VUPER: Verified ASN.1 UPER Parser
This paper presents VUPER, a framework that generates formally verified, bit-precise ASN.1 UPER parsers and serializers, which were used to uncover 20 types of inconsistencies and concrete security vulnerabilities in popular open-source and commercial parsers through dynamic testing on 5G and V2X protocols.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine the internet and our mobile phones as a massive, bustling city where billions of messages zip between buildings every second. To keep this city running, these messages need a universal language so a phone in New York can talk to a tower in Tokyo without getting confused. This language is called ASN.1, and it's like the grammar and vocabulary that tell computers exactly how to pack information into tiny, efficient digital boxes. But here's the tricky part: to save space and speed things up, these boxes are packed so tightly that they aren't even aligned to neat rows of bytes (like standard computer words); instead, they are packed down to the very last bit, the smallest speck of data. This specific, super-tight packing method is called UPER.
The problem is that writing a translator (or "parser") to unpack these tiny, bit-level boxes is incredibly hard. If the translator makes even a tiny mistake—like misreading a single bit or forgetting a rule about how to handle new, unknown information—it can cause the whole system to crash, leak secrets, or let hackers sneak in. For years, engineers have tried to fix these mistakes by testing the translators with millions of random messages, hoping to catch the bugs. But this is like trying to find a needle in a haystack by just shaking the hay; you might find some needles, but you can never be sure you've found all of them, or that the ones you found are actually the real deal.
Enter VUPER, a new tool created by researchers at Penn State that changes the game. Instead of just shaking the haystack, VUPER builds a mathematically perfect translator from scratch. Think of it as creating a "gold standard" dictionary and grammar book that is proven by a computer mathematician to be 100% correct. The researchers used this perfect translator to test 11 other popular parsers used in real-world 5G networks and vehicle communication systems. They discovered that many of these widely used translators were actually quite non-compliant, missing 20 different types of rules. In some cases, these non-compliance allowed hackers to crash phones or trick networks into sending unencrypted messages. VUPER proves that while we can't always trust the translators we have, we can now build ones that are mathematically guaranteed to be safe, and use them to fix the broken ones.
The Story of VUPER: Building the Perfect Translator
In the world of computer networks, data is like a long stream of water flowing through pipes. To send a message, a computer "serializes" it, squeezing the data into a compact stream of bits. To receive it, another computer "parses" the stream, squeezing the bits back into a readable message. In the high-stakes world of 5G cellular networks and vehicle-to-everything (V2X) communication, this process uses a specific set of rules called UPER (Unaligned Packed Encoding Rules). It's called "unaligned" because it doesn't care about neat byte boundaries; it packs data as tightly as possible, bit by bit, to save bandwidth.
The challenge is that the official rulebook for UPER is written in dense, descriptive text, not in code. This leaves engineers to guess how to implement the rules, leading to subtle errors. The researchers behind VUPER decided to stop guessing. They built a framework that formally proves the parser is correct. They didn't just write code and hope it works; they used a powerful mathematical tool called the Rocq prover to verify every single step of the logic.
The "Round-Trip" Test
To understand how VUPER works, imagine you have a magic translator that turns a book into a secret code and back again. A "round-trip" test means you take a sentence, turn it into code, and then turn that code back into a sentence. If you get the exact same sentence back, the translator is working.
However, UPER has a special twist: extensions. As technology evolves (like moving from 4G to 5G), new features are added to the messages. An old translator needs to be able to read a new message, ignore the new parts it doesn't understand, and still make sense of the old parts. This is called forward compatibility. VUPER handles this by proving two things:
- Strict Round-Trip: If the message is from the same version, the translator must turn it back into the exact same bit pattern. No extra bits, no missing bits.
- Weak Round-Trip: If the message has new, unknown extensions, the translator can skip them, but it must still be able to turn the known parts back into a valid message. It doesn't have to match the original bit-for-bit (because the unknown parts are gone), but it must not corrupt the rest.
Finding the Bugs
The researchers built a "trusted oracle"—a perfect parser generated by VUPER—and used it to test 11 other parsers. These included 7 open-source tools (like asn1c and pycrate) and 4 commercial parsers used inside real 4G and 5G base stations (the hardware that connects your phone to the network).
They didn't just send random garbage; they used a smart "fuzzer" that understood the structure of the messages to create millions of tricky test cases. When they compared the results, they found 20 different types of inconsistencies in the other parsers.
Here are some of the most interesting findings:
- The "Too Long" Problem: Some parsers accepted numbers that were too big for the space allocated, or lengths that didn't match the data. This is like a mail carrier accepting a letter that says "I have 5 pages" but actually has 100 pages, causing the mailbox to overflow and crash.
- The "Unknown Extension" Confusion: When a message had new features the old parser didn't know about, some parsers got confused and started reading the wrong part of the message, thinking it was something else entirely. This is like a translator seeing a new word in a foreign language, getting confused, and then translating the rest of the sentence incorrectly.
- The "Default Value" Mistake: The rules say that if a value is the "default," it shouldn't be sent at all to save space. But some parsers were still sending it, or failing to recognize when it was missing.
The Real-World Danger
The paper didn't just find theoretical bugs; it showed how they could be exploited. The researchers demonstrated four concrete attacks:
- Crashing a Phone: By sending a message with a list of network IDs that was slightly too long (violating a constraint), they caused a phone's software to crash, leading to a Denial of Service (DoS).
- Crashing a Tower: A compromised cell tower could send a malformed message to another tower, causing the second tower to crash while trying to process it.
- Secret Leaks: If a parser misinterprets a message due to an unknown extension, it might think a security setting is "off" when it's actually "on," or vice versa. This could lead to a situation where a phone thinks it's communicating securely, but the network is actually sending data in plain text, allowing eavesdroppers to read it.
- Device Fingerprinting: Because different parsers handle errors differently, a hacker could send specific "trick" messages and watch how the device reacts. If the device accepts a weird message, the hacker knows it's using a specific brand of hardware (like a Samsung baseband), allowing them to target that specific device with known exploits.
Performance and the Future
The researchers admit that their perfect, mathematically verified parser isn't the fastest one out there. It is about 4 times slower than the highly optimized C libraries currently used in the industry. However, it is 4 times faster than Python-based parsers.
The goal of VUPER isn't to replace the fast parsers immediately, but to serve as a reference implementation. Just as a master chef can taste a dish and tell you exactly what's wrong with the recipe, VUPER can tell engineers exactly where their parsers are failing. The researchers hope that by using VUPER to find and fix these bugs, the industry can eventually build parsers that are both fast and mathematically guaranteed to be safe.
In the end, VUPER shows that in the complex, high-speed world of 5G and beyond, we can no longer rely on "good enough" testing. We need mathematically proven translators to keep our digital city safe, secure, and running smoothly.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.