Session Management for Security Systems in 5G Standalone Network

Abstract

As 5G telecom services evolve rapidly across a broad technological environment, network security in 5G landscape emerges as a critically challenging issue. One of typical network security tools is an intrusion prevention system (IPS) that monitors a network for malicious activity across the cyber-attack chain and takes action to prevent it. Vulnerabilities in 5G core networks become more varied and protocols become increasingly complex, whereby conventional Next Generation Firewall (NGFW) is not enough anymore to respond to cyber attacks. As a typical 5G vulnerability attack, PFCP-in-GTP and IPSec disable attack are highly complex to detect and cannot identify attackers without integrated session management. However, the 5G core network uses various protocols such as Non-Access Stratum (NAS), Hyper Text Transfer Protocol (HTTP), Packet Forwarding Control Protocol (PFCP), and GPRS Tunnelling Protocol (GTP), and packets of the interface used by each protocol are managed as identities that are difficult to identify. Analyzing the relationship of these interfaces in real time is an important key to integrated session management. In addition, unlike existing 4G, as 3rd Generation Partnership Project (3GPP) specs mandate encrypting 5G Standalone (SA) user IDs, it is much more difficult to identify from which user traffic has occurred in IPSs exclusive for cellular network. With regard to the above subject, this paper introduces an efficient session management scheme for users not affordable in conventional NFGW but necessarily useful for security systems in 5G SA. Furthermore, this study compared performances between conventional NGFWs and a 5G IPS system with the scheme employed, to ascertain that the scheme is feasibly implementable in 5G SA network. The actual test results show a detection rate of 99.7% and reasonable resource overhead (Memory usage 37.8%, CPU usage 42-44%).

Multi-Process Federated Learning With Stacking for Securing 6G-V2X Network Slicing at Cross-Borders

“…In the second phase, attacks can exploit misconfigurations and information gained from system infiltration, such as the maximum number of sessions supported by V-UPF and the activation of security controls to launch the attacks. To this end, our adversary model includes attacks targeting the data plane, such as attacks that aim to break V-UPF, H-UPF, and GTP-U data traffic passing through the N9 reference point (between H-UPF and V-UPF) [23], or GTP-C passing through the N4 reference point (between H-SMF and H-UPF) [24] or even the N6 reference point between 6G-V2X application and H-UPF [25]. These can critically impact 6G-V2X services such as MEC-assisted services and applications.…”

A Vulnerability Assessment of Open-Source Implementations of Fifth-Generation Core Network Functions

“…In their study on 5G architecture, Park et al (2022) [12] propose a 5G security system to ensure security within the 5G core network. They evaluate the performance and security features in real time, focusing on interfaces used in NAS, HTTP, PFCP, and GTP protocols.…”

Reinforcement Learning-Based Security Orchestration for 5G-V2X Network Slicing at Cross-Borders

“…Consequently, V-MNO should promptly allocate for CAVs a 5G-V2X-NS with features similar to that the H-MNO uses. However, this may result in several vulnerabilities, such as non-timely synchronization of security policies and misconfigurations on both the H-MNO and V-MNO sides, which could be exploited to launch attacks on the data plane [5][6][7]. In addition to 5G security solutions, other security services should be deployed to prevent, detect, and mitigate 5G-V2X NS attacks at cross borders.…”

“…However, 5G-V2X NS at cross-border is facing several security issues, leading to road hazards and threatening users' lives [4]. Specifically, attackers can exploit the lack of synchronization between the security policies of the H-MNO and the V-MNO, misconfigurations, and information obtained from system infiltration to target the data plane related to CAVs [5][6][7]. Several intelligent security services have recently been proposed to detect and mitigate attacks in 5G-V2X network slicing [8,9].…”