Method, device and mobile terminal for detecting security holes in air interface protocols

Abstract

The embodiments of the present application relate to the field of communication transmission security technology, and in particular to a method, device, and mobile terminal for detecting security holes in an air interface protocol. The method for detecting security holes in an air interface protocol includes the steps of: acquiring mutation data generated by a fuzz test task, acquiring a service message of an air interface protocol, modifying the service message based on the mutation data, sending the modified service message to a base station, and monitoring the status of the base station and recording a security hole log according to the status of the base station.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims priority to a Chinese patent application filed on February 15, 2022, bearing application number 202210138690.1.

[0002] The embodiments of the present application relate to the field of communication transmission security technology, and in particular to a method, an apparatus, and a mobile terminal for detecting security holes in air interface protocols. [Background technology]

[0003] With the large-scale commercialization of 5G networks, 5G base stations, as an essential component of wireless communication networks, have attracted widespread attention for their security. The 3GPP (registered trademark) Security Assurance Specification (SCAS) specifications, telecommunications regulators and telecommunications operators all have requirements for air interface protocol security testing, so it is particularly important to discover security holes in air interface protocols based on fuzz testing.

[0004] In contrast, in the fuzz testing of Long Term Evolution (LTE) network control components and control plane processes, the solution adopts replay fuzz testing in normal processes. That is, the original service data of a service that has already been completed is sent again, and the service flow usually has an encryption authentication process that cannot be used again. If the service is still completed normally after the original service data is resent, it proves that there is a security problem in the service execution process. This method is only applicable to fixed test scenarios, such as the application layer where the test scenario is easy to parasitize, and cannot be applied to the underlying network where the test scenario cannot be clearly defined, and cannot perform fuzz testing on the air interface protocol, and cannot guarantee the security of information transmitted on the air interface between the user equipment (UE) and the 5G base station. Summary of the Invention [Problem to be solved by the invention]

[0005] A main objective of the embodiments of the present application is to propose a method, an apparatus, and a mobile terminal for detecting security holes in air interface protocols. [Means for solving the problem]

[0006] In order to achieve the above object, an embodiment of the present application provides a method for detecting security holes in an air interface protocol applied to a mobile terminal, the method including the steps of obtaining mutation data generated by a fuzz testing task, obtaining a service message of an air interface protocol, modifying the service message based on the mutation data, sending the modified service message to a base station, and monitoring the status of the base station and recording a security hole log according to the status of the base station.

[0007] In order to achieve the above object, an embodiment of the present application further provides a device for detecting security holes in air interface protocols, characterized in that it includes: a first acquisition unit for acquiring mutation data generated by a fuzz testing task; a second acquisition unit for acquiring a service message; a modification unit for modifying the service message based on the mutation data; a transmission unit for transmitting the modified service message to a base station; and a recording unit for monitoring a status of the base station and recording a security hole log according to the status of the base station.

[0008] To achieve the above object, an embodiment of the present application further provides a mobile terminal, wherein the server includes at least one processor and a memory communicatively connected to the at least one processor, the memory storing instructions executable by the at least one processor, and the instructions being executed by the at least one processor to perform the above method by the at least one processor.

[0009] To achieve the above object, according to an embodiment of the present application, there is further provided a computer-readable storage medium storing a computer program which, when executed by a processor, implements the above method.

[0010] In the conventional solution, most air interface protocol tests are functional and performance tests, which are difficult to find some deeper and broader level security problems. For example, most air interface protocol tests are tests on the normal use functions or performance parameters of base stations, focusing on the application layer, and cannot inspect the processes such as scenarios with a relatively deep call chain, protocol realization, and protocol standard implementation. Among them, the scenarios with a relatively deep call chain are, for example, scenarios in which the code level functions are realized by multi-layer interfaces and the call relationships are relatively large. In the embodiment of the present application, a method for discovering security holes in air interface protocols that realizes fuzz testing is proposed based on a mobile terminal that opens a basic interface. The mobile terminal opens a basic port to obtain changes to the service message of the air interface protocol, that is, mutation data and the service message of the air interface protocol, combines with the mutation data to modify the service message, and sends the modified service message to the base station, so that the status of the base station can be monitored in real time, so that the effect of recording the log of security holes in the air interface protocol and discovering security holes in the air interface protocol can be realized, and the robustness and safety of the base station can be improved, and the competitiveness of the product can be improved. [Brief description of the drawings]

[0011] [Figure 1] 2 is a flowchart of a method for detecting security holes in air interface protocols according to an embodiment of the present application; [Diagram 2] FIG. 2 is a first schematic diagram of mutation data generation according to an embodiment of the present application. [Diagram 3] FIG. 2 is a second schematic diagram of mutation data generation according to an embodiment of the present application. [Figure 4] FIG. 13 is a third schematic diagram of mutation data generation according to an embodiment of the present application. [Diagram 5] FIG. 2 is a first schematic diagram of a data structure provided by an embodiment of the present application; [Figure 6] FIG. 2 is a second schematic diagram of a data structure provided by an embodiment of the present application. [Figure 7] FIG. 1 is a first schematic diagram of a method for detecting security holes in air interface protocols provided by an embodiment of the present application; [Figure 8] FIG. 2 is a second schematic diagram of a method for detecting security holes in air interface protocols provided by an embodiment of the present application; [Figure 9] 1 is a schematic diagram of a system for detecting security holes in air interface protocols provided by one embodiment of the present application; [Figure 10] FIG. 2 is a schematic diagram of an apparatus for detecting security holes in air interface protocols provided by an embodiment of the present application; [Figure 11] FIG. 2 is a schematic diagram illustrating the configuration of a mobile terminal according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the following will describe each embodiment of the present application in detail in combination with the accompanying drawings. However, those skilled in the art can understand that many technical details are presented in each embodiment of the present application to allow the reader to better understand the present application. However, the technical solution sought to be protected by the present application can be realized without these technical details and various changes and modifications based on the following embodiments. The following embodiments are divided for the convenience of explanation and should not be construed as any limitation on the specific embodiments of the present application, and the embodiments can be combined or referenced with each other as long as they are not inconsistent.

[0013] An embodiment of the present application relates to a method for detecting security holes in an air interface protocol applied to a mobile terminal, where the mobile terminal supports opening a basic interface. The basic interface is the part of the mobile terminal that analyzes and modifies a service message after packet assembly of the service message is completed and before the service message is sent to the physical layer for processing. The process of analyzing and modifying the service message is usually realized by a customized basic interface. By opening the basic interface, a high level of customization can be performed on the mobile terminal to realize a fuzz testing function. The specific flow of the method for detecting security holes in an air interface protocol according to the present embodiment is as shown in FIG. 1, which is as follows: A step 101 of obtaining mutation data generated by a fuzz testing task; A step 102 of obtaining an air interface protocol service message; A step 103 of modifying the service message based on the mutation data; Step 104 of sending the changed service message to the base station; The method may include a step 105 of monitoring the state of the base station and recording a security hole log according to the state of the base station.

[0014] The following provides a detailed description of the implementation of the method for detecting security holes in the air interface protocol of this embodiment. However, the following content is intended to facilitate understanding of the implementation details provided and is not a prerequisite for implementing this invention.

[0015] In step 101, the mutation data generated by the fuzz test task is obtained. That is, the mobile terminal obtains the mutation data used to provide unexpected inputs to the operation of the base station required in the fuzz test process, and the mobile terminal can monitor the operation status of the base station based on the unexpected input data to find security holes in the base station. In some situations, the fuzz test task and the mutation data may be pre-stored in a storage device communicatively connected to the mobile terminal or built into the mobile terminal, and the mobile terminal can match the corresponding fuzz test task in the storage device based on the detected real-time base station service, and inquire and obtain the corresponding mutation data based on the fuzz test task.

[0016] In one example, the mobile terminal receives the mutation data obtained by the server through the fuzz test task. Since the data in the data pre-stored in the memory space is limited, even if the mutation data is queried in the pre-stored data, the result of the obtained mutation data is limited. If the mutation data is limited, the effect of the fuzz test is limited to a certain extent. In this embodiment, a server is provided to provide the mutation data to the mobile terminal, that is, the server generates a fuzz test task based on the current service of the base station, and the mutation data can be obtained through the fuzz test task. That is, the mutation data received by the mobile terminal and obtained by the server through the fuzz test task are all customized and generated by the server according to the actual situation, and are not limited data pre-stored in the memory space, and do not limit the fuzz test task or the mutation data. The method provided by this embodiment in which the mobile terminal receives the mutation data generated by the server can expand the type, number and coverage of the mutation data, and ensure the effect of the fuzz test.

[0017] Here, when the server generates a fuzz test task, the fuzz test task can be obtained by a protocol data model in the server. The protocol data model is generated by analyzing the protocol features and service features of the 5G air interface protocol. The protocol is, for example, a Service Data Adaptation Protocol (SDAP), a Radio Resource Control (RRC) protocol, a Packet Data Convergence Protocol (PDCP), a Radio Link Control (RLC), a Media Access Control (MAC) protocol, etc. The protocol features are, for example, an SDAP protocol and an RRC protocol, where the SDAP protocol is specific to the user plane, the RRC protocol is specific to the control plane, and other protocols are common to the user plane and the control plane, the service features include the role that each protocol layer plays in the service, and the service is, for example, a cell search, a system message, a paging, a measurement, a random access, etc. The protocol data model generates the matching relationship between different services and protocols by combining with the protocol features and service features, and includes a cell search model CELL_SEARCH_DATA_MODEL, a random access model RANDOM_ACCESS_DATA_MODEL, etc. The protocol data model can first identify the service of the base station in real time, determine the service message of the protocol that needs to be mutated based on these matching relationships, and generate a fuzz test task by combining with the user demand or pre-stored requirements. In addition, the protocol data model can be configured with closed-loop learning and periodic debug update, etc., and can also handle more complex and detailed situations. Compared with matching the fuzz test task according to the pre-stored correspondence relationship, the fault tolerance rate is higher, the identification accuracy is higher, and the acquisition effect of the fuzz test task can be more guaranteed.

[0018] The server may also be provided with a task management module that controls the initiation and sequence of processes such as configuring, starting, stopping, pausing, and resuming fuzz testing tasks.

[0019] In one example, the server receives mutation data generated by a mutation method, the mutation method being determined by the fuzz testing task, and the mutation method includes one of multi-protocol field simultaneous mutation, unordered mutation, and feedback mutation, or any combination thereof. According to the content of the fuzz testing task, the mutation method corresponding to the content can be selected.

[0020] The multi-protocol field simultaneous mutation can improve the coverage of fuzz testing. Specifically, refer to FIG. 2, where the realization flow of the multi-protocol field simultaneous mutation is, for example, first obtain the protocol configuration (including the service message of the protocol and the feature of the protocol, etc.), arrange and combine them, and then store them in the protocol pool, where the process of arranging and combining is expressed by the formula C n m=m! / {(mn)!n!}. The protocol configuration includes the names, lengths, and values ​​of each field of multiple protocols, and the protocol pool is a permutation and combination of protocol + field names, lengths, and values, such as the DC field name of the RLC protocol, the F field value of the MAC protocol, and the length and value of the LCID field of the MAC protocol. In the formula, m and n may specifically represent any protocol of a layer, or any field of a certain protocol. For example, two of four protocols may be selected for fuzz testing, or three of five protocol fields of a certain protocol may be selected. A mutation algorithm is used on the data in the protocol pool, and the protocol pool is a collection of service messages of protocols that may be used. The collection of results obtained by the mutation algorithm (the type of the mutation algorithm is not limited here) using the data in the protocol pool is the case seed pool. The data in the case seed pool is extracted and combined to obtain test cases, and the newly generated test cases are stored in the original protocol pool, but since the newly generated test cases are mutation data, the mutation data is added to the original protocol pool. In addition, when storing the newly generated test cases in the original protocol pool, a method of repeatedly traversing the protocol pool is used to cover multiple test scenarios, and all the generated test cases can be covered and tested. In the multi-field simultaneous mutation method, there is no limitation on the field or type in which the mutation occurs, that is, the scope covered by the mutation result is relatively large, so that the coverage of the test cases in the fuzz test can be greatly improved and the coverage of the fuzz test can be guaranteed.

[0021] The unordered mutation can realize the fuzz test process of replay, forward, reverse, etc., but it is mainly to select special values ​​without using the algorithmic data operation process. Specifically, refer to FIG. 3, where the realization flow of the unordered mutation is, for example, to perform feature analysis on the service message of the protocol that needs mutation, and take corresponding processing measures according to the fuzz test task. The processing can be to default all data as fuzz test mutation data (i.e., traverse all data during fuzz test), or to make all boundary values ​​as mutation data, or to select the formula a n =a1+(n-1)d or formula a n = a1 × q nー1 The method includes selecting the mutation data involved in the fuzz testing task using the arithmetic progression a n =a1+(n-1)d, geometric progression a n =a1*q n-1 or a1 may be selected. a1 is the first case selected, d is the common difference of the arithmetic progression, q is the common ratio of the geometric progression, and a n is the nth case selected. At the same time, the detection order for obtaining the mutation data can be set to Positive / Reverse, that is, to select test cases in positive or reverse order. In this case, the selection range of mutation data is min n <max / a n =a Finxed where min represents the minimum case selection, i.e., selecting at least one test case, and max / a n =a Finxed is the maximum number of test cases, i.e., the maximum number of cases that can be stored in the case pool.

[0022] ​As shown in Figure 4, feedback mutation is applied to processes that need to be monitored, recorded, analyzed, etc. in fuzz testing. A specific implementation of feedback mutation is, for example, identifying the state changes of the log messages of the base station, and analyzing the state features of the log messages based on the formula, that is, analyzing the state changes of the log messages. For example, the formula p(c i |ω)={p(ω|c i )p(c i )} / p(ω), where c irepresents the type of air interface protocol, and ω represents the state feature of the acquired base station log message. This formula is used as a Bayesian classification model to complete the analysis of the state feature of the log message by mainly obtaining the marginal probability for a certain state feature in a specific air interface protocol type. The analysis result is supplementarily updated to a case pool, and the analysis result is used to obtain mutation data, and the case pool is used in this embodiment to provide mutation data for fuzz testing to a message seed pool, where the mutation data used for fuzz testing is obtained by processing the data in the case pool with a mutation algorithm and stored in the message seed pool, and the terminal obtains the data in the message seed pool, that is, the mobile terminal obtains the mutation data. In some examples, a request for the base station log message may be sent from the mobile terminal to the base station, and the base station may feed back the corresponding log message to the mobile terminal after receiving the request for the log message, and when the mobile terminal receives the fed back log message, it may analyze the log message and further obtain the state characteristic of the log message. Furthermore, a request for the status feature of the log message of the base station is sent from the mobile terminal to the base station, and the base station feedbacks the request after receiving the request, and carries the status feature of the log message of the base station in the feedback information, and the mobile terminal can obtain the status feature of the log message of the base station after receiving the feedback. Note that, in the specific implementation of the present application, the status feature of the log message of the base station is not limited.

[0023] Regarding step 101, in one embodiment, the server analyzes the characteristics of the 5G air interface protocol (such as SDAP / RRC / PDCP / RLC / MAC) and generates a protocol data model based on the characteristics, and the mobile terminal accesses the base station, obtains the current air interface protocol configuration information, and generates mutation data in combination with three different machine learning methods, and the input message of the machine learning method may be generated based on a specific service model, for example, multi-protocol field simultaneous mutation, or may be an actual service message extracted from the mobile terminal, for example, unordered mutation. This can automatically and gradually improve the coverage of the test case in an unattended state and find deeper level problems. It is also possible to automate the behavioral learning closed loop and the update of the signaling state machine model by introducing the actual service message as a feedback loop, for example, as a feedback mutation, and incorporating the machine learning method and the signaling state machine model. After the mutation data is generated, it can be sent to the communication module of the mobile terminal via the forwarding module and stored. The task management module on the server or other service side can configure, start, stop, pause and resume the fuzz testing tasks, and the transfer module performs the control and data exchange between the service side and the mobile terminal.

[0024] In step 102, obtain a service message of an air interface protocol. The service message of the air interface protocol is a service message that needs to be sent to the base station during communication between the mobile terminal and the base station. That is, before sending a service message to the base station, the mobile terminal needs to obtain the service message that is about to be sent, for processing the service message later to meet the requirements of fuzz testing.

[0025] In one example, after the step of obtaining a service message of an air interface protocol and before the step of modifying the service message based on mutation data, the method further includes a step of parsing the service message. For example, when a mobile terminal accesses a base station (e.g., a 5G base station) to perform a data service, the parsing module parses the service message after the package assembly of the mobile terminal air interface L3, L2 layer protocol according to a standard protocol message format, and identifies the protocol layer, protocol field and protocol field attribute located therein. Here, the parsing of the service message is mainly performed with reference to the 3GPP protocol format, and after the message parsing, the protocol layer (e.g., MAC, RLC, etc.), protocol field (e.g., logical channel identify (lcid), segmentation information (SI), serial number (SN), etc.), and protocol field attribute (e.g., length, etc.) can be identified. Some service data unit (SDU) formats of one terabyte (TB) block of the service message are shown in FIG. 5. In the format shown in FIG. 5, payload is the payload, R represents a reserved field, DC represents a data / control field, L represents the domain of the length of the SDU or control message, the length of which is indicated by the F domain, F represents the length of L, if the length of the SDU or control message is longer than 128 bytes, F is set to 1, otherwise it is set to 0, and SO represents the segment offset field.

[0026] In step 103, the service message is modified according to the mutation data. After the mobile terminal obtains the mutation data and the service message of the air interface protocol, the mobile terminal matches the mutation data and the service message in association with the fuzz test task, i.e., modifies the service message according to the mutation data, and writes the generated fuzz test data into a data location corresponding to the service message. Note that the fuzz test task may be obtained by the mobile terminal separately or together with the mutation data.

[0027] Taking feedback mutation as an example, the log message obtained after mutation is stored in the message seed pool, and then the service message is modified with the message in the message seed pool to complete the message modification.The method of modifying several SDU formats of one TB block of a service message is shown in Figure 6, where Muiti entry phr stands for multi-entry power headroom report, the full name of phr is Power Headroom Report, and short bsr stands for short BSR format.

[0028] In one example, when the mobile terminal receives the mutation data, it stores it in the inter-core shared memory, and after completing the service message analysis of the air interface protocol (e.g., the service message analysis of the 5G air interface protocol), the mobile terminal obtains the mutation data required by the fuzz test task. The mutation data component further includes a message header that can be customized as necessary.

[0029] In one example, modifying the service message based on the mutation data includes determining a data location in the analyzed air interface protocol service message corresponding to the mutation data, and modifying the analyzed air interface protocol service message based on the mutation data at the data location. Wherein, the fuzz test task may support modifying a field in the service message of one or more 5G air interface protocols, or may support modifying a service message segment. Since the mutation data may be data generated by different protocols, it is necessary to place the mutation data at the corresponding location where it is generated to avoid the change in the location of the mutation data affecting the structure of the service message, for example, to avoid a situation where a problem such as not meeting a verification rule is detected in the structure during the execution of a protocol, and the related service message is directly discarded, making it impossible to perform fuzz testing. The influencing factors in the execution process of the fuzz test task are further reduced, ensuring the smooth execution of the fuzz test task, and improving the test efficiency.

[0030] In one example, modifying the service message based on the mutation data includes modifying the service message based on the mutation data within a scheduling delay of the service message, for example, the mobile terminal completes the modification of the service message according to a fuzz testing task, and uses a KMP (Knuth-Morris-Pratt, string matching algorithm) algorithm to ensure that the time required for obtaining and modifying the service message does not exceed the time range of service scheduling.

[0031] In step 104, send the modified service message to the base station. After obtaining the mutation data, the message processing module in the mobile terminal completes the 5G air interface protocol message modification according to the fuzz test task configured on the service side, and if the obtaining and modifying of the 5G air interface protocol message meet the delay requirements of the 5G air interface protocol, the service scheduling sends the modified service message to the 5G base station through the physical layer and the radio frequency antenna according to the original time window.

[0032] In step 105, monitor the status of the base station, and record a security hole log according to the status of the base station. That is, after the mobile terminal transmits the service message after being modified according to the mutation data to the base station, it checks the operation of the base station and finds the security hole of the base station.

[0033] In one example, the step of recording a security hole log according to the state of the base station includes a step of a mobile terminal identifying whether a security hole exists in the base station based on the state of the base station, and if a security hole exists, a step of recording a security hole log including a protocol field, a service message before and after mutation, and a system log of the mobile terminal.

[0034] The mobile terminal monitors the status of the base station in real time, and judges whether a security hole is found based on the status information of the base station obtained by the interface of the mobile terminal, and further, the mobile terminal can check whether an abnormal alarm or a system crash occurs in the 5G base station through the network management system of the 5G base station. After the security hole is found, the security hole log is collected, and the security hole log contains the information required to identify the problem, which helps to accurately identify the location where the security hole is triggered, and provides advantageous support for finding a solution to the security hole. Taking the detection of a downlink out-of-sync hole of a 5G base station as an example, when the hole is found, information such as the message before and after the mutation of the protocol field (lcid, SI, DC, etc.), transtime, tbSize, and the system log of the mobile terminal are saved, and the system log information of the 5G base station system in the time slice is matched based on this information, and the protocol field that triggered the hole is checked. Taking the detection of a downlink out-of-sync hole of a 5G base station as an example, the operation process of the monitoring module in the mobile terminal is shown in Figure 7.

[0035] Among them, the abnormal states of 5G base stations that the mobile terminal can sense mainly include abnormal states such as cell abnormality, uplink out of synchronization, downlink out of synchronization, and link re-establishment. In addition, it is also possible to check whether an alarm or system abnormality has occurred in the 5G base station system through the network management system of the 5G base station. The task of monitoring the status of the base station is mainly performed by the monitoring module in the mobile terminal, which not only obtains the status of the base station from the mobile terminal interface, but also performs the real-time transfer function of the logs of the normal and abnormal status of the base station and transmits them to the service side via the communication module. The service side maintenance test module locally stores the status of the base station and the recorded logs and displays them on the interface.

[0036] In one example, the method further includes, after the step of recording a security hole log according to a state of the base station, retesting the security hole based on the security hole log to determine a problem protocol field of the security hole, i.e., supporting retesting of the detected security hole to facilitate developer repair of the hole.

[0037] For example, taking the detection of a downlink out-of-synchronization hole of a 5G base station as an example, when the system detects the hole, it saves the current fuzz test service scenario, the mutation data generated by the 5G air interface protocol data model (e.g., the random access model RANDOM_ACCESS_DATA_MODEL), and the test case generated by the mutation data. If a retest of the hole is required, the system uses the information saved when the hole is detected to perform the fuzz test again according to the flow that detected the hole, thereby reproducing the security hole. In some execution processes, the related function may be realized by triggering a fuzz test retest function of task management in the system.

[0038] In one example, an implementation process having a re-test flow is shown in FIG. 8, where the protocol model is the above-mentioned protocol data model, the 5G base station air interface protocol configuration is the above-mentioned protocol configuration, and the base station configuration is the above-mentioned base station air interface protocol configuration.

[0039] In addition, the user interface in the mobile terminal mainly includes environment settings, task management and task details. Specifically, the configuration items of the environment configuration are, for example, background / log server address, service address, foreground / SFTP server address, environment identification number, etc. Task management fulfills the distribution and task management functions of background and foreground fuzzy test terminal test tasks, supports different modes of multi-task sequence connection test and single task test, and also supports users to manually stop the test, pause / resume the test, and clear the record. Task details mainly includes three functions: state statistics, task details and message statistics.

[0040] In one example, the above-mentioned method embodiment may be embodied in a modular form and named a fuzz testing system, which includes, as shown in FIG. 9, a task management module at a service side (server) for managing fuzz testing tasks, an intelligent mutation unit at the service side for generating mutation data, a forwarding module at the service side for communicating with the service side and the mobile terminal, a maintenance test module at the service side for locally storing the status of the base station and recorded logs and displaying them on an interface, a communication module at the mobile terminal for communicating with the service side, a message analysis module at the mobile terminal for performing analysis of air interface protocol messages, a message processing module at the mobile terminal for performing message mutation based on the mutation data and the analyzed message, a radio frequency antenna at the mobile terminal for communicating with the base station, and a monitoring module at the mobile terminal for monitoring the status of the base station and performing fuzz testing.

[0041] In the conventional solution, most air interface protocol tests are functional and performance tests, and some security problems at a deeper and broader level are difficult to find. In the embodiment of the present application, a method for detecting security holes in an air interface protocol that realizes fuzz testing is proposed based on a mobile terminal that opens a basic interface. The air interface protocol can be embodied through data transmission between a base station and a mobile terminal, and the mobile terminal can open a basic port, so that it is possible to make changes to the service message of the air interface protocol, i.e., obtain mutation data and the service message of the air interface protocol, combine the mutation data to modify the service message, send the modified service message to the base station, monitor the status of the base station in real time, and check the security problems of the base station caused by the modified air interface protocol, so that the effect of discovering security holes in the air interface protocol can be further achieved. In addition, according to the present application, a fuzz test is adopted that incorporates the air interface protocol flow to analyze the air interface data code stream, and a machine learning algorithm is incorporated into the mutation part to better perform fuzz testing on the air interface protocol, making the test deeper, wider, and more comprehensive, and further improving the robustness and security of the base station and enhancing the competitiveness of the product.

[0042] Another embodiment of the present application relates to an apparatus for detecting security holes in air interface protocols, and the implementation details of the apparatus for detecting security holes in air interface protocols in this embodiment will be described in detail below. The following content is provided to facilitate understanding of the implementation details provided, and is not a prerequisite for carrying out the present invention. Figure 10 is a schematic diagram of the apparatus for detecting security holes in air interface protocols described in an embodiment of the present application; A first acquiring unit 201 for acquiring mutation data generated by a fuzz testing task; A second acquiring unit 202 for acquiring a service message; a modification unit 203 for modifying the service message based on the mutation data; a sending unit 204 for sending the changed service message to the base station; a recording unit 205 for monitoring the status of the base station and recording a security hole log according to the status of the base station.

[0043] For the first obtaining unit 201, the step of obtaining mutation data is, for example, a step of receiving mutation data obtained by a server through a fuzz testing task.

[0044] In one example, the step of receiving mutation data obtained by the server through a fuzz testing task includes a step of receiving mutation data generated by the server through a mutation method, the mutation method being determined by the fuzz testing task, and the mutation method including one or any combination of multi-protocol field simultaneous mutation, unordered mutation, and feedback mutation.

[0045] In one example, the multi-protocol field simultaneous mutation includes obtaining each protocol configuration including a service message for each protocol required for a fuzz testing task, using a mutation algorithm for each of the protocol configurations to obtain a case seed pool, and obtaining mutation data from the case seed pool.

[0046] In one example, the feedback mutation includes the steps of obtaining a mobile terminal log message having certain status characteristics of the base station and analyzing the status characteristics, storing the analysis results in a case pool, and using a mutation algorithm on the analysis results in the case pool to obtain mutation data.

[0047] For the modification unit 203, after the step of obtaining an air interface protocol service message and before the step of modifying the service message based on the mutation data, the step of modifying the service message based on the mutation data further includes the steps of: determining a data position corresponding to the mutation data in the analyzed air interface protocol service message; and modifying the analyzed air interface protocol service message at the data position based on the mutation data.

[0048] In one example, modifying the service message based on the mutation data includes modifying the service message based on the mutation data within a scheduling delay of the service message.

[0049] For the recording unit 205, the step of recording a security hole log according to the state of the base station includes, for example, a step of identifying whether a security hole exists in the base station based on the state of the base station, and if a security hole exists, a step of recording a security hole log including a protocol field, a service message before and after mutation, and a system log of the mobile terminal.

[0050] In one example, the method further includes, after the step of recording a security hole log according to a state of the base station, the step of retesting the security hole based on the security hole log to determine a problem protocol field of the security hole.

[0051] In the conventional solution, most air interface protocol tests are function and performance tests, which are difficult to find some deeper and broader level security problems. In the embodiment of the present application, a method for discovering security holes in air interface protocols is proposed, which is based on a mobile terminal that opens a basic interface and realizes fuzz testing. The mobile terminal opens a basic port, obtains changes to the service message of the air interface protocol, that is, mutation data and the service message of the air interface protocol, combines with the mutation data to modify the service message, and sends the modified service message to the base station, so that the status of the base station can be monitored in real time, so that the effect of recording the log of security holes in the air interface protocol and discovering security holes in the air interface protocol can be achieved, and the robustness and security of the base station can be improved, and the competitiveness of the product can be improved.

[0052] This embodiment is an apparatus embodiment corresponding to the above method embodiment, and it is easy to understand that this embodiment can be implemented in combination with the above method embodiment. The relevant technical details and technical effects mentioned in the above embodiment are also valid in this embodiment, so they will not be described here to reduce duplication. Therefore, the relevant technical details described in this embodiment are also applicable to the above embodiment.

[0053] In addition, each module in this embodiment is a logical module, and in actual application, one logical unit may be one physical unit, may be a part of one physical unit, and may be realized by a combination of multiple physical units. In addition, in order to highlight the creative part of this application, means that are not related to solving the technical problem raised in this application are not introduced in this embodiment, but this does not mean that there are no other means in this embodiment.

[0054] Another embodiment of the present invention relates to a mobile terminal, as shown in Fig. 11, comprising at least one processor 301 and a memory 302 communicably connected to the at least one processor 301, the memory 302 storing instructions executable by the at least one processor 301, and the instructions being executed by the at least one processor 301, the at least one processor 301 can execute the method for detecting security holes in air interface protocols in each of the above embodiments.

[0055] Here, the memory and the processor are connected in a bus manner, which may include any number of interconnected buses and bridges, and which connects various circuits of one or more processors and memories together. The bus may also connect various other circuits together, such as peripherals, voltage stabilizers, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, and provides a means for communicating with various other devices over a transmission medium. The data processed by the processor is transmitted over a wireless medium via an antenna, which also receives data and transmits data to the processor.

[0056] A processor may provide a variety of functions including bus management and general processing, as well as timing, peripheral interfacing, voltage regulation, power management, and other control functions. Memory, on the other hand, may be used to store data used in performing operations by a processor.

[0057] Another embodiment of the present application relates to a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method embodiments described above.

[0058] That is, those skilled in the art will understand that implementing all or part of the steps in the methods of the above embodiments can be achieved by instructing related hardware by a program. The program is stored in one storage medium and includes several instructions for causing one device (which may be a one-chip computer, chip, etc.) or a processor to execute all or part of the steps of the methods in each embodiment of the present application. Meanwhile, the storage medium includes various media capable of storing program code, such as USB memory, removable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0059] Those skilled in the art will understand that the above embodiments are specific examples for implementing the present application, and that in actual applications, various changes in form and details may be made without departing from the spirit and scope of the present application.

Claims

1. A method for detecting a security hole in an air interface protocol applied to a mobile terminal, comprising: obtaining mutation data generated by a fuzz testing task; obtaining an air interface protocol service message; modifying the service message based on the mutation data; sending a changed service message to a base station; monitoring a state of the base station and recording a security hole log according to the state of the base station; A method for discovering security holes in air interface protocols including:

2. After the step of recording a security hole log according to the state of the base station, retesting the security hole based on the security hole log to determine a problem protocol field of the security hole; The method for detecting security holes in air interface protocols according to claim 1, further comprising:

3. after the step of obtaining an air interface protocol service message and before the step of modifying the service message based on the mutation data, parsing the service message; The step of modifying the service message based on the mutation data includes: determining a data location in the parsed air interface protocol service message corresponding to the mutation data; modifying the parsed air interface protocol service message based on the mutation data at the data location; 2. The method for detecting security holes in air interface protocols according to claim 1, comprising:

4. The step of obtaining mutation data includes: receiving mutation data obtained by the server through the fuzz testing task; 2. The method for detecting security holes in air interface protocols according to claim 1, comprising:

5. The step of receiving mutation data obtained by the server through the fuzz testing task includes: receiving mutation data generated by the server according to a mutation method, the mutation method being determined by the fuzz testing task, the mutation method including one or any combination of multiple protocol field simultaneous mutation, unordered mutation, and feedback mutation; 5. The method for detecting security holes in air interface protocols according to claim 4, comprising:

6. The multi-protocol field simultaneous mutation includes: obtaining each protocol configuration including service messages for each protocol required for a fuzz testing task; using a mutation algorithm for each of the protocol configurations to obtain a case seed pool; obtaining mutation data from the case seed pool; 6. The method for detecting security holes in air interface protocols according to claim 5, comprising:

7. The feedback mutation is obtaining a status characteristic of a log message of the base station and analyzing the status characteristic; storing the analysis results in a case pool; applying a mutation algorithm to the analysis results in the case pool to obtain mutation data; 6. The method for detecting security holes in air interface protocols according to claim 5, comprising:

8. The step of recording a security hole log according to a state of the base station includes: identifying whether a security hole exists in the base station based on a state of the base station; if a security hole exists, recording a security hole log including a protocol field, a service message before and after the mutation, and a system log of the mobile terminal; 2. The method for detecting security holes in air interface protocols according to claim 1, comprising:

9. The step of modifying the service message based on the mutation data includes: modifying the service message based on the mutation data within a scheduling delay of the service message; 9. A method for detecting security holes in an air interface protocol according to any one of claims 1 to 8, comprising:

10. An apparatus for detecting security holes in air interface protocols, comprising: a first acquiring unit configured to acquire mutation data generated by a fuzz testing task; A second acquiring unit configured to acquire a service message; a modification unit configured to modify the service message based on the mutation data; a sending unit configured to send the modified service message to a base station; a recording unit configured to monitor a status of the base station and record a security hole log according to the status of the base station; and a device for detecting security holes in air interface protocols including:

11. A mobile terminal, At least one processor; a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to perform the method for detecting security holes in air interface protocols according to any one of claims 1 to 9. Mobile terminal.

12. A computer-readable storage medium storing a computer program, The computer program, when executed by a processor, implements the method for detecting security holes in air interface protocols according to any one of claims 1 to 9. A computer-readable storage medium.

Images