Security Assurance for 5G Split gNB and AMF Vulnerabilities

1.1.1. Protocol Vulnerabilities

Recent 3GPP standards, particularly TS 33.501 [7] and TS 33.512 [5], have identified multiple vulnerabilities in the NAS and RRC protocols of 5G networks. NAS replay attacks can exploit unsynchronized sequence numbers, allowing attackers to resend expired authentication requests to gain unauthorized access. Meanwhile, RRC downgrade attacks exploit unencrypted signaling exchanges to force the connection to downgrade to a less secure mode.

To address these issues, stronger encryption mechanisms and stricter sequence number checks can be introduced at the access layer (AS) to reduce the risks effectively. These vulnerabilities affect network reliability and allow attackers to manipulate communication processes. Experts emphasize the need to address these challenges through robust encryption mechanisms, data integrity protection, and unique identification of data packets.

In replay attacks, adversaries retransmit intercepted messages to deceive network entities, thereby subverting authentication and session management processes. Strict sequence-number checks and timestamp verification ensure message timeliness and legitimacy, mitigating associated risks. Furthermore, advanced encryption technologies and AI-driven anomaly detection can enhance threat identification and response capabilities in real time. Strengthening the security of NAS and RRC protocols can effectively maintain the confidentiality, integrity, and availability of 5G networks and defend against growing cyber threats.

1.1.2. Man-in-the-Middle (MitM) Attacks

Man-in-the-middle (MitM) attacks pose a serious threat to 5G networks, especially in the unprotected F1-C and N2 signaling channels. Research results show that attackers can use malicious base stations to intercept control-plane messages and tamper with authentication and key-exchange procedures. Vulnerabilities in the EAP-AKA authentication mechanism can be exploited due to weak integrity verification [8], allowing adversaries to inject forged security mode commands. To address these vulnerabilities, enforcing end-to-end encryption at the NGAP layer and periodically renegotiating session keys are essential measures to mitigate the risk of interception. Standard defenses such as secure key exchange and integrity checks have been widely adopted [9]. In addition, emerging approaches such as quantum key distribution (QKD) are being further investigated to enhance the security resilience of 5G networks.

1.1.3. Distributed Denial of Service (DDoS) Attacks

Distributed Denial-of-Service (DDoS) attacks [10,11] can disrupt 5G services on a large scale, posing a significant threat to 5G information security. Mitigating such threats typically involves using anomaly detection systems or rate limiting. Common approaches include using artificial intelligence (AI) and machine learning (ML) to analyze and identify traffic patterns to detect and prevent malicious activity.

1.1.4. Network Slicing Vulnerabilities

The flexibility of network slicing also introduces potential security risks. Network slicing security can be achieved through slice isolation or other measures to prevent cross-slice attacks [12,13], such as access control policies and real-time monitoring of slice-specific traffic. These measures ensure that the compromise of one slice does not affect the security of other slices.

1.1.5. Internet of Things and Device-Level Security

Internet of Things (IoT) device vulnerabilities [14,15], particularly in 5G network environments, have become a significant security issue. Common issues include weak authentication mechanisms, insufficient encryption, and outdated firmware. Proposed solutions for enhancing IoT security include secure boot processes, firmware integrity checks, and device-level encryption protocols. Research emphasizes the importance of anomaly detection systems and rate-limiting mechanisms for mitigating these threats. Leveraging artificial intelligence and machine learning for traffic analysis and pattern recognition has emerged as a promising real-time strategy for detecting and preventing malicious activities.

2.1.1. Protocol Weaknesses

Vulnerabilities in signaling protocols such as Non-Access Stratum (NAS) and Radio Resource Control (RRC), as defined in 3GPP TS 33.501 (Release 18) and 3GPP TS 33.512 (Release 18), render them susceptible to attacks like replay and downgrade [16,17,18]. Without adequate encryption and integrity protection, attackers can manipulate these protocols to disrupt communications or downgrade security settings to weaker 4G or 3G protocols. To address this issue, mitigation measures include implementing robust encryption algorithms, such as AES-256, for NAS signaling as specified in 3GPP TS 33.501, and ensuring integrity protection for all signaling data using HMAC-SHA-256. replay prevention mechanisms incorporate unique sequence identifiers and timestamp-based validation, as mandated by 3GPP TS 33.512, to detect and block repeated messages. To ensure compliance and robustness, these standards-based countermeasures are tested within the SCAS framework, using specific test cases that validate encryption strength and sequence number integrity under simulated attack scenarios.

To strengthen these countermeasures, the proposed framework integrates AES-256-GCM encryption for NAS signaling and HMAC-SHA-256 integrity protection for all control-plane messages. Replay prevention is enforced using unique sequence identifiers and timestamp-based validation, in line with the 3GPP TS 33.512 specifications. In addition, dynamic key refresh mechanisms are applied during session establishment and at predefined intervals to minimize exposure to key compromise. These cryptographic safeguards are validated within the SCAS framework using simulated replay and downgrade attacks, and their performance is evaluated using metrics such as latency overhead, detection accuracy, and false-positive rates in anomaly detection.

2.1.2. Man-in-the-Middle (MitM) Threats

Man-in-the-middle (MitM) attacks pose a significant threat to network security by intercepting or manipulating communications between 5G components. The distributed architecture of 5G networks increases the opportunities for attackers to position themselves along the communication path, particularly across interfaces such as F1, N2, and N3, as outlined in 3GPP TS 33.523 (Release 18). Mitigation strategies encompass end-to-end encryption using Transport Layer Security (TLS) 1.3 for N2 interface communications, secure key exchange mechanisms based on the Diffie-Hellman protocol, and periodic data integrity verification via cryptographic checksums, as recommended by 3GPP TS 33.501. Emerging technologies, such as Public Key Infrastructure (PKI) and Zero Trust frameworks, further enhance resilience against MitM attacks by enforcing mutual authentication and continuous verification, ensuring robust protection across diverse 5G network scenarios [19].

2.1.3. Distributed Denial of Service (DDoS) Risks

The scalability of 5G networks increases the risk of DDoS attacks, which can overwhelm network resources and disrupt services. Common attack vectors include flooding signaling pathways or exploiting compromised IoT devices. Effective countermeasures include the use of rate limiting, traffic filtering, and AI-driven anomaly detection systems to identify and block malicious traffic patterns in real time.

2.1.4. IoT Device Vulnerabilities

The integration of IoT devices into 5G networks has introduced new attack vectors. Many IoT devices lack proper authentication, encryption, and firmware updates, making them vulnerable to exploitation. Recommended mitigations include secure boot processes, periodic firmware validation, and enforcing device-level security standards. Additionally, network segmentation can isolate compromised devices, preventing the lateral movement of attacks.

2.1.5. Network Slicing Isolation Challenges

While network slicing offers flexibility by creating virtual networks tailored to specific use cases, it also introduces risks of cross-slice attacks if isolation is not adequately enforced. An attacker accessing one slice can exploit shared resources to compromise others. Mitigation strategies include robust slice-isolation mechanisms, continuous traffic monitoring, and dynamic access-control policies to safeguard slice-specific data and functionality [20].

2.1.6. Software Vulnerabilities in Virtualized Environments

5G networks are based on SDN and NFV architectures, which introduce software vulnerabilities. Attackers can exploit flaws in the hypervisor, API, or orchestration system to compromise network integrity. Risk mitigation can include regular vulnerability assessments, timely software patching, secure configuration management, and hypervisor hardening [21,22].

2.2.1. Replay and Tampering Protection for gNB-CUs

Replay attacks and data tampering present significant threats to the integrity and reliability of gNB-CUs in 5G networks. To rigorously evaluate their mitigation capabilities, this study employed a structured methodology consisting of four steps: (1) UE Registration and Security Establishment: The UE initiates the RRC Setup and Security Mode procedures, which establish a secure channel using the Authentication and Key Agreement (AKA) protocol defined in 3GPP TS 33.501 [7]. (2) Replay Injection: This attack simulates adversary behavior by retransmitting previously valid messages (such as Security Mode Complete) or uplink data with incorrect MAC values. Replay detection mechanisms combine timestamp verification with secure nonce generation to ensure that retransmitted packets are rejected. (3) Tampering Detection and Integrity Verification: Packet authenticity is ensured through techniques such as cryptographic hashing and digital signatures. Abnormal or replayed messages are detected and discarded at both the RRC and PDCP layers. (4) Secure Session Continuation: Only authenticated packets are allowed to proceed with PDU session establishment and secure uplink/downlink data exchange. End-to-end encryption and session-based key management further ensure confidentiality and integrity between the gNB-CU and the UE.

This replay and tamper protection framework illustrates the implementation of integrity protection mechanisms defined by 3GPP, integrating timestamp verification, cryptographic authentication, and dynamic session key management to effectively mitigate replay and tampering threats throughout the communication process [26,27,28].

Figure 1 shows the Sequential flow of replay and tamper protection testing in the 5G core network. Blue arrows indicate normal signaling from UE registration to session establishment; red arrows indicate malicious replay behavior (e.g., retransmitting a Security Mode Complete message with an incorrect MAC-I). Integrity check failures at the RRC and PDCP layers are indicated by a red X, signifying that the packet has been rejected. Only messages that pass verification can proceed to complete secure session establishment, fully demonstrating the implementation of the integrity protection strategy in 3GPP TS 33.501.

2.2.2. Multi-SCAS Testing with Single-UE Connections

Conventional SCAS (Security Assurance Specification) testing for gNB-CU often involves isolated test cases, leading to prolonged testing times and substantial resource utilization. This approach proposes integrating multiple SCAS test scenarios into a single UE session, thereby improving the testing process's efficiency. By leveraging dynamic session management techniques, the framework reduces signaling exchange redundancy and optimizes network resource allocation.

In particular, the method employs layered signaling protocols that enable concurrent validation of security parameters across various network functions, including gNB, AMF, and SMF. This multi-faceted approach not only accelerates the overall testing cycle but also ensures comprehensive coverage of potential security vulnerabilities. Figure 2 highlights these concurrent testing interactions, demonstrating the streamlined flow of signaling messages between the UE, AMF, and gNB, which facilitates effective anomaly detection and ensures robust network security.

Additionally, the architecture supports seamless transitions between test scenarios without requiring session reinitialization, thereby minimizing overhead and enhancing throughput. This unified approach improves the reliability of 5G network security evaluations by providing real-time insights into the performance of multiple components under diverse conditions.

2.2.3. Interface Security: F1, N2, and N3 Protections

The gNB-CU communicates through multiple interfaces, each presenting distinct security challenges and requiring robust protection mechanisms.

1. F1 Interface: Responsible for communication between the gNB-CU and gNB-DU, this interface is particularly vulnerable to integrity attacks targeting radio signals. Encryption protocols and integrity checks are implemented to secure signaling data transmission and counter such threats.

2. N2 Interface: Handling control plane communication between the gNB-CU and the core network, this interface demands stringent confidentiality measures. Advanced Encryption Standard (AES) protects control-plane data from unauthorized access and tampering.

3. N3 Interface: Facilitating user plane data transmission, the N3 interface is secured through comprehensive data protection strategies, including encryption and traffic isolation, ensuring user data remains secure during transit.

The gNB-CU communicates via multiple interfaces, each presenting unique security challenges and necessitating robust protection mechanisms. Figure 3 provides a clear diagram of the security validation processes for the F1, N2, and N3 interfaces, detailing how encryption standards, integrity checks, and isolation methods are applied. This workflow-based approach ensures each interface is properly secured, meeting strict security standards and strengthening the overall resilience of the 5G network infrastructure.

2.2.4. Security Mechanisms: Integrity, Ciphering, and Replay Prevention

To keep Radio Resource Control (RRC) signaling and user plane data transmission secure, strong integrity protection mechanisms are essential. This includes employing advanced encryption algorithms to ensure data confidentiality and dynamic key management protocols to prevent unauthorized access. The system also incorporates integrity checks to confirm that the data is authentic and hasn’t been tampered with during transmission. Additionally, to prevent replay attacks, where hackers try to reuse intercepted data, sequence number checks are put in place to stop this kind of exploitation. Several testing procedures are performed to ensure the encryption holds up against interception, unauthorized decryption, and replay attacks, creating a secure and reliable communication environment [26].

2.2.5. SCAS Automation for Fault Detection

Automation significantly enhances Security Assurance Specifications (SCAS) testing by efficiently identifying unresponsive components within the gNB-CU environment. The system employs automated scripts and real-time monitoring tools to continuously scan network components, promptly identifying anomalies such as inactive nodes, protocol failures, and unexpected latencies. This proactive monitoring generates immediate alerts, enabling swift intervention and minimizing service disruptions. Automated error-handling routines further ensure that detected faults are logged, analyzed, and resolved without manual intervention, thereby sustaining continuous security validation and operational integrity [26]. The flowchart illustrates the detection and response mechanisms for non-responsive elements, including initial connectivity checks, heartbeat signal verification, and automated error correction processes [26] (see Figure 4).

2.2.5.1. Stepwise SCAS Testing Implementation

A systematic and layered approach to SCAS testing ensures a comprehensive security assessment of the gNB-CU across various operational phases. The process begins with UE (User Equipment) authentication, verifying device legitimacy through mutual authentication protocols and secure key exchanges. Subsequent phases involve rigorous testing of the control plane, user plane, and transport layers, ensuring each is robust against potential threats [26].

Each testing cycle is followed by automated resets and state reinitializations, ensuring the system is consistently ready for subsequent test iterations and preventing cumulative errors [26].

Figure 5 presents the SCAS testing workflow, outlining the sequence from connection setup and execution of predefined test cases to iterative reset mechanisms that facilitate continuous validation and fault isolation [26].

2.3.1. Enhanced SCAS Testing Mechanism

An intelligent automated Security Assurance Specification (SCAS) testing system is proposed to address the complexity and high resource requirements of SCAS testing in 5G networks. Unlike prior SCAS testing approaches, this work introduces a novel single-UE multi-SCAS testing framework that enables concurrent validation with reduced overhead. This new approach combines multiple test cases into fewer sessions, making testing much smoother while still fully covering the security requirements defined in 3GPP specifications, TS 33.512, which specifies the use of sequence number validation and timestamp-based verification to detect repeated NAS messages. The methodology is structured into two primary components:

1. Single-UE Connection for Multi-SCAS Testing: A single-user equipment (UE) registration instance is leveraged to validate multiple SCAS test cases simultaneously. This methodology reduces connection overhead, optimizes resource utilization, and accelerates testing workflows by minimizing the need for repeated authentication and registration. The system dynamically manages session contexts, ensuring a single UE can sequentially execute diverse SCAS test scenarios without reinitialization. To enhance practical applicability, the testing framework includes scenarios such as simulated man-in-the-middle (MitM) attacks on the N2 interface and replay attacks on NAS signaling. These scenarios are designed to mimic realistic network conditions, ensuring robust security testing of 5G network functions like the AMF and gNB-CU under diverse attack vectors. The system substantially expands scenario coverage by supporting up to ten concurrent SCAS test cases per UE session, addressing vulnerabilities across the control plane, user plane, and transport layers.

2. Automated Non-Responsive Element Detection: The framework includes continuous real-time monitoring of the Access and Mobility Management Function (AMF) responses. Automated recovery procedures mitigate faults such as signaling failures and session drops, as validated by protocols such as SCTP, NAS, and NGAP. This mechanism reduces manual intervention and ensures operational reliability, as illustrated in Figure 6. It detects non-responsive elements promptly and mitigates faults through automated recovery procedures. This proactive mechanism enhances reliability by reducing manual intervention and swiftly addressing faults such as signaling failures, session drops, or delayed authentication. To ensure comprehensive fault detection in operational environments, our practical testing scenarios include simulated network outages and protocol failures, validated through real-time monitoring of SCTP, NAS, and NGAP protocols.

The attached flow diagram (Figure 7) illustrates the process flow [29], showcasing how a single UE connection efficiently manages multiple SCAS test cases concurrently. It details the signaling interactions with core network components, including the AMF, Authentication Server Function (AUSF), and gNodeB (gNB), demonstrating the streamlined signaling flow and optimized session handling under realistic network conditions. This enhanced mechanism ensures that 5G core security testing is more efficient, less resource-intensive, and highly reliable.

2.3.2. Implementation Details and Technical Solutions

The proposed framework is organized into a straightforward step-by-step process. SCAS requirements are first defined in accordance with 3GPP TS 33.512, and a single-UE testbed is established using NFV-based AMF, gNB, AUSF, and SMF functions. Multi-SCAS scenarios are then executed within one UE session to minimize overhead, with continuous monitoring of latency, resource utilization, and test coverage. Finally, validation against anomaly- and fault-detection rules ensures reliable identification of replay, MitM, and non-responsive elements under realistic conditions. This solution enhances the SCAS testing process by streamlining UE registration to cover multiple test cases in a single session. This optimization reduces the need for repetitive registration steps, minimizing resource consumption and latency. The test environment leverages a 5G network setup that simulates critical network functions, including the AMF, gNB, AUSF, and SMF, using network function virtualization (NFV) platforms, compliant with 3GPP TS 33.512. Key test parameters include signaling protocols such as the Stream Control Transmission Protocol (SCTP) for N2 interface communications, the Non-Access Stratum (NAS) for UE-AMF interactions, and the Next Generation Application Protocol (NGAP) for gNB-AMF signaling.

Each test sequence is meticulously synchronized with AMF, UE, AUSF, and gNB signaling exchanges, ensuring precise validation and efficient execution [29,30]. The unified data analysis provides comprehensive insights into security performance by processing aggregate test outputs across diverse scenarios and enabling scalability for large-scale deployments. Specific metrics evaluated include reductions in session setup time and test case concurrency levels, up to 10 simultaneous SCAS test cases per UE session. The proposed SCAS testing framework streamlines UE registration to cover multiple test cases in a single session, minimizing resource consumption and latency. The methodology follows a structured, step-by-step process:

1. Network Access Initiation: The UE sends an initial access request to the AMF, triggering the testing framework, as shown in Figure 7.

2. Concurrent Execution of SCAS Test Cases: Multiple test cases run simultaneously, each validated through defined signaling interactions involving SCTP, NAS, and NGAP protocols, reducing overall test time by eliminating repeated testing procedures.

3. Unified Data Analysis: Test outputs are aggregated for comprehensive analysis, allowing for holistic assessment of security parameters and streamlined reporting, as depicted in Figure 6 for non-responsive device detection.

The scalable framework is validated across different network functions, including AMF, gNB, AUSF, and SMF, and across deployment scenarios. Figure 7 illustrates the signaling flow for concurrent test case execution, while Figure 6 details the automated detection and alert mechanism for non-responsive elements, ensuring alignment with the described methodology.

A vital enhancement is the automated detection mechanism for non-responsive devices during SCAS testing [29]. This mechanism continuously monitors device responsiveness across protocols such as SCTP, NAS, and NGAP, facilitating early fault identification, as shown in Figure 8. This process includes:

1. Connectivity Checks: Initiating checks across essential protocols to ensure continuous device responsiveness.

2. Fault Logging: Documenting faults when devices fail to respond within defined thresholds.

3. Automated Alerts: Notifying operators promptly, enabling swift troubleshooting, and minimizing downtime.

The detection and alert flow are visually represented to illustrate the sequence of monitoring, fault detection, logging, and alerting, ensuring seamless management of non-responsive devices.