Search for: All records

We develop 5GBaseChecker— an efficient, scalable, and dynamic security analysis framework based on differential testing for analyzing 5G basebands' control plane protocol interactions. 5GBaseChecker first captures basebands' protocol behaviors as a finite state machine (FSM) through black-box automata learning. To facilitate efficient learning and improve scalability, 5GBaseChecker introduces novel hybrid and collaborative learning techniques. 5GBaseChecker then identifies input sequences for which the extracted FSMs provide deviating outputs. Finally, 5GBaseChecker leverages these deviations to efficiently identify the security properties from specifications and use those to triage if the deviations found in 5G basebands violate any properties. We evaluated 5GBaseChecker with 17 commercial 5G basebands and 2 open-source UE implementations and uncovered 22 implementation-level issues, including 13 exploitable vulnerabilities and 2 interoperability issues. 

In this paper, we present Hermes, an end-to-end framework to automatically generate formal representations from natural language cellular specifications. We first develop a neural constituency parser, NEUTREX, to process transition-relevant texts and extract transition components (i.e., states, conditions, and actions). We also design a domain-specific language to translate these transition components to logical formulas by leveraging dependency parse trees. Finally, we compile these logical formulas to generate transitions and create the formal model as finite state machines. To demonstrate the effectiveness of Hermes, we evaluate it on 4G NAS, 5G NAS, and 5G RRC specifications and obtain an overall accuracy of 81-87%, which is a substantial improvement over the state-of-the-art. Our security analysis of the extracted models uncovers 3 new vulnerabilities and identifies 19 previous attacks in 4G and 5G specifications, and 7 deviations in commercial 4G basebands. 

Abstract Graphene, with its two linearly dispersing Dirac points with opposite windings, is the minimal topological nodal configuration in the hexagonal Brillouin zone. Topological semimetals with higher-order nodes beyond the Dirac points have recently attracted considerable interest due to their rich chiral physics and their potential for the design of next-generation integrated devices. Here we report the experimental realization of the topological semimetal with quadratic nodes in a photonic microring lattice. Our structure hosts a robust second-order node at the center of the Brillouin zone and two Dirac points at the Brillouin zone boundary—the second minimal configuration, next to graphene, that satisfies the Nielsen–Ninomiya theorem. The symmetry-protected quadratic nodal point, together with the Dirac points, leads to the coexistence of massive and massless components in a hybrid chiral particle. This gives rise to unique transport properties, which we demonstrate by directly imaging simultaneous Klein and anti-Klein tunnelling in the microring lattice.