Challenges and Opportunities in Mobile Network Security for Vertical Applications: A Survey

1. Introduction

Ensuring the Confidentiality, Integrity, and Availability (CIA) triad is pivotal for strengthening the reliability of fifth-generation (5G) mobile communication systems and previous generations. However, safeguarding the CIA triad within mobile networks introduces challenges [1]. These challenges are further compounded by the diverse range of vertical applications, each requiring specific security and privacy measures [2]. Various verticals, including smart cities, smart transportation, public services, Industry 4.0, smart grids, smart health, and smart agriculture, showcase the extensive application domains facilitated by 5G and previous generations [3].

Moreover, numerous technologies, including massive Multiple-Input/Multiple-Output (MIMO), Multi-Access Edge Computing (MEC), Software Defined Networks (SDN), Network Function Virtualization (NFV), and Network Slicing (NS), are relevant when incorporated into the architectural framework of the latest generation of mobile networks [4]. These technologies offer essential attributes for various applications, such as low latency, high reliability, extensive connectivity, and high-capacity broadband capabilities. Understanding these systems’ potential threats and vulnerabilities becomes essential as these technological infrastructures and components integrate with vertical applications. Furthermore, it is crucial to apply new security paradigms to address the specific security challenges in each scenario.

Security concerns in 5G are heightened due to the software-based nature of many components, significantly expanding attack surfaces and necessitating robust cybersecurity measures. The dynamic nature of networks, facilitated by virtualization, enhances their flexibility and introduces potential vulnerabilities. Attacks targeting these virtualized components can compromise the integrity of the network. Consequently, cybersecurity has emerged as a critical priority for the successful and secure implementation of 5G. Nevertheless, legacy network infrastructures will coexist with 5G network infrastructure for many years [5], given the high costs of upgrading and replacing devices. Vulnerabilities of legacy networks can be used as a backdoor to attack 5G networks [6].

1.1. Related Works

Research focusing on security and privacy is essential for instilling confidence in mobile networks among various stakeholders, including industries, governments, and scientific communities. Khan et al. [4] addressed general security and privacy concerns, emphasizing key 5G technologies such as SDN, NFV, and NS. Sullivan et al. [7] provided a comprehensive overview of 5G security and the technologies designed to ensure its robustness. Tanveer et al. [8] conducted an in-depth exploration of the 5G network architecture, emphasizing crucial performance indicators compared to previous and upcoming generations of cellular networks. Tang et al. [9] conducted a comprehensive review of the novel features of 5G technology. Additionally, Khan and Martin [10] undertook a thorough examination of the current state of sign-up/subscription privacy in 5G networks.

Varga et al. [11] addressed challenges and proposed solutions concerning integrating 5G with industrial Internet of Things (IoT) applications. Wijethilaka and Liyanage [12] conducted a comprehensive analysis of NS implementation in the context of IoT. Wazid et al. [13] provided an in-depth exposition on the essential network and threat models required for the communication environment in IoT-enabled systems. Sanchez-Gomez et al. [14] conducted a detailed analysis of critical aspects of low-power wide area network security, emphasizing network access and the intersection of 5G and IoT.

Sharma et al. [15] conducted an extensive review focusing on securing industrial IoT devices and contributing to developing security methods employed in 5G and blockchain environments. Zhang et al. [16] presented a comprehensive summary of current end-to-end secure communication scenarios and fundamental techniques. Liu et al. [17] conducted an extensive survey covering various aspects of the security of 5G-IoT in the context of smart agriculture. Ahad et al. [18] discussed technology trends and security considerations for 5G-IoT-based smart health applications. Hui et al. [19] provided a review of the applications of 5G-IoT in the context of smart grids, with a specific focus on security and privacy.

Ogbodo et al. [20] analyzed the security aspects of 5G-enabled smart cities, specifically within the context of 5G, low-power wide-area networks, and IoT. Hakak et al. [21] conducted a study on smart vehicles in the context of 5G technology and security. Qiu et al. [22] briefly highlighted the security requirements of 5G vertical applications such as smart manufacturing, smart traffic, smart grid, and smart campus. Their primary focus, however, was on the three main 5G pillars, namely Enhanced Mobile Broadband (eMBB), Ultra-Reliable Low Latency Communications (URLLC), and massive Machine Type Communications (mMTC), along with a use case related to Industry 4.0. These studies contribute valuable insights into the security considerations of 5G-enabled smart cities, smart vehicles, and various vertical applications.

1.2. Contributions

The current literature does not provide a thorough survey that addresses the security and privacy concerns associated with 5G, legacy mobile networks, and vertical applications. Current surveys concentrate on individual technologies or a vertical rather than comprehensively analyzing the broader security and privacy landscape.

Furthermore, our research builds upon and extends the discussions presented in prior studies, notably the surveys conducted by Khan et al. [4] and Qiu et al. [22]. Consequently, the contributions of our article can be summarized: (1) we explore the security aspects of legacy networks and vertical applications; (2) we explore the security aspects of 5G networks; (3) we fill a gap in the literature by reviewing security aspects regarding various technologies and vertical applications; and (4) based on our findings, we present attack scenarios and attack-defense trees for 5G vertical applications.

1.3. Outline of the Article

The remainder of this article is structured as follows. Section 2 discusses the security aspects of legacy mobile networks, specifically in the context of vertical applications. Section 3 examines the security aspects of 5G in vertical applications. Section 4 presents the challenges and potential solutions concerning privacy in vertical applications. Section 5 outlines discussions and prospects for future research. Finally, Section 6 offers a conclusive summary of the paper’s findings and contributions.

2. Security of Legacy Mobile Networks in Vertical Applications

2.1. Security of Vertical Applications in 2G

2G networks are based on Global System for Mobile Communications (GSM) technology and are used in applications requiring broad signal coverage, low cost, and low data transmission. Some usage scenarios of GSM networks include electronic security systems [23], remote monitoring of small dynamic quantities [24], agriculture [25], healthcare [26,27], industry [28], and tracking [29].

The absence of security measures during the connection to fixed networks is an example of a problem that makes communication and signaling traffic vulnerable. Moreover, the technology cannot effectively detect and neutralize active attacks, such as identity theft, establishing fake base transceiver stations, and eavesdropping [30].

Therefore, 2G network vulnerabilities put vertical applications at risk. Table 1 presents some threats to 2G networks. For instance, attackers can exploit a relatively non-complex form of unilateral authentication. The GSM network can enable operators to employ algorithms such as A3 and A8 [31]. However, extensive analysis has exposed numerous security vulnerabilities within the algorithm’s design or implementation, compromising the confidentiality and integrity of the authentication process [32].

These weaknesses can allow attackers to gain unauthorized access or manipulate authentication mechanisms. Other examples of vulnerabilities include [33]: SIM card cloning, over-the-air cracking, flaws in cryptographic algorithms, short-range protection, lack of client perceptibility, user anonymity leakage, absence of integrity protection, and increased redundancy due to coding preference.

2.2. Security of Vertical Applications in 3G

Wideband Code Division Multiple Access (WCDMA), High-Speed Packet Access (HSPA), and Evolved High-Speed Packet Access (HSPA+) are technologies that emerged in the 3G architecture. Consequently, they provide enhanced data transmission capabilities [34]. Examples of applications include smart home security [35], intelligent image monitoring system [36], water resource monitoring system [37], telemedicine systems [38], remote control system for aerial vehicles [39], vehicle monitoring system [40], bridge monitoring system [41], intelligent electrical workplace security monitoring [42], video service [43], and streaming applications [44].

The growth of 3G networks has enabled a wide range of services, making security-related issues more evident. With the transition to Internet Protocol (IP)-based services, a broader field of applications emerged. However, security challenges also increased as using IP-based networks introduces threats such as viruses and user information theft.

The Authentication and Key Agreement (AKA) protocol has been adopted for access security in 3G networks. However, the techniques used in 3G networks have not been able to authenticate securely, presenting several vulnerabilities. Table 2 presents examples of threats that can be observed in 3G networks. For instance, mobile users are not authenticating in the Serving Network (SN) and not authenticating between the SN and the home network in the wired network. This allows authentication messages to be easily captured and modified during Man-in-the-Middle (MitM) attacks [45].

2.3. Security of Vertical Applications in 4G

Long Term Evolution (LTE) technology has transformed mobile communications with its capability to support multimedia content, nearly real-time communication, and internet connectivity. Applications include remote system control [46], communication systems for drones [47,48], augmented reality [49], high-definition live video streaming [50], telemedicine [51], and smart grid communications [52].

The fully IP-based architecture of 4G networks and the new features introduced in this generation have brought new security challenges. Table 3 presents some threats to 4G networks. Some vulnerabilities from previous generations have been inherited by 4G networks. Attacks on data integrity, Denial of Service (DoS) attacks, unauthorized access, and location tracking are some of the issues identified in networks based on LTE [53].

3. Security of 5G Networks in Vertical Applications

3.1. 5G General Threats

Categorizing threats to 5G networks using the CIA triad can offer an overview of the general challenges involved. We identified various threats during our survey, and the upcoming sections highlight some of them.

3.1.1. Confidentiality

Table 4 presents some examples of confidentiality threats. For instance, relevant information can be obtained passively by accessing and analyzing data transmitted in plaintext over the network. If credentials or access keys are stolen, encryption algorithms are compromised, privilege escalation is executed, lateral movement occurs, or an insider facilitates unauthorized access, confidential information can be obtained actively.

3.1.2. Integrity

Table 5 presents some examples of integrity threats. For instance, false synchronization signal transmissions threaten the 5G Radio Access Network (RAN), which is used to gather critical information and disrupt the proper functioning of communication services. The Quality of Service *(QoS) in 5G networks can be degraded, and harmful actions can be carried out on the systems, altering traffic, data, or controller functions.

3.1.3. Availability

Table 6 presents some examples of availability threats. For instance, an attacker may choose one or several architectural components to form their network exploitation strategy. Malicious actions, whether known or unknown, may be carried out with the intent to conduct DoS, function degradation or interruption, and hijacking applications or devices to alter configurations and introduce malicious code.

3.2. 5G Vertical Applications Threats

Any attack compromising the network’s CIA can impact the vertical applications the network supports. Figure 1 synthesizes examples of threat scenarios in some vertical applications. The scenarios for Industry 4.0 (I), Smart Cities (C), Public Services (P), Smart Grids (G), Intelligent Transportation (T), Smart Health (H), and Smart Agriculture (A) depict potential threats (red image of the attacker) with their respective identifiers. The red light represents compromised air interface communications, active or passive, depending on the related threat. The gray light indicates service unavailability for the user equipment in service. The blue light indicates that channel security is preserved, but internal threats may still exist in the equipment or applications.

Concerning Figure 1, in the context of smart transportation, the Road Side Unit (RSU) is a device that collects, processes, and transmits traffic, safety, and vehicle management information [69]. Multi-Access Edge Computing (MEC), Centralized Unit (CU), and Distributed Unit (DU) refer to 5G network architecture elements.

3.3. Security in Smart Cities

In the context of smart cities [70,71,72], concepts such as smart homes and buildings and smart infrastructure and mobility are considered. Privacy is one of the most relevant challenges in smart cities, as devices constantly capture users’ voices, locations, and behavior.

For instance, this vertical is subject to espionage, DoS, MiTM, side-channel attacks, phishing, and spoofing attacks. To mitigate these attacks, it is necessary to establish a secure environment for processing private data, using appropriate encryption models, and implementing suitable policies for access authentication and data transfer [73].

3.3.1. Example of a Smart City Attack Scenario

An attacker can use a network of zombie devices or Software Defined Radio (SDR) to simulate many different devices and initiate mass Radio Resource Control (RRC) connection requests. These requests can overwhelm the radio resources of the base station, causing drones used for logistics to lose their communication channel and become adrift. Many infected drones or SDR devices are required to conduct these malicious actions.

Vulnerabilities can result from infected devices with malicious code or inherent system weaknesses, which may stem from the lack of periodic updates for the devices. Attackers can explore the lack of encryption in specific signaling messages (e.g., RRC connection message) and integrity in specific signaling messages in 3G, 4G, or 5G networks.

Figure 2 presents a sequence diagram depicting the interception, by an attacker, of message exchanges for the configuration of malicious devices. We can observe that by triggering a large volume of connection messages to the base station, the attacker exhausts the available radio resources on the channel, causing legitimate devices to be unable to communicate with the network.

For example, consider a fleet of logistics drones that carry out deliveries in a large metropolitan area. Another fleet from a different company got infected by a malicious update, introducing malicious code into the drones and turning them into zombie devices that form a network controlled by the attacker.

By intercepting the RRC connection parameters in the middle, the attacker triggers commands to their malicious network, altering device configurations and forcing them to send connection requests to the gNodeB continuously. The attacker may also utilize SDR equipment to ensure scarce radio resources. Once the gNodeB can no longer handle the many connection requests, legitimate drones may have their requests left unanswered, resulting in a DoS and system unavailability for delivery operations.

3.4. Security in Smart Transportation

The high mobility and rapid vehicular access make the communication environment in 5G networks complex [74]. The 5G vehicular network access control supports heterogeneous technology and, as a result, presents security risks, demanding a unified and real-time authentication scheme. The network is also vulnerable to DoS attacks due to massive access devices. The 5G vehicular network encounters challenges concerning confidentiality, integrity, availability, and authentication, making its protection a significant challenge [75,76,77,78,79,80,81,82].

As the components of autonomous vehicles are limited in computational capacity, the protection of vehicular networks demands an adaptable infrastructure to ensure passengers’ safety and vehicle cybersecurity [83]. Since each vehicle type has distinct computational constraints, policy-based security provides enhanced security to match these differences, ensuring each vehicle has appropriate protection resources.

3.4.1. Example of a Smart Transportation Attack Scenario

An attacker can monitor and analyze network traffic and steal sensitive vehicle information (e.g., vehicle location and identity). The attacker monitors and analyzes network traffic on the air interface, capturing message exchanges between a vehicle and the gNodeB, and stealing sensitive vehicle information (e.g., vehicle location and identity). The location can be retrieved by obtaining parameters such as the International Mobile Subscriber Identity (IMSI), Temporary Mobile Subscriber Identity(TMSI)/Globally Unique Temporary Identity (GUTI), and Tracking Area Identity (TAI).

Vulnerabilities can result from incorrect equipment configuration, either accidental or malicious. The lack of encryption in specific signaling messages (2G, 3G, 4G, and 5G), such as RRC connection messages and Paging messages, can be exploited. Attackers can also explore weak encryption algorithms (e.g., A5/1) and the lack of additional security countermeasures (e.g., random padding and inclusion of International Mobile Equipment Identity (IMEI)). Other vulnerabilities include rare allocation of TMSI/GUTI, allocation of IMSI (instead of TMSI), and non-compliance with 3GPP specifications due to lack of encryption in "security mode command" messages.

Figure 3 shows a sequence diagram illustrating the interception, by an attacker, of the message exchange during the establishment of a 5G-New Radio (NR) RRC connection. By capturing the RRCSetupComplete message, we can observe that the attacker gains access to the parameters required to infer the user’s location.

For instance, consider an autonomous vehicle transporting high-value cargo (a critical business system). If the network operator has incorrectly or insufficiently configured security settings in commissioning their gNodeB, the attacker could capture the signaling exchange between the vehicle and the gNodeB. By obtaining the relevant parameters, the attacker can infer the location of the cargo. Moreover, this scenario could be related to secure critical systems, as undesired behaviors may harm human beings (e.g., collisions).

3.5. Security in Public Services

Public service systems are commonly interconnected through private networks and entail high maintenance costs. Public service networks must comply with 3GPP standards, utilizing tactical bubbles in a hybrid format with commercial networks. However, this exposes the network to challenges concerning availability, reliability, and integrity [84,85,86].

3.5.1. Example of a Public Service Attack Scenario

An attacker can capture sufficient information to tamper with remote commands sent to a surveillance drone, which may have weapons attached to its structure. This highly complex attack requires the attacker to capture security configuration parameters. Once the attackers obtain the keys and identifiers, they can conduct malicious actions to send false or altered commands to control the drone or any of its resources.

Vulnerabilities can also result from incorrect equipment configurations, either accidental or malicious. The lack of encryption in specific signaling messages (2G, 3G, 4G, and 5G), such as RRC connection messages and Paging messages, can be exploited. The attacker can also exploit the weak encryption algorithms (e.g., A5/1) and the lack of additional security countermeasures (e.g., random padding and IMEI inclusion). Other examples of vulnerabilities include rare TMSI/GUTI allocation, allocation of IMSI instead of TMSI, non-compliance with 3GPP specifications due to the lack of encryption in "security mode command" messages, and low control of information shared by individuals involved in the network configuration or operation process.

Figure 4 presents a sequence diagram to illustrate the interception by an attacker of the message exchange to perform the 5G RRC connection setup and Non-Access Stratum (NAS) authentication and security. We can observe that the attacker, in possession of network security information, can take actions to compromise data confidentiality and integrity that traverse the user plane, thereby tampering with the data flow by removing, adding, or altering packets in the network.

For instance, consider a fleet of armed drones patrolling conflict zones and high-risk areas. An attacker could capture airborne signalings to obtain connection setup parameters and, in conjunction with information (security keys) obtained through malicious insiders who might have infiltrated the operators or corporations responsible for network configuration and operation, gain access to the UPF in the core. Subsequently, the attacker could implement malicious code within the function to tamper with the data flow, enabling the transmission of adulterated commands to the drones. This could result in actions such as firing weapons to harm innocent civilians (critical mission system).

3.6. Security in Industry 4.0

Industry 4.0, evolving with IoT technologies, utilizes 5G networks in industrial IoT applications [87]. Moreover, Industry 4.0 is associated with security challenges in industrial cyber-physical systems, as an attacker can exploit known cellular network vulnerabilities to carry out cyber-attacks and cause damage to the industrial processes [88,89,90].

Industry 4.0 also leads to an increase in the use of private mobile networks [91]. This type of network is one of the most important connectivity technologies in this context and, therefore, should be among the services offered by Mobile Network Operators (MNOs). To ensure network availability, privacy, and integrity, companies and MNOs must prioritize cybersecurity. The private mobile network can be deployed in different architectures depending on corporate use cases, subject to different security risks. The company and the MNO must work together to mitigate them [92].

3.6.1. Example of an Industry 4.0 Attack Scenario

An attacker can capture information about the cell on the air interface and use it to configure a fake base station through which industrial equipment can be made unavailable by disabling or isolating them from the network. A malicious base station captured IMSI (or GUTI), and Cell Radio Network Temporary Identifier (C-RNTI) is required for devices to connect to the fake network.

Vulnerabilities can result from incorrect equipment configuration, whether accidental or malicious or the use of radio resources causing destructive interference, forcing the network to downgrade. It can exploit the lack of mutual authentication (2G), lack of encryption in specific signaling messages (2G, 3G, 4G, and 5G) (i.e., RRC connection messages), lack of integrity (2G), lack of integrity in specific signaling messages (3G, 4G, and 5G), weak encryption algorithms (i.e., A5/1), and lack of additional countermeasures for weak encryption algorithms (i.e., padding randomization and inclusion of IMEI), rare allocation of AKA (in comparison with the proposed frequency for AKA allocation).

Figure 5 presents a sequence diagram to represent the interception, by an attacker, of the message exchange for the configuration of a fake base station. We can observe that by capturing configuration information about the cell, such as the C-RNTI message, the attacker gains access to the necessary parameters for creating the fake base station.

For instance, consider a set of industrial equipment operating on a production line. An attacker could employ a fake base station and provide a signal with a higher power to the industrial devices. Since attackers can capture the cell configuration parameters, when correctly set up, the equipment can detect this fake base station as legitimate.

However, upon connecting to this higher-power signal, which is expected to deliver a better QoS, the devices become inaccessible, as they need access to the core network and, consequently, need a data plan. Therefore, the industry could not send new commands or collect crucial plant data for control actions, leading to paralysis or reduced production line performance and financial losses (given that these are critical business systems).

3.7. Security in Smart Grid

Using 5G networks can benefit the requirements present in the services of power grids [93]. However, many security challenges exist [94,95]. Applying 5G resources in power grids introduces new threats due to the integration of multiple heterogeneous wireless networks, more open network installations, and service providers with different levels of trust. Additionally, network devices have limited computational resources, making security protection difficult. In the case of an attack at the edge, for example, the attacker may gain access to the core and perform data leakage and DoS attacks [95].

3.7.1. Example of a Smart Grid Attack Scenario

An attacker can intercept uplink data from the smart energy meter and tamper with it, retransmitting it to provide the utility company with fake information about the load consumption. This is a highly complex attack, as the attacker needs to capture security configuration parameters. Once attackers obtain these keys and identifiers, they can conduct malicious actions to send false or tampered information to the electric system operator.

As for the previous scenarios, vulnerabilities can result from incorrect equipment configuration. Lack of encryption in specific signaling messages (2G, 3G, 4G, and 5G), such as RRC connection messages and Paging messages, can be exploited. Attackers can exploit weak encryption algorithms (e.g., A5/1) and the lack of additional security countermeasures (e.g., random padding and IMEI inclusion). Other examples of vulnerabilities include infrequent allocation of TMSI/GUTI, allocation of IMSI instead of TMSI, non-compliance with 3GPP specifications due to the lack of encryption in "security mode command" messages, and insufficient control over information shared by individuals involved in the network configuration or operation process.

Figure 6 depicts a sequence diagram to represent the interception, by an attacker, of the message exchange for the 5G RRC connection setup and NAS authentication and security configuration. We can observe that the attacker, possessing network security information, can perform actions to breach the confidentiality and integrity of data transmitted in the user plane, enabling the attacker to impersonate the legitimate user and manipulate the data flow by removing, adding, or tampering with packets in the network.

For example, consider a smart meter installed in a high-end residence. After capturing the parameters, the attacker, with the help of security keys from SIM cards purchased from employees with elevated access credentials within the service providers, can transmit tampered data to the energy utility company, indicating a consumption much lower than what the actual consumer unit is performing.

This attack can cause significant financial losses for the distributor if carried out in many residences (a critical business system). In another scenario, the attacker could infer the occupants’ behavior with access to the household’s consumption data, potentially mapping the moments when the property is most vulnerable to invasions and theft of targeted assets.

3.8. Security in Smart Health

The advent of 5G networks can support smart health in aspects such as hospital asset management, remote health data monitoring, and medication control [96]. The architecture of e-Health applications [97], for example, includes sensors on the human body, communication networks, and services associated with medical service providers. Therefore, sensitive data can be exposed to various attacks [98,99]. For instance, data breaches, interference, availability attacks, unauthorized access, DoS attacks, social engineering, phishing, and malware attacks can occur.

Therefore, ensuring the security and privacy of medical applications is essential [73,100]. To protect this type of application, solutions proposed in the literature address, for example, authentication and authorization, using encryption and redundancy to ensure availability and secure communication between hospitals, medical personnel, and patients [73].

3.8.1. Example of a Smart Health Attack Scenario

An attacker can emit a signal that causes destructive interference, disrupting or degrading the connection of a medical device during a hospital procedure. An attacker requires a jamming device to carry out this attack. The capture of information about the configuration of the 5G RRC connection can assist in adjusting the malicious equipment, making it no longer necessary to radiate the signal over a wide range and increasing the damage in the specific irradiated frequency band due to the provision of power in the equipment.

The vulnerability exploited in this attack is inherent to the communication channel used, as the air interface remains inevitably exposed and widely accessible. Figure 7 presents a sequence diagram to represent the interception, by an attacker, of the message exchange to capture parameters about the 5G RRC connection.

We can observe that the attacker, armed with the captured information, configures the jamming device and initiates signal radiation, causing connection loss or deterioration of service quality. To continue operating the device, it may seek a connection with a more distant gNodeB operating in a different frequency band from the degraded one. However, due to the greater distance between the equipment and the base station, attackers can use a modulation level with fewer symbols. This procedure will worsen service quality to levels that may render healthcare service provision impossible.

For example, one can envision a surgery scenario where a physician remotely controls a surgical robot. Upon capturing the RRC connection configuration parameters, the attacker adjusts the jamming equipment to the operating frequency band of the hospital device.

Subsequently, the attacker initiates the signal radiation that will cause destructive interference in the 5G network signal. The robot will lose communication with the network and may attempt to connect to another base station farther away, operating on a different channel. However, the increased distance will result in the use of a modulation level with fewer symbols, leading to a deterioration in service quality. Consequently, the quality of service may become insufficient for providing a service like surgery, which relies on low latency for the surgical equipment to respond quickly and for procedure images to reach the physician in near real-time (a safety-critical system).

3.9. Security in Smart Agriculture

The evolution of agricultural applications in the context of smart agriculture necessitates using technologies such as edge computing, augmented reality, and artificial intelligence [101]. Various network requirements are considered when considering the different types of applications, including latency, data processing, and transmission type. By supporting different types of radio connections, agricultural systems present vulnerabilities related to licensed radio spectrum standards (2G, LTE, and eMTC), as well as threats found in IoT devices when using unlicensed spectrums (Wi-Fi, LoRa, and SIGFOX).

Furthermore, attackers can conduct DoS attacks by infected devices or external devices attempting unauthorized access. In general, attacks threatening systems in this vertical are related to IoT system vulnerabilities and can be categorized into data attacks, network and equipment attacks, and supply chain attacks [73].

3.9.1. Example of a Smart Agriculture Attack Scenario

An attacker can capture enough information to tamper with remote commands sent to a fleet of autonomous harvesters, interrupting or delaying harvesting and damaging the machines or crops. This results in significant financial losses.

This is a highly complex attack, as the attacker needs to capture security configuration parameters. Once the attackers obtain these keys and identifiers, they can conduct malicious actions to send false or tampered commands to control the harvesting machines. For this type of attack to occur, specific vulnerabilities in the system are considered a premise. Vulnerabilities can result from incorrect equipment configuration, whether accidental or malicious. Lack of encryption in specific signaling messages (2G, 3G, 4G, and 5G), such as RRC connection messages and Paging messages, can be exploited.

Weak encryption algorithms (e.g., A5/1) and the lack of additional security countermeasures (e.g., random padding and IMEI inclusion) are vulnerabilities. Other examples of vulnerabilities include infrequent allocation of TMSI/GUTI, allocation of IMSI instead of TMSI, non-compliance with 3GPP specifications due to the lack of encryption in "security mode command" messages, and insufficient control over information shared by individuals involved in the network configuration or operation process.

Figure 8 presents a sequence diagram to represent the interception of the message exchange for the 5G RRC connection setup and NAS authentication and security configuration. We can observe that the attacker, armed with network security information, can carry out actions to breach the confidentiality and integrity of data transmitted in the user plane, allowing them to intercept, read, alter, and retransmit packets that will appear legitimate.

For example, consider a fleet of autonomous harvesters operating in the field, monitored and operated remotely through the 5G network. With the collected information from the air interface and internal malicious actors within the network operators, an attacker can intercept the data sent to the machines and maliciously retransmit commands. The harvesters can then misbehave and damage vast areas of crops, resulting in losses for the harvest, which, depending on their magnitude, can influence the availability of that crop in the market and alter its prices (a critical business system).

3.10. Security in Other Verticals

The existing threats may extend to other verticals, such as education and retail [102]. Smart education is a relevant vertical for both the public and private sectors, which can positively impact student learning [103]. In the context of education, immersive technologies like Augmented Reality (AR) and Virtual Reality (VR) are also susceptible to attacks. For example, an attacker might gain unauthorized access to and manipulate video streams used in AR applications. Moreover, AR and VR applications are vulnerable to tampering, side-channel attacks, malicious code injections, and hardware Trojans [94].

3.11. Attack-Defense Trees

3.11.1. Attack-Defense Tree for the Smart City Scenario

Figure 9 presents an attack-defense tree for the DDoS scenario in smart cities. We can observe that there is a primary goal (Attack on the 5G Network) from which a primary sub-goal derives (DDoS Attack on the Smart Cities Vertical). The subsequent nodes are divided into secondary sub-goals (Logical Attack and Physical Attack). They are conjunctive refinements, implying that both conditions must be fulfilled. Also, security and privacy solutions in smart cities [104] and DDoS prevention strategies [105] are presented as countermeasures for the primary sub-goal. The logical attack must be done by infecting the drones, which can be achieved through malicious firmware updates. The countermeasure proposed is to verify the integrity and authenticity of updates.

The physical attack will involve saturating the radio resources of the base station, which can be countered by implementing mechanisms for security at the physical layer [106]. In the lack of measures to mitigate vulnerabilities at the physical layer, two new conjunctive refinements can be valid: capturing 5G RRC connection parameters and continuously firing RRC connection messages. It is possible to address the second refinement by quickly limiting the responsiveness to repetitive RRC connection requests. To carry out the parameter capture, the attacker must employ eavesdropping techniques. It is possible to prevent this threat through specific security strategies [107], such as using encrypted signaling messages. With the lack of measures against the continuous firing of messages, the attacker may use a network of zombie drones or SDRs to flood the base station with RRC connection requests. Attackers can employ a botnet detection and mitigation system to address these actions [108]. In the case of SDR, unauthorized devices can be identified and blocked.

3.11.2. Attack-Defense Tree for the Smart Transportation Scenario

Figure 10 presents an attack-defense tree for capturing confidential information in smart transportation. This and the following trees use the same logic of Figure 9. A set of solutions for physical layer security relates to this scenario [59,106,109,110,111]. We can observe that the capture occurs through eavesdropping on the air interface. As a countermeasure to protect the air interface, increasing the secrecy rate with the design of pre-coding and artificial noise transmission by the base station is proposed [107].

We also observe that the successful progress of the attack depends on the Improper Security Configuration of the Base Station, enabling vulnerabilities such as transmitting permanent identifiers in clear text. On the other hand, the User Equipment Localization attack will involve using the captured parameters to infer the user’s location. For instance, one possible countermeasure for this attack is the random selection of pre-coding schemes that provide the highest rates [112].

3.11.3. Attack-Defense Tree for the Public Service Scenario

Figure 11 presents an attack-defense tree for the scenario of compromising the control of patrolling drones in public services. A set of solutions is presented to combat the capture of identifiers and keys, replacing permanent identifiers with variable and temporary pseudonyms [113]. We can observe that the capture occurs through eavesdropping on the air interface and information leakage by malicious insiders within the network.

As a countermeasure to protect the air interface, increasing the secrecy rate with the design of pre-coding and artificial noise transmission by the base station can be used [107]. Against the exposure of confidential information, access control and action logging for non-repudiation, user behavior analysis, and user-level and time-based access policies can be implemented [114].

On the other hand, the attack of Malicious Access to User Plane Function (UPF) will involve using captured keys and identifiers to access the data flow and inject malicious code into the UPF. One possible countermeasure for this attack is using intelligent authentication through machine learning [115] and cross-layer authentication protocol [116]. With the lack of measures to mitigate the vulnerabilities mentioned above, data flow poisoning and takeover of patrolling drones may occur. However, there are possible countermeasures [117].

3.11.4. Attack-Defense Tree for the Industry 4.0 Scenario

Figure 12 presents an example of an attack-defense tree for the scenario of disruption in industrial service. We can observe the connection of the equipment to the fake base station. As an example of a countermeasure, the use of an algorithm that monitors the equipment and verifies if they are performing the expected function [118] is presented. With the lack of measures to mitigate the vulnerabilities mentioned above, the attacker may cause the equipment to disconnect from the legitimate network and halt the production line.

3.11.5. Attack-Defense Tree for the Smart Grid Scenario

Figure 13 presents an attack-defense tree for the scenario of data tampering in smart grids. A set of solutions is present in the literature to combat the capture of identifiers and keys, replacing permanent identifiers with variable and temporary pseudonyms [113]. Afterward, we can observe that the capture occurs through eavesdropping on the air interface and leakage of information by malicious insiders within the network.

As an example of a countermeasure to protect the air interface, increasing the secrecy rate with pre-coding design and artificial noise transmission by the fake base station is presented [107]. Against the exposure of confidential information, access control and action logging for non-repudiation, user behavior analysis, and user-specific access policies in terms of level and time are presented [114].

The attack of transmitting adulterated data consists of using the captured keys to access intercepted user plane data and retransmit modified information, which has the potential countermeasure of using intelligent authentication through machine learning [115]. With the lack of measures to mitigate the vulnerabilities mentioned above, modification of data sent by the smart meter to feed the utility company with false or maliciously biased information may occur, with a potential countermeasure being the use of blockchain to ensure message authenticity and integrity [119].

3.11.6. Attack-Defense Tree for the Smart Health Scenario

Figure 14 presents an attack-defense tree for smart health’s 5G network signal degradation scenario. A set of solutions for physical layer security is presented [106]. Subsequently, we can observe that the capture occurs through eavesdropping on the air interface.

As an example of countermeasure, increasing the secrecy rate through pre-coder design and artificial noise transmission by the fake base station is presented [107]. The attack that causes loss of connection or QoS degradation is carried out through Jamming, which can be mitigated by designing a high-reliability beamforming transceiver. With the lack of measures to mitigate the mentioned vulnerabilities, attackers could conduct signal radiation, causing destructive interference on the legitimate network signal.

3.11.7. Attack-Defense Tree for the Smart Agriculture Scenario

Figure 15 presents an attack-defense tree for the scenario of command tampering in smart agriculture. A set of solutions is presented to combat the capture of identifiers and keys, replacing permanent identifiers with variable and temporary pseudonyms [113].

Afterward, we can observe that the capture occurs through eavesdropping on the air interface and information leakage by malicious insiders within the network. A countermeasure to protect the air interface is to increase the secrecy rate by designing a pre-coder and artificial noise transmission by the fake base station [107]. To counter the exposure of confidential information, access control and action logging can be implemented for non-repudiation, user behavior analysis, and user-specific access policies based on level and time [114].

The attack of transmitting adulterated commands consists of using the captured keys to access intercepted data from the user plane. In this case, one countermeasure is using intelligent authentication through machine learning [115]. With the lack of measures to mitigate the mentioned vulnerabilities, the attacker could conduct the modification of commands sent by the control center and subsequent sending of malicious commands to the self-driving harvesters, with a possible countermeasure being the use of blockchain to ensure authenticity and integrity of messages [119]. This solution was initially designed to address security issues in the smart transportation vertical. However, given the similarities between attacks that adulterate data in transit in the network, the same solution could apply to the smart agriculture scenario.

4. Other Concerns on the Privacy in Vertical Applications

4.1. Privacy in Vertical Applications Communications

This section discusses privacy based on communication, NS, and MEC. For communication, we exemplify two application scenarios: vehicular networks and drones.

4.1.1. Privacy of 5G Vehicular Networks

The most recurring threats mentioned in the literature are eavesdropping, MitM, impersonation, collusion, identity disclosure, de-anonymization/re-identification, tracking, and inference. Li et al. [120], for instance, presented some privacy preservation solutions, organizing them according to different types and classifications of services. The solutions can address data privacy, identity privacy, location privacy, and mobility privacy.

4.1.2. Privacy of 5G Drone Communications

In specific scenarios where drones are used as 5G base stations or relays, such as in public safety situations, the data collected by these drones becomes a potential target. Intruders aim to extract sensitive information from the drones. Similarly, intruders may attempt to compromise the drones and control them for malicious purposes when drones are used for civilian monitoring and surveillance purposes. This can pose serious threats, as compromised drones can be used as weapons to carry out attacks against crowds. Moreover, compromised drones can exploit communications between devices to eavesdrop on data acquired by other nearby drones.

4.2. Privacy in Network Slicing

The division of the network into distinct slices, each with appropriate isolation measures, is essential to meet the privacy needs of various vertical applications [121]. By incorporating the necessary NF to preserve privacy, allocating separate slices helps address the diverse privacy requirements of different verticals. More robust authentication mechanisms and effective slice isolation techniques restrict access from one slice to another, ensuring data confidentiality. The dynamic modification of the NFV structure adds complexity to disrupting privacy-preserving mechanisms.

Compliance with specific privacy schemes adds another layer of complexity. Given the various data protection regulations in different countries or regions, there may be conflicts of laws requiring adherence to privacy frameworks tailored to the respective geographical context. These schemes are essential to maintain data integrity and security during transmission [12]. One possible solution is to modify settings within the slices, such as adjusting the arrangement of NF.

4.3. Privacy of Application Data in MEC

Regarding security and privacy protection from the MEC perspective, several solutions are proposed in the literature to enhance network trust. In the work presented by Khan et al. [4], various examples of solutions related to this relevant topic are discussed. In 5G networks, the mobile edge is the point of access for users and services from the RAN, and it is also a point of vulnerability in terms of security. Identified vulnerabilities and potential attacks can cause significant damage to the MEC system.

5. Discussion and Future Research Directions

Downgrade attacks are noteworthy among the various threats targeting legacy and 5G networks. In the event of a successful downgrade attack, it is essential to minimize the impact on network users. Such concerns are particularly relevant for countries where the transition between legacy networks and 5G occurs gradually. Government documents highlight the downgrade attack as a relevant threat to national security. For instance, in a technical document [122], the United States Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and the Office of the Director of National Intelligence presented the following scenario: (1) an attacker accesses a 5G small cell near a government office, (2) the attacker configures the small cell to enable spoofing in the context of 4G, (3) the attacker forces a downgrade in the 5G network to a vulnerable 4G configuration (exploiting vulnerabilities in the Signaling System 7 (SS7)) to gain access to information technology and communication components used by government employees, and (4) the attacker can use the obtained information to access more secure networks and obtain confidential data. In addition to governments, we propose that vertical industries thoroughly analyze comparable scenarios to mitigate such cyber-attacks proactively.

Some studies analyzed in this extensive survey propose or verify strategies to prevent general threats such as eavesdropping [107,123,124,125,126], DoS [127,128,129], EDoS [130], scanning attacks [131], IMSI catchers [113,132], spoofing attacks [133,134,135,136], resource depletion attacks (e.g., botnet attacks [108,137]), jamming [138,139,140], localization attack [112], pilot contamination [141,142], pollution attacks [143,144,145], false data injection [117], DDoS [105,146,147,148,149,150], and DRDoS [151,152]. Other proposed solutions address secure handover (e.g., for heterogeneous IoT networks [153]), enabling devices to join domains with trust (e.g., using authentication frameworks [88,154,155] and protocols [156]). Some studies concern the proposal of improved authentication/authorization [157,158,159,160,161], architectures [162,163,164,165,166,167], lightweight security [168,169,170,171,172], security schemes (models or protocols) [58,62,173,174,175], security platforms (or systems) [176,177,178,179,180], algorithms (or methods) [181,182,183,184,185], SDN/NFV-based core NS [186], anomaly/threat detection [118,187,188,189,190], controlling NS access/use [191], ensuring NS isolation [192], ensuring intra-slice security [193], ensuring security in D2D communications [64,194,195,196,197,198], security based on blockchain [54,119,199,200,201], and testbeds for 5G experimentation [202,203,204,205,206].

Some proposed solutions focus on resource management considering the QoS, including security [207]. Other solutions focus on security and privacy in 5G networks and vertical applications, such as smart transportation [208], Industry 4.0 [209], smart cities [104], public services [168], smart grids [95], smart agriculture [210], and smart health [211].

However, the literature lacks comprehensive discussions on threats and solutions for other vertical applications, including education. For instance, this encompasses potential threats to the confidentiality of students’ historical records within the education system. Due to the unique requirements and challenges introduced by vertical applications, generic security solutions may only partially align with the specific needs of individual services for effectively mitigating distinct threats such verticals face.

Some surveyed papers also propose applying formal methods to enhance trust (regarding security) in 5G networks (e.g., [210,212,213,214,215]). In this case, one of the challenges is the appropriate choice of how to represent network components, specific components of application scenarios, potential attacks, and mitigation strategies. Analyzing the security properties of specific solutions (e.g., protocols) is a common and recognized activity within the community. However, when integrated with network elements, the formal modeling and analysis of 5G application scenarios remain challenging in the field [212]. As each vertical application has specific security threats, its characteristics should be considered in formal security analyses of 5G networks.

Moreover, other surveyed papers propose applying machine learning techniques to detect threats [216], as with intrusion detection systems. In this case, a relevant issue relates to trust in 5G systems based on artificial intelligence [68]. Applying formal methods is also an interesting research opportunity to increase trust in these systems. However, several challenges are identified when using formal methods, such as (1) the representation of traditional machine learning models as part of 5G-enabled systems, (2) the representation of deep learning models as part of 5G-enabled systems, and (3) the formal analysis of such models’ properties (including security).

6. Conclusion

This extensive survey included analyses of research papers, technical reports, technical specifications, and white papers. Upon analyzing the documents, we observed that several vulnerabilities, threats, and attacks highlighted in research papers are also emphasized as concerns by industry, governments, and standardization institutions.

We categorized threats to vertical applications, such as smart cities and Industry 4.0. We defined attack scenarios and attack-defense trees to provide a more in-depth discussion of some identified threats. We highlighted the relevance of a set of threats and attacks based on our extensive survey. For instance, DoS attacks are highly critical for all vertical applications discussed. We filled the gap in the literature regarding comprehensive discussions on threats and solutions for other vertical applications, including education.