# Survey on 5G Physical Layer Security Threats and Countermeasures
## 3 Possible Attack Types on Physical and MAC Layer
### Jamming Attack Types  
Traditionally, using band-limited noise to jam the entire transmitter band is considered as a functional but energy-inefficient jamming technique. More energy-efficient methods include partial band jamming, single-tone jamming, multi-tone jamming, asynchronous single-tone jamming, and asynchronous multi-tone jamming, as illustrated in Figure 6.  
* Single tone jamming involves the utilization of a single, high-power Codeword (CW) tones to disrupt a single subcarrier. This method necessitates the precise knowledge of the subcarrier's exact frequency, as depicted in Figure 6. Additionally, single-tone jamming can be employed to disrupt the cell-specific reference signal, consequently \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Layer** & **Attack Type** & **Target** & **Effectiveness** & **Effects** \\ \hline \multirow{8}{*}{L1 PHY} & & PSS & HIGH & DoS \\ \cline{2-4}  & & PBCH & MEDIUM & DoS \\ \cline{2-4}  & & SSS & MEDIUM & DoS \\ \cline{2-4}  & Smart Jamming & PBCH DM-RS & MEDIUM & DoS \\ \cline{2-4}  & & PRACH & MEDIUM & DoS \\ \cline{2-4}  & & PDCCH & LOW & DoS \\ \cline{2-4}  & & PUCCH & LOW & DoS \\ \cline{2-4}  & & Implicit Beam Reporting (RA) & HIGH & User Localization \\ \cline{2-4}  & Spoofing & DCI/UCI & MEDIUM & UL Jamming by UE, Resource Jamming, HARQ Failure \\ \cline{2-4}  & & PDCCH Order & MEDIUM & DoS \\ \hline \multirow{8}{*}{L2 MAC} & & BWP Switching & LOW & DoS, MITM Enabler \\ \cline{2-4}  & & CSI-RS/SP-SRS Act./Deact. & HIGH & Passive User Localization and Tracking, Massive MIMO Pilot Contamination \\ \cline{2-4}  & Spoofing & SCSL Act./Deact. & MEDIUM & Throughput Throttling, Battery Draining \\ \cline{2-4}  & & Timing Advance, Recommended BitRate & MEDIUM & DoS, De-synchronization \\ \cline{2-4}  & & Beam Failure Recovery & LOW & DoS \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Possible attack types on PHY and MAC layers [56; 67]. Figure 6: Illustration of jamming types with higher energy efficiency. diminishing the overall system capacity. However, for effective jamming, the jammer must achieve perfect synchronization with the network. * Multi-tone jamming is employed to disrupt multiple subcarriers simultaneously. In contrast to single-tone jamming, multi-tone jamming involves the generation of multiple random phase CW tones [69]. Similar to single-tone jamming, multi-tone jamming also necessitates accurate knowledge of the subcarriers' exact frequencies, as illustrated in Figure 6.
* Partial band jamming involves transmitting Additive White Gaussian Noise (AWGN) across a specific frequency band. The effectiveness of this jamming technique correlates directly with the ratio of the jamming bandwidth to the signal bandwidth when maintaining constant jamming power [70; 71]. As depicted in Figure 6, this method allows for the jamming of a segment of continuous subcarriers. * The asynchronous form of jamming can be categorized into two types: asynchronous single tone jamming and asynchronous multi tone jamming, as also shown in Figure 6. The underlying principle of asynchronous jamming involves disrupting the target signal with a frequency offset from the subcarrier. This offset allows the jamming signal to interfere with neighboring subcarriers, resulting in a scenario of Inter-Carrier Interference (ICI) at the receiver, rather than directly jamming the signal. Compared to the other types of jamming mentioned earlier, asynchronous jamming demonstrates superior performance [72]. The susceptibility of a physical channel or signal to jamming depends significantly on its sparsity within the overall time-frequency resource grid [19]. A key factor mitigating vulnerability is if the channel or signal is allocated on the time-frequency resource grid using a dynamic scheme controlled by higher-layer parameters, which may not be known to a potential jammer. This fact, from the point of view of the jammer, defines a trade-off between the complexity of the jamming method and the effectiveness of the jamming and jammer power consumption.