# 5G Security Threat Assessment in Real Networks
## 8 Countermeasures and Future Work
### Countermeasures through Standardization  
**User DoS (RRC connection DoS). ** The root cause of the RRC connection DoS threat is that RRC connection request, a message transmitted when an user terminal accesses the network, is transmitted in plain text, and the message includes TMSI, a temporary identification information of the user terminal. In order to respond to this, the forgery of RRC messages must be verified at the base-station level, which is not easy to define in 3 GPP. Additionally, blocking attackers from finding out the temporary identification information of a specific user can be a way to verify, which is not easy either because there are too many known methods. Utilizing temporary identification information in RRC Connection request is to prevent privacy invasion caused by leakage and abuse of IMSI which is subscriber identification information within USIM, but attackers can intercept RRC Connection request messages sent in plain text and easily identify TMSI, which is temporary identification information. Through this, the attacker can create and transmit a modulated RRC Connection request message so that the base-station mistakes the message for one sent by the victim UE. In the core network, temporary identification information is created with a certain time interval according to specific rules based on IMSI, and even if the TMSI is changed, the attacker can identify the changed TMSI and create an attack message again. When receiving the modulated RRC connection request, the base stations cancel the connection to the existing victim's terminal without checking modulation status and allows access to the attacker's terminal. In such situation, if the base-station does not disconnect from exiting victim's terminal or keeps the connection for a certain period of time, it can reduce the DoS threat of the victim. Because the attacker's terminal fails authentication after the RRC Connection, maintaining the connection to the existing terminal only during the period when the attacker's terminal sends the RRC connection request and the authentication fails may not significantly affect the performance of the base station. The above countermeasures are matters of implementation in the base station, and reflecting them in 3 GPP TS. 33.401 is a matter to be reviewed carefully considering the scope or depth of the standards. On the other hand, it would be more feasible to present relevant countermeasures as security guidelines for 5G base-stations and propose them as related international standards such as ITU-T. In the future, relevant standardization will be promoted so that mobile carriers providing 5G services can use relevant countermeasures as a reference guide to enhance their security. **NAS Manipulation (NAS ciphering spoofing). ** 3 GPP 5G standard supports both integrity verification and cipher communication to reinforce NAS protocol security between terminals and 5G core networks. However, because cipher communication is not mandatory but optional function among NAS protocol security functions, there are some cases of security functions not being used according to the policy of the country or the mobile carrier (3 GPP TS. 33.401). In addition to emergency calls, some countries or carriers may not use ciphering capabilities provided by 5G standards in terms of security. Additionally, the 5G standard does not define mutual authentication between terminals (UE) and 5G networks or the integrity verification function of initial messages exchanged before ciphering, which is based on underlying trust assuming that the initial messages are not modulated. This problem arises from a vulnerability that does not confirm the forgery of the first access request message (attach request) to 5G network sent by UE.