Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of the 5G initial access phase, specifically targeting the random access channel (RACH) procedure, which can be exploited to launch signaling storms that overwhelm base station resources. The authors successfully implement and validate this attack using the OpenAirInterface project on a real testbed, demonstrating its impact on legitimate user connections. They also propose a lightweight mitigation technique that monitors half-open connections at the gNB and provide a real-time network management interface to visualize suspicious activities, with all findings made available as open source for further research.
Signaling storms in 5G networks can be triggered by exploiting the RACH procedure, crippling legitimate user access and revealing critical vulnerabilities in the initial access phase.
The initial access phase of the 5G system remains sensitive because the base station (gNB) must allocate radio resources before the user is fully authenticated. In particular, the random access channel (RACH) procedure can be abused to generate large numbers of incomplete connection attempts, creating a signaling storm that consumes gNB resources and prevents legitimate users from connecting successfully. In this paper, we implement this signaling storm attack using the OpenAirInterface project and validate it on a real testbed composed of software-defined radios and commercial phones. We then design and implement a lightweight mitigation technique that operates directly at the gNB by monitoring and acting on suspicious half-open connections. To make the system observable in practice, we also develop a network management interface that visualizes the network state in real time and highlights suspicious activity during the attack phase. Finally, the work is released as open source so that other researchers can reproduce our results, build on the implementation, and evaluate new mitigation strategies.
