## 5 Experimental Methodology
### Replay Attack on AMF  
The TS 33.512 [48] furnishes comprehensive security controls and specifications for the AMF, encompassing both safety and security aspects. Within this framework, the test TC_NAS_REPLAY_AMF mandates that the AMF be fortified against replay attacks: _Verify that the NAS signalling messages are replay protected by AMF over N1 interface between UE and AMF._  
As reinforced in TS 33.501 [28], clause 5.5.2 mandates that _AMF shall support replay protection of NAS signalling messages between UE and AMF on N1 interface._  
Therefore, our initial test scenario involves scrutinizing the susceptibility of the AMF implementation in OAI and Open5 GS to replay attacks. To accomplish this, we harness the capabilities of 5 Greplay [19]. This tool enables us to simulate replay attacks using intercepted traffic on interfaces N1 and N2. A similar attack scenario is also explored in [18] (Section 4.3 \"Scenario 3\") considering a different implementation of the 5 GC, namely free5G.  
During the UE interaction with the 5G system, the registration procedure is vital for network entry. This entails authentication and the establishment of encryption and integrity protection parameters at the Access Stratum and NAS. The NAS SMC procedure plays a pivotal role in this process, ensuring secure communication between the UE and the AMF (see Figure 3). After a series of exchanges between the two elements, this procedure involves the downlink transmission of the **NAS Security Mode Command** and the subsequent **NAS Security Mode Complete** message from the UE to the AMF. The AMF may also send an NAS Security Mode Command message to modify the security algorithm within an existing security context [49].  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & Value _(comments)_ \\ \hline
**method** & TCP _(Flooding TCP)_ \\ \hline
**url** & URL to attack _(in our case, the IP address of AMF and NRF)_ \\ \hline
**threads** & 200 _(number of threads employed for the attack)_ \\ \hline
**duration** & Attack duration _(set to 500 s)_ \\ \hline
**debug** & True _(to collect information about the incoming requests in the AMF logs)_ \\ \hline \hline \end{tabular}
\end{table}
Table 3: MHDDoS configuration parameters.  
Preceding the establishment of the security context, NAS messages are transmitted in an unencrypted state. This vulnerability emerges from the potential interception of a clear NAS Security Mode Command sent from the AMF to the UE. An attacker with access to NAS traffic on the N1 interface could replicate the NAS SeQuence Number (NAS SQN) and craft a replayed NAS Security Mode Complete message. Alternatively, the attacker could intercept a NAS Security Mode Complete message and retransmit it to the AMF.  
If the AMF lacks sufficient safeguards against such attacks, the network may not detect the replayed packet. Consequently, the attacker could impersonate a UE, prompting the system to adopt a weaker security algorithm or disable security altogether, in both cases undermining the system integrity.  
The results presented in [18] point out that the free5 Gc AMF is protected against the NAS-5G SMC replay attack. Our focus is to ascertain whether Open5 GS and OAI have incorporated adequate security measures to thwart this kind of replay attack.  
The rules necessary for executing a replay attack on the N1 interface need to be configured within a configuration file (named _nas-smc-replay-attack.xml_) in the directory _Sgreplay/rules_.The rule comprises two events with a minimal delay of 0 ms and a maximum delay of 10 ms. The first event identifies a NAS Security Mode Command message using the NAS message type, set to 93. The second event detects the expected receipt of a NAS Security Mode Complete message after the first event, identified by the _NAS security type_, which is 4. This rule serves to filter captured network packets, transmitting only those aligned with the specified conditions.