## 4 Security in 5G Infrastructure
### Fifth-Generation Protection Mechanisms  
The security foundations of 5G systems are shaped by the security requirements outlined in [28]. This document underscores the five pillars of information security: confidentiality, integrity, availability, authenticity, and nonrepudiation. The security protocols established in 5G are designed to safeguard networks and users against diverse security threats, including cyberattacks, data breaches, and unauthorized access. Notably, 3 GPP security specifications are mandatory for vendors, yet optional for 5G service providers. This flexibility in implementation has led to varying security levels across different 5G networks. This approach caters to the varied regulations of different countries, some of which opt not to mandate certain security features for national telecommunications providers to preserve privacy [29]. General Security Requirements  
One of the most important functions considered in the general security architecture is related to the authentication and authorization of UEs. In particular, subscriber and serving network authentication ensure authorized access and secure communication. Serving networks verify the SUPI authenticity, while UEs authenticate the serving network identifier to counter rogue networks or man-in-the-middle attacks. Furthermore, the threat of bidding down attacks necessitates robust security mechanisms. These attacks manipulate negotiation between UE and network entities, deceiving both into believing the other lacks specific security features. Preventive measures involve mutual authentication, secure negotiation of security parameters, and detecting and rejecting misleading messages. The security architecture considers the UE requirements. The most important is the guarantee of confidentiality and integrity of user data and signaling data. UEs must encrypt user data and signaling messages to preserve confidentiality and integrity. Ciphering activation by gNB indication, support for different data rates, and integrity protection mitigate tampering and replay threats. The same security services are required on the gNBs and AMF. gNBs encrypt user data and signaling messages based on security policies and requirements. Versatility in applying confidentiality and integrity protection balances security needs. AMFs encrypt and protect NAS signaling messages, enhancing confidentiality and integrity. The security policy-driven application of protection mechanisms renders confidentiality protection optional. The security requirements considered for the SBA are mainly related to the interaction among the different NFs. Among the NFs, the NRF represents the most critical one from the security perspective because it enables the registration and discovery of NFs for interfunction communications. Given this role, the NRF must support confidentiality, integrity, and replay protection in the _discovery_ and _registration_ processes between the NF Service Consumer and NF Service Producer. The NRF must authorize discovery and registration requests, allowing only authorized entities to discover and register with NFs. The process should hide the topology of NFs within one trust domain from entities in different domains, preventing unauthorized access and disclosure of network topology. Furthermore, Mutual authentication between the NF Service Consumer and NF Service Producer is crucial for secure communication. The other critical element is the NEF, which exposes NF functionality externally for fostering interaction with third-party applications. The NEF must ensure **integrity, replay,** and **confidentiality protection** for communication with application functions (AFs). **Mutual authentication** between the NEF and AFs is necessary to prevent unauthorized access and ensure secure communication. Each NF must validate all incoming messages. Messages failing validation based on protocol specification and network state should be rejected or discarded. This ensures the processing of valid messages and the discarding of malicious ones.