GTP-U Relay Packet Rewriting for Cellular Penetration Testing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cellular networks, such as 5G networks, are vulnerable to network attacks like unauthorized intrusion and packet injection, with existing penetration testing methods being inefficient and slow, particularly in identifying and exploiting Tunnel Endpoint Identifiers (TEIDs) in GTP-U tunnels.

Innovation Solution

A method involving an attacker system and a relay system that manipulate IP addresses and TEIDs within GTP-U tunnels to establish a two-way TCP connection with target user equipment, using encapsulation and reversal programs to facilitate efficient penetration testing by brute forcing TEIDs and establishing a reliable communication channel.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If traditional penetration testing methods are used to identify TEIDs in GTP-U tunnels, then security vulnerabilities can be detected, but the process is inefficient and slow

Engineering Contradiction:

Improvepenetration testing efficiencyVSAvoidtime to identify TEIDs

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The patent introduces a relay system as an intermediary component between the penetration testing system and the target cellular network. This relay system intercepts and forwards packets, enabling efficient TEID discovery by capturing response packets that contain TEID information without requiring direct connection to the target network, thus significantly improving testing efficiency and reducing time consumption

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If IP address manipulation is performed to establish two-way communication, then penetration testing capability is improved, but network protocol compliance may be compromised

Engineering Contradiction:

Improvepenetration testing capabilityVSAvoidprotocol compliance

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The relay system acts as a protocol-compliant intermediary that handles IP address manipulation. It intercepts outgoing packets, modifies source IP addresses to enable two-way communication, and forwards them through proper GTP-U tunnels. Response packets are similarly intercepted and forwarded to the appropriate destinations, maintaining protocol compliance while enabling the necessary adaptability for penetration testing

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system inverts the traditional approach by having the relay system modify packet IP addresses rather than having the penetration testing system directly manipulate them. This inversion allows the testing system to work with standard packets while the relay handles the non-standard modifications, separating concerns and maintaining better protocol compliance

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS12581308B1Penetration testing of cellular network environments

Publication Date: 2026.03.17 TREND MICRO INC

AI summary

Penetration testing is performed on a cellular network environment. An attacker system sends a request packet to a target user equipment that is connected to a base station of a cellular network. A source Internet Protocol (IP) address of the request packet is changed to an IP address that allows a response packet from the target user equipment to be received at a relay system. The request packet is encapsulated in a General Packet Radio Services Tunneling Protocol User (GTP-U) tunnel packet that is sent to a UPF of the cellular network. The response packet, which is responsive to the request packet, is received at the relay system by way of the UPF. A destination IP address of the response packet is changed to an IP address of the attacker system before forwarding the response packet to the attacker system.