TR 33.701
Study on mitigations against bidding down Attacks

3GPP‑Page fToC_↓ Partial Content _→

V19.0.0 (Wzip) 2024/09 31 p.

Rapporteur:: Dr. Ben Henda, Noamen
Huawei Technologies Sweden AB

full Table of Contents for TR 33.701 Word version: 19.0.0

each clause number in 'red' refers to the equivalent title in the Partial Content

Scope p. 7

References p. 7

Definitions of terms, symbols and abbreviations p. 7

3.1	Terms p. 7
3.2	Symbols p. 7
3.3	Abbreviations p. 7

Key issues p. 8

4.1

Key Issue #1: Bidding down attacks from LTE/NR to decommissioned GERAN/UTRAN p. 8

4.1.1	Description p. 8
4.1.2	Threats p. 8
4.1.3	Potential requirements p. 9

Solutions p. 9

5.1

Solution #1: Securely notification to UE when the GERAN/UTRAN networks are decommissioned p. 9

5.1.1	Introduction p. 9
5.1.2	Details p. 9
5.1.3	Evaluation p. 9

5.2

Solution #2: Provisioning of information on restricted RAT types using NAS message p. 10

5.2.1	Introduction p. 10
5.2.2	Details p. 10
5.2.3	Evaluation p. 10

5.3

Solution #3: Mitigation against bidding down attacks from LTE/NR to decommissioned GERAN/UTRAN p. 11

5.3.1	Introduction p. 11
5.3.2	Details p. 12
5.3.3	Evaluation p. 13

5.4

Solution #4: Solution for mitigating GERAN UTRAN bidding down attack p. 13

5.4.1	Introduction p. 13
5.4.2	Details p. 13
5.4.3	Evaluation p. 14

5.5

Solution #5: Solution for access restrictions to decommissioned UTRAN and GERAN p. 15

5.5.1	Introduction p. 15
5.5.2	Details p. 15
5.5.3	Evaluation p. 16

5.6

Solution #6: Using allowlist to avoid bidding down attack from LTE/NR to decommissioned GERAN/UTRAN p. 16

5.6.1	Introduction p. 16
5.6.2	Details p. 16
5.6.3	Evaluation p. 16

5.7

Solution #7: Registration-based provisioning of decommissioned system list p. 17

5.7.1	Introduction p. 17
5.7.2	Details p. 17
5.7.3	Evaluation p. 18

5.8

Solution #8: UPU-based provisioning of decommissioned system list p. 18

5.8.1	Introduction p. 18
5.8.2	Details p. 18
5.8.3	Evaluation p. 19

5.9

Solution #9: Reuse SoR procedure for bidding down attack mitigation p. 20

5.9.1	Introduction p. 20
5.9.2	Details p. 20
5.9.3	Evaluation p. 20

5.10

Solution #10: Solution for configured operator indication p. 21

5.10.1	Introduction p. 21
5.10.2	Details p. 21
5.10.3	Evaluation p. 21

5.11

Solution #11: Solution to prevent GERAN/UTRAN bidding down attack using UICC Configuration p. 21

5.11.1	Introduction p. 21
5.11.2	Details p. 22
5.11.3	Evaluation p. 22

5.12

Solution #12: Solution to prevent bidding down to GERAN/UTRAN by restricting inter RAT handover p. 22

5.12.1	Introduction p. 22
5.12.2	Solution details p. 22
5.12.3	Evaluation p. 23

5.13

Solution #13: Solution to prevent bidding down by restricting UE access to GERAN/UTRAN in its location p. 24

5.13.1	Introduction p. 24
5.13.2	Solution details p. 24
5.13.3	Evaluation p. 25

5.14

Solution #14: configuration in UE per country p. 26

5.14.1	Introduction p. 26
5.14.2	Details: p. 26
5.14.3	Evaluation p. 27

5.15

Solution #15: Mitigation of Roaming Attack based on UE Implementation p. 27

5.15.1

Introduction p. 27

5.15.2

Solution details p. 27

5.15.2.1	PLMN Selection Logic p. 27
5.15.2.2	Mitigation of Attack Scenario 1 p. 28
5.15.2.3	Mitigation of Attack Scenario 2 p. 28

5.15.3

Evaluation p. 28

5.16

Solution #16: configuration in UE p. 29

5.16.1	Introduction p. 29
5.16.2	Details: p. 29
5.16.3	Evaluation p. 29

Conclusion p. 29

Guidance for legacy devices p. 30

A.1

Description p. 30

A.2

Approaches p. 30

A.2.1

Approach #1: Raising user awareness p. 30

Change history p. 31

TR 33.701 Study on mitigations against bidding down Attacks

full Table of Contents for TR 33.701 Word version: 19.0.0

TR 33.701
Study on mitigations against bidding down Attacks