# Survey on 5G Physical Layer Security Threats and Countermeasures
## 5 Test-Beds for 4G/5G Experimentation  
To verify vulnerabilities at the PHY layer, a proper testing system is necessary. The development of a full 4G/5G systems is a very time- and money-consuming process; fortunately, there are currently possibilities to build a private 4G/5G network for reasonable costs. For such implementations, three components are needed: the Software Defined Radio (SDR) with well-chosen front-end, which serves as the transmitting and receiving device; the RAN, which manages the wireless communication between mobile devices and the backbone network; and the backbone network, which includes all 5G functions and interactions including authentication, security, session management, and traffic aggregation from end-user devices. Various Software (SW) frameworks and tools have been developed for experimenting with security threats and countermeasures in 4G/5G cellular networks [95]. The open-source projects developed by the community are one of the most suitable solutions for such experiments. Here, the functionality of the overall system can be adapted to demonstrate vulnerabilities or implement countermeasures against specified threats. There are several options for RAN implementation, including, but not limited to the following:  
* Free5G RAN [96] (Hsinchuis, Taiwan, current version v3.4.2) an open-source project with very limited functionality. The current version includes a receiver that decodes MIB and SIB1 data and can act as a cell scanner in SA mode. * OpenAirInterface [97] (Biot, France, current version v2.1.0) developed by Eurecom, and maintained under a public license, which implements NSA/SA gNB as well as 5G NSA/SA UE. The project is also integrated with the NVIDIA Aerial software development kit's L1 inline hardware accelerator with the OpenAirInterface L2 and above to build an accelerated 5G virtual RAN. This kit provides a full L1 high-PHY implementation of 5G NR compatible and interoperable with the Open-RAN 7.2\(\times\) front-haul split. * srsRAN [98] (Cork, Ireland, current version 23.11) an open-source SW that provides a compete 5G RAN solution, optimized for SDRs [99]. This software package supports 5G NSA/SA modes for both srsUE and srsENB. In 4G mode, it implements the EPC; alternatively, for 5G SA mode, it supports the 3 rd party 5G cores. The big advantage of srsRAN for amateur and educational usage is that it can be used with the ZMQ virtual RF front-end. In such a case, there is no need for physical RF-hardware to implement RAN. It allows simultaneous packet capturing and analyzing by a Wireshark. There have been many recent research publication profiting from the use of this project [19; 67; 100]. According to provided tests [99], srsRAN is more suitable for beginners in the field but yields unstable results in terms of latency, while OpenAirInterface offers more flexible configuration options. A brief overview of related works dealing with SW tools developed to test the vulnerabilities of cellular protocols is provided in [101]. These findings highlight the importance of selecting the appropriate software tools for testing and implementing 5G technologies. There are many options for 5 GC implementation. Some include only 5 GC for 5G SA networks, while others also include EPC for 4G and 5G NSA modes. The most known and widespread are as follows:  
* Open5 GS, an open-source project that provides a comprehensive 4G/5G core network solution. It implements a Release 17-compliant EPC for 4G and 5G NSA networks, as well as a 5G SA core. Open5 GS supports the delivery of voice calls and text messages through the LTE network. This is achieved by leveraging third-party Voice over LTE (VoLTE) and SG-SMS (SMSoSGs) solutions, respectively, such as those from Kamailio and Osmocom [102]. This 5 GC is recommended by srsRAN for 5G SA. * free5 GC, an open-source 5G mobile core network project. The goal of the project is to implement the 5G core network defined in 3 GPP Release 15 and beyond [103].