Resistance to side-channel attacks on 5G network slices
Resistance to vulnerabilities from timing-based side-channel attacks on 5G network slices that share underlying physical infrastructure and resources may be enhanced by selectively imposing time-based constraints on service provisioning and data handling to obscure data-driven time variations that occur during workload execution in a slice that can leak secret information. By preventing timing leakage from the 5G network slices, an attacker cannot observe execution latencies to thereby infer the constituency of workload characteristics. In addition, the attacker cannot create contention for shared resources on its own slice to observe an extent to which the shared resources are utilized by a targeted slice.
1. A computer-implemented method for increasing resistance to side-channel attacks on a first slice of a 5G (fifth generation) network having a plurality of slices, including at least a second slice, that share underlying physical network resources and infrastructure in a core network, radio access network, and wide area network, the method comprising:
receiving data packets to be carried by the slice, the data packets associated with a workload to which secret information is associated, the data packets having transmission characteristics with a natural timing distribution that is inherent to the workload;
configuring a slice controller in the 5G network to control transmission of traffic over the slice, the traffic including the data packets, and wherein the slice controller is implemented as a software-defined networking (SDN) component instantiated on the underlying physical network infrastructure for controlling slicing in the core network, radio access network, and wide area network; and
operating the slice controller to perform secret-independent shaping for the traffic to obfuscate the secret information associated with the workload for the first slice from the second slice, wherein the secret-independent shaping comprises enforcing temporal isolation of shared physical network resources between the first slice and second slice in which the slice controller alternately allocates shared physical network resources to the first slice and the second slice to prevent simultaneous use of the shared physical network resources by the first slice and the second slice.
2. The computer-implemented method of claim 1 in which the secret-independent traffic shaping comprises transforming each of the data packets to have a fixed packet length.
3. The computer-implemented method of claim 1 in which the workload provides timing for the data packets and the secret-independent traffic shaping comprises perturbing the timing for the data packets.
4. The computer-implemented method of claim 3 in which the perturbation of the timing for the data packets includes imposing a fixed transmission time interval for each of the data packets.
5. The computer-implemented method of claim 1 in which the secret-independent traffic shaping comprises imposing a synthetic distribution for time-based aspects of data packet transmission.
6. The computer-implemented method of claim 5 in which the synthetic distribution comprises fixed sizes for data packets and fixed data packet transmission time intervals.
7. The computer-implemented method of claim 6 in which the fixed data packet sizes and fixed data packet transmission time intervals include deviations within a predetermined threshold, the threshold selected to prevent revealing the secret information.
8. The computer-implemented method of claim 1 in which the slice controller operates to control transmission over a portion of the 5G network, the portion including one of radio access network (RAN), wide area network (WAN), or cloud network, and the secret-independent traffic shaping is applied to data traffic on the portion of the 5G network.
9. The computer-implemented method of claim 1 further comprising controlling a degree of secret-independent traffic shaping based on a type of the data packets.