first commit

.gitignore

@@ -0,0 +1,25 @@
+*~
+*.aux
+*.fdb_latexmk
+*.sw?
+*.gz
+.DS_Store
+/*.bak
+/*.bbl
+/*.blg
+/*.dvi
+/*.fls
+/*.log
+/*.out
+/*.toc
+/*.pdf
+/rev.tex
+/abstract.txt
+/code/*.tex
+!/code/fmt.tex
+!/figs/*.pdf
+!/figs/*.eps
+!/data/*.pdf
+!/data/*.eps
+*.pdf
+.latexrun.db

Makefile

@@ -0,0 +1,77 @@
+MAIN ?= p
+DIFF ?= HEAD^
+CODE := $(addsuffix .tex,$(filter-out %.tex,$(wildcard code/*)))
+FIGS := $(patsubst %.svg,%.pdf,$(wildcard fig/*.svg))
+PLOT := $(patsubst %.gp,%.tex,$(wildcard data/*.gp))
+DEPS := $(CODE) $(FIGS) $(PLOT)
+BTEX := --bibtex-args="-min-crossrefs=99"
+
+all: $(DEPS)
+	@TEXINPUTS="sty:" bin/latexrun $(BTEX) $(MAIN)
+
+submit: $(DEPS)
+	@for f in $(wildcard submit-*.tex); do \
+		TEXINPUTS="sty:" bin/latexrun $$f; \
+	done
+
+diff: $(DEPS)
+	@bin/diff.sh $(DIFF)
+
+help:
+	echo "..."
+
+rev.tex: FORCE
+	@printf '\\gdef\\therev{%s}\n\\gdef\\thedate{%s}\n' \
+	   "$(shell git rev-parse --short HEAD)"            \
+	   "$(shell git log -1 --format='%ci' HEAD)" > $@
+
+code/%.tex: code/%
+	pygmentize -P tabsize=4 -P mathescape -f latex $^ > $@
+
+code/fmt.tex:
+	pygmentize -f latex -S default > $@
+
+fig/%.pdf: fig/%.svg
+	inkscape --without-gui -f $^ -D -A $@
+
+data/%.tex: data/%.gp
+	gnuplot $^
+
+draft: $(DEPS)
+	echo -e '\\newcommand*{\\DRAFT}{}' >> rev.tex
+	@TEXINPUTS="sty:" bin/latexrun $(BTEX) $(MAIN)
+
+watermark: $(DEPS)
+	echo -e '\\usepackage[firstpage]{draftwatermark}' >> rev.tex
+	@TEXINPUTS="sty:" bin/latexrun $(BTEX) $(MAIN)
+
+spell:
+	@for i in *.tex fig/*.tex; do bin/aspell.sh $$i; done
+	@for i in *.tex; do bin/double.pl $$i; done
+	@for i in *.tex; do bin/abbrv.pl  $$i; done
+	@bin/hyphens.sh *.tex
+
+clean:
+	@bin/latexrun --clean
+	rm -f abstract.txt
+
+distclean: clean
+	rm -f code/*.tex
+
+init:
+	rm -f {code,fig,data}/ex-*
+	perl -pi -e 's/^\\input{ex}/% \\input{ex}/g' $(MAIN).tex
+
+SYS := $(shell sed -n -e 's/\\newcommand{\\sys}{\\mbox{\\textsc{\([^}]*\)}.*/\1/p' $(MAIN).tex)
+abstract.txt: abstract.tex
+	@cat $<                         \
+	    | grep -v '{abstract}'      \
+	    | sed -e 's/\\emph//g'      \
+	    | sed -e 's/{//g'           \
+	    | sed -e 's/}//g'           \
+	    | sed -e 's/---/ -- /g'     \
+	    | sed -e 's/~/ /g'          \
+	    | sed -e 's/\\sys/${SYS}/g' \
+	    | fmt -w72 > $@
+
+.PHONY: all help FORCE draft clean spell distclean init

README.md

@@ -0,0 +1,43 @@
+# KAIST Thesis Template
+
+## Usage
+
+1. clone the git repo:
+
+```
+$ git clone [email protected]:0xdkay/kaist-thesis-template.git
+```
+
+2. build it:
+
+``` sh
+$ make
+```
+
+(check p.pdf)
+
+3. starting point, p.tex:
+
+```
+$ grep -oP 'input{\K\w+' p.tex
+macro
+abstract
+intro
+back
+anal
+accounting
+attack
+cm
+related
+concl
+summary
+ack
+cv
+```
+
+## Special Thanks
+Original format:
+
+```
+https://github.com/tsgates/die
+```

abstract.tex

@@ -0,0 +1,14 @@
+\begin{abstract}
+Long Term Evolution (LTE) is becoming the dominant cellular networking
+technology, shifting the cellular network away from its circuit-switched legacy
+towards a packet-switched network that resembles the Internet. To support voice
+calls over the LTE network, operators have introduced Voice-over-LTE (VoLTE),
+which dramatically changes how voice calls are handled, both from user equipment
+and infrastructure perspectives. We find that this dramatic shift opens up a
+number of new attack surfaces that have not been previously explored. To call
+attention to this matter, this paper presents a systematic security analysis.
+\\
+\\
+\\
+\keywords{VoLTE, Accounting, Security, Cellular Networks}
+\end{abstract}

accounting.tex

@@ -0,0 +1,5 @@
+
+\chapter{Exploiting Hidden Data Channels}
+\label{sec:accounting}
+
+From the analysis of the accounting policy and VoLTE call flow in

ack.tex

@@ -0,0 +1,5 @@
+\acknowledgement[korean]
+이 연구를 수행하기까지 많은 분들의 도움을 받았습니다. 우리 시스템보안 연구실의
+모든 분들이 도움을 주셨기에 좋은 연구를 진행할 수 있었습니다.  전체적인 연구의
+
+

anal.tex

@@ -0,0 +1,6 @@
+\chapter{Empirical Analysis of VoLTE Services}
+\label{sec:anal}
+In this section, we describe our empirical security analysis
+on the current implementation of \vt services by commercial,
+deployed mobile cellular network operators.
+

aspell.words

@@ -0,0 +1,99 @@
+personal_ws-1.1 en 98
+AES
+AUTN
+CP
+CSCF
+CSFB
+DIAG
+DK
+DNS
+DPI
+DSP
+Delugre
+DoS
+EPS
+Enck
+Extractocol
+Freewave
+Fuction
+GPP
+GSM
+GW
+IMEI
+IMS
+IP
+IPSec
+IPsec
+IPv
+ISPs
+Innowireless
+Kbps
+LTE
+LimeGreen
+MSC
+MTU
+Mbps
+Mis
+Mobilestation
+NodeB
+OPTis
+Overbilling
+PDN
+PRACK
+PSTN
+Param
+Peng
+QCI
+Qian
+QoS
+Qos
+QualComm's
+RIL
+RTP
+SIM
+SMS
+Skypemorph
+TCP
+TK
+TLS
+TODO
+TrustZone
+UDP
+UE
+UE's
+UEs
+UMTS
+VoIP
+VoLTE
+YJ
+YK
+ack
+al
+anonymized
+basicstyle
+behaviros
+blackbox
+botnet
+callee
+callee's
+centric
+credentiality
+eNodeB
+et
+furthemore
+infeasible
+mis
+moredelim
+overbilling
+plaintext
+retransmission
+sRTP
+sep
+smartphone
+smartphones
+steganography
+texting
+timestamp
+versa
+xsep
+ysep

attack.tex

@@ -0,0 +1,4 @@
+% 5. attack
+\chapter{Exploiting VoLTE Mis-implementation}
+\label{sec:attack}
+

back.tex

@@ -0,0 +1,46 @@
+% 2 Background
+\chapter{VoLTE Overview}
+\label{sec:back}
+
+\section{LTE Network Infrastructure}
+\label{sec:cellular}
+
+A cellular network comprises two architectural components: an access
+network that the UE connects to, and a core network that supports its
+cellular infrastructure.
+
+
+\section{VoLTE Service}
+\label{sec:volte_network}
+
+\vt service is introduced to deliver voice calls
+over the packet-switching based LTE network.
+The service utilizes an IMS network based on SIP,
+similar to VoIP service over the LTE network.
+To establish a voice call, a UE
+follows standard procedures as depicted in~\autoref{fig:volte_procedure}.
+
+\begin{figure}[h]
+  \centering
+  \includegraphics[width=130mm]{images/volte_procedure4}
+  \caption{Overview of packet-switching and IMS protocols in \vt; registration and call setup
+    between a UE and a LTE network.}
+  \label{fig:volte_procedure}
+\end{figure}
+
+
+\section{VoLTE Signaling Protocol}
+\label{sec:signal_protocol}
+
+
+\PP{Call Signaling.}
+If the user accepts the call at UE-B, it sends an {\tt OK (200)}
+
+
+\PP{Call Management in the UE.}
+speaker and a microphone. Upon receiving voice traffic from a radio
+channel, the CP processes the voice packets and forwards only audio data to
+the AP, which lessens the computational burden of the AP. 
+
+
+

bin/abbrv.pl

@@ -0,0 +1,11 @@
+#!/usr/bin/perl
+# Detects potential abbreviations at the end of a sentence.
+
+while (<>) {
+    s/%.*//;
+    next unless s/([A-Z]+\.)/\e[7m$1\e[m/g;
+
+    s/^([^\e]*\n)+//mg;
+    s/^/$ARGV: /mg;
+    print;
+}

bin/aspell.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+DIC=$(dirname "$0")/../aspell.words
+TEX=$1
+
+# p: skip a param
+# P: don't skip a param
+# o: skip an optional param
+# O: don't skip an optional param
+TEXCMD=(--add-tex-command="autoref p"
+        --add-tex-command='begin pop'
+	      --add-tex-command='bibliography p'
+      	--add-tex-command='bibliographystyle p'
+      	--add-tex-command='cc p'
+      	--add-tex-command='citeauthor p'
+      	--add-tex-command='color p'
+      	--add-tex-command='definecolor ppp'
+      	--add-tex-command='eqref p'
+      	--add-tex-command='fvset p'
+      	--add-tex-command='hypersetup p'
+      	--add-tex-command='lstset p'
+      	--add-tex-command='mathit p'
+      	--add-tex-command='mathrm p'
+      	--add-tex-command='includeplot p'
+      	--add-tex-command='includepdf p'
+      	--add-tex-command='therev p'
+      	--add-tex-command='newcommand pp'
+      	--add-tex-command='renewcommand pp'
+      	--add-tex-command='usetikzlibrary p'
+      	--add-tex-command='DeclareMathOperator pp'
+      	--add-tex-command='VerbatimInput p'
+        --add-tex-command='includefig pp')
+
+touch $DIC
+aspell --lang en -x --mode=tex "${TEXCMD[@]}" -p $(pwd)/$DIC -c $TEX
+
+VER=$(head -1 $DIC)
+tail -n +2 $DIC | LC_ALL=C sort > $DIC~
+
+echo $VER > $DIC
+cat $DIC~ >> $DIC