5G - Security

5G Security

Takeaways from various industry white papers (Mainly from Ericsson, Nokia and Huawei)

Current 4G(LTE) Security:

• Encryption up to the base station.
• Elaborate key management to protect data from physical break-ins.
• Traditional security that come from 3G such as
• Tamper resistant SIM card to protect subscribers from risk of fraud.
• Strong authentication of subscriber
• Strong binding to the charging.

Drivers for 5G Security

• Diverse Usage of 5G - 5G networks to service various industries  beyond mobiles.
• Industry to Industry communications.
• Unattended terminals connecting to 5G networks (Critical infrastructure)
• Health &  Public Safety industries (eg. IOT devices)
• Self Driving cars
• Non-Critical Services, but important business services  such as
• E-Commerce
• New Service delivery models -  Cloud & Virtualization technologies,  X-as-a-Service to reduce costs and deliver services faster.
• Exposing API Interfaces by telecom operators to users & third party services
• Location awareness services
• Caching
• Content adaptation etc..

 5G Security requirements:

• Network Slicing
• Problem statement :
• There are common security requirements across multiple usages. But some usages require additional security requirements and compliance requirements.  
• Safety-related car systems need to follow very comprehensive standards, such as ISO 26262 (Part 6 covers Software security requirements)
• Health care sector is governed by standards such as ISO 27799 and, in the US, the HIPAA (Health Insurance Portability and Accountability Act)
• For smart grids, compliance with standards from the IEEE (Institute of Electrical and Electronics Engineers), the IEC and the NIST (National Institute of Standards and Technology)
• Essentially, each use case its own security requirements.  It is not wise to burden by applying union of all security requirements on all kinds of usages.  It is cost prohibitive,
• Solution: 
•  Network slicing. By having each slice for different usages,  security and associated compliance certifications can be localized to the slices.  Compute, storage and network virtualization play an important role in providing isolation for various slices in cost effective fashion.
• Wherever possible, data security needs to be pushed to the edge nodes (even terminals) to keep the majority of  5G network out of client data security boundary.
• Open Identity Management
• Problem Statement : 
• So far,  the identity in 4G  is limited to usage of SIM cards.  This is good enough in 4G as the usage is limited to mobiles and special M2M communications.  With 5G being thought to be ubiquitous network,  there is a need to support Enterprise ID management systems. 
• Solution:  Support for various ID management systems such as LDAP,  SAML, PKI based authentication systems where terminals can authenticate with 5G network without having to have SIM card in every terminal.
• Radio Access Network Security:
• Problem statement:  PDCP layer in 4G currently supports only encryption of the data between terminal and base stations. Thought it protects from data being eaves dropped, it does not protect from the MITM to replay the traffic and insert new traffic.  
• Solution:  5G networks are expected to mandate not only encryption, but also the data origin authentication & integrity.
• Dynamic security architecture (Security as a service)
• Problem statement :  Current network using physical security functions are neither slice-able nor flexible enough to add new security functions.  Also, they are not flexible to address traffic explosion as they may require revamping the security hardware. 
• Solution:  Cloud & Virtualization technologies associated with SFC (Service Function Chaining)  allow insertion of security services to slices,  order the security functions, auto scale-out by bringing up more VNFCs and ensure that all security functions are applied on the traffic classes.  
• New trust boundaries - Data Confidentiality:
• Problem statement:  Cloud, SDN & Virtualization technologies introduce new attack surfaces. Also, it introduces ability for cloud operators to see the client traffic that goes across security functions. Cloud operators would like to be out of the client TCB as well as clients would like their traffic be secured from eaves-dropping by anybody.
• Solution :  All the traffic leaving every node of the slice to be encrypted and tunneled. 
• Low delay Security :
• Problem statement:  Traffic related to critical services such as "Self Driving cars"  should not be delayed.  Addition of security functions, especially on user plane, should not lead to massive delays.  
• Soluton statement :  Wherever possible, user plane traffic needs to be isolated from the control plane traffic. Also, it should be processed using fast path solutions such as FPGA and network processors.  One needs to ensure that the accelerators used are trusted and made available to virtualized security functions. 
• Key Security :
• Problem statement:  Network slices (eg. base stations) can be extended to third party providers.   Keys used to encrypt the data and keys used for authentication are not expected to be exposed in clear either in dynamic memory or persistent storage. Also, keys are expected to be controlled by the mobile operator.  
• Solution statement:  Key security using network HSM and secure crypto execution at each node are thought to be method to use where keys are secured and security performance is not impacted.
• Other security considerations
• Energy efficient security
• Trusted Compute pools and attestation of Cloud software.

Good information on 5G Security:

http://www.ericsson.com/res/docs/whitepapers/wp-5g-security.pdf

http://www.3gpp.org/DynaReport/33916.htm

http://dwaterson.com/2015/03/09/security-implications-of-5g/

http://networks.nokia.com/sites/default/files/document/conference_paper__towards_5g_security_.pdf

http://www.huawei.com/minisite/5g/img/5G_Security_Whitepaper_en.pdf

http://www.5gensure.eu/

https://www.ngmn.org/fileadmin/ngmn/content/downloads/Technical/2015/NGMN_5G_White_Paper_V1_0.pdf

https://5g-ppp.eu/