# 5G Security Threat Assessment in Real Networks
## 2 Background
### 5G NSA Arthitecture  
5G NSA is a method where the core network is configured as LTE-based evolved packet core (EPC), and both evolved node B (eNB) and next generation node B (gNB) are used together for wireless networks. Given that it is difficult to quickly introduce 5G SA method from the perspective of mobile carriers who provided existing LTE services, soft landing is easy for 5G services in this architecture.  
5G NSA communication section is divided into a wireless section and a wire section as shown in Figure 1. The wireless section represents RAN between User Equipment (UE) and base station, while the wire section represents CN between base station and service network. Here, there is a control plane (CP) between a terminal and RAN or CN, while there is a user plane (UP) between a terminal and IP multimedia subsystem (IMS) network for internet or voice services. In the CP, traffic using protocols such as radio resource control (RRC), NAS, and GTP-C is transmitted, while tunneling traffic using the GTP-RRC protocol in user data, such as a voice, is transmitted in the UP. Figure 1 shows 5G NSA architecture with a simplified configuration based on components required in this paper. The descriptions of each component in 5G NSA are as follows [10].  
* **User equipment (UE)**: User terminals and includes smartphones, USB modems, computers with built-in mobile communication modules.
* **Evolved node B (eNB)**: Provides wireless interface to UE and is used for functions related to UE control in 5G.
* **Next generation node B (gNB)**: Provides wireless interface to UE and is used for data transmission.
* **Mobility management entity (MME)**: Manages authentication and connection status, and active status for UE.
* **Home subscriber server (HSS)**: A central database that manages key information and subscriber profile for authentication for each UE. When an UE accesses the network, it delivers relevant key information and subscriber profile for UE authentication to MME.
* **Serving gateway (S-GW)**: Routes and delivers user packets between the base-station and P-GWs, and plays a role of anchoring point when the UE performs handover between eNBs or gNBs.
* **Packet data network gateway (P-GW)**: Connects the UE to an external packet data network (PDN). It acts as a channel for delivery packets between the UE and the PDN, and performs functions such as charging according to data usage and allocating IP address to the UE.  
Unlike NSA, new technical elements should be considered in accessing 5G SA network security. Wireless networks, called 5G NR, have changed the configuration form from existing radio unit (RU) and digital unit (DU) configuration to access unit (AU), DU, and central unit (CU) configuration. In the AU, a physical layer is added to the existing RU, and the time division duplex (TDD) communication method is applied. Additionally, due to the cloudification of DU, CU is newly introduced and takes a role of orchestration. Along with changes in wireless networks, core networks have changed to a decentralized configuration to separate CP and UP and minimize traffic transmission delay. Therefore, a decentralized security configuration needs to be considered for core network security rather than existing centralized configuration. Security requirements for 5G mobile communication networks that require super-connection, ultra-fast, and ultra-low latency are expanding significantly [11].  
Table 2 shows the commercialization schedule of respective network configurations, and the scope of this paper covers NSA only, as SA configuration is not actively commercialized yet.  
Finally, the fifth step is the process of evolved packet system (EPS) session establishment to create data session for the terminal. Next is detailed descriptions for NAS security setup in the 3 rd step and EPS session establishment in the 5 th step, which are key steps utilized in security threats that will be described subsequently.