When the UE Turns Adversary: Real-Time Uplink Jamming from Within 5G Networks
当用户设备成为对手:5G网络内部的上行实时干扰
Rosolino Alaimo, Alessandra Dino, Ilenia Tinnirello, Domenico Garlisi
AI总结 提出STORM-RJ框架,利用软件定义无线电实时解码下行控制信息,在5G NR网络中实现针对物理上行共享信道的精准选择性反应式干扰,并分析低层控制策略的微秒级响应能力。
详情
本文研究了一类针对5G新空口(NR)网络中物理上行共享信道(PUSCH)的新型隐蔽选择性反应式干扰攻击。我们设计并实现了STORM-RJ(隐蔽定时阻塞和无线电操控——反应式干扰),这是一个基于软件定义无线电(SDR)的对抗框架,通过实时动态调整注入噪声突发的带宽和中心频率,实现高度精确的时频对齐干扰。STORM-RJ利用解码的下行控制信息(DCI)识别上行授权(UL-Grant),并将干扰精确同步到分配给目标用户设备(UE)的资源块上。我们进一步表征并减轻了主要延迟源——包括软件处理和硬件射频(RF)前端层面——以实现授权检测后的快速干扰响应。我们对高层与低层无线电控制策略进行了比较分析,证明只有低层调谐能提供满足5G-NR时序约束所需的微秒级响应能力,从而实现有效的反应式干扰。我们分析了在现实硬件和时序约束下此类选择性干扰的实际可行性,突出了SDR灵活性、处理延迟和同步精度之间的关键权衡。最后,我们讨论了潜在的缓解策略,包括混合自动重传请求(HARQ)异常检测。
This paper presents an investigation of a novel class of stealthy and selective reactive jamming attacks targeting the Physical Uplink Shared Channel (PUSCH) in 5G New Radio (NR) networks. We design and implement STORM-RJ (Stealthy Timing Obstruction and Radio Manipulation -- Reactive Jamming), a Software-Defined Radio (SDR)-based adversarial framework that enables highly precise, time-frequency aligned interference by dynamically adapting the bandwidth and center frequency of injected noise bursts in real time. STORM-RJ leverages decoded Downlink Control Information (DCI) to identify Uplink-Grants (UL-Grants) and synchronizes interference exactly with the resource blocks allocated to a target User Equipment (UE). We further characterize and mitigate the dominant latency sources -- both at the software processing and hardware Radio Frequency (RF) frontend levels -- to achieve a rapid jamming response upon grant detection. We conduct a comparative analysis of high-level versus low-level radio control strategies, demonstrating that only low-level tuning provides the microsecond-scale responsiveness necessary to meet 5G-NR timing constraints for effective reactive jamming. We analyze the practical feasibility of such selective jamming under realistic hardware and timing constraints, highlighting key trade-offs between SDR flexibility, processing latency, and synchronization accuracy. Finally, we discuss potential mitigation strategies, including Hybrid Automatic Repeat reQuest (HARQ) anomaly detection.