PRB Starvation at Slot Time via Rank Indicator Inflation: Attacking Proportional Fair Memory in the Scheduler
Ryan Barker, Julia Boone, Tolunay Seyfi, Alirez Ebrahimi, Ethan Farquhar, Brian Davis, Joseph Boccuzzi, Fatemeh Afghah
原文摘要
Proportional fair (PF) scheduling in fifth-generation (5G) New Radio (NR) ranks user equipment (UE) by instantaneous rate over an exponentially weighted moving average (EWMA) of delivered service. We identify a served-but-undelivered denial-of-service (DoS) attack in which rank indicator (RI) inflation induces persistent physical resource block (PRB) starvation. Unsupported spatial layers cause first-attempt delivery failure, keeping the attacker's service EWMA low; the evaluated PF allocator repeatedly grants it the full PRB pool, denying honest UEs transmission opportunities. We formalize this recurrence and evaluate it in 3,300 paired, 200 slot multi-user shards spanning rank 1 and rank 2 Sionna Ray Tracing geometries, three link adaptation controllers, PF and round robin (RR), four target identities, and five seeds. On the rank 2 geometry, selective RI inflation yields 94--95\% target capture, reduces PRB Jain fairness from 0.997 to 0.28, and produces mean honest zero-grant runs of 41--56\,ms; RR preserves equal allocation. Exact offline replay and a Monte Carlo recurrence isolate the delivered-service denominator as the causal path. Cross-field and controller ablations show a weaker, controller-dependent channel-quality trigger, while activity-gated EWMA defenses remain structurally blind. The results motivate RI-consistency checks before feedback acquires scheduling authority and slot-time PRB evidence inside the O-RAN Distributed Unit.
cs.NI