Cellular Networks Attacks: 5g network research, inter-rat security, private 5g security

Public and private 5G deployments present security challenges spanning the full protocol stack — from the radio interface through the core to internet interconnect. Multi-generation (2G/3G/4G/5G) deployments are particularly vulnerable to inter-RAT fallback attacks, where an adversary induces a 5G-capable device to connect to a legacy network with weaker security controls, stripping SUPI concealment, downgrading encryption, and enabling passive interception.

Network slicing, a flagship 5G SA capability, promises logical isolation between virtual network instances sharing the same physical infrastructure. In practice, slice isolation depends on correct implementation of 3GPP specifications across the AMF, NSSF, RAN, and UPF. Published research has demonstrated cross-slice authentication bypass, resource starvation attacks, and data-plane leakage in misconfigured commercial deployments. The NSSF (Network Slice Selection Function) and NSSAI (Network Slice Selection Assistance Information) handling represent particularly sensitive components where implementation deviations from the specification create exploitable conditions.

Private 5G networks (Non-Public Networks or NPNs) are increasingly deployed in industrial, campus, and enterprise environments. Unlike public MNO deployments, private 5G networks are operated by organizations without telecommunications security expertise, introducing configuration vulnerabilities, default-credential risks, insufficient RAN-to-core network segmentation, and inadequate monitoring for protocol-level anomalies. This growing deployment class represents a rapidly expanding and under-audited attack surface.

Security auditing for public and private 5G deployments draws on frameworks including 3GPP TS 33.501, the GSMA NESAS (Network Equipment Security Assurance Scheme), and ETSI NFV security specifications. For private deployments specifically, GSMA FS.38 provides guidance on Non-Public Network security architecture — an important reference for organizations deploying 5G infrastructure without dedicated telecommunications security staff.