# Survey on 5G Physical Layer Security Threats and Countermeasures
## 1 Introduction
### General Countermeasures for the Access Network, Backhaul, and Core Network  
To protect the 5G network, 3 GPP has established specific and detailed security objectives [30]. These objectives are closely aligned with the 5G security architecture and procedures, which are divided into five key areas [31]:  
* Confidentiality: Ensures only authorized users access confidential data.
* Integrity: Protects against unauthorized data modification, ensuring data is transmitted in its original form.
* Authentication: Verifies the identities of entities (UEs, network functions, serving networks, Public Land Mobile Networks (PLMNs)) before communication, which involves a key exchange.
* Replay Protection: Prevents attackers from capturing and reusing packets for illegitimate communication.
* Privacy: Protects users' sensitive data, including inferred information like habits, profiles, and location, from unauthorized access.  
Authors in [1; 32] surveyed the security requirements recommended by 3 GPP for Device-to-Device (D2D), Internet of Things (IoT), Vehicle-to-Everything (V2X), network slicing, network function virtualization, mobile edge computing, and other 5G-specific technologies. The authors in [33] highlighted weaknesses, such as a scenario where an attacker, by reusing a previous key, could force the UE and serving network, establishing a secure communication link. This could potentially enable the reply of user data. To cope with this issue, they also suggested a protocol improvement to use a different key for each session. They also confirmed that IMSI catchers are defeated by the use of a randomized public key encryption. The authors in [34] provided a performance overhead comparison for various optional AKA integrity protection algorithms applied on the user plane. Practically, the throughput and latency are minimally affected, while the security of the network is increased. In [35] the authors analyzed critical 5G interfaces and their endpoints, as depicted in Figure 2. They provided suggested improvements for system interfaces, which can be summarized by the following points:  
* N1 and Uu Interfaces: Ensuring the integrity of the control plane on the N1 and Uu interfaces, as well as the Permanent Equipment Identifier (PEI) on N1, is crucial and is enforced using NIA1-Network Integrity Algorithms (NIA)3. Operators have the discretion to choose the level of confidentiality using Network Encryption Algorithms (NEA)1-NEA based on their specific requirements. The Subscriber Permanent Identifier (SUPI) and the Subscriber Concealed Identifier (SUCI) should be protected using the Elliptic Curve Integrated Encryption Scheme (ECIES). Additionally, operators can determine the integrity and confidentiality measures for the user plane on the Uu interface by selecting the appropriate NIA1-NIA3 and NEA1-NEA3 algorithms.
* N2, N3, Xn, and F1 Interfaces: To safeguard confidentiality and integrity and protect against replay attacks on the N2, N3, Xn, and F1 interfaces, operators can implement IP Security (IPsec) Encapsulating Security Payload (ESP), along with Internet Key Exchange version 2 (IKEv2) utilizing certificate-based authentication.
* Service-Based Interface: To ensure confidentiality, integrity, and protection against replay attacks on the SBI, operators can employ Transport Layer Security (TLS). This protocol encrypts data, verifies its integrity, and prevents unauthorized retransmissions, ensuring a secure communication channel for the SBI interface.  
Note that the above presented security mechanisms involve rather higher layers than PHY, but they are worth mentioning for the sake of completeness.