5G Security

5G Security
Alf Zugenmaier, Munich University of Applied Sciences

March 1, 2019
Warning
This presentation has a high density of acronyms.

If you would like to be reminded of their meanings, please ask or
look up at http://webapp.etsi.org/Teddi/.
5G Security 2 A. Zugenmaier
Agenda
5G Standardization Process
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
Agenda
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
5G Standardization Process - Actors
ITU-T
High level requirements (IMT2020)
IETF
RFCs – protocols
IPsec
TLS
EAP
3GPP
System specification
Interoperability
Standards bodies
ETSI, etc.
5G Standardization Process – 3GPP
Industry Association
Organizational Partners
ARIB, ATIS, CCSA, ETSI, TSDSI, TTA, TTC
Members can attend meetings
Companies, Ministries, etc.
Output
Technical reports
Feasibility study
Technical specifications
System specification of procedures (API like view)
3GPP Process
Structure
Technical Specification Groups (SA, CT, RAN)
Working Groups (e.g. WG SA3: security)
Project planning
Study items (e.g. Study on Next Generation Security Architecture)
Output: none
Work items (e.g. 5G Phase 1 security)
Output: TS 33.501
Releases
5G phase 1 – R15
Stages
Requirements, architecture, protocols
3GPP process
Input
Contribution driven
Textual modifications to specifications
Member company contributions
Consensus
Lack of sustained objection
Voting: more than 71% in favour
Agenda
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
Mobile Network Architecture in a Nutshell
Security
Gateway
Gateway
Other
Network(s)
Radio Access Network Core Network
Security
Gateway
Gateway
Other
Network(s)
Security
Gateway
Gateway
Other
Network(s)
Access Stratum Security Network Domain Network Domain

Security Security
5G Mobile Network Architecture in a Nutshell
DU: Distributed Unit of gNodeB

CU: Central Unit of gNodeB
UDM ARPF AMF: Access Management Function
SMF: Session Management Function
DU UPF: User Plane Function
AMF SMF UDM: Unified Data Management
CU Security ARPF: Authentication credential
Gateway UPF Repository and Processing Function
Gateway
Other
Network(s)
Access Stratum Security Network Domain Network Domain

Security Security
Non-Access Stratum Security
5G Mobile Network Architecture
Home network UDM ARPF
external AAA
Visited / home network AMF SEAF SMF for secondary
authentication
DU CU UPF
gNB
gNB: 5G base station
AMF: Access Management Function
Non-3GPP SEAF: Security Anchor Function
SMF: Session Management Function
access N3IWF UPF: User Plane Function
(e.g. WLAN) UDM: Unified Data Management
ARPF: Authentication credential Repository
and Processing Function
N3IWF: Non-3GPP InterWorking Function
RAN architecture option
Non standalone with 4G core
Dual Connectivity
5G NR to increase capacity
eNB as master node

gNB as secondary node
Security as in 4G
Agenda
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
5G Security Goals
At least as good as 4G
Subscriber authentication
Encryption on radio interface
Protection of subscriber identity
Network authentication
Key separation
Good for homogenous security requirements

Same security applied to all users and services
Make it better
Evolution instead of revolution
5G Security Goals
Fix known weaknesses

Some of them
Provide unified framework for authentication
Enable secondary authentication for applications
Network and service flexibility
Agenda
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
SUPI (IMSI) Privacy
4G
Initial attach with permanent identity
Response to identity request in clear
5G
Encryption of SUPI with public key of home operator (SUCI)
Routing information (home network ID) in clear
SUPI revealed to VPLMN only after authentication
Binding of SUPI into key
UE and HPLMN have to use the same SUPI: requested for lawful
intercept purposes
Respond to identifier request with SUCI
No SUPI based paging
More Privacy
Service request messages

Network may have lost UE keys
UE sends in clear only information for locating security context
Initial NAS protection
Reallocation of temporary IDs

After security set up
On every periodic mobility registration update
After use in paging
Unified Security Framework
Credential storage on secure hardware (UICC)
Access via 3GPP radio and non-3GPP radio
Authentication
EAP AKA' for 3GPP and non 3GPP
Native AKA for 5G access
One security context for both access technologies
Radio Network Security
Integrity protection
Finally!
Split of gNB into Central and Distributed Unit (CU/DU)

CU performs security functions (confidentiality/integrity)
Can be located closer to the core
Visibility
Requirement to enable applications to check security being applied to
the connection
Increased home network control
Proof of presence
UE is in visited network
Native to EAP AKA
5G AKA
Challenge Response with UE
Visited network receives hash of response
Response has to be forwarded to home network
Linking of subsequent procedures

Registration procedure only accepted after successful authentication
Trust model – non roaming
Separation of AMF (mobility) and SEAF (security)
UDM
USIM ME ME DU CU AMF SEAF AUSF
ARPF
Key hierarchy
Network side UE side

Key separation UDM/ARPF K USIM
between trust domains CK, IK

UDM/ARPF ME
HPLMN 5G AKA EAP-AKA'
Future proofing: KAUSF CK', IK'
AUSF ME
bid down protection KAUSF
by ABBA parameter in SEAF

KSEAF
ME
KAMF derivation KAMF
AMF ME
VPLMN
KNASint KNASenc
KN3IWF KgNB, NH
KRRCint KRRCenc KUPint KUPenc
N3IWF ME gNB ME
Trust model - roaming
UDM
USIM ME ME DU CU AMF SEAF SEPP SEPP AUSF
ARPF
Visited network Home network
Requirements for Interoperator Interconnect
End to end confidentiality and integrity

Authenticity of the sending network
Support addition, deletion, modification of information elements

by intermediate nodes
Operator A IPX A IPX B Operator B
Security for Interoperator Interconnect
N32-c
N32-f
NF cSEPP pSEPP NF
Symmetric
cIPX pIPX Symmetric
key A key A
Private key Private key
cIPX pIPX Clear text IEs
HTTP/2 Request Encrypted IEs HTTP/2 Request

JWE (JWE)
Meta data
JSON patch Public key

Clear text IEs JSON Patch cIPX
JWS IPX Id
modification(s)
Encrypted IEs JWS Signature
(JWE)
JSON patch Public key
Meta data pIPX
JSON Patch IPX Id
JWS
modification(s)
JWS Signature
Steering of Roaming
UE connects to "best" network

Home operator may want to reconfigure UE about "best"
Inclusion of steering list in registration accept

Optional confirmation
Agenda
5G Architecture
5G's Security Goals
5G Key Enhancements
Summary
5G Security Architecture
User plane security
AS (Radio) control plane security
Home network UDM ARPF
NAS security
Interconnect security
SEPP NDS/IP (IPsec)
TLS
SEPP
Visited / home network AMF SEAF SMF
DU CU Security Gateway UPF

gNB
Summary
Evolution of 4G security
More privacy
Unified security framework
RAN security
Integrity
Security termination point
Future proofing
Interconnect Security
Thank you for your attention

5G Security

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

5G Security

Încărcat de

Drepturi de autor:

Formate disponibile

5G Security

Alf Zugenmaier, Munich University of Applied Sciences

This presentation has a high density of acronyms.

5G's Security Goals

5G's Security Goals

5G's Security Goals

Radio Access Network Core Network

Radio Access Network Core Network

Radio Access Network Core Network

Access Stratum Security Network Domain Network Domain

DU: Distributed Unit of gNodeB

Radio Access Network Core Network

Access Stratum Security Network Domain Network Domain

Non-Access Stratum Security

Home network UDM ARPF

Non standalone with 4G core

eNB as master node

5G's Security Goals

Good for homogenous security requirements

Fix known weaknesses

Network and service flexibility

5G's Security Goals

Service request messages

Reallocation of temporary IDs

Credential storage on secure hardware (UICC)

Access via 3GPP radio and non-3GPP radio

One security context for both access technologies

Split of gNB into Central and Distributed Unit (CU/DU)

Native to EAP AKA

Linking of subsequent procedures

Separation of AMF (mobility) and SEAF (security)

Network side UE side

between trust domains CK, IK

Future proofing: KAUSF CK', IK'

by ABBA parameter in SEAF

KRRCint KRRCenc KUPint KUPenc

Visited network Home network

End to end confidentiality and integrity

Support addition, deletion, modification of information elements

Operator A IPX A IPX B Operator B

HTTP/2 Request Encrypted IEs HTTP/2 Request

JSON patch Public key

UE connects to "best" network

Inclusion of steering list in registration accept

5G's Security Goals

Visited / home network AMF SEAF SMF

DU CU Security Gateway UPF

S-ar putea să vă placă și