RRC-Layered Vulnerability Implementation Based on Signal Overshadowing in Radio Access Network

The security of Radio Access Network (RAN) is increasingly becoming a focal point of attention. The lack of integrity protection and encryption mechanisms in the Radio Resource Control (RRC) protocol before the establishment of a security context poses a significant security threat that cannot be overlooked. Unlike traditional full-band radio jamming and Fake Base Station (FBS) attacks, Signal Overshadowing can precisely target specific time-frequency resource blocks, offering stronger stealth and energy efficiency. In this paper, we propose two novel attack patterns targeting System Information Block type 1 (SIB1) by leveraging Signal Overshadowing. These attacks achieve precise and stealthy signal injection through high-precision time-frequency synchronization. Experimental results demonstrate that both attack patterns can effectively cause Denial of Service (DoS) while maintaining stable characteristics of the received signal, such as Reference Signal Received Power (RSRP), with no significant fluctuations observed. These innovative attack strategies provide valuable insights into the vulnerabilities of the RAN protocols and contribute to the development of further security enhancement mechanisms.