Goals

• Analyze new Security feature "Limit precise location from cellular networks" with Apple's new C1/C1X modems 
• Analyzing/Measuring TAR in iPhones (iPhone 17e) 
• Evaluation of how well it performs at protecting user privacy

The objective of this practical research project is to design, implement, and evaluate an automated testing strategy for key network functions in a telecommunications environment. The focus lies on the development of structured test cases and their integration into existing test automation frameworks and CI/CD pipelines.

The objective is to investigate the security of the testbed from both the control plane and the user plane perspective by reproducing multiple attack scenarios in a controlled environment, analyzing how the network reacts to them, and potentially identifying which security mechanisms are effective in preventing or limiting their impact.

The first part of the internship will focus on understanding and documenting the current testbed architecture, including the involved network functions and interfaces, signaling and user plane paths, and the normal behavior of UE registration and PDU session establishment. Based on this understanding, several roaming-related attacks are currently planned for investigation, including SEPP impersonation, Roaming DoS, SUCI DoS, Incorrect PLMN-ID Mismatch, Boundary Bridging into the control plane, Malformed GTP-U Messages, and Invalid User Plane Data Forwarding. This list represents the current candidate set, while the exact number of attacks implemented during the internship may vary depending on their relevance and feasibility within the available setup. The final selection will consider the required attacker position, implementation effort, and expected security impact. This approach aims to maintain a balance between control plane and user plane security while allowing the work to adapt to practical limitations that may arise during implementation.

Each selected scenario will first be analyzed theoretically and then implemented in a reproducible manner using configuration changes, packet manipulation, or traffic generation through a list of dedicated scripts. During execution, the behavior of the system will be constantly monitored. The resulting traces will then be compared with the normal baseline in order to determine whether the attack was successful, blocked by some existing mechanism, or not applicable to the current setup. For each investigated scenario, suitable mitigation mechanisms will be identified and, if feasible, evaluated experimentally. This can include stronger authentication and authorization checks, encryption, or improved intrusion detection.

The final outcome of the internship will therefore consist of a documented set of reproducible security experiments, an assessment of which attack classes are applicable to the testbed, an analysis of their impact on the control and user planes, and practical recommendations for improving the security of the environment. All active testing will remain restricted to the isolated LKN testbed.

The primary objective of this work is to help maintain and extend the LKN 5G Roaming Testbed. The testbed is now available as open-source software on GitHub and it is also part of the student position to keep that repository up to date: https://github.com/tum-lkn/LKN_5G_Roaming_Testbed

The main use of the LKN 5G Roaming Testbed is to perform security investigations, but also present the testbed in various demonstrations. While security investigations in more detail are part of other student works like research internships and master theses, helping to prepare for the demos is also part of this working student position.

The transition from 4G to 5G introduced a highly service-based and cloud-native core network architecture. While the 5G User Plane Function (UPF) provides efficient packet forwarding, security functionality traditionally associated with packet gateways in previous generations has largely been separated from the user plane. To address security concerns, the 3GPP architecture introduces the Inter PLMN User Plane Security (IPUPS) function, which can be deployed alongside the UPF and acts as a non-transparent firewalling entity.

However, recent developments indicate that transparent firewalling approaches may also be feasible in 5G environments, potentially offering advantages in terms of performance, deployment flexibility, and operational simplicity. At the same time, the increasing use of IPsec-based protection for inter-operator roaming interfaces raises new challenges and opportunities for different firewall architectures.

This thesis aims to investigate and compare transparent and non-transparent security approaches in 5G core networks through practical implementation and experimental evaluation.

Thesis Outline

The increasing use of cellular-connected drones (UAVs), especially for beyond-visual-line-of-sight applications, introduces significant challenges for airspace security, critical infrastructure protection, and regulatory compliance. Unlike traditional drones controlled via short-range radio, modern UAVs increasingly rely on 5G/6G networks for command, control, and video transmission. This shift opens up a novel opportunity: mobile network infrastructure itself can be leveraged as a large-scale sensor system for drone detection. The objective of this thesis is to investigate whether cellular-connected drones can be detected using mobile network data.

Work Items

The thesis is structured into several closely connected stages:

• comprehensive literature review that systematically surveys existing approaches to drone detection in mobile networks
• in-depth analysis of RAN and core network parameters at the MAC layer and above to identify metrics that may carry discriminative information
• generation and collection of representative data
• investigate different drone detection concepts based on the identified metrics

Depending on the type of thesis and the progress during the work, the scope may be adjusted, and not all work items need to be completed. For more details regarding the individual work items, do not hesitate to contact us.

Prerequisites

The idea is to implement attacks against the 5G SEPP and implement countermeasures into the Open5GS SEPP implementation. The effect of the attacks and countermeasures shall be evaluated.

This will be done on the already existing 5G Roaming Testbed at LKN, which is dockerized and can run on any two machines (VMs, PCs, ..).

The 5G Service-Based Architecture (SBA) introduces new challenges and opportunities in the design of roaming interfaces between mobile network operators. Central to secure inter-operator communication are the Security Edge Protection Proxy (SEPP) and IP eXchange (IPX) network provider entities, which facilitate secure signaling across trust boundaries.

An existing Python-based simulation framework models a fixed 5G roaming topology with four entities: vSEPP, vIPX, hIPX, and hSEPP. While this setup is suitable for basic testing, it lacks scalability and flexibility for simulating realistic, multi-operator roaming scenarios.

This thesis aims to refactor and extend the SEPP and IPX implementations to support scalable, multi-connection environments, enabling dynamic routing and connection management across a larger simulated network. The SEPP must unify the roles of vSEPP and hSEPP, while the IPX must support parallel connections and enforce routing rules based on operator policies and network topology. To achieve realistic routing behavior, the thesis will incorporate the FRRouting (FRR) suite, an open-source routing stack supporting protocols such as BGP, OSPF, and IS-IS. FRR will be used to simulate routing decisions and path selection within the IPX network, enabling policy-based and topology-aware message forwarding.

Objectives

1. Unified SEPP Design: Develop a single SEPP module that combines both vSEPP and hSEPP functionalities, capable of handling multiple concurrent connections and maintaining session state.
2. Enhanced IPX Module: Extend the IPX implementation to support: Multiple parallel connections. Routing logic based on operator identifiers, trust relationships, and message types. Integrate with the FRRouting suite to simulate realistic routing behavior.
3. Scalability Framework: Design a flexible configuration system to instantiate multiple SEPP and IPX entities dynamically, simulating a larger roaming network.
4. Testing & Validation: Create test scenarios to validate connection handling, routing correctness, and protocol compliance.
5. Documentation & Thesis Writing: Produce comprehensive documentation and a formal thesis de-

tailing design decisions, implementation, and evaluation results.

Prerequisites