The primary objective of this work is to help maintain and extend the LKN 5G Roaming Testbed. The testbed is now available as open-source software on GitHub and it is also part of the student position to keep that repository up to date: https://github.com/tum-lkn/LKN_5G_Roaming_Testbed

The main use of the LKN 5G Roaming Testbed is to perform security investigations, but also present the testbed in various demonstrations. While security investigations in more detail are part of other student works like research internships and master theses, helping to prepare for the demos is also part of this working student position.

The transition from 4G to 5G introduced a highly service-based and cloud-native core network architecture. While the 5G User Plane Function (UPF) provides efficient packet forwarding, security functionality traditionally associated with packet gateways in previous generations has largely been separated from the user plane. To address security concerns, the 3GPP architecture introduces the Inter PLMN User Plane Security (IPUPS) function, which can be deployed alongside the UPF and acts as a non-transparent firewalling entity.

However, recent developments indicate that transparent firewalling approaches may also be feasible in 5G environments, potentially offering advantages in terms of performance, deployment flexibility, and operational simplicity. At the same time, the increasing use of IPsec-based protection for inter-operator roaming interfaces raises new challenges and opportunities for different firewall architectures.

This thesis aims to investigate and compare transparent and non-transparent security approaches in 5G core networks through practical implementation and experimental evaluation.

Thesis Outline

The increasing use of cellular-connected drones (UAVs), especially for beyond-visual-line-of-sight applications, introduces significant challenges for airspace security, critical infrastructure protection, and regulatory compliance. Unlike traditional drones controlled via short-range radio, modern UAVs increasingly rely on 5G/6G networks for command, control, and video transmission. This shift opens up a novel opportunity: mobile network infrastructure itself can be leveraged as a large-scale sensor system for drone detection. The objective of this thesis is to investigate whether cellular-connected drones can be detected using mobile network data.

Work Items

The thesis is structured into several closely connected stages:

• comprehensive literature review that systematically surveys existing approaches to drone detection in mobile networks
• in-depth analysis of RAN and core network parameters at the MAC layer and above to identify metrics that may carry discriminative information
• generation and collection of representative data
• investigate different drone detection concepts based on the identified metrics

Depending on the type of thesis and the progress during the work, the scope may be adjusted, and not all work items need to be completed. For more details regarding the individual work items, do not hesitate to contact us.

Voraussetzungen

The idea is to implement attacks against the 5G SEPP and implement countermeasures into the Open5GS SEPP implementation. The effect of the attacks and countermeasures shall be evaluated.

This will be done on the already existing 5G Roaming Testbed at LKN, which is dockerized and can run on any two machines (VMs, PCs, ..).

The 5G Service-Based Architecture (SBA) introduces new challenges and opportunities in the design of roaming interfaces between mobile network operators. Central to secure inter-operator communication are the Security Edge Protection Proxy (SEPP) and IP eXchange (IPX) network provider entities, which facilitate secure signaling across trust boundaries.

An existing Python-based simulation framework models a fixed 5G roaming topology with four entities: vSEPP, vIPX, hIPX, and hSEPP. While this setup is suitable for basic testing, it lacks scalability and flexibility for simulating realistic, multi-operator roaming scenarios.

This thesis aims to refactor and extend the SEPP and IPX implementations to support scalable, multi-connection environments, enabling dynamic routing and connection management across a larger simulated network. The SEPP must unify the roles of vSEPP and hSEPP, while the IPX must support parallel connections and enforce routing rules based on operator policies and network topology. To achieve realistic routing behavior, the thesis will incorporate the FRRouting (FRR) suite, an open-source routing stack supporting protocols such as BGP, OSPF, and IS-IS. FRR will be used to simulate routing decisions and path selection within the IPX network, enabling policy-based and topology-aware message forwarding.

Objectives

1. Unified SEPP Design: Develop a single SEPP module that combines both vSEPP and hSEPP functionalities, capable of handling multiple concurrent connections and maintaining session state.
2. Enhanced IPX Module: Extend the IPX implementation to support: Multiple parallel connections. Routing logic based on operator identifiers, trust relationships, and message types. Integrate with the FRRouting suite to simulate realistic routing behavior.
3. Scalability Framework: Design a flexible configuration system to instantiate multiple SEPP and IPX entities dynamically, simulating a larger roaming network.
4. Testing & Validation: Create test scenarios to validate connection handling, routing correctness, and protocol compliance.
5. Documentation & Thesis Writing: Produce comprehensive documentation and a formal thesis de-

tailing design decisions, implementation, and evaluation results.

Voraussetzungen