Experimental Validation and Mitigation of RRC Storm Attacks in 5G Cellular Networks

Every time a mobile phone connects to a 5G network, it must first pass through a brief, unguarded doorway. Before the network can verify who the user is or check their password, the phone must ask for permission to speak. This initial handshake is essential for the system to function, but it is also a vulnerability. Because the network must allocate resources to handle the request before it knows if the request is legitimate, a malicious actor can exploit this gap. By sending a flood of fake requests that look like real connection attempts but never finish, an attacker can clog the system. This creates a traffic jam where the network's processing power is consumed by incomplete tasks, leaving no room for real people to make calls or send messages. This specific type of disruption, known as a signaling storm, has long been a theoretical threat in the world of wireless security, but proving it works in the real world and finding a way to stop it has remained a challenge.

A team of researchers at King Abdullah University of Science and Technology has now moved this problem from the realm of computer simulations into the physical world. They built a real 5G network using software-defined radios and commercial mobile phones to demonstrate exactly how an attacker could overwhelm a cell tower. More importantly, they designed and tested a lightweight defense that runs directly on the tower itself. Their work shows that while an attacker can indeed shut down a cell by flooding it with unfinished connection requests, a smart monitoring system can spot the pattern of this abuse and block it without stopping legitimate users. The researchers released all their code as open source, allowing others to verify their findings and build better defenses.

To understand the attack, one must first look at how a phone joins a 5G network. When a device turns on, it sends a signal to the nearest tower, known as a base station, asking to connect. The tower responds with a temporary ID and a grant to send more data. The phone then sends a formal request to establish a connection. At this stage, the tower has created a small memory space, or context, to track this specific phone. Only after this exchange does the network begin the process of authenticating the user. In a normal scenario, the phone completes the handshake, and the connection becomes active. However, an attacker can exploit the fact that the tower creates this memory space before knowing if the user is real. A malicious device can repeatedly start this process, sending the initial request and the follow-up message, but then deliberately stopping before the final step. The tower is left holding a memory space for a phone that never arrives, a state the researchers call a "half-open" connection.

The researchers set up a test environment to see how quickly this could go wrong. They used a desktop computer running specialized software to act as the base station, connected to two radio devices that transmitted signals over the air. One radio acted as the attacker, while a standard commercial phone served as a victim. When the attacker began sending these incomplete requests, the results were immediate. The base station's memory filled up with these ghost connections. In their first test, the system reached its limit of sixteen users in less than a second. When they increased the capacity to ninety users, the system still collapsed in under four seconds. Once the memory was full, the tower could no longer accept new requests. When the researchers tried to connect the commercial phone, it failed repeatedly, unable to get a signal. The attack had successfully created a denial of service, blocking real users from the network.

Having proven the attack works, the team turned to the solution. They needed a way to tell the difference between a busy network with many real users and a network under attack. In a normal high-load situation, most phones that start the connection process finish it. In an attack, the ratio of finished connections to started ones drops sharply because the attacker never completes the handshake. The researchers programmed the base station to watch this ratio. If the number of completed connections fell below a certain level compared to the number of started ones, the system would know an attack was happening.

Once the attack was detected, the system needed to act without shutting down the entire cell. The researchers developed a method that groups suspicious requests based on where they are coming from. They used a value called the timing advance, which the tower calculates to determine how far away a phone is. While this value is not precise enough to identify a specific device, it is accurate enough to group devices that are at a similar distance. The system counts how many half-open connections are coming from each distance group. If one group has a sudden spike in incomplete connections, the system marks that group as suspicious.

When a group is flagged, the base station changes its behavior for any new requests coming from that specific distance. Instead of giving these new requests the full time to complete, the system gives them a very short window to finish the handshake. For a legitimate user, this window is plenty of time to connect. For the attacker, who is trying to cycle through thousands of fake requests as fast as possible, the window is too short to accumulate the necessary number of half-open connections. The attacker's requests time out and are cleared away, freeing up resources.

The researchers tested this defense in the same real-world setup. When the attack began, the system detected the drop in completed connections and activated the defense. The attacker was immediately blocked from filling up the memory. Crucially, the commercial phone was also able to connect, though it had to try a few times because it happened to be in the same distance group as the attacker. The phone eventually connected and achieved full speed. This result highlighted the trade-off of the defense: legitimate users in the same area as the attacker might experience a slight delay or need to retry, but the network as a whole remains open. Without the defense, the entire network would have been shut down.

The study concludes that while the RRC signaling storm is a real and dangerous threat, it is not unstoppable. By monitoring the flow of connection requests and applying a simple, targeted filter based on distance, a network can protect itself from being overwhelmed. The researchers emphasized that their defense is lightweight and runs directly on the network equipment, making it practical for real-world deployment. They also noted that if an attacker were to move around or use multiple devices in different locations, the current method might be less effective, suggesting that future defenses could combine distance with other features to catch more complex attacks. By releasing their work as open source, the team has provided the community with a working model to test, improve, and adapt, turning a theoretical vulnerability into a solved problem with a practical defense.