P4USE: P4-Based User Equipment Fingerprinting for Mitigating DoS Signaling Attacks on the 5G Control Plane

5 G networks, essential for applications like smart cities and factories, must ensure high reliability, availability, and security. However, the safety of 5 G remains a matter of concern. Despite its enhanced security mechanisms compared to previous generations, our study identifies two novel denial-of-service (DoS) signaling attack types that can disrupt the 5 G control plane (CP), exposing weaknesses in its current security design. Traditional switches cannot prevent such attacks because they are unable to extract attacking user equipment (UE) information from encapsulated nonaccess stratum (NAS) data. While ensuring the availability of the 5 G CP is essential to protect 5 G services, this issue has emerged as a pressing challenge. To address this challenge, we propose a novel P4-based user equipment fingerprinting (P4USE) method to mitigate 5 G CP DoS signaling attacks. Leveraging P4's programmable packet processing capability, P4USE can parse encapsulated NAS information at line rate, identify UE fingerprints, and drop anomalous NAS messages originating from attackers. Experimental evaluations in Open5GS confirm both the existence of the identified vulnerabilities and the effectiveness of P4USE in mitigating them. Overall, our work reveals two novel vulnerabilities and presents a defense solution to enhance the availability and security of the 5 G CP.