PaperlayerView exact revision on arXiv

Source-linked AI summary

Smart Jamming Attacks in 5G New Radio: A Review

Youness Arjoune, Saleh Faruque

arXiv:2009.05531v1eess.SPcs.CRcs.SYeess.SY

TL;DR

Jamming could threaten 5G’s expected public-safety and emergency communications, so the paper examines the 2017 3GPP NR standard’s vulnerabilities. It reviews NR architecture, jammer models, and detection and mitigation approaches. The paper concludes that NR’s flexible, dynamic resource allocation improves resilience, but current antijamming strategies remain poorly suited to NR.

  • Problem

    The paper asks how vulnerable the 2017 3GPP NR standard is to jamming, a threat to 5G’s expected emergency, rescue, public-safety, and military communications.

    Source: §I · p. 1

  • Method

    The paper reviews NR architecture, jamming models, and NR vulnerabilities, then surveys detection and mitigation techniques and discusses their suitability against smart jammers.

    Source: §I · p. 2

  • Results

    NR’s flexible, dynamic resource allocation enhances resilience to jamming, but NR remains far from secure and reviewed antijamming strategies are not very suitable for it.

    Source: §VI · p. 6

  • Takeaways & Limitations

    Further research on antijamming techniques for 5G NR is highly needed.

    Source: §VI · p. 6

Abstract

from arXiv · show

The fifth generation of wireless cellular networks (5G) is expected to be the infrastructure for emergency services, natural disasters rescue, public safety, and military communications. 5G, as any previous wireless cellular network, is vulnerable to jamming attacks, which create deliberate interference to hinder the communication of legitimate users. Therefore, jamming 5G networks can be a real threat to public safety. Thus, there is a strong need to investigate to what extent these networks are vulnerable to jamming attacks. For this investigation, we consider the 3GPP standard released in 2017, which is widely accepted as the primary reference for the deployment of these networks. First, we describe the key elements of 5G New Radio (NR) architecture, such as different channels and signals exchanged between the base station and user equipment. Second, we conduct an in-depth review of the jamming attack models and we assess the 5G NR vulnerabilities to these jamming attacks. Then, we present the state-of-the-art detection and mitigation techniques, and we discuss their suitability to defeat smart jammers in 5G wireless networks. Finally, we provide some recommendations and future research directions at the end of this paper.

I. INTRODUCTION

The introduction frames jamming as a public-safety risk for 5G and calls for assessing the 2017 3GPP NR standard’s resilience. The paper reviews NR architecture, jamming models and vulnerabilities, and detection and mitigation techniques, then identifies future research directions.

I. INTRODUCTION

  • Jamming threatens 5G’s expected role in emergency, rescue, public-safety, and military communications, with low-cost software-defined radio tools lowering the barrier to sophisticated attacks.The paper cites costs as low as 1k$ and notes that jamming can hinder public communication services,.Source: §I · p. 1
  • The paper asks how resilient the 2017 3GPP 5G NR standard is to jamming, under what jammer conditions channels can be taken down, and which countermeasures suit NR.The stated aim includes assessing jamming risks and suggesting future research directions.Source: §I · p. 1
  • The review covers NR architecture, jamming strategies and models, and NR vulnerability assessment.These are identified as core inputs of the article.Source: §I · pp. 1–2
  • It also reviews jamming detection and mitigation techniques, evaluates their suitability against smart jammers in 5G, and outlines conclusions and future research directions.The remaining sections include an assessment of antijamming techniques and recommendations.Source: §I · p. 2

II. 5G NR ARCHITECTURE

The section surveys NR’s spectrum, channels, synchronization signals, numerology, coding, and massive-MIMO features. These elements shape how NR allocates radio resources and exchanges control and data.

II. 5G NR ARCHITECTURE

  • NR operates across 0.6–30 GHz, with carrier bandwidths up to 100 MHz below 6 GHz and 400 MHz above 6 GHz, and provides distinct uplink and downlink physical channels.The listed channels include PDSCH, PBCH, and PDCCH on downlink, and PUSCH, PUCCH, and PRACH on uplink.Source: §II · p. 2
  • NR uses PSS and SSS for downlink frame synchronization and cell-ID conveyance; their sequences and Gold-sequence construction support distinguishing base stations at low SNR.PSS has three possible combinations and SSS has 336; each uses an m-sequence of length 127.Source: §II · p. 2
  • NR numerology supports different spectrum, bandwidth, and service settings through 15, 30, 60, and 120 kHz subcarrier spacings, while mini-slots enable shorter transmissions.A slot has 14 symbols, and mini-slots contain 2, 4, or 7 symbols.Source: §II · p. 2
  • NR uses LDPC coding for data channels and polar coding for control channels; massive MIMO is used to enhance wireless-cell coverage and capacity –.The section notes LDPC performance on small data chunks and polar coding’s near-Shannon-limit performance with large data pieces.Source: §II · p. 2

III. JAMMING ATTACKS

The section distinguishes jammers by how they transmit, conserve energy, and select targets. Their strategies range from continuous interference to reactive or channel-selective attacks.

III. JAMMING ATTACKS

  • Regular jammers continuously inject radio signals without following MAC protocols, while delusive jammers send legitimate-looking bits that can keep receivers listening –.Regular jamming consumes substantial power; delusive jamming can be harder to detect because its signal resembles a legitimate one,.Source: §III · p. 2
  • Random jammers alternate predetermined active and idle periods, conserving energy while using regular or deceptive jamming during active periods –.Source: §III · p. 2
  • Responsive jammers monitor the channel and transmit only when the legitimate transmitter is active, reducing power use relative to continuous jamming,,,.The passage states that the power required for monitoring is far less than that needed to jam a channel continuously.Source: §III · pp. 2–3
  • Go-next jammers follow a transmitter across frequency channels, whereas control-channel jammers target the exchange that precedes communication and can deny network access,.Fast-rate frequency hopping can waste a go-next jammer’s energy.Source: §III · p. 3

A. Vulnerableness of the PBCH to Jamming

The assessment contrasts selective jamming risks in PBCH and PDCCH. PBCH symbols’ proximity can permit shallow-duty-cycle targeting, while PDCCH’s localized CORESET creates a target whose location a jammer may need to discover.

A. Vulnerableness of the PBCH to Jamming

  • PBCH symbols are assigned within two slots below 3 GHz and four slots above 3 GHz; their proximity lets selective jammers target PBCH with a shallow duty cycle.Higher subcarrier spacing shortens slots and lowers the selective-jamming duty cycle; mobile jammers may require ongoing localization monitoring.Source: A. Vulnerableness of the PBCH to Jamming · p. 3

B. Vulnerableness of PDCCH to Jamming

  • CORESET defines localized physical resources and parameters for carrying PDCCH, unlike LTE’s PDCCH region, which spans the channel bandwidth.The passages contrast NR’s frequency-localized CORESET with LTE’s full-bandwidth PDCCH region.Source: B. Vulnerableness of PDCCH to Jamming · p. 3
  • Without CORESET frequency-domain knowledge, a jammer must cover all possible PDCCH locations; decoding that location can enable targeted subcarrier jamming at low duty cycle.The passage identifies the time required to intercept and decode CORESET as an open question.Source: B. Vulnerableness of PDCCH to Jamming · p. 3

C. Vulnerableness of PUCCH to Jamming

The review finds vulnerabilities in both PUCCH and RACH: PUCCH’s hopping defense depends on its rate, while PRACH jamming remains feasible and invalid-preamble handling is unspecified.

C. Vulnerableness of PUCCH to Jamming

  • PUCCH intra-slot hopping offers some protection against selective jamming, but its robustness depends on the hopping rate and public standard information gives jammers an advantage.PUCCH uses MPSK with polar or repetition coding, which the passage describes as offering low jamming protection for polar codes.Source: C. Vulnerableness of PUCCH to Jamming · p. 3

D. Vulnerableness of RACH to Jamming

  • Despite many possible preamble locations and the complexity of finding them in real time, PRACH jamming remains feasible.A jammer unable to locate preambles can instead flood the channel with invalid preambles; 5G NR does not specify how to handle that case.Source: D. Vulnerableness of RACH to Jamming · p. 3
  • The random-access procedure uses a UE preamble on a dedicated RACH, after which the base station estimates timing and allocates resources.The base station communicates the synchronization and resource-allocation information to the initiating UE within a specified time.Source: D. Vulnerableness of RACH to Jamming · p. 3

E. Vulnerableness of Massive MIMO to Jamming

The reviewed material describes jamming vulnerabilities in massive MIMO and channel coding, alongside a review of detection and mitigation methods. Accurate channel estimation under jamming remains a key need for massive MIMO.

E. Vulnerableness of Massive MIMO to Jamming

  • Jamming massive MIMO can target channel estimation; reported attacks against SVD-based and Alamouti STBC systems were supported by analysis, simulations, and real-world experiments.The review says these attack strategies remain valid for massive MIMO.Source: E. Vulnerableness of Massive MIMO to… · pp. 3–4
  • Preserving accurate channel estimation under jamming is described as essential to achieving massive MIMO performance; the review calls for estimation methods that account for jammer-affected pilots.The cited attack strategies were shown feasible by analysis, simulations, and real-world experimentation.Source: E. Vulnerableness of Massive MIMO to… · pp. 3–4

F. Robustness of 5G NR Channel Coding to Jamming

  • The review describes polar and LDPC channel coding as vulnerable to jamming, with high polar-code bit error rate at 0 dB SNR.Most control channels use polar coding, while data channels use LDPC coding; the passage also notes decoder complexity increases with large LDPC blocks.Source: F. Robustness of 5G NR Channel Coding… · p. 4

V. ANTI-JAMMING IN 5G

  • The review organizes anti-jamming coverage into detection methods, mitigation methods, and their effectiveness against 5G jamming.Source: §V · p. 4

A. Detection of Jamming Attacks

The review covers threshold, statistical, and machine-learning approaches to jamming detection. It notes that threshold methods are limited to constant jammers and can produce false alarms in dynamic wireless environments.

A. Detection of Jamming Attacks

  • Threshold detection monitors metrics such as packet delivery or drop ratio, BER, and SNR, but is effective only against constant jammers.These methods manually set metric thresholds by comparing conditions with and without jamming.Source: A. Detection of Jamming Attacks · p. 4
  • Wireless-environment dynamics give threshold-based detection methods a high false-alarm rate.Source: A. Detection of Jamming Attacks · p. 4
  • Statistical detection uses historical data to distinguish jammed from unjammed signals and can achieve high accuracy against constant jammers,.Source: A. Detection of Jamming Attacks · p. 4
  • Machine-learning and deep-learning methods have been investigated for jamming detection,, but the lack of public training datasets and reliance on simulations limit confidence about real-attack performance.Only a few papers cited in the passage collected data in real-world setups.Source: A. Detection of Jamming Attacks · p. 4

B. Mitigation of Jamming Attacks

The review surveys spread-spectrum, game-theoretic, timing-channel, UAV, suppression, and scheduling approaches to jamming mitigation. Their suitability is qualified by implementation, synchronization, power, and smart-jammer constraints.

1) Direct Sequence Spread Spectrum

  • With N = 4095, DSSS can reliably recover data when jamming power exceeds 400 times received-signal power, provided BER does not exceed 105.DSSS multiplies the data signal by a wideband pseudo-noise sequence; its jamming resilience depends on the spreading factor.Source: B. Mitigation of Jamming Attacks · p. 4
  • DSSS requires larger bandwidth and can be complex to implement; recovered PN codes can also enable low-cost follow-on jamming.The passage says a TDMA system using DSSS has been cracked in real time to detect its PN code.Source: B. Mitigation of Jamming Attacks · pp. 4–5

2) Frequency-hop Spread Spectrum

  • Slow-rate frequency hopping can be tracked by a smart jammer, while fast-rate hopping can impair channel performance through synchronization difficulty.Frequency hopping also requires a pre-shared key, whose exchange may be intercepted; the review notes a need to evaluate outage probability for 5G mmWave hopping.Source: B. Mitigation of Jamming Attacks · p. 5

3) Game Theory

  • Game-theoretic anti-jamming models users and jammers as players and seeks an optimal user strategy, such as hopping to another frequency, –.The review notes prior work showing that a Nash equilibrium can be achieved.Source: B. Mitigation of Jamming Attacks · p. 5

4) Timing channels

  • A timing channel restores communication over a jammed channel by using the jammer’s timing pattern to transmit during idle periods.Creating this channel requires jamming detection first.Source: B. Mitigation of Jamming Attacks · p. 5

5) UAVs and Reinforcement learning

  • UAV relays guided by deep reinforcement learning can route mobile users around a heavily jammed base station, but the UAVs are themselves jammer-vulnerable and power-limited, –.Source: B. Mitigation of Jamming Attacks · p. 5

6) Suppression of Jammers

  • Massive-MIMO suppression may address jamming without changing the 5G NR specification; a proposed receiver estimates the jamming channel during pilots and uses it to form rejecting filters.The passage also mentions a mitigation technique based on random matrix theory.Source: B. Mitigation of Jamming Attacks · p. 5

7) Scheduling and Deep Learning

  • SDN/NFV and deep learning may support dynamic resource allocation and scheduling to reduce jamming risk; one proposed joint power-control and scheduling method assumes minimum QoS constraints without prior jammer locations.The passage says scheduling can perform better when combined with deep learning to learn the jammer’s strategy.Source: B. Mitigation of Jamming Attacks · p. 5

C. Effectiveness of Mitigation Techniques and Future Research Directions

The review finds important limits in existing anti-jamming approaches and calls for security to be built into 5G NR design. It also identifies real-world deep-learning data collection and on-the-fly jammer recognition as future research needs.

C. Effectiveness of Mitigation Techniques and Future Research Directions

  • Direct spread spectrum can strongly protect against jamming but may be too complex to implement; frequency hopping is vulnerable to prediction and interception.The review also notes that machine-learning schemes may require long training and large datasets, timing channels need excellent detection, and UAV mitigation needs practical investigation.Source: C. Effectiveness of Mitigation… · p. 6
  • 5G base stations should incorporate anti-jamming measures, including spatial retreat, movement, time, and network reconfiguration.Embedding cybersecurity requirements in the initial design is presented as a way to ensure low-cost deployment rather than addressing future failures.Source: C. Effectiveness of Mitigation… · p. 6
  • Future deep-learning anti-jamming work needs real-world datasets spanning different jammers and both jammed and normal conditions.The proposed models would combine with sensing to recognize jammer strategies and select unjammed channels, including recognizing jamming signals versus legitimate users on the fly.Source: C. Effectiveness of Mitigation… · p. 6

VI. CONCLUSION

The review studies 5G wireless systems’ vulnerability to smart jamming and finds that flexible, dynamic resource allocation improves resilience. However, 5G NR remains vulnerable, and the reviewed strategies are not well suited to it.

VI. CONCLUSION

  • The review concludes that flexible, dynamic resource allocation enhances 5G NR resilience to jamming, but does not make it secure.Source: §VI · p. 6
  • The anti-jamming strategies reviewed address simple attacks and are not very suitable for 5G NR.Source: §VI · p. 6
  • The authors call for further research on anti-jamming techniques for 5G NR.Source: §VI · p. 6
Loading 2009.05531v1…