## 4 Security Challenges and Solutions in 5G Network and LPWAN-IoT
### Security Challenges and Solutions in LPWAN-IoT and 5G
#### 4.2.2 Security Challenges and Solutions in 5G
5G dictates the use of different session keys for specific protocols and purposes between the UE and the network components. The keys are organized in a hierarchy as shown in Figure 6. At the root of the hierarchy is a key that is shared between the UDM in the home network and the UE where it is securely stored in a smart card. This approach is the key hierarchy and was considered important to meet the strict requirements for isolation and key separation. Mobility of the UE introduces mobility of the security anchor points within the network, which entails a change of the gNB or the AMF serving the UE. Thus, it is important to follow the principle of categorization so that a ruined key in one network entity does not spread to the other entities. The PA is based on the root key. The other keys are afterward derived from keys higher in the hierarchy for other dedicated procedures. Each key in the hierarchy is shared between the UE and a specific entity called to function in the network. For instance, the K\({}_{\text{AUSF}}\) key is shared with the AUSF, the K\({}_{\text{SEAF}}\)  
Figure 6: 5G Basic Security Architecture and key hierarchy (adapted from [75]). and K\({}_{\rm{AMF}}\) keys are shared with the AMF, and the K\({}_{\rm{gNB}}\) key is shared with the gNB. The 5G specifications define a particular procedure for the establishment of each key in the hierarchy. For instance, the K\({}_{\rm{AUSF}}\) and K\({}_{\rm{SEAF}}\) keys are established by the PA procedure which runs between the UE and the AUSF. While the K\({}_{\rm{AUSF}}\) key remains in the AUSF, the K\({}_{\rm{SEAF}}\) is sent to the target AMF serving the UE and afterward used for the derivation of the K\({}_{\rm{AMF}}\) key. The K\({}_{\rm{gNB}}\) is initially established by a combination of procedures involving the AMF, the gNB, and the UE. The UE and AMF use the KAMF to agree on a KGB. The AMF then provides this key to the gNB, in which the UE is connected to the network and finally activates the security OTA between the UE and the gNB based on the K\({}_{\rm{gNB}}\)[74; 75]. A new feature called Authentication and Key Management for Applications (AKMA) framework was developed by SA3 as an enhancement of the GBA feature that was meant for earlier networks (4G/LTE-A) [74; 78; 79]. The aim is to utilize an operator authentication infrastructure to bootstrap security between the UE and an application function (AF). Since the UE has a subscription already to access the network and shares security keys with a given operator. Such keys can be used to establish a secure channel for other purposes as well, to secure communication with an application service provider. For example, banks, institutions, tax offices, social security services, and so on. The 5G network system in the AKMA framework supports a UE to be registered in and or attached to both over 3 GPP or non-3 GPP network access. But the GBA lacks this capability feature for supporting authentication in 3 GPP together with a non-cellular network. Further enhancement of the 5G authentication mechanism led to the development of integrated access backhaul (IAB) by the RAN groups in 3 GPP SA3 [80; 81]. The IAB feature is envisioned to improve the coverage and boost the performance over 5G New Radio (NR) technology. Moreover, to enable mechanisms for differentiation protection between the CP and UP in 5G security, and support the protection for both slices and applications security, including data security protection, a unified authentication framework for 5G security architecture was proposed by the China IMT-2020 (5G) Promotion Group [26]. This entails UE, access network, serving network, home environment, and service applications. This 5G security architecture contains eight major domains, (see Figure 7).