一种基于加权状态选择的LTE NAS协议模糊测试方法  

A LTE NAS Protocol Fuzzing Method Based on Weighted State Selection

作　　者：廖显锋 吴礼发 Liao Xianfeng;Wu Lifa(School of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing 210023)

机构地区：[1]南京邮电大学计算机学院、软件学院、网络空间安全学院,南京210023

出　　处：《信息安全研究》2025年第1期12-20,共9页Journal of Information Security Research

基　　金：国家重点研发计划项目(2019YFB2101704)。

摘　　要：NAS协议是LTE(long-term evolution)网络中移动设备与核心网络之间的主要控制面协议,其安全性对于保障整个4G网络稳健安全运行具有重要意义.模糊测试是一种广泛使用的漏洞挖掘技术,现有的模糊测试方法应用于NAS(non-access stratum)协议时存在测试效率低、测试用例难以构建等问题.为了解决这些问题,提出了一种基于权重的测试状态选择算法:以NAS协议状态机为基础,根据测试反馈动态地调整每个测试状态的权重;以消息元素IE为最小单位设计了测试用例生成算法;实现了模糊测试工具NASFuzzer并对开源核心网open5GS及真实终端设备进行测试.测试结果表明,该方法能够有效挖掘LTE NAS协议实现中的漏洞.NAS protocol is the main control plane protocol between mobile devices and LTE core network,and its security is of great significance to ensure the robustness and safety of the whole 4G network.Fuzz testing is a widely used vulnerability mining technique,and existing fuzz testing methods for NAS Protocol have problems such as low testing efficiency and difficulty test case formulation.In order to solve these problems,this paper e proposes a weight based test state selection algorithm,which is based on NAS protocol state machine and can dynamically adjust the weight of test states based on feedback;Additionally,this paper devises a test case generation strategy rooted in the information element and develops the fuzzing tool named NASFuzzer,which is tested on open source core networks open5GS and real terminal devices.The test result shows that the method in this paper can effectively find the vulnerabilities in the LTE NAS protocol implementation.

关 键 词：LTE NAS 模糊测试 状态选择 漏洞挖掘 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]