## 7 Vulnerability Assessment of AMF to Replay Attacks
### Testbed 1--Open5 GS  
The first step to perform the replay attack is the registration in a pcap file of the traffic exchanged between the RAN and the 5 GC. This traffic encompasses UE registration and gNB association messages. The replaying process resulted in the forwarding of all acquired packets. Analyzing the log of the program, we observed that 5 Greplay successfully forwarded all 22 packets in the file. However, the outcome of forwarding all packets was the registration of a new gNB and UE with the same SUPI, essentially replicating the devices. This unexpected behavior led to the misbehavior of the entire 5G infrastructure. In more detail, on the RAN-side, a replay attack led to the gNB receiving a UE Context Release Command message, followed by the release of the UE's RCC (Radio Connection Control) connection. This disconnection prompted the UE to switch to the \"Connection Management Idle\" (CM-IDLE) state. This state indicates that the UE is powered on and has registered with the network but is not actively engaged in any data transmission or communication. When a user tries to access the Internet, the gNB receives a request to establish an RCC connection (RCC setup for UE) and an initial NAS message from UE, but these attempts fail. Only after the UE is rebooted and received a new ID from the gNB, a successful connection of UE to the core network could be established and the normal operation restored. On the core side, three different blocks of events can be observed: the attack start time, the data network (DN) reachability request from legitimate UE, and the UE restart. During the start time of the attack, the core receives the message requesting registration of a new gNB (NGSetupRequest). The core does not perform checks on this message and it is accepted as coming from a legitimate radio station. So, no replay attack is detected, and the core registers a new gNB with the parameters given in the request (IP, TAX, PLMN_ID, etc.). It then notifies that there are two gNBs. Then, a registration procedure request (InitialUEMessage) is sent to negotiate the radio connection parameters required for network access and data communication. As the UE's data are already registered in the core (and the core identifies this through the SUCI - known UE by SUCI), it sends a context release request to the legitimate gNB to which the UE was previously connected, resulting in the UE losing connectivity to the core. Replay of the registration request begins, but this time, core 5G realizes that the message has been compromised through MAC verification (NAS MAC verification) and sends an \"Authentication Rejected\" message. Subsequent messages from the UE to the AMF (UplinkNASTransport) are all verified through the MAC, which can detect a replay attack and trigger a context release request from the UE. This action results in the removal of the UE from the core. The UPF and SMF then proceed to eliminate the context information associated with the gNB that registered through the replay attack (which was fake). The fake gNB is instructed to release the UE's context, but since no actual gNB exists, the connection request is denied. Following this, the AMF removes the UE information and reports the count of UEs connected to the gNBs, which now amounts to 0. This indicates that there are no longer any UE devices connected to the gNB (5G base station). The MFA (Mobility Management Function for Access) removes the fake gNB from its list and reports the total number of gNBs, which is now 1. Analyzing the DN reachability request from a legitimate UE, a request for an InitialUEMessage is received from the genuine gNB. The MFA proceeds to add this device to the list of known devices (now totaling 1) and associates it with a TMSI. However, the request ultimately fails because there is no active session established for this UE at that moment. Finally, let us consider the UE restart. The registration process begins with the transmission of the InitialUEMessage to initiate registration at the core.