AI 中文总结
提出5GDescrambler，利用代数结构逆向DCI加扰，集成于开源嗅探管道，实现被动高效解码，支持用户追踪，性能优于暴力破解。
AI 中文摘要
最近，通过利用各种侧信道，已经成功演示了在5G NR中对用户的追踪。这允许识别个体、实时分类用户活动以及通过指纹进行追踪，影响了数十亿拥有5G订阅的用户和拥有私有5G部署的公司。然而，先前的工作依赖于泄露网络参数（如握手期间的无线网络临时标识符（RNTI）或加扰因子（$N_{ID}$））的弱运营商配置，或者低效地暴力破解下行控制信息（DCI）。在本文中，我们提出了一种利用代数结构来逆向DCI加扰的新技术，并完全集成到一个开源端到端二进制DCI嗅探管道中。它为后续攻击（如用户实时追踪）提供了使能输入，并支持自动检测所使用的控制信道配置。我们通过对srsRAN、OpenAirInterface5G和两个商业供应商的部署进行测量活动，证明了我们方法的鲁棒性和性能。在低于高效通信预期值的信噪比（SNR）下，它达到了低于1%的块错误率，同时在参考样本上的执行速度显著快于先前提出的被动暴力破解所需参数的技术。此外，它完全是被动的，不依赖任何侧信道泄漏。
英文摘要
Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.
CommentsTo be published in the Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security, vendors redacted until disclosure period is over
