Abstract:Thanks to technologies such as virtual network function the Fifth Generation (5G) of mobile networks dynamically allocate resources to different types of users in an on-demand fashion. Virtualization extends up to the 5G core, where software-defined networks and network slicing implement a customizable environment. These technologies can be controlled via application programming interfaces and web technologies, inheriting hence their security risks and settings. An attacker exploiting vulnerable implementations of the 5G core may gain privileged control of the network assets and disrupt its availability. However, there is currently no security assessment of the web security of the 5G core network.

What problem does this paper attempt to address?

### What problems does this paper attempt to solve? This paper aims to conduct the first comprehensive security assessment of the 5G Core from the perspective of Web security. Specifically, the author attempts to solve the following problems: 1. **Insufficient Web security assessment of the 5G core network**: - Although the 5G core network has made significant progress in virtualization and software - defined networking, there is currently a lack of security assessment of its Web components. In particular, the security risks brought by these new technologies through application programming interfaces (APIs) and Web technologies have not been fully studied. 2. **Identify potential threats and attack vectors**: - The author uses the STRIDE threat - modeling method (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to systematically identify all possible threat vectors that may affect the 5G core network and describes in detail how a successful attack of each threat affects the 5G network. 3. **Test the security of existing 5G core implementations**: - The author selects three widely - used open - source 5G core implementations (Open5GS, Free5GC, and OpenAirInterface) and conducts extensive tests on these implementations through a series of penetration - testing tools to verify whether they are vulnerable to the identified attack vectors. 4. **Reveal vulnerabilities in existing implementations**: - The test results show that all of these 5G core implementations have at least two identified attack vectors, indicating that current 5G core development needs to pay more attention to security measures. ### Formula representation Although the content of this paper mainly involves network security assessment, for the sake of completeness of the answer, the following are the formula representations of some key concepts mentioned in the paper: - **STRIDE threat model**: \[ \text{STRIDE}=\{\text{Spoofing}, \text{Tampering}, \text{Repudiation}, \text{Information Disclosure}, \text{Denial of Service}, \text{Elevation of Privilege}\} \] - **DoS attack example**: \[ \text{DoS}=\left\{\begin{array}{ll} \text{Send a large number of requests to the target server}&\text{Exhaust the server resources}\\ \text{Cause the service to be unavailable or the response to be delayed}& \end{array}\right. \] ### Summary Through the above analysis, the paper emphasizes the vulnerability of the 5G core network in terms of Web security and calls for more attention to security in future research and development, especially in virtualization and software - defined networking environments.

Penetration Testing of 5G Core Network Web Technologies

Advanced Penetration Testing for Enhancing 5G Security

Machine Learning Assisted Security Analysis of 5G-Network-Connected Systems

5G Security Challenges and Solutions: A Review by OSI Layers

Automated Attack and Defense Framework for 5G Security on Physical and Logical Layers

5G System Security Analysis

Survey on 5G Physical Layer Security Threats and Countermeasures

Towards Securing Availability in 5G: Analyzing the Injection Attack Impact on Core Network

Security and Protocol Exploit Analysis of the 5G Specifications

Towards Dynamic Threat Modelling in 5G Core Networks Based on MITRE ATT&CK

Unprotected 4G/5G Control Procedures at Low Layers Considered Dangerous

Security Vulnerabilities in 5G Non-Stand-Alone Networks: A Systematic Analysis and Attack Taxonomy

Guidelines for 5G End to End Architecture and Security Issues

SoK: Evaluating 5G Protocols Against Legacy and Emerging Privacy and Security Attacks

Security Analysis of Critical 5G Interfaces

5Greplay: a 5G Network Traffic Fuzzer -- Application to Attack Injection

Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples

The current state of affairs in 5G security and the main remaining security challenges

Security and Trust in the 6G Era: Risks and Mitigations

Measuring the Deployment of 5G Security Enhancement

Software Enabled Security Architecture and Mechanisms for Securing 5G Network Services