# A Systematic Survey on 5G and 6G Security Considerations, Challenges, Trends, and Research Areas
## 3 5G Security Architecture: A Systematic Approach
### Core Network  
#### 3.1.1 Authentication  
In any network, authentication is necessary in order to ensure the user attempting to gain access has the right to do so. This can be seen as the first line of defense when connecting a device to a network. Protocols used for authentication need to be robust to allow for seamless use for an authorized client but also have mechanisms in place to reject access by illegitimate users. Authentication mechanisms have grown over the years, adapting to the ever-changing communications landscape. The 3 rd Generation Partnership Project (3 GPP) has specified two main sectors of security in 5G authentication: primary and secondary authentication. Primary authentication is used for device and network mutual authentication in both 4G and 5G [18]. The purpose of secondary authentication is for a UE to be able to connect outside of its mobile network operator (MNO) domain [19]. Respectively, there are two protocols that handle the two different authentication methods in 5G: 5G-AKA (Authentication and Key Agreement) used in primary authentication when a device first connects or attaches to the network, and a suite of Extensible Authentication Protocols (EAPs) used in secondary authentication, usually when a device is connecting to a service on the internet using the 5G network [20]. The 5G-AKA protocol is outlined in 3 GPP specification number 33.501 [21] and is used to verify authenticity when a user device connects to a home or serving network. 5G-AKA has been stated to be more secure than its predecessors in 3G and 4G LTE with privacy and integrity goals listed by 3 GPP in [21] and summarized below from [22].  
* Mutual authentication (implicit) between UE and SN, and UE and HN.
* SN is authorized by HN.
* Confidentiality for \(K_{\text{SEAF}}\) (Key [from] Security Anchor Function) even if the attacker learns session keys established in other sessions (previous or consequent).
* Anonymity: SUPI (Subscription Permanent Identifier) and SQN (Sequence Number) shall remain secret in the presence of a passive attacker in order to guarantee activity privacy.
* Unlinkability (user location confidentiality and user untraceability) against passive adversaries. An attacker cannot deduce the presence of a subscriber in a certain area or whether different services are delivered to the same user by eavesdropping on the radio access link.  
The author of [22] points out that there have been integrity vulnerabilities of the 5G-AKA protocol detailed in the literature [23; 24; 25]. 5G-AKA security is affected when an attacker eavesdrops on a suspected target UE and intercepts a failed authentication challenge, either being a MAC_Failure or Sync_Failure. The attacker then has the ability to reply to the UE with another authentication message and will wait for either a Sync or MAC failure. If a Sync_Failure is returned, the adversary then knows that the target UE is the one being communicated with. This fault is a breach of user privacy, as it allows for potential user traceability and knowledge of their subscription location. One solution to this issue is to encrypt both messages, making them look indistinguishable to the attacker. The work in [26] addresses the formal verification of 5G-AKA and its findings. In the paper, the authors share that the UE's data privacy is at risk if the USIM (Universal Subscriber  
Figure 5: Basic 5G architecture based off of Figure 1 in 3 GPP article “5G System Architecture” [17].  
Identity Module) is compromised, as the master key K\({}_{\text{SEAF}}\) can be found by using the K in the USIM and one of the initial messages sent to the UE in plain text containing the random number. The authors also state that Perfect Forward Security (PFS) is possible if a Diffie-Hellman (DH) key exchange is utilized.