# An Introduction of a Modular Framework for Securing 5G Networks and Beyond
## 2 Related Work
### Security Mechanisms
#### 2.1.1 Authentication  
There are two authentication procedures specified in the 5G standard [6], i.e., primary authentication with two methods, namely 5G-AKA and Extensible Authentication Protocol (EAP)-AKA' and secondary authentication based on the EAP framework, which is an important step for 5G to become an open network platform. The UE and network authentication methods in 5G are classified as primary authentication. It is comparable to that used in the legacy systems, however, in 5G, the HN has been given more control during the authentication procedure. This procedure has an in-built home control, which allows the HN to be notified when the UE is authenticated in an SN and to make the final decision on mutual authentication with the UE, whether it agrees with the message exchange and verification process [6]. This applies to the authorisation process for non-3 GPP technologies such as IEEE 802.11, due to it being independent of radio access technology. Secondary authentication provides secure communication between UE and DN outside the mobile operator domain. EAP-based authentication techniques and related credentials can be utilised for this. The UE can be authenticated with DN and obtain authorisation on establishing a data path from the operator network to DN, assisted by the HN Session Management Function (SMF). In this case, the DN could be a third-party SP. The DN might be providing data services such as operator services, Internet access or content services. The DN function has been mapped onto the third party domain in 5G architecture because of secondary authentication provided by DN Authentication Authorisation Accounting (AAA) servers [8]. In another applicable scenario, the HN might provide infrastructure services via network slices to other MNOs or SPs, even though they are in the same network domain; however, the service and security provision are handled by another party, thereforesecondary authentication could be applied to internal DN [9]. The primary and secondary authentications are discussed in detail in [10; 11; 12; 13], respectively.  
Mutual authentication is achieved when both parties confirm each other's identities and agree on a session key. The access security for the New Generation Radio Access Network (ngRAN) and 5G Core Network (5 GC) involves mutual authentication between the HN and UE, key derivation for authentication, access network, non-access stratum, radio resource control security and non-3 GPP access [6; 10]. It provides integrity, ciphering and replay protection of signalling within the 5G network. The UE and 5G network mutual authentication rely on primary and secondary authentication procedures for accessing services in 5 GC and from third-party SP/external DN, respectively. The 5G system supports mutual AKA between the UE and SN authorised by the HN, enabling the UE to securely access the HN via SN. The 5G-AKA or EAP-AKA' methods are mandatory for the 5G primary authentication procedure and the only authentication methods supported by UE and SN, for private networks' EAP framework, should be used as specified in [6] and as shown in Figure 1. The 5G-AKA and EAP-AKA' are discussed in [6; 10; 11; 14; 15].