The Wiley 5G Ref Security 1St Edition Rahim Tafazolli Full Chapter PDF

The Wiley 5G REF: Security 1st Edition
Rahim Tafazolli
Visit to download the full and correct content document:
https://ebookmass.com/product/the-wiley-5g-ref-security-1st-edition-rahim-tafazolli/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...
5G Wireless Network Security and Privacy Dongfeng Fang
https://ebookmass.com/product/5g-wireless-network-security-and-
privacy-dongfeng-fang/
Impact 1st Edition Ali Rahim
https://ebookmass.com/product/impact-1st-edition-ali-rahim/
UAV Communications for 5G and Beyond (Wiley - IEEE) 1st

Edition Yong Zeng (Editor)
https://ebookmass.com/product/uav-communications-for-5g-and-
beyond-wiley-ieee-1st-edition-yong-zeng-editor/
Vannithamby, R: 5G Verticals (Wiley - IEEE) Rath

Vannithamby (Editor)
https://ebookmass.com/product/vannithamby-r-5g-verticals-wiley-
ieee-rath-vannithamby-editor/
Comparative Homeland Security: Global Lessons (Wiley
Series on Homeland Defense and Security) – Ebook PDF
Version
https://ebookmass.com/product/comparative-homeland-security-
global-lessons-wiley-series-on-homeland-defense-and-security-
ebook-pdf-version/
Exam Ref AZ-104 Microsoft Azure Administrator 1st

Edition Harshul Patel
https://ebookmass.com/product/exam-ref-az-104-microsoft-azure-
administrator-1st-edition-harshul-patel/
5G & Beyond For Dummies Larry Miller
https://ebookmass.com/product/5g-beyond-for-dummies-larry-miller/
Rights As Security: The Theoretical Basis Of Security

Of Person 1st Edition Rhonda Powell
https://ebookmass.com/product/rights-as-security-the-theoretical-
basis-of-security-of-person-1st-edition-rhonda-powell/
People-centric security : transforming your enterprise

security culture 1st Edition Hayden
https://ebookmass.com/product/people-centric-security-
transforming-your-enterprise-security-culture-1st-edition-hayden/
The Wiley 5G REF: Security
The Wiley 5G REF: Security
Editors-in-Chief
Rahim Tafazolli
University of Surrey, UK
Chin-Liang Wang
National Tsing Hua University, Taiwan, R.O.C.
Periklis Chatzimisios
International Hellenic University, Greece
Section Editor
Madhusanka Liyanage
University College Dublin, Ireland
This edition first published 2021
© 2021 John Wiley & Sons, Ltd
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or
transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise,
except as permitted by law. Advice on how to obtain permission to reuse material from this title is available
at http://www.wiley.com/go/permissions.
The right of Rahim Tafazolli, Chin-Liang Wang, Periklis Chatzimisios, and Madhusanka Liyanage to be
identified as the authors of the editorial material in this work has been asserted in accordance with law.
Registered Offices
John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, USA
John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, UK
Editorial Office
The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, UK
For details of our global editorial offices, customer services, and more information about Wiley products
visit us at www.wiley.com.
Wiley also publishes its books in a variety of electronic formats and by print-on-demand. Some content that
appears in standard print versions of this book may not be available in other formats.
Limit of Liability/Disclaimer of Warranty

While the publisher and authors have used their best efforts in preparing this work, they make no
representations or warranties with respect to the accuracy or completeness of the contents of this work and
specifically disclaim all warranties, including without limitation any implied warranties of merchantability or
fitness for a particular purpose. No warranty may be created or extended by sales representatives, written
sales materials or promotional statements for this work. The fact that an organization, website, or product is
referred to in this work as a citation and/or potential source of further information does not mean that the
publisher and authors endorse the information or services the organization, website, or product may provide
or recommendations it may make. This work is sold with the understanding that the publisher is not engaged
in rendering professional services. The advice and strategies contained herein may not be suitable for your
situation. You should consult with a specialist where appropriate. Further, readers should be aware that
websites listed in this work may have changed or disappeared between when this work was written and when
it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial
damages, including but not limited to special, incidental, consequential, or other damages.
Library of Congress Cataloging-in-Publication Data Applied for:

ISBN: 9781119820314
Cover Design: Wiley

Cover Image: © Blackboard/Shutterstock
Set in 10/12pt WarnockPro by Straive, Chennai, India
10 9 8 7 6 5 4 3 2 1
v
Contents
Foreword xiii
List of Contributors xv
1 5G Mobile Networks Security Landscape and Major Risks 1

Rupendra Nath Mitra and Mahesh K. Marina
Introduction 1
4G to 5G: A Paradigm Shift 2
5G System Architecture 2
Salient Features of 5G Network 5
The Threat Landscape and Security Roadmap 7
5G Network Threat Surface 7
Inspecting 3GPP Security Proposals 10
Security Research Groups and Visions 11
Why Securing 5G is Challenging? 12
Billions of Hackable IoT Devices 12
The Convergence of IT and Telecom Infrastructure 13
Open-source Softwarization 13
AI vs AI 14
Real-time E2E Security Monitoring at Scale 14
Physical Layer Security 14
Can 3GPP Recommendations Solely Secure the 5GS? 15
Current State of the Arts and Open Research Areas 16
Conclusion 17
Acronyms 18
Related Articles 18
References 19
Further Reading 23
2 SDMN Security 25
Edgardo Montes de Oca
Software-defined Mobile Network (SDMN) Security 25
Introduction 25
SDN Concepts 25
SDN Vulnerabilities 27
vi Contents
SDN Security 30
Security Monitoring and Policy Enforcement 33
Conclusion and Future Trends 36
Related Articles 38
References 38
Further Reading 42
3 5G Security – Complex Challenges 43

Silke Holtmanns, Ian Oliver, Yoan Miche, Aapo Kalliola, Gabriela Limonta,
and German Peinado
Introduction 5G Security Building Blocks 43
Old Challenges in New Context for 5G 43
New Security Research Challenges for 5G 45
Trust 46
Dimension 1: Trust Stack 46
Dimension 2: E2E Trust 47
Dimension 3: Supply Chain Integrity 47
Dimension 4: Dynamicity 48
Malware in Mobile Core Networks 48
Measuring Security 49
Need for a Comprehensive and Regular Risk Management
Approach 51
Status Regulatory Approaches for Risk Management 51
How to Proceed Today in 5G Risk Management Approach 52
Latest Proposal for 5G Risk Management 54
Summary 54
Related Articles 55
References 55
Further Reading 56
4 Physical-Layer Security for 5G and Beyond 59

Diana P.M. Osorio, José D.V. Sánchez, and Hirley Alves
Introduction 59
Notion on Physical-Layer Security 60
Secrecy Performance Metrics 61
Secrecy Capacity 61
Secrecy Outage Probability 62
Alternative Secrecy Outage Formulation 62
Fractional Equivocation-Based Metrics 63
Intercept Probability 63
Probability of Strictly Positive Secrecy Capacity 63
Physical-Layer Security Techniques 64
Artificial Noise Generation 64
Multiantenna Diversity 65
Cooperative Diversity 65
Physical-Layer Authentication and Secret-Key Generation 67
Physical-Layer Key Generation 69
Contents vii
Physical-Layer Security for 5G Technologies 70

Massive MIMO 71
mmWave Communications 71
Full-Duplex Communications 71
Nonorthogonal Multiple Access 72
Conclusions and Future Challenges 72
Practical Channel Models 72
Secure Waveforms 73
Physical-Layer Security in Terterahertz communications 73
Physical-Layer Security for UAV-Aided Communications 73
Machine-Learning Techniques for Physical-Layer Authentication 74
Acknowledgment 74
Related Article 74
Endnote 74
References 75
Further Reading 76
5 Security for Handover and D2D Communication in 5G HetNets 77

Alican Ozhelvaci and Maode Ma
Introduction 77
Security Architecture Overview 83
3GPP 5G Network Architecture 83
3GPP 5G Security Architecture 84
Security Attacks and Mechanisms in 5G 85
Attacks in 5G 85
Key Security Technologies in 5G 88
Security Mechanisms in 5G 92
Security Evaluations Techniques 97
Security in 5G Heterogeneous Networks 98
Handover Authentication Security 99
D2D Group Authentication Security 102
Conclusions 106
Related Articles 106
References 106
Further Reading 111
6 Authentication and Access Control for 5G 113

Shanay Behrad, Emmanuel Bertin, and Noel Crespi
Introduction 113
Basics of Authentication and Access Control 114
Overall Architecture of the AAC in 3G, 4G, and 5G 115
5G Network Architecture 117
Authentication and Access Control in 5G 118
5G-AKA Protocol 119
Security Flaws in 5G-AKA 121
New Concepts in 5G 122
5G-Specific Use Cases and Requirements 123
viii Contents
Motivated Use Cases 124

Derived Requirements 124
AAC Proposal in Cellular Networks 125
Summary 127
References 128
Further Reading 130
7 5G-Core Network Security 133

Ijaz Ahmad, Jani Suomalainen, and Jyrki Huusko
Introduction 133
5G Design Principles and the Core Network 134
Security of Core Network 135
Overview of 5G Security Architecture 135
Security of Core Network Elements 137
Security of Interfaces/Protocols 139
UE and Network Authentication 141
Security of Emerging New Network Technologies 141
Security of Cloud Platforms 142
Security of SDN 142
Security of Network Virtualization 144
Discussion and Conclusion 146
Related Article 146
References 146
Further Reading 149
8 MEC and Cloud Security 151

Aaron Yi Ding
Introduction 151
5G MEC-Cloud Overview 152
Edge and Cloud Computing for 5G 152
Features and Synergies 153
MEC and Cloud Security in 5G 156
Threat Models 156
Security Challenges and Considerations for Integrating MEC
and Cloud to 5G 158
Open Research Directions 163
Conclusions 164
References 164
Further Reading/Resources 165
9 Security in Network Slicing 167

Pawani Porambage and Madhusanka Liyanage
Introduction 167
Network Slicing Architecture 168
Security Threats of NS High-Level Functional Roles 169
Security Considerations in Network Slicing and Related Work 171
Contents ix
Security Considerations in Network Slicing 171

State of the Art for NS Security 174
Future Research Directions 175
Artificial Intelligence 175
One Slice for Security 175
Context-Aware Security 176
Security Orchestration and Automation 176
Security-By-Design 176
Security-as-a-Service 177
Conclusions 177
References 177
Further Reading 178
10 VNF Placement and Sharing in NFV-Based Cellular Networks 179

Francesco Malandrino and Carla Fabiana Chiasserini
Introduction 179
Related Issues 181
System Model and Decisions to Make 183
Relevant Quantities for VNF Placement and Sharing 185
Objective and Constraints 186
The FlexShare Algorithm 186
Placement Decisions 187
Priority, Scaling, and Pruning 188
Reference Scenarios and Benchmark Strategies 189
Synthetic Scenario 189
Real-World Scenario 189
Benchmark Strategies 191
Numerical Results 192
Conclusions 194
Acknowledgment 194
References 195
Further Reading 197
11 Security Monitoring and Management in 5G 199

Introduction 199
Network Security Monitoring 202
Software-Defined Security 206
Network Slicing 207
Cognitive Network Security Management 207
Optimization Techniques 208
Conclusions 209
Related Article 210
References 210
Further Reading 213
x Contents
12 Security for Vertical Industries 215

Mehrnoosh Monshizadeh, Vikramajeet Khatri, and Iris Adam
Introduction 215
Cloudification of the Network Operators 218
MVNO Security in 5G Networks 219
Security Management and Orchestration 223
TaaS Deployment Security 225
Conclusions 226
References 227
Further Reading 228
13 Introduction to IoT Security 229

Anca D. Jurcut, Pasika Ranaweera, and Lina Xu
Introduction 229
Attacks and Countermeasures 231
Perception Layer 231
Network Layer 235
Application Layer 237
Authentication and Authorization 244
Authentication 245
Authorization 245
Authentication at IoT Layers 246
Other Security Features and Related Issues 251
The Simplified Layer Structure 251
The Idea of Middleware 252
Cross-Layer Security Problem 253
Privacy 254
Risk Mitigation 254
Discussion 255
Future Research Directions 257
Blockchain 257
5G 258
Fog and Edge Computing 259
Quantum Security, AI, and Predictive Data Analytics 260
Network Slicing 260
Conclusions 261
Endnotes 262
References 262
Further Reading 267
14 Privacy in the 5G World: The GDPR in a Datafied Society 269

Sebastiao Teatini and Marja Matinmikko-Blue
Introduction 269
The 5G World. What Sets It Apart from Previous Communication
Technologies? 270
Data Privacy and the GDPR 271
Contents xi
The Risks and Threats to Privacy in 5G 276

Concluding Thoughts 278
Related Article 279
References 279
Further Reading 280
15 Structural Safety Assessment of 5G Network Infrastructures 283

Rui Travanca, Tiago de J. Souza, and João André
Introduction 283
Discussion 285
Telecommunication Sector Background 285
Communication Structures Background 288
Safety Assessment of Communication Structures 289
Major Concerns to 5G when Compared with Pre-5G Networks 294
Conclusions and Recommendations 295
References 299
Further Reading 303
Index 305
xiii
Foreword
The Wiley 5G Ref: Security offers a stellar collection of articles selected from the
online-only Work, The Wiley 5G Reference. It aims to provide a solid educational
foundation for researchers and practitioners in the field of 5G Security and Privacy to
expand their knowledge base by including the latest developments in these disciplines.
Security and Privacy have become the primary concern in the 5G and Beyond 5G
(B5G) network as risks can have high consequences. The security and Privacy of 5G and
B5G networks can be broadly categorized into three main components. First, most of the
security threats and security requirements related to pre-5G mobile generations are still
applicable in 5G and B5G networks. Second, 5G will have a new set of security challenges
due to connectivity offered to new IoT-based vertical industries such as healthcare,
smart grid, smart transportation, smart industries, etc. Each vertical will have a new
set of security and privacy concerns due to increased users, heterogeneity of connected
devices, new network services, and new stakeholders. Third, network softwarization and
utilization of new technologies such as SDN (Software Defined Networking), NFV (Net-
work Function Virtualization), MEC (Multi-access Edge Computing), and NS (Network
Slicing) will introduce a brand-new set of security and privacy challenges.
However, most of the security models in pre-5G (i.e., 2G, 3G, and 4G) networks
cannot be directly utilized in 5G due to new architecture and new service. Also,
most of the security challenges in 5G are yet to be identified since 5G is under the
development phase. Moreover, the 5G and B5G security solutions must address the
new technical and performance requirements such as high scalability to connect
billions of devices, high throughput to support Gbps connectivity, and ultra-low latency
to support sub-millisecond range applications. Therefore, it is necessary to identify
these threats and integrate the security and privacy solutions already at the design
phase. Furthermore, the EU coordinated risk assessment of the cybersecurity of 5G
networks report1 published in October 2019 highlights several necessary processes or
configuration-related vulnerabilities that should be considered. For example, from the
perspective of a mobile network operator, a poor network design and architecture and
the lack of security requirements in the procurement process may lead to unwanted
exposure or a disruption of service.
In addition, present-day mobile networks suffer from many security limitations such
as securing only the perimeter, distributed and uncoordinated security mechanisms,
security functions tightly coupled to physical resources, lack of adaptation and inter-
operability, over-provisioned security mechanisms, scalability issues, vulnerability to
various IP based attacks, lack of visibility and high network monitoring overhead, and
xiv Foreword
unexpected privacy breaches. The introduction of centralized controllers with the

separation of the control and data planes, programmability, NFV, the introduction
of new network functions, and even introducing new stakeholders such as Local 5G
Operators (L5GO) are expected to solve the security and privacy limitations of current
telecommunication networks. On the other side, relying on a single controller creates
a potential single point of failure. Moreover, integration of smart and agile monitoring
and decision frameworks enabled via Artificial Intelligence (AI) are promising to tackle
these security challenges. The security techniques and schemes devised and imple-
mented for this massively connected and pervasive network structure will also have an
overreaching impact on B5G systems since these traits are expected to be apparent in
those systems. In that regard, AI-based resilience techniques, Machine Learning (ML)
driven cognitive and self-X network management techniques, and privacy management
for highly sensitive data running on B5G networks should also be considered.
Well-known experts in security and Privacy for the telecommunication network field
wrote the book you are about to read. It provides the methodologies, guidance, and
suggestions on how to deliver the possible ways of developing novel security and privacy
solutions to protect the 5G telecommunication networks from strengthening critical
infrastructures and novel research directions and open challenges that will encourage
future research.
The book introduces the security landscape of 5G, and significant security and pri-
vacy risks associated with the 5G networks. Then, the security solutions for different
segments of the 5G network, i.e., radio network, edge network, access network, and
core network, are discussed. Since 5G is developed based on network softwarization,
security threats associated with key network softwarization technologies such as SDN,
NFV, NS, and MEC are also presented in detail. Then, the security issues related to the
new 5G and IoT services are delivered. Finally, a detailed discussion on the privacy of
5G networks is presented by considering Datafied Society.
This book is another step in closing this educational gap. It is intended to provide addi-
tional learning opportunities for a wide range of readers, from graduate-level students
to seasoned engineering professionals. We are confident that this book and the entire
collection of selected articles will continue Wiley’s tradition of excellence in technical
publishing and provide a lasting and positive contribution to the teaching and practice
of security and privacy of 5G and beyond networks.
Dr. Madhushanka Liyanage

Section Editor
University College Dublin
Ireland
xv
List of Contributors
Iris Adam Carla Fabiana Chiasserini

Nokia Bell Labs Germany Politecnico di Torino
Stuttgart CNR-IEIIT
Germany Torino
Italy
Ijaz Ahmad
VTT Technical Research Centre of Noel Crespi
Finland Institut Mines-Telecom
Espoo Telecom SudParis
Finland Paris
France
Hirley Alves
6G Flagship Aaron Yi Ding
University of Oulu Delft University of Technology (TU Delft)
Oulu Delft
Finland The Netherlands
João André Silke Holtmanns

National Laboratory for Nokia Bell Labs
Civil Engineering Espoo
Lisbon Finland
Portugal
Jyrki Huusko
Shanay Behrad VTT Technical Research Centre of
Orange Labs Caen Finland
Caen Oulu
France Finland
Emmanuel Bertin Anca D. Jurcut

Orange Labs Caen School of Computer Science
Caen University College Dublin
France Dublin
Ireland
xvi List of Contributors
Aapo Kalliola Yoan Miche

Nokia Bell Labs Nokia Bell Labs
Espoo Espoo
Finland Finland
Vikramajeet Khatri Rupendra Nath Mitra

Nokia Bell Labs Finland The University of Edinburgh
Helsinki Edinburgh
Finland UK
Gabriela Limonta
Mehrnoosh Monshizadeh
Nokia Bell Labs
Nokia Bell Labs France
Espoo
Nozay
Finland
France
Madhusanka Liyanage
and
Centre for Wireless Communication
University of Oulu Aalto University
Oulu Helsinki
Finland Finland
and
School of Computer Science Montimage
University College Dublin Paris
Dublin France
Ireland
Ian Oliver
Maode Ma Nokia Bell Labs
Nanyang Technological University Espoo
Singapore Finland
Singapore
Diana P.M. Osorio
Francesco Malandrino Federal University of São Carlos (UFSCar)
CNR-IEIIT Center for Exact Sciences and
Torino Technology
Italy São Carlos
SP
Mahesh K. Marina
Brazil
The University of Edinburgh
Edinburgh and
UK
6G Flagship
Marja Matinmikko-Blue University of Oulu
University of Oulu Oulu
Oulu Finland
Finland
List of Contributors xvii
Alican Ozhelvaci Tiago de J. Souza

Nanyang Technological University American Tower of Brazil
Singapore São Paulo
Singapore Brazil
German Peinado Jani Suomalainen

Nokia VTT Technical Research Centre of
Warszaw Finland
Poland Espoo
Finland
Pawani Porambage
Centre for Wireless Communication Sebastiao Teatini
University of Oulu University of Oulu
Oulu Oulu
Finland Finland
Pasika Ranaweera Rui Travanca

School of Computer Science DIGAMA Engineering Consultants
University College Dublin Lisbon
Dublin Portugal
Ireland
Lina Xu
José D.V. Sánchez School of Computer Science
Department of Electronics University College Dublin
Telecommunications and Information Dublin
Networks Ireland
Escuela Politécnica Nacional
Quito
Ecuador
1
5G Mobile Networks Security Landscape and Major Risks

Rupendra Nath Mitra and Mahesh K. Marina
The University of Edinburgh, Edinburgh, UK
Introduction
Mobile communication networks since its emergence in the mid-1980s have been
rapidly transforming our everyday life. Beginning with a first-generation analog voice
communication system on the go, the fourth generation of the mobile networks cur-
rently guarantees high-speed Internet and ubiquitous connectivity among numerous
smart devices. The present-day cellular networks cater to diversified services such
as banking, health, governance, e-commerce, education, and mobile TV, to name a
few (Liyanage et al. 2017). Yet today’s mobile network infrastructure requires another
quantum leap to its next-generation called the 5th generation (5G) to fulfill the growing
demand of higher data rates in mobile Internet and the need for extremely low-latency
communication links, enabling futuristic applications such as mission-critical commu-
nications, augmented reality, self-driving cars, virtual reality, and so on (Qayyum et al.
2019).
The 5G mobile networks are not just a technologically advanced version of currently
deployed 4th generation (4G) systems but a completely new telecommunication
paradigm powered by software-defined networking (SDN), network function virtu-
alization (NFV), and cloud computing. The adoption of these new technologies in
telecommunication system design brings unprecedented network agility and offers
service providers the ability to implement 5G infrastructures incredibly rapidly, and
that is too at a low cost. However, along with the unmatched network flexibility and
advantages mentioned above, 5G networks bring in an increased concern for security
and privacy. The unrestricted usage of open-source software and machine learning
techniques, provision of virtualized services over shared physical infrastructure,
connecting almost everything, and finally, the softwarization of the telecommunication
network functions increase the cybersecurity threat to 5G networks (Belmonte Martin
et al. 2016).
5G will play a pivotal role in building a networked society because critical services
such as public transportation (i.e. railways and city transports), energy sectors, national
security, governance, and healthcare, which currently operate on exclusive networks,
will heavily rely on the pervasive 5G infrastructures. Therefore, any adversary may
launch malicious attacks to the 5G networks and, if successful, can bring large-scale
The Wiley 5G REF: Security. Edited by Rahim Tafazolli, Chin-Liang Wang, Periklis Chatzimisios and Madhusanka Liyanage.
© 2021 John Wiley & Sons Ltd. Published 2021 by John Wiley & Sons Ltd.
2 1 5G Mobile Networks Security Landscape and Major Risks
catastrophe to the society (Kumar et al. 2018). So, the hasty adoption of open-source
software, authentication protocols, large-scale machine learning (ML) models, and
multi-tenant public cloud-based network operations need to be overseen and scruti-
nized formally before being integrated to the 5G infrastructure. A systematic study on
privacy-preserving techniques and policies in 5G securing it from innumerable cyber
threats is essential and timely (Hodges 2019).
In this article, we provide a fresh insight into the end-to-end (E2E) 5G security threat
landscape, analyze the recommendations to secure the 5GS, identify evolved attack vec-
tors, recognize the vulnerabilities, and categorize the major risks to highlight the crucial
gaps currently prevailing in the way of 5G to become a trustworthy ecosystem. We also
introduce the research groups working toward a safe and secure 5G network infrastruc-
ture and briefly review their lines of works.
4G to 5G: A Paradigm Shift

Today’s cyber world is well connected through physical transoceanic cables, numer-
ous satellite links, long haul optical or unguided media, wide-area connectivities, and
local wireless and wired networks. Traditionally, end users connect to the worldwide
cyber networks using user equipment, typically a general-purpose computer or a smart-
phone through the mobile network’s radio access network or the locally available access
network. With the advent of smart devices, exponential growth has been projected in
the number of connected Internet of Things (IoT) in the coming years, as illustrated
in Figure 1. With the growing demand for staying always connected everywhere and
accessing high volume traffic on the go, cellular data service emerged as the predominant
way to provide ubiquitous connectivity to the users. Thus, 5G network is designed in a
very different way than its 4G counterpart so that 5G can cater to the massive amount of
connectivities to numerous futuristic services and many smart IoT devices for billions
of its subscribers, providing high-speed cellular broadband (University of Surrey 2017).
5G System Architecture
5G architecture is proposed to be fundamentally different than the network architecture
of 4G because 5G necessitates backward compatibility and an agile, modular architec-
ture for an expeditious low-cost deployment and smooth technical augmentation in
5
0
202
202
5
201
15.41 B
30.73 B
75.44 B
Figure 1 The projected boom in the number of connected gadgets (Statista Research Department
2016).
the future. The present-day 4G network inherits architectural features from its previ-
ous generations of traditional mobile networks. The 4G network has three segments,
the user equipment (UE), the Radio Access Network (RAN) that connects to the UE
over the air interface, and Evolved Packet Core (EPC) networks that connect to the
RAN through transmission networks. However, 5G system (5GS) architecture has UE,
multifaceted radio access networks called New Radio (NR), Multi-access Edge Cloud
for reduced network latency, and the cloud-native 5G core networks (5G-CN) (Arfaoui
et al. 2018; Belmonte Martin et al. 2016; Ericsson 2018). A piece of mobile equipment
(ME) equipped with a universal subscriber identity module (USIM) constitutes the UE
by which the users can access the 5G network over the air interface.
The important entity of NR is gNB, which hosts three main functional units called
Radio Unit (RU), Distributed Unit (DU), and Centralized Unit (CU). Thus, NR becomes
a flexible logical architecture, unlike 4G RAN, which has a monolithic architecture. 5G
radio network (RN) can be deployed over the serving cell site and mobile edge server
premise in different combinations of functional units as required by the application sce-
nario. For example, only RU can be installed in the cell site with minimum installation
cost and complexity, and DU-CU can be installed on the edge site (in a local exchange
office) to build a latency tolerant access network. In contrast, a DU split from the CU
can be installed in the cell site associated with RU for improved latency but at a higher
installation cost and complexity. The latter is a lower layer split of RN functions, and
the prior topology is an example of a higher layer functional split. DU-CU could also be
integrated with the RU in the cell site for ULLC in the case of industrial automation.
5G is meant to coexist with legacy networks as well as stand-alone network
architecture. Therefore, the 5G-CN has two different implementable provisions,
stand-alone (SA) and non-stand-alone (NSA) modes. Besides, 5G-CN implements
the network functions much like a 4G EPC does (3GPP 2019). Still, 5G-CN is defined
as a Service-Based Architecture (SBA) framework for increased modularity and
function reusability. 5G-CN hosts various network functions (NFs) interfaced among
them instead of various core network entities of a traditional mobile network. SBA
architecture applies only to interfaces among control plane (CP) functions within the
5GC. The control plane network functions of the 5G-CN interact using service-based
interfaces (SBIs). This functional core architecture helps an implemented technology
in the system to evolve and makes it seamlessly replaceable by its suitable future coun-
terparts. 5G-CN brings more scalability, flexibility, and upgradability in the network
architecture, enabling the operators to build and maintain the network at a low cost.
Cloud-based core network functionalities and NFV become the significant enablers of
5G mobile network architecture because of the SBA and the network slicing.
Figure 2 looks into a 5G network from a functional perspective, where the cloud-native
5GC NFs interact among themselves over defined interfaces. The main NFs are shown
in the diagram and discussed below.
The Network Functions Repository Function (NRF) registers and discovers NF ser-
vices. An NF identifies other NFs through NRF.
The Unified Data Management (UDM) performs significant functionality of HSS from
EPC. It is responsible for user identity management, subscription management, and gen-
eration of AKA credentials. The Authentication credential Repository and Processing
Function (ARPF) retains the authentication credentials. Only the Subscription Identifier
3rd Party NEF AF
UDM +
NSSF PCF ARPF +SIDF
NRF
Non-3GPP
access Nnssf Nnef Npcf Nudm Naf Nnrf
network
SBI SEPP
Namf Nsmf Nausf
Foreign network
AUSF
N2 AMF
M3lWF +
SEAF SMF
Control plane
Network slicing
N1 N2 N4 (Does not include RN slicing)
N3 N6
UPF
Uu
UE gNB User plane Data network
NR (RU+DU+CU)
Figure 2 5G-CN SBA representation as specified by 3rd Generation Partnership Project (3GPP) (3GPP
2019).
De-concealing Function (SIDF) decrypts a Subscription Concealed Identifier (SUCI) to

obtain its long-term identity, namely the Subscription Permanent Identifier (SUPI).
The Policy Control Function (PCF) is synonymous with PCRF of the EPC framework.
It provides policy decisions to control plane functions.
The Network Exposure Function (NEF) is a new network function created for 5G-CN
and was not present in 4G EPC. It ensures secure information exchange to and from an
external application to 3GPP core and works like an exposure function.
The Application Function (AF) replicates the functionalities of AF from EPC archi-
tecture.
The Authentication Server Function (AUSF) is the authentication server that com-
pletes the Home Subscriber Server’s (HSS) functionalities of an EPC along with UDM.
The AUSF keeps a key that is derived after authentication for reuse in case of simulta-
neous registration of a UE in different access networks.
The Access and Mobility Function (AMF) is a subfunction of the Mobility Manage-
ment Entity (MME) of 4G EPC. AMF tackles all the connection and session information
from UEs or RAN and performs connection and mobility management tasks. The Ses-
sion Management Function (SMF) takes care of the session management tasks. The
AMF is collocated with the SEcurity Anchor Function (SEAF) which permits the secure
introduction of future functions.
The SMF performs the interaction with the decoupled data frame and also acts as
an Internet Protocol (IP) address manager and a Dynamic Host Configuration Protocol
(DHCP) server.
The Network Slice Selection Function (NSSF) offers services to the AMF and NSSF in
a different Public Land Mobile Network (PLMN) via the Nnssf service-based interface
within 5G-CN. NSSF is responsible for network slice selection and management.
The Non-3GPP Interworking Function (N3IWF) is similar to the ePDG (for Evolved
Packet Data Gateway) in the 4G EPC. N3IWF allows the UE to access 5G-CN
through untrusted non-3GPP access networks. It is responsible for establishing secure
communication between UE and 5G-CN and routing messages outside the 5G RAN.
However, 3GPP does not categorize any non-3GPP technologies as untrusted. This
decision is left on the operator.
The User Plane Function (UPF) is the functional point between the mobile network
and the Data Network (DN). UPF facilitates Control and User Plane Separation (CUPS)
for non-stand-alone (NSA) 5GS which allows scalable and efficient management of
packet traffic in the mobile edge.
The Security Edge Protection Proxy (SEPP) is a new NF called Security Edge
Protection Proxy introduced in 5GS by 3GPP SA3 to ensure secure signaling traffic
between different operator networks. N32 interface between the SEPPs is designed to
protect sensitive data flowing through it and to ensure secure authentication between
SEPPs.
The NSA mode is an intermediate step toward a full 5G network from the legacy net-
work. In this configuration, 5G gNB facilitates the access network by carrying user plane
(UP) traffic along with 4G LTE eNB but connects to the 4G EPC (and not 5G-CN) over
standard S1-U interface. The control plane traffic still routes through the 4G network. In
other words, in NSA mode, 5G access network increases the capacity to the existing 4G
services as a secondary serving cell being a slave to the 4G network which controls the
5G access network as the master. Since NSA mode does not demand the all-new 5G-CN
but still capable of offering a 5G experience to the subscribers, telecom operators adopt
NSA configuration as their first step to commercial 5G network.
On the other hand, SA mode demands 5G NR be connected to the 5GC; hence, it
is the true 5G only network capable of offering low-latency mobile broadband service.
5G-CN is seen as the common core to 5G NR, 4G RAN, and any other type of access
network in the future.
From the above description, we can understand that a majority of the 5G-CN NFs
are created by refactoring the 4G EPC functions, MME, SPWG, HSS, and PCRF. At
the same time, a set of brand new NFs such as NSSF, N3IWF, SEPP, or the SBA itself
are introduced for enhanced network programmability, agility, and security. A full CP
and UP separation in the 5G-CN is another unique trait where UPF processes UP data,
and all other nodes tackle CP functionalities, enabling separate scale-up of CP and UP
operations.
Salient Features of 5G Network

5GS is a step toward the converged network of IT and telecommunication infrastructure
for the future. Thus, 5GS has several new features that the previous generations of tele-
com networks did not have. From a security perspective, 5G being a telecom network
more similar to the IT infrastructure opens up a wider boundary of cyberattacks on the
new unfortified sides of the 5G network (Shaik et al. 2015). The unique architectural
amendments are briefly introduced as follows (5G Americas 2019; Hodges 2019):
• New physical layer: 5GS physical layer is significantly different from that of LTE. The
use of a massive number of active antennae for efficient beamforming, high-frequency
millimeter-wave signals for higher data rate over the air, and nonorthogonal multi-
ple access for higher spectral efficiency makes 5G new radio conspicuous from other
radio communication systems (3GPP 2018).
Slice 1: Public transport

Mission critical
communication Orchestratoin &
Slice 2: Virtual reality
Ultra high BW
management
Slice 3: Autonomous vehicle layer
Ultra low latency
High BW e
WWW Servic rs
ente
Sensitive data et datac
Intern
cloud
Low energy, low core
port
AN Trans rk VNFs
BW WL cell serve
r
netwo Application cloud
Pico AN Edge d
Industry verticals with GR cess clou Physical infrastructure
th ic 4 RAN Ac ork
different resource o n oli le 5G netw
M le x ib
requirements F
Figure 3 Schematic diagram of network slicing in an evolved network architecture of 5G coexisting

with legacy networks.
• Multiaccess Edge Computing: 5G enables operators to host latency-critical services

closer to the end user through the Multiaccess Edge Computing (MEC) capability.
MEC helps to reduce the traffic load on the transport network and meet the Service
Level Agreements (SLA) of an ultra-low-latency service by local hosting.
• Network Slicing: E2E network slicing is a significant feature of the 5G network. A
network slice is an optimized set of network resources that enables a specialized
service (Foukas et al. 2016). In principle, any given kind of slice of an operator can
interconnect with the same kind of slice from another operator if the slice-sharing
policy requirements are met. The NSSF enables the slice selection procedure. Figure 3
schematically describes the E2E network slicing over a 5G network infrastructure
layer. Network slicing can be described as a horizontal network virtualization
technique that offers the flexibility to mobile operators to logically separate its
different users with different SLAs. Mobile virtual operators can borrow their virtual
network infrastructure in a pay-as-you-go fashion where E2E network slicing is in
operation.
• Cloud-native architecture: In principle, cloud-native architecture promotes software
services that are broken down into a compact, more convenient pieces of constituent
software, which is achieved using a microservice architecture. 5G-CN adopts a
cloud-native architecture so that each piece of such microtechnologies can be indi-
vidually scaled, reconfigured, and upgraded. The actual cloud-native core network is
a unique feature of 5G.
• Multi-RAT connectivity: 5G supports a UE to stay connected to more than one 5G
eNB, which also includes different Radio Access Technology (RAT) such as Wi-Fi.
In such scenarios, the connected gNB will act as a master node and the other as
a secondary node. This unique feature of 5G requires new security mechanisms
and procedures to protect user traffic between UE and master and secondary
nodes.
• Support for non-3GPP access: Apart from 3GPP access networks, 5G-CN opens its
door to the non-3GPP access networks with enhanced security function defined by
N3IWF. A UE can be served through Wi-Fi like access networks directly connected
to the 5GC for reduced latency. The provision of such many non-3GPP accesses to
the 5GC requires more robust authentication than that of 4G ePDG.
The Threat Landscape and Security Roadmap

5G network will entice an unprecedented number of cyberattacks due to its pervasive
reachability into high-value targets such as governmental and financial organization, its
capability to serve a wide variety of industry verticals, and its accessibility to a mas-
sive amount of user data. Previous generations of the mobile network have seen several
malicious attacks (Rafiul Hussain et al. 2019), (Rupprecht et al. 2018), but 5G will face
more aggravated threats. The attackers have continued to grow with time with inexpen-
sive yet smarter AI-based attack tools, innovative side-channel attack techniques, and
a plethora of malicious software capable of evading intrusion detection systems. The
number of attacks that 5GS will experience is an order of magnitude higher than that of
its previous generation counterparts (Belmonte Martin et al. 2016).
Before we further explore the different aspects of the security threats on 5G, a few
closely related technical vocabularies need to be clarified for a better understanding of
the reader. Table 1 defines some basic cybersecurity terms which have occurred fre-
quently in this article after that.
5G Network Threat Surface

In the past few years, a broad set of attacks on GSM, UMTS, and LTE systems have
been reported, which threatened user privacy, data secrecy, and business integrity.
Rupprecht et al. analyzed the LTE layer two security vulnerabilities and designed
attack vectors that exploited the fact that LTE user payload is encrypted in counter
mode (AES-CTR) but not integrity protected to modify user data (Rupprecht et al.
2019). Hussain et al. have shown the security loophole in downlink paging occasion
and exploited the weakness to leak victim’s soft identities and coarse-grained location
(Arapinis et al. 2012). So, the 5G defense mechanism needs further strengthening by
underlying E2E network monitoring, reimplementing Artificial Intelligence (AI)-driven
Table 1 Definitions of some common cybersecurity terms.
Vulnerability A weakness or lacuna which can be potentially exploited to damage the system or to
have unauthorized access to the system
Threat Anything that can cash in on the vulnerabilities to destroy or paralyze the system. A
threat can result from unintentional accidents as well as from a planned attack
Attack A planned activity that exploits security vulnerabilities and threatens the system by
obtaining unauthorized access or causing disruptions in system operation
Risk A composite factor which is a function of vulnerability, threat, and the amount of
damage caused. If a threat breaks in exploiting an existing vulnerability, then how
much potential damage it may cause to the system or in general to the business is
called the risk associated with the vulnerability and threat. Likelihood of occurrence
of the event is also another constituting factor of risk
Trust A psychological confidence in our general life, but in the digital world, trust is often
described as a binary model. Either one has complete trust or no trust in a digital
system
Privacy The confidentiality of the user identity and concealment of sensitive data and
personal information that is often sent over a network to which a user is connected to
Channel sniffing
Jamming
User ID, Port scanning
Malware USER APP TCP SYN Flood
Botnets IMSI catching
Spyware DDoS Application service
Ransomware OS MitM attack data centers
Phishing Non-3GPP Malicious access
access to core
CPU
SCA User data stealing
Firmware hacking PHY NIC Non-3GPP access to 5GC
PHY layer attacks
3GPP access
USIM
ME + USIM 5G UE gNB
N3IWF
Adversarial attacks
on Machine Learning Autonomous vehicles 5G gNB
S6a
S1 HSS Gx PCRF
5G gNB www
Social engineering MME
Smart home S1-U
WiFi hacking SGW-CP PGW-CP
PGW-UP Internet
SGW-UP SGi
5G gNB
5GC after CUPS
Zero-days IoT Air interface Malicious access Foreshadow
IoT Malware (Uu) to MEC server VM attacks
DDoS Backhaul sniffing Slice tampering
IoT to Core integration failure
DDos, Dos
Vulnerable authentication protocols
Device space Access network Transport network Core network
Figure 4 Evolved security threat landscape for 5G network.
intrusion detection systems, updating authentication protocols, and fixing security

bugs in its previous versions (Amine Ferrag et al. 2018). In this section, we present a
pragmatic view of the evolving 5G threat space by zooming in into the transfigured
network architecture and interfaces.
Vulnerabilities of the 5G telecommunication ecosystem are spread all over the net-
work (Ahmad et al. 2017). As elucidated in Figure 4, the UE, the air interface between the
UE and the base stations, the physical and application interfaces, and the core networks
all can be quietly scanned for exploitable vulnerabilities by hackers.
Security Threats to the UE: The UE has been a soft target by the hackers for quite a
long time. Mobile operating systems, for instance, Android, have been reported with
stealthy interapplication data leakage. In the 5G scenario, a plethora of malware along
with countless phishing websites and nearby Bluetooth devices target end-user devices
with vicious objectives (Antonioli et al. 2019). Wu et al. (2019) reported an extensive
analysis of android open ports that revealed vulnerability patterns in open ports of popu-
lar apps, including Skype, Instagram, and Samsung Gear. Hardware chipsets and sophis-
ticated sensor arrays can often be tampered to steal user data, and the high-speed 5G
Internet connectivity to the devices expedites the unauthorized data transfer, leaving
the users clueless about the harm to them.
The 5G architecture accommodates various use cases and business verticals with a
wide variety of SLAs. The threat surface for the use cases which includes self-driving
vehicles, low-energy low bandwidth IoTs, ultra-low-latency tactile Internet applica-
tions, and high bandwidth Virtual Reality (VR) applications, to name a few, is unique
in many ways. For instance, the machine learning models that control the behavior of
an autonomous car are vulnerable to the plentiful of adversarial attacks (Qayyum et al.
2019; Cao et al. 2019; Usama et al. 2019; Usama et al. 2019). Billions of IoT apparatus
are often compromised to create a large-scale network of infected machines called
botnet, which can then perform baleful activities such as Distributed Denial of Service
(DDoS) attack. Shaik et al. demonstrated DoS attacks against UEs by exploiting the fact
that certain tracking area update messages sent from the LTE network are accepted by
UEs without any integrity protection (Shaik et al. 2015).
Security Threats to the Air Interface: The air interface being open to everyone
undergoes a massive number of maleficent attacks day in and day out. Hence, securing
communication over the air is the most challenging. The Man in the Middle (MitM)
attack is one of the commonly found attacks that happen in the air interface by
intercepting or decrypting the victim’s data surreptitiously. Another common threat
is intentionally jamming the physical channel with a transmission of a high-power
signal of the same frequency as that of the cellphones, which outmuscles the phone’s
signal causing a communication lapse. International Mobile Subscriber Identity (IMSI)
catching has been a severe privacy threat to the subscribers of the previous generation
telecom networks where the downlink paging messages are sniffed for side-channel
data leakage and identify or track a connected device (Rafiul Hussain et al. 2019).
Jover reported a DoS attack against the LTE EPC using a compromised UE or another
eNodeB that sends enormous number of attach request messages to the EPC to
eventually choke the service (Jover 2013).
However, the new 5G standard enhanced the privacy safeguards against such
attacks by frequently refreshing and encrypting the user identifier called Subscription
Concealed Identifier (SUCI) and dynamically adjusting the paging timings. Although
fundamental security mechanisms of the entire telecommunication system depend on
cryptographic algorithms and security protocols in the bit level in the digital domain,
the need for another layer of secrecy of the propagation channel is often required from
the information-theoretic perspective, which is called the security of physical layer.
The RAN and the mobile edge servers for 5G are crucial for ensuring ultra-low-latency
services. A rouge base station attack, where a false base station convinces the end users
to get attached to it instead of a bona fide gNB, can severely downgrade the service expe-
rienced by the users. On the other hand, the transmission networks that are responsible
for bringing the aggregated mobile traffic to the 5GC can be passively sniffed for possible
UP or CP meta-data.
Security Threats to the Core Networks: 5G packet core, which deploys and manages
large-scale virtual machines for network functions virtualizations and slice manage-
ment, is susceptible to information leakage through covert channels between various
instances of virtual machines and hence vulnerable to attacks trying to gain access to
the system-level information of the whole infrastructure (Michalopoulos et al. 2017).
Since the network slicing does not require strict hardware separations, shared hardware
resources such as cache memory can be exploited to gain side-channel access.
5G-enabled end-user devices can connect to the 5G-CN through the non-3GPP access
network via a network function called N3IWF. The securely encrypted tunnel between
the UE and the N3IWF is vulnerable to cyber threats if the lightweight encryption fails to
encounter brute-force attacks often faced by Virtual Private Network (VPN) or Secure
Shell (SSH) tunnels over insecure Internet.
It has been well known that Signaling System 7 (SS7) and Diameter protocol, which
have been widely used in wireless and wired telecommunication networks for signal-
ing in call processing, value-added services, traffic routing, and information exchange,
have exploitable vulnerabilities (Rao et al. 2015). The major weakness of SS7, which has
been in use until 3G network systems, had a lack of encryption. Current 4G systems
use an IP-based improved signaling protocol called Diameter, where the encryption
is compulsory in principle but often not practiced by the service providers within the
network. 5GS specifications proposed enhancement in the procedure of accepting the
resource reservation requests using an HTTP/XML-based interface from other services.
However, the PCF maintains traditional Diameter protocol to exchange information
with AF, keeping the vulnerability alive in the 5GS.
Security Threats to the Application Servers: The conventional Internet and the appli-
cation servers, external to the 5GS, remain vulnerable to the full range of cyber threats
ranging from Domain Name Server (DNS) tunneling to DDoS attacks such as Trans-
mission Control Protocol (TCP) Synchronize (SYN) flood attack (Chen et al. 2016). 5G
subscribers will experience poor application responsiveness or no service at all if the
application server is under such an attack, no matter how ultra-high-speed 5G connec-
tion they are subscribed to Wu et al. (2018) and Vairam et al. (2019).
5G network architecture has a new set of threat vectors, which is exceptionally chal-
lenging to be tackled by the 5G system designers. Network softwarization has merged
the telecommunication networks with Information Technology (IT) infrastructures
and thus become a great contributor to the broad range of 5G security threats that we
are facing today. To mitigate the threats to 5GS, 3GPP has published recommendations
for security and privacy procedures that are open to all for further inspection. In the
following section, we investigate the 3GPP security recommendations to secure 5G
networks.
Inspecting 3GPP Security Proposals

The 3GPP that comprises seven Standards Development Organizations (SDOs) from
across the world is responsible for developing the technical specifications for mobile
communication systems starting from 3G onward. The relevant partner SDOs then con-
vert the specifications into proper deliverables, which becomes the standards. Accord-
ing to 3GPP announcements, 5G will be spelled out in two or more phases starting
from the Rel-15, which is the first phase of technical documentation of 5G (3GPP 2019).
Technological Specification Group-Service and System Aspects 3 (TSG-SA3), a tech-
nological specification working group within 3GPP that specifies and standardizes the
security architecture, privacy requirements, and relevant protocols for 5G, has recently
published specifications where they mentioned the security procedures for the 5G core
and the 5G NR and in general 5G security architecture (ETSI 2019). 3GPP Release 15
(R-15) depicts the 5G security as a domain-based architecture that serves both SA and
NSA modes of 5G operations.
• Network access security domain includes the set of security requirements that ensure
a UE to authenticate and access the 5G network through both 3GPP and non-3GPP
access networks. Access security measures are responsible for securing the most vul-
nerable part, the RAN, where a UE exchanges all forms of data with the network over
the air interface.
• Network domain security is the set of security features that help the network nodes to
communicate the user and control plane data securely among themselves.
• User domain security ensures a user to have secure access to the mobile equipment.
• Application domain security offers reliability so that user applications and providers’
applications interact securely.
Table 2 Key 5G security recommendations by 3GPP.
Requirements of UE
• UE should be capable of exchanging encrypted messages with gNB using the ciphering algorithms
NEA0, 128-NEA1, and 128-NEA2, as presented in R-15
• The UE must support 5G-GUTI, an 80-bit-long unique identifier allocated by the AMF to the UE
during network registration to keep the subscriber’s IMSI safe
Requirements of gNB
• gNB must support the encryption and ciphering algorithms a UE is required to have
• Commissioning gNB should be done through secured O & M systems so that no attacker can
stealthily modify the gNB configuration
• Clear text key storing is strongly discouraged. A secured and trusted environment should be used
to store sensitive user data and to execute privacy-preserving algorithms
Requirements of core
• Network operators are required to divide the network into several trust zones so that the
subnetworks of different operators lie in the different trust zones
• Message exchanges among SBA NFs should be confidential and done only after successful
authentication
• E2E core network interconnection security solution should be activated
• SBA domain Security is the set of security procedures that enable the NFs of the SBA
architecture to exchange messages.
• Visibility and configurability of security is vital to let the user know if a security feature
is turned on and in use or not.
3GPP documented the security requirements on the UE, gNB, and the core networks
toward a more transparent and trustworthy ecosystem (Surridge et al. 2018). Table 2
highlights a few key security requirements as prescribed by the 3GPP. Security require-
ments of the 5G physical layer are not specified in the R-15 security proposals, and
security of narrowband IoT devices, vehicle-to-everything services, codec, and stream-
ing techniques are to be specified in release 16 due in June 2020.
Security Research Groups and Visions

5G security enablers are proposed, developed, delivered, and maintained by a handful
of technical working groups. Within the 3GPP, Technical Specification Group Service
and System Aspects (TSG-SA) take care of the overall system architecture, and service
specifications based on the 3GPP recommendations and the SA3 working group
are exclusively responsible for security and privacy of 5G. Similarly, the Technical
Committee (TC) Cyber is the technical group within ETSI responsible for designing
reliable cybersecurity solutions and is an active contributor to 5G security and privacy
deliverables. Another such group is 5G-Ensure that belongs to the 5G Infrastructure
Public–Private Partnership (5GPPP), which is a joint initiative between the European
Commission (EC) and the European Information and Communications Technology
(ICT) industry to deliver 5G solutions. Table 3 briefs the security goals of the above-
mentioned working groups along with other prominent technical working groups
working in 5G security and privacy area and their primary responsibilities to enable a
safe and trustworthy 5G network.
Table 3 A synopsis of 5G Security Research Groups and deliverables.
3GPP-SA3 SA WG3 is responsible for specifying security and privacy in 3GPP system’s
architectures and protocols and defining cryptographic algorithms for
specifications
ETSI TC Cyber TC Cyber works on quantum-safe cryptography and cybersecurity for
national safety and ensures privacy for enterprise and individual data
5G-ENSURE 5G-ENSURE sec is responsible for realizing the 5G security specification,
Security development, and documentation of the challenges and needs for 5G security
(Morant et al. 2016)
NGMN 5G SCT SCT focuses on security issues raised by NGMN, revision, and updation of
deliverables by security work stream
ETSI ISG MEC Industry Specification Group on Multi-access Edge Computing creates
standardized, open environment that allows flawless integration of various
applications from third parties across different vendors’ Multi-RAT Edge
Computing (MEC) platforms
STIX Community STIX Community develops a structured language called STIX for formal
description of new cyber threats for efficient information sharing and analysis
in a standard way
GSMA FAS group The FAS group analyzes the global fraud and security threat landscape and
predicts risks for network operators and subscribers
Trusted TCG is a nonprofit organization which develops, defines, and promotes
Computing Group vendor-independent, open industry specifications for interoperable trusted
computing platforms
Why Securing 5G is Challenging?

Identifying potential cybersecurity threats and providing prudent solutions to resolve
them is not a whole new area of research in computer networking. However, with the
advent of 5GS and its pervasive revolutionary nature to connect anything anywhere,
the scope of possible risk has gotten more extensive. The evolved threat space brings
a fresh and unique set of challenges for cybersecurity experts in securing the 5GS and
establishing it as a trustworthy ecosystem (Siddiqi et al. 2017). This section summarizes
the vital challenges of securing a hyperscale pervasive network such as 5G.
Billions of Hackable IoT Devices

New vulnerabilities are contributed significantly by billions of insecure smart devices,
which are tiny computers equipped with high-end sensors. These devices give rise to the
massive 5G IoT traffic (Salman et al. 2017). However, these small devices are often hack-
able by side-channel attacks, exploiting software security weaknesses, and doing reverse
engineering. Once an attacker manages to get access to the device, he can virtually do
many malicious activities to capture or modify sensitive user data stealthily and can even
install unwanted software for continuous unsolicited user activity monitoring. Thus,
IoTs accessing 5G networks open up more point of entries to hack into subscribers’
privacy domain.
Many attacks on IoT devices are known as zero-day attacks. Zero-day attacks
received the name from the number of days the device developers have known about
the vulnerabilities (Palani et al. 2016). Several zero-day attacks have been reported with
speculated fix time as high as 4 months, which is enough to bring disastrous loss to the
user or the network by an attacker. Not just attacks, interactions between coexisting
IoT applications may also lead to unsafe system behavior. For instance, an application
that turns the garage lights on detecting the owner’s car may interact with another
application that turns off lights when it detects higher power consumption. Another
popular way to attack a network is called “botnets,” which is essentially hacking a weak
IoT and then using them to paralyze the network or steal user data. Through large-scale
measurement studies, Herwig et al. (2019) showed how IoT botnets compromise other
IoT devices, and what countries are susceptible to botnet attacks. They detailed the
analysis of Hajime, a new peer-to-peer IoT botnet that targets different processor archi-
tectures such as ARM (Advanced RISC Machine) and MIPS (Million Instructions Per
Second)-based devices. When attackers take control of several IoT devices connected
to 5GS, they can generate a massive amount of service requests than the network is
designed for and thus initiate a DDoS attack. Due to the high download speed of 5G,
stealing user data and network information by an attacker having illegal access to it
becomes much faster than ever.
The Convergence of IT and Telecom Infrastructure

5GS inspired the telecom network to merge with IT infrastructure by virtualizing
high-level network functions traditionally carried out by dedicated physical entities.
Network functions are pushed to the cloud of connected servers throughout the
network. SDN, NFV, and cloud computing are the key enablers of the 5G network
toward a programmable, scalable, all IP infrastructure for voice and broadband
(Blanco et al. 2017). Schneider and Horn (2015) pointed out that due to a flat IP-based
network architecture, cyberattacks such as IP spoofing and port scanning can harm
the 5G network if not appropriately secured from the very beginning. Moreover, in
cloud-native computing architecture, user information is stored, processed, and shared
by many colocated services following techniques such as replication, distributed file
synchronization, and controlled data flow, to name a few. However, a few of these
techniques only have intrinsic security features (Akhunzada et al. 2015; He et al. 2016).
A recent contribution in network systems research explicates that the public cloud for
implementing 5GC functionalities is feasible (Nguyen et al. 2018), although another set
of security research reveals that the data leaks among the virtual machines are quite
possible due to the lack of hardware isolation.
Open-source Softwarization
5GS standardization is largely implemented by open-source software alliances
such as Openair Interface (Open Air Interface 2017) along with many propri-
etary vendor-specific implementations. Small-scale implementations often opt for
open-source software implementation to keep costs low. The advantage of using an
open-source software suite is that anybody from the community can review the codes
and flag potential bugs. Many reviewers can report those bugs so that the vulnerabilities
can be detected early for patching.
On the other hand, the National Vulnerability Database (National Vulnerability
Database 2019) publicly lists recent exploits, which could be potential targets by the
attackers. Another risk of using open-source software modules at enterprise scale is

sluggish development practices (such as copying code from unreliable sources) and
slow process of security patching. Hence, it is indeed a challenge to secure 5GS, which
mainly adopts several open-source software (Liyanage et al. 2016).
AI vs AI
5GS adopts a massive number of third-party services, network management and
orchestration system, and intrusion detection systems that unleash the power of
machine learning, which itself is not secured enough (Marino et al. 2018; Barreno
et al. 2006). Adversarial machine learning has recently gained popularity, and it is well
recognized now that machine learning models are vulnerable to adversarial attacks. In
the 5G context, AI and its subfields such as machine learning and deep learning have
been adopted to accomplish a variety of tasks, including resource management, carrier
sensing, cross-channel learning, user requirement profiling, and anomalous traffic
detection for cyber defense.
On the other hand, machine learning techniques are increasingly getting popular
also among hackers to initiate smarter and faster yet low-cost attacks. Hackers can
use publicly available AI tools to generate fake images or videos to fool users. For
instance, Deepfake can produce a video that contains words on a celebrity’s mouth
that she never told (Wikipedia 2019). GANs can guess passwords better than a brute
force password-guessing tool. Modern spammers use AI tools to generate unsolicited
emails with spam-contents that can fool the spam filters in operation and can make
their way to a user’s inbox. Fuzzing, which is a popular means to discover exploitable
vulnerabilities of a system by monitoring the system behavior after putting a massive
set of random inputs to it, has been more potent after being driven by AI. Hence, new
age cyber criminals are empowered and ready to fight the AI-based cyber defense
techniques with another set of AI-based cyberattack tools. The cybersecurity game is
on, and it is AI versus AI.
Real-time E2E Security Monitoring at Scale

Securing the 5G network requires intrinsic security features to be developed as an inte-
gral part of the 5GS development process. Every module should have secure commu-
nication protocols and interfaces over which they transfer user and control data. We
cannot envisage 5G security as a separate layer of shield that can save the whole 5G
system after its deployment (Liyanage et al. 2015). This stand-alone security idea is not
suitable mainly because of the highly modular and agile network architecture of 5GS,
providing non-3GPP access to the 5G core network, and hosting highly sensitive public
health and national security data services (Kumari et al. 2018). But there is no ultimate
security by design guaranteed for a complicated, evolving, and a multivendor system
such as 5G (Liyanage et al. 2017). Hence, continuous monitoring for incoming attacks
is more appropriate than just securing the system during its development.
Physical Layer Security

Securing the real-life noisy physical channel in the presence of active eavesdropper is
challenging because the snooper can contaminate the pilot signaling and hence can
ruin channel measurement, which is crucial for massive MIMO and beamforming tech-
niques to work. Moreover, the nonorthogonal multiple access techniques are hard to
implement securely, since users need to share unprotected broadcast messages among
them (Wu et al. 2018).
Can 3GPP Recommendations Solely Secure the 5GS?

5G security architecture, as proposed by 3GPP, throws light only on a few selected
aspects of network security procedures and privacy-preserving protocols (Blanc et al.
2018). However, cybersecurity research continues to identify weaknesses in existing
defense mechanisms and new protocols (Gross 2018). In this section, we highlight a
few research needs and corner cases that 3GPP security proposals left out of scope.
ML security: ML models are going to be an integral part of future networks. Various
applications, such as autonomous cars, are controlled by ML algorithms, although many
other network operations use ML to enhance user experience. On the other hand, net-
work monitoring and security software adopt ML systems for intrusion detection, mali-
cious activity recognition, and understanding user behavior for optimized utilization of
network resources (Usama et al. 2019). Nevertheless, well-designed adversaries can fool
the ML algorithms (Biggio and Roli 2018). If the ML models of a 5G network security
software undergo an adversarial attack, the services that rely on the 5G connectivity
immediately become insecure. 3GPP does not propose any minimum safety require-
ments for ML, especially deep learning-based algorithms for 5G network monitoring.
A machine learning model should qualify specific performance tests and be proved
as highly reliable, dependable, and understandable before they are allowed to serve in a
critical network system such as 5G. Also, the ML models need to be categorized based
on their resiliency to adversarial attacks, reliability under edge cases, availability dur-
ing limited network coverage, and capacity. A true carrier-grade AI standard needs to
be agreed soon to keep 5GS free from poor and vulnerable ML software because deep
learning and other machine learning models are being adopted in 5GS increasingly.
Directing resilient machine learning research does not come under the 3GPP purview;
still, the safety of ML models has critical implications on the 5G network performance
and security to the society.
Government requirements: Lawful interception of user data is often a requirement
in scenarios where law enforcement authority wants to track an individual for criminal
offenses committed. Hence, it is mandatory not to altogether abolish support for null
encryption or unencrypted mode of communications from the 3GPP specifications.
This requirement from a government leaves a vulnerable corner case that may poten-
tially lead to an infrequent occasion of security threat to the networks (Ahmad et al.
2018).
Coexistence with vulnerable LTE network: Various security research works have
recently disclosed several loopholes in LTE’s privacy and authentication procedures
(Shaik et al. 2015). 5G network will initially coexist with the LTE counterpart, where
a set of known vulnerabilities, including RNTI tracking and DNS traffic hijacking in
layer 2, exist without being adequately addressed by current safety proposals. Thus, the
existing loopholes of LTE may become a potential weakness to the new 5G networks,
and there is no countermeasure recommended by 3GPP.
Vendor-specific hardware security: 3GPP security proposal assumes that the

user-specific sensitive data such as credentials and long-term keys and authentication
algorithms are stored and executed in secure hardware. However, the security auditing
scheme to ensure the tamper-resistant secure hardware component falls outside the
scope of the specifications (Jover and Marojevic 2019).
Thus, 3GPP security recommendations have limitations, presumptions, and a handful
of protocol corner cases that can leave 5G networks vulnerable to future cyberattacks
(Dehnel-Wild and Cremers 2018). To make 5G a trusted mobile network ecosystem,
cross-domain research endeavors are essential along with the efforts from the telecom
standardization bodies represented by 3GPP.
Current State of the Arts and Open Research Areas

The widespread security threat landscape and shortcomings in the existing systems
offer exciting opportunities for the cybersecurity and communication system experts
to indulge in innovative research that resolves the current security flaws and establishes
5G as a ubiquitous mode of reliable communication. In this section, we highlight a
few decisive aspects of 5G security and state-of-the-art systems currently available to
secure the network. We also throw light on possible future research endeavors aiming
towards an improved and safer 5G networks.
Security of IoT: The security of the increasing number of smart IoT devices connected
to the network is a challenging research topic. IoT security specifications demand robust
and verified protocols yet to be declared. Hence, 3GPP pushed IoT security as a topic for
their release 16. The current state-of-the-art IoT security solutions such as IoTGUARD
apply dynamic security strategy on all interacting commodity devices in a home or a
small network because treating individual IoT device is no longer sufficient in a multiapp
environment (Berkay Celik et al. 2019). IoTFuzzer is another successful app-based tech-
nique to uncover the IoT device’s memory corruption vulnerability (Chen et al. 2018).
Formal Verification of 5G Protocols: The various protocols through which the 5G net-
work functions exchange various authentication key and control messages need to be
formally analyzed and proven to sufficiently meet a set of security objectives. Basin et al.
provided a formal analysis of 5G Authentication and Key Exchange (AKA) protocol and
showed that active privacy attacks are still possible (Basin et al. 2018). TAMARIN Prover
is a state-of-the-art protocol verification tool that helps verify the reliability of the state-
ful security protocols such as 5G-AKA. However, extensions of verification tools and
exhaustive formal analysis of other security protocols specified for 5GS need further
attention from the researchers.
Adversarial Attacks on ML Systems: The considerable excitement for adopting AI in
the mobile networking domain gives rise to the need for a “telecom-grade” AI, which
is reliable, explainable, and secure enough to serve the customers. The ML algorithms
are vulnerable to adversarial attacks, and the latest attacks have proved that not only
the image analysis ML algorithms but industrial automation algorithms are also vul-
nerable (Zizzo et al. 2019). Deep learning algorithms are the nervous systems of con-
nected autonomous cars, but carefully engineered adversarial inputs can fool these sys-
tems (Sitawarin et al. 2018). Thus, it is evident that 5GS needs well-developed scanning
tools for AI safety to ensure users’ security. Cleverly designed attacks to expose the
weaknesses of popular ML algorithms are necessary, and, on the other hand, research
toward building attack resilient AI systems needs to grow.
Security of SDN: Recent attacks, such as SSH over robust cache covert channels in
the cloud, divulge the inherent weaknesses of cloud computing on which a majority of
the SDN solutions depends (Maurice et al. 2017). The current state of the art of SDN
security tool is ForenGuard, which is capable of recording the runtime dependencies and
activities involving both the SDN’s control and data plane and detect any control plane
attack on the SDN (Wang et al. 2018). Dixit et al. developed AIM-SDN that divulges
the vulnerabilities of widely used SDN datastores and addressed the weaknesses (Dixit
et al. 2018). Veriflow is another popular SDN-based network DDoS defense mechanism
(Khurshid et al. 2013). However, a scalable security monitoring tool ensuring the safety
of the microservices running on a public cloud is needed to facilitate the secure and
rapid deployment of the 5G.
Apart from the digital domain security measures, the physical analog propagation
channel also needs to be secured. Although 3GPP assumes that no particular physical
layer security is necessary for above 28 GHz 5G radio, the possibility of an eavesdropper
spoiling pilot signaling needs to be examined further.
Conclusion
E2E security and privacy standards are vital necessities for a hyperscale, pervasive, and
high-performance telecommunication network such as 5G so that it can withstand
the future threat vectors and emerge as a trusted network architecture. 3GPP formally
approaches 5G security and privacy; however, many aspects of it remain unattended
by the security standardization bodies. This article argues that this is the right time to
consider 5G security and privacy as a design obligation and not to see it as an overhead
to a faster system standardization because it is often not adequate and economical to
annex security and privacy features afterward.
5G infrastructures revamp the traditional cellular network architecture radically to
cater to the exponentially growing demand for high-speed, low-latency mobile Internet
spurring exciting new business opportunities. Hence, the current 5G standardization
should include security and privacy concerns to thwart early attacks on the 5GS. Stan-
dardized security procedures should test the reliability of ML systems before they are
adopted in the network operations. Cross-discipline research areas including crypto-
graphic security, formal device testing, systematic and exhaustive testing of security
procedures of 5G, and cyberattacks designing for 5G network components are neces-
sary to bridge the security gaps that currently exist in present-day telecommunication
systems.
The beneficiaries of a disruptive technology such as 5G are the people from all
the cross sections of the society. At the same time, any security defect can impact a
significant section of the society that depends on the technology. Therefore, this article
highlights the emerging threat landscape and major security risks associated with the
advent of the 5G technology, anticipate impacts of unresolved security weaknesses,
and spotlights new research directions essential to establish 5G as the most trusted
network architecture for the years to come.
Acronyms
4G 4th Generation ng-eNB 5G-eNodeB

5G 5th Generation NOMA Nonorthogonal Multiple Access
5G-CN 5G-Core Network NR New Radio
5G-GUTI 5G-Global Unique Temporary NRF NF Repository Function
Identifier
5GS 5G System NSA Non-stand-alone
AF Application Function NSSF Network Slice Selection Function
AI Artificial Intelligence NVF Network Function Virtualization
AMF Access and Mobility Management O&M Operations and Monitoring
Function
AUSF Authentication Server Function PCF Policy and Charging Function
CU Centralized Unit PCRF Policy and Charging Rule Function
CUPS Control and User Plane Separation PLMN Public Land Mobile Network
DDoS Distributed Denial of Service R-15 3GPP Release-15
DHCP Dynamic Host Configuration Protocol RN Radio Network
DoS Denial of Service RNTI Radio Network Temporary Identifier
DU Distributed Unit RU Radio Unit
E2E End-to-end SA3 Service and System Aspects 3
EPC Evolved Packet Core SBA Service-based Architecture
GAN Generative Adversarial Network SBI Service-based Interface
gNB next-generation NodeB SDN Software-defined Networking
GSM Global System for Mobile SDO Standards Development
Communication Organization
HSS Home Subscriber Server SEPP SEcurity Protection Proxy
IoT Internet of Things SLA Service-level agreement
IT Information Technology SSH Secure Socket Shell
LTE Long-term Evolution SUCI SUbscription Concealed Identifier
ME Mobile Equipment TSG Technological Specification Group
MIMO Multiple Input Multiple Output UDM Unified Data Management
ML Machine Learning UE Users Equipment
MME Mobility Management Entity ULLC Ultra-low-latency Communication
N31WF Non-3GPP Internetworking UMTS Universal Mobile Telecommunication
Function System
NEF Network Exposure Function USIM Universal Subscriber Identity Module
NF Network Function VPN Virtual Private Network
Related Articles
5G-Core Network Security
Physical-Layer Security for 5G and Beyond
References
3GPP (2018). 5G; NR; Physical layer; General description. Technical specification (ts),
3rd Generation Partnership Project (3GPP), 09 2018.
3GPP (2019). 3rd Generation Partnership Project; Technical Specification Group Services
and System Aspects; Release 16 Description; Summary of Rel-16 Work Items (Release
16). Technical report (tr), 3rd Generation Partnership Project (3GPP), 09 2019.
3GPP (2019). 3rd Generation Partnership Project; Technical Specification Group Services
and System Aspects; Release 15 Description; Summary of Rel-15 Work Items (Release
15). Technical specification (ts), 3rd Generation Partnership Project (3GPP), 09 2019.
5G Americas (2019). The Evolution of Security in 5G. White paper (wp), 5G Americas,
08 2019.
Ahmad, I., Kumar, T. and Liyanage, M. et al. (2018). Overview of 5G security challenges
and solutions. IEEE Communications Standards Magazine 2 (1), 36–43.
Ahmad, I., Kumar, T., Liyanage, M. et al. (2017). 5G security: analysis of threats and
solutions. 2017 IEEE Conference on Standards for Communications and Networking
(CSCN), 193–199. IEEE.
Akhunzada, A., Ahmed, E. and Gani, A. et al. (2015). Securing software defined networks:
taxonomy, requirements, and open issues. IEEE Communications Magazine 53 (4),
36–44.
Amine Ferrag, M., Maglaras, L. and Argyriou, A. et al. (2018). Security for 4G and 5G
cellular networks: a survey of existing authentication and privacy-preserving schemes.
Journal of Network and Computer Applications 101, 55–82.
Antonioli, D., Tippenhauer, N.O. and Rasmussen, K. (2019). Nearby Threats: Reversing,
Analyzing, and Attacking Google’s’ Nearby Connections’ on Android,
Arapinis, M., Mancini, L., Ritter, E. et al. (2012). New privacy issues in mobile telephony:
fix and verification. Proceedings of the 2012 ACM Conference on Computer and
Communications Security, CCS ’12, 205–216, New York, NY, USA. ACM.
Arfaoui, G., Bisson, P. and Blom, R. et al. (2018). A security architecture for 5G networks.
IEEE Access 6, 22466–22479.
Barreno, M., Nelson, B., Sears, R. et al. (2006). Can machine learning be secure?
Proceedings of the 2006 ACM Symposium on Information, Computer and
Communications Security, 16–25. ACM.
Basin, D., Dreier, J., Hirschi, L. et al. (2018). A formal analysis of 5G authentication.
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications
Security, 1383–1396. ACM.
Belmonte Martin, A., Marinos, L. and Rekleitis, E. et al. (2016). Threat Landscape and
Good Practice Guide for Software Defined Networks/5G, Technical report (tr),
European Union Agency for Network and Information Security (ENISA).
Belmonte Martin, A., Marinos, L., Rekleitis, E. et al. (2016). Threat Landscape and Good
Practice Guide for Software Defined Networks/5G. White paper (wp), Huawei
Technologies.
Berkay Celik, Z., Tan, G. and McDaniel, P.D. (2019). Iotguard: dynamic enforcement of
security and safety policy in commodity iot, NDSS.
Biggio, B. and Roli, F. (2018). Wild patterns: ten years after the rise of adversarial machine
learning. Pattern Recognition 84, 317–331.
Blanc, G., Kheir, N., Ayed, D. et al. (2018). Towards a 5G security architecture: articulating
software-defined security and security as a service. Proceedings of the 13th International
Conference on Availability, Reliability and Security, page 47. ACM.
Blanco, B., Fajardo, J.O. and Giannoulakis, I. et al. (2017). Technology pillars in the
architecture of future 5G mobile networks: NFV, MEC and SDN. Computer Standards &
Interfaces 54, 216–228.
Cao, Y., Xiao, C. and Cyr, B. et al. (2019). Adversarial sensor attack on lidar-based
perception in autonomous driving, arXiv preprint arXiv:1907.06826.
Chen, J., Diao, W. and Zhao, Q. et al. (2018). Iotfuzzer: discovering memory corruptions in
iot through app-based fuzzing, NDSS.
Chen, M., Qian, Y. and Mao, S. et al. (2016). Software-defined mobile networks security.
Mobile Networks and Applications 21 (5), 729–743.
Dehnel-Wild, M. and Cremers, C. (2018). Security Vulnerability in 5G-aka Draft,
Department of Computer Science, University of Oxford, Tech. Rep.
Statista Research Department (2016). Iot-number-of-connected-devices-worldwide.
Dixit, V.H., Doupé, A., Shoshitaishvili, Y. et al. (2018). Aim-sdn: attacking information
mismanagement in sdn-datastores. Proceedings of the 2018 ACM SIGSAC Conference on
Computer and Communications Security, 664–676. ACM.
Ericsson (2018). 5G Security - Enabling a Trustworthy 5G System. White paper (wp),
Ericsson.
ETSI (2019). System Architecture for the 5G System; (Release 15). Technical specification
(ts), ETSI 3rd Generation Partnership Project (3GPP), 06 2019.
Foukas, X., Nikaein, N., Kassem, M.M. et al. (2016). Flexran: a flexible and programmable
platform for software-defined radio access networks. Proceedings of the 12th
International on Conference on Emerging Networking EXperiments and Technologies,
CoNEXT ’16, 427–441, New York, NY, USA. ACM.
Gross, M. (2018). Eth Researchers Uncover Security Gaps in the 5G Mobile
Communication Standard,
He, D., Chan, S. and Guizani, M. (2016). Securing software defined wireless networks.
IEEE Communications Magazine 54 (1), 20–25.
Herwig, S., Harvey, K. and Hughey, G. et al. (2019). Measurement and analysis of hajime, a
peer-to-peer iot botnet, NDSS.
Hodges, J. (2019). Heavy Reading’s 2019 5G Security Survey, Research report (rr), F5
Networks, Fortinet, NetNumber, and Palo Alto Networks, 02 2019.
Jover, R.P. (2013). Security attacks against the availability of lte mobility networks: overview
and research directions. 2013 16th International Symposium on Wireless Personal
Multimedia Communications (WPMC), 1–9. IEEE.
Jover, R.P. and Marojevic, V. (2019). Security and protocol exploit analysis of the 5G
specifications. IEEE Access 7, 24956–24963.
Khurshid, A., Zou, X., Zhou, W. et al. (2013). Veriflow: verifying network-wide invariants in
real time. Presented as part of the 10th {USENIX} Symposium on Networked Systems
Design and Implementation ( {NSDI} 13), 15–27.
Kumar, A.D., Chebrolu, K.N.R. and Soman, K.P. (2018). A brief survey on autonomous
vehicle possible attacks, exploits and vulnerabilities, arXiv preprint arXiv:1810.04144.
Kumar, T., Liyanage, M., Ahmad, I. et al. (2018). User Privacy, Identity and Trust in 5G. A
Comprehensive Guide to 5G Security, page 267.
Kumari, A., Gowri, S., Radhika, E.G., et al. (2018). An approach for end-to-end (e2e)
security of 5G applications. 2018 IEEE 4th International Conference on Big Data Security
on Cloud (BigDataSecurity), IEEE International Conference on High Performance and
Smart Computing (HPSC) and IEEE International Conference on Intelligent Data and
Security (IDS), 133–138. IEEE.
Liyanage, M., Ahmed, I. and Okwuibe, J. et al. (2017). Enhancing security of software
defined mobile networks. IEEE Access 5, 9422–9438.
Liyanage, M., Ahmed, I., Ylianttila, M. (2015). Security for future software defined mobile
networks. 2015 9th International Conference on Next Generation Mobile Applications,
Services and Technologies, 256–264. IEEE.
Liyanage, M., Bux Abro, A., Ylianttila, M. and Gurtov, A. (2016). Opportunities and
challenges of software-defined mobile networks in network security. IEEE Security &
Privacy 14 (4), 34–44.
Marino, D.L., Wickramasinghe, C.S., and Manic, M. (2018). An adversarial approach for
explainable ai in intrusion detection systems. IECON 2018-44th Annual Conference of
the IEEE Industrial Electronics Society, 3237–3243. IEEE.
Maurice, C., Weber, M., Schwarz, M. et al. (2017). Hello from the other side: SSH over
robust cache covert channels in the cloud. NDSS, vol. 17, 8–11.
Michalopoulos, D.S., Gajic, B., Crespo, B.G.-N. et al. (2017). Network resilience in
virtualized architectures. In Interactive Mobile Communication, Technologies and
Learning ( eds M.E. Auer and T. Tsiatsos), 824–839. Springer.
Morant, S., Wary, J.-P. and Piri, E. (2016). 5G Enablers for Network and System Security
and Resilience, Deliverable, EG-ENSURE, 06 2016.
National Vulnerability Database (2019). Online. nvd.nist.gov (accessed 26 November 2019).
Nguyen, B., Zhang, T., Radunovic, B. et al. (2018). Echo: a reliable distributed cellular core
network for hyper-scale public clouds. Proceedings of the 24th Annual International
Conference on Mobile Computing and Networking, 163–178. ACM.
ONF (2015). Principles and Practices for Securing Software-Defined Networks. Technical
report (tr), Open Networking Foundation (ONF).
Open Air Interface (2017). 5G Software Alliance for Democratising Wireless Innovation.
Palani, K., Holt, E., and Smith, S. (2016). Invisible and forgotten: zero-day blooms in the iot.
2016 IEEE International Conference on Pervasive Computing and Communication
Workshops (PerCom Workshops), 1–6. IEEE.
Qayyum, A., Usama, M., Qadir, J. and Al-Fuqaha, A.I. (2019). Securing Connected &
Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and the Way
Forward, CoRR, abs/1905.12762.
Qayyum, A., Usama, M., Qadir, J. and Al-Fuqaha, A. (2019). Securing connected &
autonomous vehicles: challenges posed by adversarial machine learning and the way
forward, arXiv preprint arXiv:1905.12762.
Rafiul Hussain, S., Echeverria, M. and Chowdhury, O. et al. (2019). Privacy attacks to the
4G and 5G cellular paging protocols using side channel information, NDSS, 2019.
Rao, S.P., Holtmanns, S., Oliver, I., and Aura, T. (2015). Unblocking stolen mobile devices
using ss7-map vulnerabilities: exploiting the relationship between imei and imsi for eir
access. 2015 IEEE Trustcom/BigDataSE/ISPA, vol. 1, 1171–1176. IEEE.
Rupprecht, D., Dabrowski, A. and Holz, T. et al. (2018). On security research towards future
mobile network generations. IEEE Communications Surveys & Tutorials 20 (3),
2518–2542.
Rupprecht, D., Kohls, K., Holz, T. and Pöpper, C. (2019). Breaking lte on layer two, IEEE
Symposium on Security & Privacy (SP).
Salman, O., Kayssi, A., Chehab, A., and Elhajj, I. (2017). Multi-level security for the 5G/iot
ubiquitous network. 2017 Second International Conference on Fog and Mobile Edge
Computing (FMEC), 188–193. IEEE.
Schneider, P. and Horn, G. (2015). Towards 5G security. 2015 IEEE
Trustcom/BigDataSE/ISPA, vol. 1, 1165–1170. IEEE.
Scott-Hayward, S., Natarajan, S. and Sezer, S. (2015). A survey of security in software
defined networks. IEEE Communications Surveys & Tutorials 18 (1), 623–654.
Sezer, S., Scott-Hayward, S. and Chouhan, P.K. et al. (2013). Are we ready for sdn?
Implementation challenges for software-defined networks. IEEE Communications
Magazine 51 (7), 36–43.
Shaik, A., Borgaonkar, R. and Asokan, N. et al. (2015). Practical Attacks Against Privacy
and Availability in 4G/lte Mobile Communication Systems.
Shaik, A., Borgaonkar, R. and Asokan, N. et al. (2015). Practical attacks against privacy and
availability in 4G/lte mobile communication systems, arXiv preprint arXiv:1510.07563.
Siddiqi, M.A., Khoso, M. and Aziz, A. (2017). Security Issues in 5G Network.
Sitawarin, C., Nitin Bhagoji, A. and Mosenia, A. et al. (2018). Darts: Deceiving autonomous
cars with toxic signs, arXiv preprint arXiv:1802.06430.
Surridge, M., Correndo, G., Meacham, K. et al. (2018). Trust modelling in 5G mobile
networks. Proceedings of the 2018 Workshop on Security in Softwarized Networks:
Prospects and Challenges, SecSoN ’18, 14–19, New York, NY, USA. ACM.
University of Surrey (2017). 5G Whitepaper: 5G Security Overview. White paper (wp),
University of Surrey.
Usama, M., Asim, M., Latif, S. et al. (2019). Generative adversarial networks for launching
and thwarting adversarial attacks on network intrusion detection systems. 2019 15th
International Wireless Communications & Mobile Computing Conference (IWCMC),
78–83. IEEE.
Usama, M., Qadir, J., Al-Fuqaha, A.I. and Hamdi, M. (2019). The Adversarial Machine
Learning Conundrum: can the Insecurity of ML become the Achilles’ Heel of Cognitive
Networks?, CoRR, abs/1906.00679,
Usama, M., Qayyum, A., Qadir, J., and Al-Fuqaha, A. (2019). Black-box adversarial machine
learning attack on network traffic classification. 2019 15th International Wireless
Communications & Mobile Computing Conference (IWCMC), 84–89. IEEE.
Vairam, P.K., Mitra, G., Manoharan, V. et al. (2019). Towards measuring quality of service
in untrusted multi-vendor service function chains: balancing security and resource
consumption. IEEE INFOCOM 2019-IEEE Conference on Computer Communications,
163–171. IEEE.
Wang, H., Yang, G., Chinprutthiwong, P. et al. (2018). Towards fine-grained network
security forensics and diagnosis in the sdn era. Proceedings of the 2018 ACM SIGSAC
Conference on Computer and Communications Security, 3–16. ACM.
Wikipedia (2019). Online. https://en.wikipedia.org/wiki/Deepfake (accessed 26 November
2019).
Wu, D., Gao, D. and Chang, R.K.C. et al. (2019). Understanding Open Ports in Android
Applications: Discovery, Diagnosis, and Security Assessment.
Wu, Y., Khisti, A. and Xiao, C. et al. (2018). A survey of physical layer security techniques
for 5G wireless networks and challenges ahead. IEEE Journal on Selected Areas in
Communications 36 (4), 679–695.
Zizzo, G., Hankin, C., Maffeis, S., and Jones, K. (2019). Adversarial machine learning
beyond the image domain. Proceedings of the 56th Annual Design Automation
Conference 2019, page 176. ACM.
Further Reading
Dutta, A. and Hammad, E. (2020). 5G Security Challenges and Opportunities: A System

Approach. 2020 IEEE 3rd 5G World Forum (5GWF). IEEE.
Ericsson.com. 5G standardization - Ericsson [online]. https://www.ericsson.com/en/tech-
innovation/standardization/5G-standardization.
Fonyi, S. (2020). Overview of 5G security and vulnerabilities. The Cyber Defense Review
5 (1), 117–134.
Suomalainen, J., Juhola, A., Shahabuddin, S. et al. (2020). Machine learning threatens
5G security. IEEE Access 8, 190822–190842.
Usama, M., Mitra, R.N., Ilahi, I. et al. (2020). Examining machine learning for 5G and
beyond through an adversarial lens. arXiv preprint arXiv:2009.02473.
25
SDMN Security
Montimage, Paris, France
Software-defined Mobile Network (SDMN) Security

Introduction
Software-Defined Mobile Networks (SDMNs) is a rapidly emerging paradigm that
involves designing and implementing mobile networks and functions as software allow-
ing the introduction of generic, commodity, and off-the-shelf hardware and software
in the core and radio access parts. The key concepts involved are (i) Software-Defined
Networking (SDN), allowing dynamic programmable network management, and
separating the data and control planes; and (ii) Network Function Virtualization (NFV),
introducing an architecture based on the virtualization of network functions that can
be connected and chained together to create communication services. The introduction
of these concepts has an important impact on how the security of mobile networks is
managed. They introduce new capabilities with respect to manageability, scalability,
and dynamicity, but also new vulnerabilities that will be discussed in the next section,
followed by the presentation of different solutions. In particular, distributed and
highly flexible and programmable security monitoring architectures are important for
providing the awareness of the state of the network at all levels (i.e. from the application
to physical layers, at the data, and control planes) to enable the prevention and reaction
to security breaches involving anomalies, sensitive data loss, and cyber-attacks.
SDN Concepts
To satisfy new requirements related to flexibility, dynamicity, and scalability, future
mobile networks are adopting SDN and NFV-based architectures that allow introduc-
ing Cloud Computing, virtualization, Mobile Edge Computing (i.e. Fog Computing)
technologies, as well as anything-as-a-service models, for improved resource use and
management. SDN decouples the control and data planes of the network, placing the
control functions outside of the network elements (e.g. software or hardware switches,
routers) and enabling external control through a logical software entity called the net-
work SDN Controller. SDN in mobile networks brings the ability to provide centralized
control, hardware device abstraction, network virtualization, common device stan-
dards, and automation. These features are useful for designing scalable, dynamic, and
The Wiley 5G REF: Security. Edited by Rahim Tafazolli, Chin-Liang Wang, Periklis Chatzimisios and Madhusanka Liyanage.
© 2021 John Wiley & Sons Ltd. Published 2021 by John Wiley & Sons Ltd.
Another random document with
no related content on Scribd:
"You are sure of that?" insisted the ape-man.
"Of course I am."
Tarzan turned to Ibn Jad. "You have lied to me. You are not here to
trade but to find and sack a city; to take its treasure and steal its
women."
"That is a lie!" cried Ibn Jad. "Whoever told thee that, lied."
"I do not think he lied," replied Tarzan. "He seemed an honest
youth."
"Who was he?" demanded Ibn Jad.
"His name is Zeyd." Ateja heard and was suddenly galvanized to
new interest. "He says all this and more, and I believe him."
"What else did he tell thee, Nasrany?"
"That another stole his musket and sought to slay thee, Ibn Jad, and
then put the blame upon him."
"That is a lie, like all he hath told thee!" cried Fahd.
Ibn Jad sat in thought, his brows contracted in a dark scowl, but
presently he looked up at Tarzan with a crooked smile. "Doubtless
the poor youth thought that he spoke the truth," he said. "Just as he
thought that he should slay his sheykh and for the same reason.
Always hath his brain been sick, but never before did I think him
dangerous.
"He hath deceived thee, Tarzan of the Apes, and that I can prove by
all my people as well as by this Nasrany I have befriended, for all will
tell thee that I am seeking to obey thee and leave thy country. Why
else then should I have travelled north back in the direction of my
own beled?"
"If thou wished to obey me why didst thou hold me prisoner and
send thy brother to slay me in the night?" asked Tarzan.
"Again thou wrongst Ibn Jad," said the sheik sadly. "My brother came
to cut thy bonds and set thee free, but thou set upon him and then
came el-fil and carried thee away."
"And what meant thy brother when he raised his knife and cried:
'Die, Nasrany!'" demanded the ape-man. "Sayeth a man thus who
cometh to do a kindness?"
"I did but joke," mumbled Tollog.
"I am here again," said Tarzan, "but not to joke. My Waziri are
coming. Together we shall see you well on your way toward the
desert."
"It is what we wish," said the sheik quickly. "Ask this other Nasrany if
it be not true that we are lost and would be but too glad to have thee
lead us upon the right way. Here we be beset by Galla warriors.
Their chief hath been gathering them for days and momentarily we
fear that we shall be attacked. Is that not true, Nasrany?" he turned
to Stimbol as he spoke.
"Yes, it is true," said Stimbol.
"It is true that you are going to leave the country," said Tarzan, "and I
shall remain to see that you do so. Tomorrow you will start. In the
meantime set aside a beyt for me—and let there be no more
treachery."
"Thou needst fear nothing," Ibn Jad assured him, then he turned his
face toward the women's quarters. "Hirfa! Ateja!" he called. "Make
ready the beyt of Zeyd for the sheykh of the jungle."
To one side but at no great distance from the beyt of Ibn Jad the two
women raised the black tent for Tarzan, and when the am'dan had
been placed and straightened and the tunb el-beyt made fast to the
pegs that Ateja drove into the earth Hirfa returned to her household
duties, leaving her daughter to stretch the side curtains.
The instant that Hirfa was out of ear shot Ateja ran to Tarzan.
"Oh, Nasrany," she cried, "thou hast seen my Zeyd? He is safe?"
"I left him in a village where the chief will care for him until such time
as thy people come upon thy return to the desert country. He is quite
safe and well."
"Tell me of him, oh, Nasrany, for my heart hungers for word of him,"
implored the girl. "How came you upon him? Where was he?"
"His mare had been dragged down by el-adrea who was about to
devour your lover. I chanced to be there and slew el-adrea. Then I
took Zeyd to the village of a chief who is my friend, for I knew that he
could not survive the perils of the jungle should I leave him afoot and
alone. It was my thought to send him from the country in safety, but
he begged to remain until you returned that way. This I have
permitted. In a few weeks you will see your lover."
Tears were falling from Ateja's long, black lashes—tears of joy—as
she seized Tarzan's hand and kissed it. "My life is thine, Nasrany,"
she cried, "for that thou hast given me back my lover."
That night as the Galla slave, Fejjuan, walked through the menzil of
his masters he saw Ibn Jad and Tollog sitting in the sheik's mukaad
whispering together and Fejjuan, well aware of the inherent turpitude
of this precious pair, wondered what might be the nature of their
plotting.
Behind the curtain of the hareem Ateja lay huddled upon her
sleeping mat, but she did not sleep. Instead she was listening to the
whispered conversation of her father and her uncle.
"He must be put out of the way," Ibn Jad insisted.
"But his Waziri are coming," objected Tollog. "If they do not find him
here what can we say? They will not believe us, whatever we say.
They will set upon us. I have heard that they are terrible men."
"By Ullah!" cried Ibn Jad. "If he stays we are undone. Better risk
something than to return empty handed to our own country after all
that we have passed through."
"If thou thinkest that I shall again take this business upon myself
thou art mistaken, brother," said Tollog. "Once was enough."
"No, not thee; but we must find a way. Is there none among us who
might wish more than another to be rid of the Nasrany?" asked Ibn
Jad, but to himself as though he were thinking aloud.
"The other Nasrany!" exclaimed Tollog. "He hateth him."
Ibn Jad clapped his hands together. "Thou hast it, brother!"
"But still shall we be held responsible," reminded Tollog.
"What matter if he be out of the way. We can be no worse off than
we now are. Suppose Batando came tomorrow with the guides?
Then indeed would the jungle sheykh know that we have lied to him,
and it might go hard with us. No, we must be rid of him this very
night."
"Yes, but how?" asked Tollog.
"Hold! I have a plan. Listen well, O brother!" and Ibn Jad rubbed his
palms together and smiled, but he would not have smiled, perhaps
had he known that Ateja listened, or had he seen the silent figure
crouching in the dark just beyond the outer curtain of his beyt.
"Speak, Ibn Jad," urged Tollog, "tell me thy plan."
"Wellah, it is known by all that the Nasrany Stimbol hates the sheykh
of the jungle. With loud tongue he hath proclaimed it many times
before all when many were gathered in my mukaad."
"You would send Stimbol to slay Tarzan of the Apes?"
"Thou guessed aright," admitted Ibn Jad.
"But how wilt that relieve us of responsibility? He wilt have been slain
by thy order in thine own menzil," objected Tollog.
"Wait! I shall not command the one Nasrany to slay the other; I shall
but suggest it, and when it is done I shall be filled with rage and
horror that this murder hath been done in my menzil. And to prove
my good faith I shall order that the murderer be put to death in
punishment for his crime. Thus we shall be rid of two unbelieving
dogs and at the same time be able to convince the Waziri that we
were indeed the friends of their sheykh, for we shall mourn him with
loud lamentations—when the Waziri shall have arrived."
"Allah be praised for such a brother!" exclaimed Tollog, enraptured.
"Go thou now, at once, and summon the Nasrany Stimbol," directed
Ibn Jad. "Send him to me alone, and after I have spoken with him
and he hath departed upon his errand come thee back to my beyt."
Ateja trembled upon her sleeping mat, while the silent figure
crouching outside the sheik's tent arose after Tollog had departed
and disappeared in the darkness of the night.
Hastily summoned from the beyt of Fahd, Stimbol, cautioned to
stealth by Tollog, moved silently through the darkness to the mukaad
of the sheik, where he found Ibn Jad awaiting him.
"Sit, Nasrany," invited the Beduin.
"What in hell do you want of me this time of night?" demanded
Stimbol.
"I have been talking with Tarzan of the Apes," said Ibn Jad, "and
because you are my friend and he is not I have sent for you to tell
you what he plans for you. He has interfered in all my designs and is
driving me from the country, but that is as nothing compared with
what he intends for you."
"What in hell is he up to now?" demanded Stimbol. "He's always
butting into some one else's business."
"Thou dost not like him?" asked Ibn Jad.
"Why should I?" and Stimbol applied a vile epithet to Tarzan.
"Thou wilt like him less when I tell thee," said Ibn Jad.
"Well, tell me."
"He says that thou hast slain thy companion, Blake," explained the
sheik, "and for that Tarzan is going to kill thee on the morrow."
"Eh? What? Kill me?" demanded Stimbol. "Why he can't do it! What
does he think he is—a Roman emperor?"
"Nevertheless he will do as he says," insisted Ibn Jad. "He is all
powerful here. No one questions the acts of this great jungle sheykh.
Tomorrow he will kill thee."
"But—you won't let him, Ibn Jad! Surely, you won't let him?" Stimbol
was already trembling with terror.
Ibn Jad elevated his palms. "What can I do?" he asked.
"You can—you can—why there must be something that you can do,"
wailed the frightened man.
"There is naught that any can do—save yourself," whispered the
sheik.
"What do you mean?"
"He lies asleep in yon beyt and—thou hast a sharp khusa."
"I have never killed a man," whimpered Stimbol.
"Nor hast thou ever been killed," reminded the sheik; "but tonight
thou must kill or tomorrow thou wilt be killed."
"God!" gasped Stimbol.
"It is late," said Ibn Jad, "and I go to my sleeping mat. I have warned
thee—do what thou wilt in the matter," and he arose as though to
enter the woman's quarters.
Trembling, Stimbol staggered out into the night. For a moment he
hesitated, then he crouched and crept silently through the darkness
toward the beyt that had been erected for the ape-man.
But ahead of him ran Ateja to warn the man who had saved her lover
from the fangs of el-adrea. She was almost at the beyt she had
helped to erect for the ape-man when a figure stepped from another
tent and clapping a palm across her mouth and an arm about her
waist held her firmly.
"Where goest thou?" whispered a voice in her ear, a voice that she
recognized at once as belonging to her uncle; but Tollog did not wait
for a reply, he answered for her. "Thou goest to warn the Nasrany
because he befriended thy lover! Get thee back to thy father's beyt.
If he knew this he would slay thee. Go!" And he gave her a great
shove in the direction from which she had come.
There was a nasty smile upon Tollog's lips as he thought how neatly
he had foiled the girl, and he thanked Allah that chance had placed
him in a position to intercept her before she had been able to ruin
them all; and even as Tollog, the brother of the sheik, smiled in his
beard a hand reached out of the darkness behind him and seized
him by the throat—fingers grasped him and dragged him away.
Trembling, bathed in cold sweat, grasping in tightly clenched fingers
the hilt of a keen knife, Wilbur Stimbol crept through the darkness
toward the tent of his victim.
Stimbol had been an irritable man, a bully and a coward; but he was
no criminal. Every fiber of his being revolted at the thing he
contemplated. He did not want to kill, but he was a cornered human
rat and he thought that death stared him in the face, leaving open
only this one way of escape.
As he entered the beyt of the ape-man he steeled himself to
accomplish that for which he had come, and he was indeed a very
dangerous, a very formidable man, as he crept to the side of the
figure lying in the darkness, wrapped in an old burnous.
CHAPTER XIV
Sword and Buckler

As the sun touched the turrets of the castle of the Prince of Nimmr a
youth rolled from between his blankets, rubbed his eyes and
stretched. Then he reached over and shook another youth of about
his own age who slept beside him.
"Awaken, Edward! Awaken, thou sluggard!" he cried.
Edward rolled over on his back and essayed to say "Eh?" and to
yawn at the same time.
"Up, lad!" urged Michel. "Forgottest thou that thy master fares forth
to be slain this day?"
Edward sat up, now fully awake. His eyes flashed. "'Tis a lie!" he
cried, loyally. "He will cleave Sir Malud from poll to breast plate with
a single blow. Livest no sir knight with such mighty thews as hast Sir
James. Thou art disloyal, Michel, to Sir Richard's friend who hath
been a good and kindly friend to us as well."
Michel patted the other lad upon the shoulder. "Nay, I did but jest,
Edward," he said. "My hopes be all for Sir James, and yet——" he
paused, "I fear——"
"Fear what?" demanded Edward.
"That Sir James be not well enough versed in the use of sword and
buckler to overcome Sir Malud, for even were his strength the
strength of ten men it shall avail him naught without the skill to use
it."
"Thou shalt see!" maintained Edward, stoutly.
"I see that Sir James hath a loyal squire," said a voice behind them,
and turning they saw Sir Richard standing in the doorway, "and may
all his friends wish him well this day thus loyally!"
"I fell asleep last night praying to our Lord Jesus to guide his blade
through Sir Malud's helm," said Edward.
"Good! Get thee up now and look to thy master's mail and to the
trappings of his steed, that he may enter the lists bedight as befits a
noble sir knight of Nimmr," instructed Richard, and left them.
It was eleven o'clock of this February morning. The sun shone down
into the great north ballium of the castle of Nimmr, glinting from the
polished mail of noble knights and from pike and battle-axe of men-
at-arms, picking out the gay colors of the robes of the women
gathered in the grandstand below the inner wall.
Upon a raised dais at the front and center of the grandstand sat
Prince Gobred and his party, and upon either side of them and
extending to the far ends of the stand were ranged the noble knights
and ladies of Nimmr, while behind them sat men-at-arms who were
off duty, then the freedmen and, last of all, the serfs, for under the
beneficent rule of the house of Gobred these were accorded many
privileges.
At either end of the lists was a tent, gay with pennons and the colors
and devices of its owner; one with the green and gold of Sir Malud
and the other with the blue and silver of Sir James.
Before each of these tilts stood two men-at-arms, resplendent in new
apparel, the metal of their battle-axes gleaming brightly, and here a
groom held a restive, richly caparisoned charger, while the squire of
each of the contestants busied himself with last-minute preparations
for the encounter.
A trumpeter, statuesque, the bell of his trumpet resting upon his hip,
waited for the signal to sound the fanfare that would announce the
entrance of his master into the lists.
A few yards to the rear a second charger champed upon his bit as
he nuzzled the groom that held him in waiting for the knight who
would accompany each of the contestants upon the field.
In the blue and silver tilt sat Blake and Sir Richard, the latter issuing
instructions and advice, and of the two he was the more nervous.
Blake's hauberk, gorget and bassinet were of heavy chain mail, the
latter lined inside and covered outside, down to the gorget, with
leopard skin, offering fair protection for his head from an ordinary,
glancing blow; upon his breast was sewn a large, red cross and from
one shoulder depended the streamers of a blue and silver rosette.
Hanging from the pole of the tilt, upon a wooden peg, were Blake's
sword and buckler.
The grandstand was filled. Prince Gobred glanced up at the sun and
spoke to a knight at his side. The latter gave a brief command to a
trumpeter stationed at the princely loge and presently, loud and
clear, the notes of a trumpet rang in the ballium. Instantly the tilts at
either end of the lists were galvanized to activity, while the
grandstand seemed to spring to new life as necks were craned first
toward the tent of Sir Malud and then toward that of Sir James.
Edward, flushed with excitement, ran into the tilt and seizing Blake's
sword passed the girdle about his hips and buckled it in place at his
left side, then, with the buckler, he followed his master out of the tilt.
As Blake prepared to mount Edward held his stirrup while the groom
sought to quiet the nervous horse. The lad pressed Blake's leg after
he had swung into the saddle (no light accomplishment, weighed
down as he was by heavy chain mail) and looked up into his face.
"I have prayed for thee, Sir James," he said. "I know that thou wilt
prevail."
Blake saw tears in the youth's eyes as he looked down at him and
he caught a choking note in his voice. "You're a good boy, Eddie," he
said. "I'll promise that you won't have to be ashamed of me."
"Ah, Sir James, how could I? Even in death thou wilt be a noble
figure of a knight. An fairer one it hath never been given one to see,
methinks," Edward assured him as he handed him his round buckler.
Sir Richard had by now mounted, and at a signal from him that they
were ready there was a fanfare from the trumpet at Sir Malud's tilt
and that noble sir knight rode forward, followed by a single knight.
Blake's trumpeter now announced his master's entry and the
American rode out close along the front of the grandstand, followed
by Sir Richard. There was a murmur of applause for each
contestant, which increased as they advanced and met before
Prince Gobred's loge.
Here the four knights reined in and faced the Prince and each raised
the hilt of his sword to his lips and kissed it in salute. As Gobred
cautioned them to fight honorably, as true knights, and reminded
them of the rules governing the encounter Blake's eyes wandered to
the face of Guinalda.
The little princess sat stiffly erect, looking straight before her. She
seemed very white, Blake thought, and he wondered if she were ill.
How beautiful, thought Blake, and though she did not once appear to
look at him he was not cast down, for neither did she look at Malud.
Again the trumpet sounded and the four knights rode slowly back to
opposite ends of the lists and the principals waited for the final signal
to engage. Blake disengaged his arm from the leather loop of his
buckler and tossed the shield upon the ground.
Edward looked at him aghast. "My Lord knight!" he cried. "Art ill? Art
fainting? Didst drop thy buckler?" and he snatched it up and held it
aloft to Blake, though he knew full well that his eyes had not
deceived him and that his master had cast aside his only protection.
To the horrified Edward there seemed but one explanation and that
his loyalty would not permit him to entertain for an instant—that
Blake was preparing to dismount and refuse to meet Sir Malud,
giving the latter the victory by default and assuring himself of the
contempt and ridicule of all Nimmr.
He ran to Richard who had not seen Blake's act. "Sir Richard! Sir
Richard!" he cried in a hoarse whisper. "Some terrible affliction hath
befallen Sir James!"
"Hey, what?" exclaimed Richard. "What meaneth thou lad?"
"He has cast aside his buckler," cried the youth. "He must be stricken
sore ill, for it cannot be that otherwise he would refuse combat."
Richard spurred to Blake's side. "Hast gone mad, man?" he
demanded. "Thou canst not refuse the encounter now unless thou
wouldst bring dishonor upon thy friends!"
"Where did you get that line?" demanded Blake. "Who said I was
going to quit?"
"But thy buckler?" cried Sir Richard.
The trumpet at the Prince's loge rang out peremptorily. Sir Malud
spurred forward to a fanfare from his own trumpeter.
"Let her go!" cried Blake to his.
"Thy buckler!" screamed Sir Richard.
"The damned thing was in my way," shouted Blake as he spurred
forward to meet the doughty Malud, Richard trailing behind him, as
did Malud's second behind that knight.
There was a confident smile upon the lips of Sir Malud and he
glanced often at the knights and ladies in the grandstand, but Blake
rode with his eyes always upon his antagonist.
Both horses had broken immediately into a gallop, and as they
neared one another Malud spurred forward at a run and Blake saw
that the man's aim was doubtless to overthrow him at the first
impact, or at least to so throw him out of balance as to make it easy
for Malud to strike a good blow before he could recover himself.
Malud rode with his sword half raised at his right side, while Blake's
was at guard, a position unknown to the knights of Nimmr, who
guarded solely with their bucklers.
The horsemen approached to engage upon each other's left, and as
they were about to meet Sir Malud rose in his stirrups and swung his
sword hand down, to gain momentum, described a circle with his
blade and launched a terrific cut at Blake's head.
It was at that instant that some few in the grandstand realized that
Blake bore no buckler.
"His buckler!" "Sir James hath no buckler!" "He hath lost his buckler!"
rose now from all parts of the stand; and from right beside him,
where the two knights met before the loge of Gobred, Blake heard a
woman scream, but he could not look to see if it were Guinalda.
As they met Blake reined his horse suddenly toward Malud's, so that
the two chargers' shoulders struck, and at the same time he cast all
his weight in the same direction, whereas Malud, who was standing
in his stirrups to deliver his blow, was almost in a state of equilibrium
and having his buckler ready for defense was quite helpless insofar
as maneuvering his mount was concerned.
Malud, overbalanced, lost the force and changed the direction of his
blow, which fell, much to the knight's surprise, upon Blake's blade
along which it spent its force and was deflected from its target.
Instantly, his horse well in hand by reason that his left arm was
unencumbered by a buckler, Blake reined in and simultaneously cut
to the left and rear, his point opening the mail on Malud's left
shoulder and biting into the flesh before the latter's horse had carried
him out of reach.
A loud shout of approbation arose from the stands for the thing had
been neatly done and then Malud's second spurred to the Prince's
loge and entered a protest.
"Sir James hath no buckler!" he cried. "'Tis no fair combat!"
"'Tis fairer for thy knight than for Sir James," said Gobred.
"We would not take that advantage of him," parried Malud's second,
Sir Jarred.
"What sayest thou?" demanded Gobred of Sir Richard who had
quickly ridden to Jarred's side. "Is Sir James without a buckler
through some accident that befell before he entered the lists?"
"Nay, he cast it aside," replied Richard, "and averred that the
'damned thing' did annoy him; but if Sir Jarred feeleth that, because
of this, they be not fairly matched we are willing that Sir Malud, also,
should cast aside his buckler."
Gobred smiled. "That be fair," he said.
The two men, concerned with their encounter and not with the
argument of their seconds, had engaged once more. Blood was
showing upon Malud's shoulder and trickling down his back, staining
his skirts and the housing of his charger.
The stand was in an uproar, for many were still shouting aloud about
the buckler and others were screaming with delight over the neat
manner in which Sir James had drawn his first blood. Wagers were
being freely made, and though Sir Malud still ruled favorite in the
betting, the odds against Blake were not so great, and while men
had no money to wager they had jewels and arms and horses. One
enthusiastic adherent of Sir Malud bet three chargers against one
that his champion would be victorious and the words were scarce out
of his mouth ere he had a dozen takers, whereas before the opening
passage at arms offers as high as ten to one had found no takers.
Now the smile was gone from Malud's lips and he glanced no more
at the grandstand. There was rage in his eyes as he spurred again
toward Blake, who he thought had profited by a lucky accident.
Unhampered by a buckler Blake took full advantage of the
nimbleness of the wiry horse he rode and which he had ridden daily
since his arrival in Nimmr, so that man and beast were well
accustomed to one another.
Again Sir Malud saw his blade glance harmlessly from the sword of
his antagonist and then, to his vast surprise, the point of Sir James'
blade leaped quickly beneath his buckler and entered his side. It was
not a deep wound, but it was painful and again it brought blood.
Angrily Malud struck again, but Blake had reined his charger quickly
to the rear and before Malud could gather his reins Blake had struck
him again, this time a heavy blow upon the helm.
Half stunned and wholly infuriated Malud wheeled and charged at full
tilt, once again determined to ride his adversary down. They met with
a crash directly in front of Gobred's loge, there was a quick play of
swords that baffled the eyesight of the onlookers and then, to the
astonishment of all, most particularly Malud, that noble sir knight's
sword flew from his grasp and hurtled to the field, leaving him
entirely to the mercy of his foe.
Malud reined in and sat erect, waiting. He knew and Blake knew that
under the rules that governed their encounter Blake was warranted
in running him through unless Malud sued for mercy, and no one,
Blake least of all, expected this of so proud and haughty a knight.
Sir Malud sat proudly on his charger waiting for Blake to advance
and kill him. Utter silence had fallen upon the stands, so that the
champing of Malud's horse upon its bit was plainly audible. Blake
turned to Sir Jarred.
"Summon a squire, sir knight," he said, "to return Sir Malud's sword
to him."
Again the stands rocked to the applause, but Blake turned his back
upon them and rode to Richard's side to wait until his adversary was
again armed.
"Well, old top," he inquired of Sir Richard, "just how much a dozen
am I offered for bucklers now?"
Richard laughed. "Thou hast been passing fortunate, James," he
replied; "but methinks a good swordsman would long since have cut
thee through."
"I know Malud would have if I had packed that chopping bowl along
on the party," Blake assured him, though it is doubtful if Sir Richard
understood what he was talking about, as was so often the case
when Blake discoursed that Richard had long since ceased to even
speculate as to the meaning of much that his friend said.
But now Sir Malud was rearmed and riding toward Blake. He
stopped his horse before the American and bowed low. "I do my
devoirs to a noble and generous knight," he said, graciously.
Blake bowed. "Are you ready sir?" he asked.
Malud nodded.
"On guard, then!" snapped the American.
For a moment the two jockeyed for position. Blake feinted and Malud
raised his buckler before his face to catch the blow, but as it did not
fall he lowered his shield, just as Blake had known that he would,
and as he did so the edge of the American's weapon fell heavily
upon the crown of his bassinet.
Malud's arm dropped at his side, he slumped in his saddle and then
toppled forward and rolled to the ground. Agile, even in his heavy
armor, Blake dismounted and walked to where his foe lay stretched
upon his back almost in front of Gobred's loge. He placed a foot
upon Malud's breast and pressed the point of his sword against his
throat.
The crowd leaned forward to see the coup-de-grace administered,
but Blake did not drive his point home. He looked up at Prince
Gobred and addressed him.
"Here is a brave knight," he said, "with whom I have no real quarrel. I
spare him to your service, Prince, and to those who love him," and
his eyes went straight to the eyes of the Princess Guinalda. Then he
turned and walked back along the front of the grandstand to his own
tilt, while Richard rode behind him, and the knights and the ladies,
the men-at-arms, the freedmen and the serfs stood upon their seats
and shouted their applause.
Edward was beside himself with joy, as was Michel. The former knelt
and embraced Blake's legs, he kissed his hand, and wept, so great
were his happiness and his excitement.
"I knew it! I knew it!" he cried. "Didst I not tell thee, Michel, that my
own sir knight would overthrow Sir Malud?"
The men-at-arms, the trumpeter and the grooms at Blake's tilt wore
grins that stretched from ear to ear. Whereas a few minutes before
they had felt ashamed to have been detailed to the losing side, now
they were most proud and looked upon Blake as the greatest hero of
Nimmr. Great would be their boasting among their fellows as they
gathered with their flagons of ale about the rough deal table in their
dining hall.
Edward removed Blake's armor and Michel got Richard out of his
amidst much babbling upon the part of the youths who could not
contain themselves, so doubly great was their joy because so
unexpected.
Blake went directly to his quarters and Richard accompanied him,
and when the two men were alone Richard placed a hand upon
Blake's shoulder.
"Thou hast done a noble and chivalrous thing, my friend," he said,
"but I know not that it be a wise one."
"And why?" demanded Blake. "You didn't think I could stick the poor
mutt when he was lying there defenseless?"
Richard shook his head. "'Tis but what he would have done for thee
had thy positions been reversed," said he.
"Well, I couldn't do it. We're not taught to believe that it is exactly
ethical to hit a fellow when he's down, where I come from," explained
Blake.
"Had your quarrel been no deeper than appeared upon the surface
thou might well have been thus magnanimous; but Malud be jealous
of thee and that jealousy will be by no means lessened by what hath
transpired this day. Thou might have been rid of a powerful and
dangerous enemy had thou given him the coup-de-grace, as was thy
right; but now thou hast raised up a greater enemy since to his
jealousy is added hatred and envy against thee for thy prowess over
him. Thou didst make him appear like a monkey, James, and that Sir
Malud wilt never forgive, and I know the man."
The knights and ladies attached to the castle of Gobred ate together
at a great table in the huge hall of the castle. Three hundred people
could be accommodated at the single board and it took quite a
company of serving men to fill their needs. Whole pigs, roasted,
were carried in upon great trenchers and there were legs of mutton
and sides of venison and bowls of vegetables, with wine and ale,
and at the end immense puddings.
There was much laughter and loud talking, and it all presented a wild
and fascinating picture to Sir James Blake as he sat at the lower end
of the table far below the salt that night, in his accustomed place as
one of the latest neophytes in the noble ranks of the knighthood of
Nimmr.
The encounter between himself and Malud was the subject of the
moment and many were the compliments bestowed upon him and
many the questions as to where and how he had acquired his
strange technique of swordsmanship. Although they had seen him
accomplish it, yet they still appeared to believe it inconceivable that a
man might prevail without a buckler over one who carried this
essential article of defense.
Prince Gobred and his family sat, with the higher nobles of Nimmr, at
a table slightly raised above the rest of the board and running across
its upper end, the whole forming a huge T. When he wished to speak
to anyone farther down the table he resorted to the simple expedient
of raising his voice, so that if several were so inclined at the same
time the room became a bedlam for uproar and confusion.
And as Blake sat at the farthest end of the table it was necessary for
one at Gobred's end to scream to attract attention, though when it
was discovered that it was the prince who was speaking the rest of
the company usually lapsed into silence out of respect for him,
unless they were too far gone in drink.
Shortly after the feasters were seated Gobred had arisen and lifted
his goblet high in air, and silence had fallen upon the whole company
as knights and ladies rose and faced their prince.
"Hal to our King!" cried Gobred. "Hal to our liege lord, Richard of
England!"
And in a great chorus rose the answering "Hal!" as the company
drank the health of Richard Coeur de Lion seven hundred and
twenty-eight years after his death!
Then they drank the health of Gobred and of the Princess Brynilda,
his wife, and of the Princess Guinalda, and each time a voice
boomed from just below the dais of the prince: "Here I be looking at
thee!" as Sir Richard with a proud smile displayed his newly acquired
knowledge.
Again Prince Gobred arose. "Hal!" he cried, "to that worthy sir knight
who hath most nobly and chivalrously acquitted himself in the lists
this day! Hal to Sir James, Knight Templar and, now, Knight of
Nimmr!"
Not even the name of Richard I of England had aroused the
enthusiasm that followed the drinking to Sir James. The length of the
long hall Blake's eyes travelled straight to where Guinalda stood. He
saw her drink to him and he saw that her eyes were regarding him,
but the distance was too great and the light of the pitch torches and
the oil cressets too dim for him to see whether her glance carried a
message of friendship or dislike.
When the noise had partially subsided and the drinkers had retaken
their seats Blake arose.
"Prince Gobred," he called the length of the room, "knights and
ladies of Nimmr, I give you another toast! To Sir Malud!"
For a moment there was silence, the silence of surprise, and then
the company arose and drank the health of the absent Sir Malud.
"Thou are a strange sir knight, with strange words upon thy lips and
strange ways, Sir James," shouted Gobred, "but though thou callest
a hal 'a toast' and thy friends be 'old top' and 'kid,' yet withal it
seemeth that we understand thee and we would know more about
thy country and the ways of the noble knights that do abide there.
"Tell us, are they all thus chivalrous and magnanimous to their fallen
foes?"
"If they're not they get the raspberry," explained Blake.
"'Get the raspberry'!" repeated Gobred. "'Tis some form of
punishment, methinks."
"You said it, Prince!"
"Of a surety I said it, Sir James!" snapped Gobred with asperity.
"I mean, Prince, that you hit the nail on the head—you guessed it the
first time. You see the raspberry is about the only form of punishment
that the Knights of the Squared Circle, or the Knights of the Diamond
can understand."
"'Knights of the Squared Circle'! 'Knights of the Diamond'! Those be
knightly orders of which I wot not. Be they doughty knights?"
"Some of them are dotty, but a lot of them are regulars. Take Sir
Dempsey, for instance, a knight of the Squared Circle. He showed
'em all he was a regular knight in defeat, which is much more difficult
than being a regular knight in victory."
"Be there other orders of knighthood these days?" demanded
Gobred.
"We're lousy with them!"
"What?" cried Gobred.
"We're all knights these days," explained Blake.
"All knights! Be there no serfs nor yeomen? 'Tis incredible!"
"Well, there are some yeomen in the navy, I think; but all the rest of
us, pretty much, are knights. You see things have changed a lot
since the days of Richard. The people have sort of overthrown the
old order of things. They poked a lot of ridicule at knights and wanted
to get rid of knighthood, and as soon as they had they all wanted to
be knights themselves; so we have Knights Templar now and
Knights of Pythias and Knights of Columbus and Knights of Labor
and a lot more I can't recall."
"Methinks it must be a fine and noble world," cried Gobred, "for what
with so many noble sir knights it would seemeth that they must often
contend, one against another—is that not true?"
"Well, they do scrap some," Blake admitted.
CHAPTER XV
The Lonely Grave

Within the dark interior of the beyt Stimbol could see nothing. Just
before him he heard a man breathing heavily as might one in a
troubled sleep. The would-be murderer paused to steady his nerves.
Then, on hands and knees, he crept forward inch by inch.
Presently one of his hands touched the prostrate figure of the
sleeper. Lightly, cautiously, Stimbol groped until he had definitely
discovered the position in which his victim lay. In one hand, ready, he
grasped the keen knife. He scarce dared breathe for fear he might
awaken the ape-man. He prayed that Tarzan was a sound sleeper,
and he prayed that the first blow of his weapon would reach that
savage heart.
Now he was ready! He had located the exact spot where he must
strike! He raised his knife and struck. His victim shuddered
spasmodically. Again and again with savage maniacal force and
speed the knife was plunged into the soft flesh. Stimbol felt the warm
blood spurt out upon his hand and wrist.
At length, satisfied that his mission had been accomplished, he
scurried from the beyt. Now he was trembling so that he could
scarcely stand—terrified, revolted by the horrid crime he had
committed.

The Wiley 5G Ref Security 1St Edition Rahim Tafazolli Full Chapter PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

The Wiley 5G Ref Security 1St Edition Rahim Tafazolli Full Chapter PDF

Uploaded by

Copyright:

Available Formats

The Wiley 5G REF: Security 1st Edition

5G Wireless Network Security and Privacy Dongfeng Fang

Impact 1st Edition Ali Rahim

UAV Communications for 5G and Beyond (Wiley - IEEE) 1st

Vannithamby, R: 5G Verticals (Wiley - IEEE) Rath

Exam Ref AZ-104 Microsoft Azure Administrator 1st

5G & Beyond For Dummies Larry Miller

Rights As Security: The Theoretical Basis Of Security

People-centric security : transforming your enterprise

Limit of Liability/Disclaimer of Warranty

Library of Congress Cataloging-in-Publication Data Applied for:

Cover Design: Wiley

Set in 10/12pt WarnockPro by Straive, Chennai, India

1 5G Mobile Networks Security Landscape and Major Risks 1

3 5G Security – Complex Challenges 43

4 Physical-Layer Security for 5G and Beyond 59

Physical-Layer Security for 5G Technologies 70

5 Security for Handover and D2D Communication in 5G HetNets 77

6 Authentication and Access Control for 5G 113

Motivated Use Cases 124

7 5G-Core Network Security 133

8 MEC and Cloud Security 151

9 Security in Network Slicing 167

Security Considerations in Network Slicing 171

10 VNF Placement and Sharing in NFV-Based Cellular Networks 179

11 Security Monitoring and Management in 5G 199

12 Security for Vertical Industries 215

13 Introduction to IoT Security 229

14 Privacy in the 5G World: The GDPR in a Dataﬁed Society 269

The Risks and Threats to Privacy in 5G 276

15 Structural Safety Assessment of 5G Network Infrastructures 283

unexpected privacy breaches. The introduction of centralized controllers with the

Dr. Madhushanka Liyanage

Iris Adam Carla Fabiana Chiasserini

João André Silke Holtmanns

Emmanuel Bertin Anca D. Jurcut

Aapo Kalliola Yoan Miche

Vikramajeet Khatri Rupendra Nath Mitra

Alican Ozhelvaci Tiago de J. Souza

German Peinado Jani Suomalainen

Pasika Ranaweera Rui Travanca

5G Mobile Networks Security Landscape and Major Risks

4G to 5G: A Paradigm Shift

3rd Party NEF AF

De-concealing Function (SIDF) decrypts a Subscription Concealed Identiﬁer (SUCI) to

Salient Features of 5G Network

Slice 1: Public transport

Figure 3 Schematic diagram of network slicing in an evolved network architecture of 5G coexisting

• Multiaccess Edge Computing: 5G enables operators to host latency-critical services

The Threat Landscape and Security Roadmap

5G Network Threat Surface

Table 1 Deﬁnitions of some common cybersecurity terms.

Figure 4 Evolved security threat landscape for 5G network.

intrusion detection systems, updating authentication protocols, and ﬁxing security

Inspecting 3GPP Security Proposals

Table 2 Key 5G security recommendations by 3GPP.

Security Research Groups and Visions

Table 3 A synopsis of 5G Security Research Groups and deliverables.

Why Securing 5G is Challenging?

Billions of Hackable IoT Devices

The Convergence of IT and Telecom Infrastructure

attackers. Another risk of using open-source software modules at enterprise scale is

Real-time E2E Security Monitoring at Scale