# Security Awareness in Software-Defined Multi-Domain 5G Networks
## 4 Security Scenarios of Multi-Domain Data Correlation
### IoT Authentication Storms and Adaptive Group Authentication  
In 5G systems, new emerging IoT applications cause additional threats to availability [38; 39]. The previous mobile network generations were designed for user devices that authenticated at an even  
Figure 4: Trust Level Agreement messaging—The framework aggregates, filters, and brokers of security information between domains (updated from the Trust Metric Enabler’s open specification [37]). VPN: Virtual Private Network.  
pace. In 5G systems, simultaneous authentication events may cause an excessive traffic and processing burden for 5G Authentication, Authorization and Accounting (AAA) services. Pre-5G authentication services (particularly Home Subscriber Server, HSS) were not designed to handle situations where thousands or millions of devices authenticated simultaneously. In IoT, devices often behave differently to phones by sending short periodic communication bursts, e.g., they may switch on or send reports at even hours or when the sun starts to shine. Thus, many devices may authenticate to the network at the same time. Furthermore, adversaries--aiming to perform a denial-of-service attack--may use different means to initiate traffic spikes. As a result, authentication processing may face a heavy overload situation and thus 5G service becomes unavailable. Solutions to the threat include blocking of detected adversaries [40] as well as gateways and group authentication schemes [41; 42] where the serving network handles more of the authentication signalling load.  
In this scenario, illustrated in Figure 5, we monitor signalling in three domains involved in authentication: access, serving, and home network domains. The collected monitoring data includes SDN traffic statistics towards authentication components as well as the used and available authentication mechanisms.  
An overload situation in one domain may then trigger different control actions:  
1. In a situation where a home network has enough capacity, the system allows devices to authenticate directly with the home network using, e.g., a standard authentication and key agreement (AKA) [5] protocol.
2. In a case where a monitor detects an overload situation in the home network domain, it adapts security controls in access and/or user equipment domains so that traffic flows are blocked and devices are required to use group authentication mechanisms instead. These mechanisms require less effort from the home network but may also have some downsides with respect to the access network performance or for the security level [43].
3. In a situation where the access network does not have enough capacity for group authentication, the monitoring system may allow device access through trusted gateways which authenticate devices locally. This solution is the most scalable but places trust in local gateways.
4. In a situation where a slice subscriber has specified a trust model with high integrity requirements, the strongest (e.g., direct authentication with home network) is applied even if that means that some devices will be disconnected. The slice may also have set particular trust models, which define the amount of devices that can be connected to a slice using group authentication mechanisms and for which authentication mechanisms are possible.  
The controls can be implemented through the SDN means by redirecting traffic flows to a slice that provides authentication services suitable for each situation.  
Figure 5: Domains and information in the authentication storm scenario. GW: gateway.