# A Systematic Survey on 5G and 6G Security Considerations, Challenges, Trends, and Research Areas
## 3 5G Security Architecture: A Systematic Approach  
5G as a whole is a vast and complex protocol with a rich history that has evolved from previous cellular generations, such as 2G, 3G, and 4G LTE. Security has, over time, become one of the highest priorities for these networks and is of paramount importance in today's information society. This section presents a breakdown of security mechanisms currently in place, some of which are defined by 3 GPP and others introduced in the literature. The survey of current security protocols and any necessary security considerations are separated into three subsections, focusing on the Core Network, Radio Access Network, and User Equipment, which are the main three pillars of a 5G connected system, as depicted in Figure 5.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Tenet** & **Explanation** \\ \hline (1) “All data sources and computing services are considered resources”. & A network can comprise different classes of devices, which can have different footprints and functions. A personal device can also be seen as a resource if it can access the enterprise-owned network. \\ \hline (2) “All communication is secured regardless of network location”. & Any equipment attempting to obtain access to a network, whether on-site or remote, must be authenticated. Network location alone does not imply trust. Confidentiality and integrity need to be protected. \\ \hline (3) “Access to individual enterprise resources is granted on a per-session basis”. & Prior to accessing an asset, the user will be identified and verified. Only the minimum resources should be given in order to complete a task. Successful authentication and access to one resource does not grant access to other resources on the network without further permissions. \\ \hline (4) “Access to resources is determined by dynamic policy—including the observable state of client identity, application/service, and the requesting asset—and may include other behavioral and environmental attributes”. & It is necessary for an organization to protect resources by defining what resources it has, who its members are, and what access to resources those members need. Requesting asset state can include device characteristics such as software versions installed, network location, time/date of request, previously observed behavior, and installed credentials. Resource access and action permission policies can vary based on the sensitivity of the resource/data. \\ \hline (5) “The enterprise monitors and measures the integrity and security posture of all owned and associated assets”. & No access within the network or remote can be inherently trusted. Devices should be monitored using continuous diagnostics and mitigation (CDM), and patches/fixes should be applied when necessary. Devices that do not match this criteria can be completely rejected from making any connections with the network. \\ \hline (6) “All resource authentication and authorization are dynamic and strictly enforced before access is allowed”. & A ZTA needs to be adaptive and continually reevaluate trust with devices and their open sessions. Identity, Credential, and Access Management (ICAM) and asset management systems are an expectation of the ZTA. Continual monitoring with possible reauthentication and reauthorization occurs throughout user transactions, as defined and enforced by policy (e.g., time-based, new resource requested, resource modification, anomalous subject activity detected) that strives to achieve a balance of security, availability, usability, and cost-efficiency. \\ \hline (7) “The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture”. & Any data on the network that can be captured should be. This allows for the improvement of the policy creation and enforcement. \\ \hline \hline \end{tabular}
\end{table}
Table 1: ZTA tenets.