# Survey on 5G Physical Layer Security Threats and Countermeasures
## 3 Possible Attack Types on Physical and MAC Layer
### Smart Jamming  
Knowing the frame structure of 5G transmissions, smart jamming attacks can be targeted against various physical signals in both UL and DL directions, as described bellow. * Synchronization signals in NR are more resilient to jamming [56] due to Gold sequence low cross correlation allowing the UE to distinguish between nearby base stations on the same channel at low SINR. Thus, jammers need to transmit with high power in order to jam the synchronization signals. The SS bursts are mapped to the resource grid based on SCS, carrier frequency, and offset-ref-low-scs-ref-PRB parameters [57]. A jammer targeting the PSS and/or SSS in time needs to synchronize with the cell and identify the SCS, which can often be determined using public band plans. This is slightly more complex than in LTE [19]. * The Physical Broadcast Channel (PBCH) is located in the same slot as PSS and SSS. The combination of PSS/SSS with PBCH, known as SSB, is transmitted over 4 OFDM symbols and 240 subcarriers (20 RBs). The Synchronization Signal Block is transmitted with a variable interval with at least a period of 20 ms, depending on SCS. The allocation in time-frequency space is variable to the center or to the side of the DL channel. Jamming the PBCH prevents the UE from accessing the critical information it needs to connect to a cell. If the jammer can synchronize with the target cell, PBCH jamming can be done in a time-selective manner. Alternatively, the jammer could continuously jam the subcarriers on which the PBCH is located. The latter method involves jamming 240 subcarriers. To put this into context, a 20 MHz DL with a 15 kHz SCS has 1272 subcarriers. Therefore, this would mean jamming approximately 19% of the DL signal, resulting in a jamming gain of approximately 7 dB compared to barrage jamming [56; 73]. * The Physical Downlink Control Channel (PDCCH) is used to send control information to the UE to schedule DL and UL transmission and defines its modulation and coding and carries HARQ and DCI messages. The PDCCH always starts in the first symbol of each slot, is Quadriphase Phase Shift Keying (QPSK) modulated, and uses polar coding. To determine PDCCH localization in the time-frequency grid, the CORESET parameters have to be demodulated [57]. To successfully jam the PDCCH, the jammer has to set a valid jamming duty cycle according to the CORESET time duration parameters [56]. DCI is vulnerable to various passive attacks, such as localization and traffic fingerprinting, which infer users' information from allocated resources. * The Physical Uplink Control Channel (PUCCH) carries control information about the Scheduling Request (SR), HARQ, UL CSI, and others [74]. There are five formats of PUCCH carrying various parameters provided by higher layers. The PUCCH is modulated by Binary Phase Shift Keying (BPSK) or QPSK and can be coded by polar or simplex or Reed Muller codes. PUCCH can also implement inter slot hopping to reduce interference. Similarly to LTE, some control information can be carried by PUSCH. This makes PUCCH very unreliable for jamming. * Reference signals are used for the channel estimation of DM-RS or for phase tracking the Phase Tracking Reference Signal (PT-RS). DM-RS can be assigned in both the time and frequency domains, and they are separated by physical channels; compared to LTE, DM-RS are assigned in the frequency domain and are transmitted in specific resource blocks within the LTE carrier. For the jammer, the ideal Reference Signal (RS) to disrupt is the one that requires minimal energy, but that is crucial for the link's operation. The DM-RS for the PBCH fulfill the criteria as it is consistently located and only needs the cell ID and PBCH location, which a time-synchronized jammer can easily know. The DM-RS for the PBCH takes up a quarter of the PBCH's Resource Elements (REs) and can be jammed without cell synchronization by disrupting the correct 60 subcarriers. PT-RS for the PDSCH are used only when the higher layer parameter is enabled.