Decoding 5G RRC for Subscriber Insights

The Theory: Hiding in Plain Sight with SUCI

In older 2G, 3G, and 4G networks, a major privacy vulnerability exists: the device's permanent identifier, the International Mobile Subscriber Identity (IMSI), is often sent unencrypted over the air. This allows anyone with the right radio equipment to passively listen and link a device's activity to a specific SIM card.

5G was designed to fix this. It introduces two key concepts:

• SUPI (Subscription Permanent Identifier): This is the 5G equivalent of the IMSI. It's a globally unique identifier for your subscription, stored securely on the USIM card.
• SUCI (Subscription Concealed Identifier): To prevent the SUPI from being sent unencrypted, the UE conceals it before transmission. It does this by encrypting the SUPI with the home network's public key, creating a SUCI. Only the home network, with its private key, can decrypt the SUCI to reveal the SUPI.

As the video explains, the SUCI is essentially a cryptographic container for the SUPI.

The key takeaway is that the permanent identifier (SUPI) should never appear on the air interface in a secure 5G network. Instead, we should only see the temporary, encrypted SUCI.

The Message Flow: Piggybacking Identity

So, where exactly is the SUCI sent? It's transmitted during the UE's initial registration with the network. This involves two protocol layers you may recall from your networking background:

1. RRC (Radio Resource Control): This protocol manages the radio connection between the UE and the base station (gNB).
2. NAS (Non-Access Stratum): This protocol handles session management and mobility between the UE and the core network (AMF). NAS messages are said to be "piggybacked" inside RRC messages to get them across the radio interface.

The initial connection sequence is a multi-step dance.

To summarize the flow:

1. The UE performs a Random Access procedure (RACH) to get the gNB's attention.
2. The UE sends an RRCSetupRequest.
3. The gNB responds with RRCSetup.
4. The UE confirms with RRCSetupComplete. Inside this message is the NAS Registration Request, which contains the SUCI.

The gNB then extracts this NAS payload and forwards it to the AMF inside an Initial UE Message over the N2 interface. Your experience with Wireshark and encapsulated protocols like HTTP within TCP/IP is analogous here—NAS is encapsulated within RRC, which is then re-packaged into NGAP.

Lab: Capturing and Analyzing the 5G Attach

Now, let's put theory into practice. We will capture the traffic from a 5G attach procedure in our lab and find the SUCI.

Step 1: Configure srsRAN for Packet Capture

We need to tell our srsRAN gNB to save the radio messages to a .pcap file that we can analyze in Wireshark.

Based on this, open your gNB configuration file (srsRAN_Project/gnb_zmq.yaml). Find or add the pcap section and modify it to enable MAC-layer capture. The mac_filename directive will tell srsRAN where to save the RRC messages.

pcap:
  enable: true
  mac_enable: true
  mac_filename: /tmp/gnb_mac.pcap
  ngap_enable: false # We're focusing on the RRC layer for now

Save the file. This configuration will now create a file named gnb_mac.pcap in your /tmp directory every time you run the gNB.

Step 2: Run the Scenario

1. Start the Core Network: In a terminal, start Open5GS as usual.

   cd Open5GS-srsRAN/docker
   docker-compose up -d
   

2. Start the gNB: In a second terminal, start the gnb with our modified capture config.

   cd srsRAN_Project/build
   sudo ./apps/gnb/gnb -c ../../gnb_zmq.yaml
   

3. Start the UE: In a third terminal, start the srsue and let it attach to the network.

   cd srsRAN_Project/build
   sudo ./apps/ue/ue -c ../../ue.yaml
   

   Wait for the UE log to show that it has successfully attached and received an IP address. Once it has, you can stop the gnb and srsue with Ctrl+C.

Step 3: Analyze the Capture in Wireshark

The capture file /tmp/gnb_mac.pcap now contains the radio messages from the connection. Let's analyze it.

1. Open the file in Wireshark.

   wireshark /tmp/gnb_mac.pcap
   

2. Set the Dissector: The packets will likely show up as "DLT_USER" because srsRAN uses a custom encapsulation. To make Wireshark decode them correctly as 5G RRC, go to Edit -> Preferences -> Protocols -> DLT_USER, and edit the DLT User table. Set User 12 (DLT=159) to nr-rrc.mac. Click OK. The display should update to show RRC messages.
3. Filter the Traffic: In the display filter bar, type nr-rrc and press Enter to see only the RRC messages.
4. Find the RRCSetupComplete message. Scroll through the packets and locate this message, which is sent from the UE to the gNB.
5. Drill Down: Click on the RRCSetupComplete message and expand the protocol tree in the packet details pane. Navigate as follows:
   • NR RRC
     • c1: rrcSetupComplete (1)
       • rrcSetupComplete
         • criticalExtensions: rrcSetupComplete (0)
           • rrcSetupComplete-r8
             • dedicatedNAS-Message

6. Identify the Subscriber Information:
   The dedicatedNAS-Message field contains the UE's Registration Request. If you expand the 5GMM (5G Mobility Management) details within it, you will find an information element called 5GS mobile identity. Expand this.

   • You will see Type of identity: SUCI...
   • You will also see the SUCI value itself, which in our lab is composed of the MCC, MNC, and the subscriber's permanent ID.

   An important note for security: As the Open5GS and srsRAN 5G Network Log Analysis article mentions, Open5GS with null-encrypted SIMs does not actually encrypt the SUPI. The SUCI in the capture is therefore identical to the SUPI. This demonstrates a critical real-world concept: security features are only effective if they are correctly configured and implemented. In our controlled lab, we can see the "plaintext" SUPI, achieving the goal of an IMSI/SUCI-catcher.

Conclusion

Congratulations! You have successfully captured and dissected the initial 5G connection messages to find a subscriber's identifier.

Key Takeaways:

• 5G improves privacy by encrypting the permanent subscriber identifier (SUPI) into a concealed identifier (SUCI) for over-the-air transmission.
• The SUCI is transmitted within a NAS Registration Request message.
• This NAS message is carried over the radio interface inside an RRCSetupComplete message from the UE to the gNB.
• Using srsRAN's built-in pcap functionality and Wireshark, we can capture and analyze this RRC traffic.
• Security is implementation-dependent. Our lab uses null-scheme encryption, which allows us to see the SUPI within the SUCI field, effectively bypassing the privacy measure.

Preview of the Next Lesson:
We've now examined traffic on the radio interface (UE-gNB). But what about the core network itself? In the next lesson, we will use web security tools to probe the HTTP/2 interfaces of the Open5GS core network functions. You'll see how your existing cybersecurity skills in API and web security are directly applicable to the 5G Service-Based Architecture.