## 4 Security in 5G Infrastructure
### Fifth-Generation Protection Mechanisms
The extracted NF requirements highlight the need to validate every received message, aligning with zero-trust principles. Given the 5G vast and perimeter-less ecosystem, reliance on trustworthiness to third parties or other NFs is insufficient. Attacks like API injection,Distributed DoS (DDoS) attacks, and replay attacks are potential threats; therefore, in our experimental testbeds, we will verify their impact on AMF and NRF/NEF in two popular 5G open-source projects. The 5G landscape incorporates APIs and exposes the core to third parties, with the Common API Framework (CAPIF) introduced in Release 15 and expanded in Release 16. CAPIF establishes a consistent northbound API framework for diverse 3 GPP functions. This framework encompasses the API Exposing Function, API Publishing Function, and API Management Function. Any SIM card contains an International Mobile Subscriber Identity (IMSI) uniquely identifying a subscriber in the operator's network. The IMSI, comprising 15/16 digits, was sent in clear text during NAS procedures in the past mobile generation. This feature has been exploited to perform the tracking of users' location and violate the users' privacy. In 4G, the generation of a Globally Unique Temporary ID (GUTI) avoids one sending IMSI in the clear. However, the development of IMSI catcher techniques allows to overcome the barrier added by the temporary identifier [30]. In 5G, to contrast this issue, privacy starts preauthentication via encrypting the SUPI using the home network public key in the USIM, generating the Subscription Concealed Identifier (SUCI). This approach mitigates the exposure of subscriber identity during transmission [27]. However, it does not completely prevent all tracking and linking. In scenarios where a user's identity is already known, an attacker can still probe users for that identity, as exemplified by the SUCI-Catcher attack [31]. Furthermore, the recent analysis of public mobile networks shows that the SUCI mechanism is not deployed [32; 33]. Two types of SUPI are defined: the Network Specific Identifier (NSI) and the IMSI [34]. In the first case, the unique identifier is composed of a variable-length username and domain name (e.g., [EMAIL_ADDRESS]). In the second case, the SUPI consists of a 3-digit Mobile Country Code (MCC), a 2-3-digit Mobile Network Code (MNC), and a 10-11-digit Mobile Subscriber Identification Number (MSIN). The SUCI always contains the SUPI type (e.g., IMSI, NSI), Home Network Identifier, Routing Indicator, Protection Scheme, Home Network Public Key ID, and Protection Scheme Output. The Home Network Identifier contains the domain name of the NSI SUPI, while consisting of MCC and MNC in the case of the IMSI. The Protection Scheme Output completes the SUPI by reporting the username part of NSI SUPI, or the mobile subscriber identification number (MSIN) of the IMSI. Although not considered in our testbeds, it is worth mentioning that other than mobility, roaming is a distinctive feature of mobile networks. The fifth-generation system introduces Security Edge Proxy Protection (SEPP) for roaming interconnection, which ensures secure communication between home network and serving network. Two Internet Protocol Exchanges (IPXs) are established between the Visited and the Home Public Land Mobile Networks (VPLMN and HPLMN, respectively), and SEPP implements application layer security, preventing IPX providers from reading sensitive data. It detects unauthorized message modifications and performs source validation, message format verification, and topology hiding [27]. Communication between SEPPs uses HTTP/2 protocol via well-defined API requests, so our testing methodology (see, in particular, Section 5.4) could be easily extended to SEPP. Finally, for non-3 GPP access networks, 3 GPP has considered two access scenarios: trusted and untrusted. In the trusted scenario, traffic is exchanged with the trusted non-3 GPP access using the Trusted Non-3 GPP Gateway Function (TNGF).