{"id":54348,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","title":{"rendered":"Introduction to 5G Security Architecture: NFV, Keys, and 2 Authentication","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Introduction<\/a><\/noindex><\/p>\n

Clearly, embarking on the development of a new communication standard without considering security mechanisms is an extraordinarily questionable and futile endeavor.<\/p>\n

5G Security Architecture<\/u> \u2014 a set of security mechanisms and procedures implemented in fifth-generation networks<\/a><\/noindex> covering all components of the network, from the core to the radio interfaces. <\/p>\n

Fifth-generation networks are essentially an evolution of fourth-generation LTE networks.<\/a><\/noindex>The most significant changes have occurred in radio access technologies. A new RAT<\/a><\/noindex> (Radio Access Technology) \u2014 5G New Radio<\/a><\/noindex>. As for the core network, it has not undergone such substantial changes. Consequently, the security architecture of 5G networks was developed with an emphasis on reusing relevant technologies adopted in the 4G LTE standard.<\/p>\n

However, it is worth noting that rethinking well-known threats such as attacks on radio interfaces and the signaling layer (signalling<\/a><\/noindex> plane), DDoS attacks, Man-In-The-Middle attacks, etc., has prompted telecommunications operators to develop new standards and integrate entirely new security mechanisms into fifth-generation networks.
\n<\/a><\/noindex>
\n\"Introduction<\/p>\n

Prerequisites<\/h1>\n

\nIn 2015, the International Telecommunication Union created the first of its kind global plan for the development of fifth-generation networks, making the development of security mechanisms and procedures in 5G networks particularly urgent. <\/p>\n

The new technology promised truly impressive data transfer speeds (over 1 Gbps), latency of less than 1 ms, and the ability to simultaneously connect up to 1 million devices within a radius of 1 km\u00b2. Such high demands placed on fifth-generation networks were reflected in their organizational principles.<\/p>\n

The key principle became decentralization, which involved placing numerous local databases and processing centers at the edge of the network. This helped minimize delays during M2M<\/a><\/noindex>-communication and alleviate the core network's load due to the service of a vast number of IoT devices. Thus, the boundaries of next-generation networks were extended all the way to base stations, enabling the creation of local communication centers and the provision of cloud services without the risk of critical delays or service outages. Naturally, the altered approach to network organization and customer service attracted the attention of malicious actors, as it opened up new opportunities for attacks on both users' confidential information and the network components themselves, with the aim of causing service disruptions or seizing the operator's computing resources.<\/p>\n

Main vulnerabilities of 5th generation networks<\/h2>\n

<\/p>\n

Increased attack surface<\/h3>\n

\nLearn more<\/b>When building telecommunication networks of the 3rd and 4th generations, operators typically limited themselves to working with one or several vendors who provided a complete package of hardware and software. This meant that everything could work 'out of the box'\u2014it was enough to install and configure the equipment purchased from the vendor; there was no need to replace or supplement proprietary software. Current trends contradict this 'classic' approach and are directed towards network virtualization, a multi-vendor approach to their construction, and software diversity. Technologies such as SDN<\/a><\/noindex> (Software Defined Network) and NFV<\/a><\/noindex> (Network Functions Virtualization) are becoming increasingly popular, leading to the inclusion of a vast amount of software built on open-source foundations in the processes and functionalities of network management. This gives malicious actors the opportunity to better study the operator's network and identify more vulnerabilities, which, in turn, increases the attack surface of next-generation networks compared to current ones.<\/p>\n

A large number of IoT devices<\/h3>\n

\nLearn more<\/b>By 2021, around 57% of devices connected to 5G networks will be IoT devices. This means that most hosts will have limited cryptographic capabilities (see point 2) and, consequently, will be vulnerable to attacks. The enormous number of such devices will increase the risk of botnet proliferation and enable even more powerful and distributed DDoS attacks.<\/p>\n

Limited cryptographic capabilities of IoT devices<\/h3>\n

\nLearn more<\/b>As already mentioned, fifth-generation networks actively engage peripheral devices that help offload some of the network core, thereby reducing latency. This is crucial for essential services such as unmanned vehicle management and emergency alert systems IMS<\/a><\/noindex> and others, for which ensuring minimal latency is critical, as human lives depend on it. Due to the connection of a large number of IoT devices, which, due to their small size and low energy consumption, have very limited computational resources, 5G networks become vulnerable to attacks aimed at taking control and subsequently manipulating such devices. For example, scenarios may involve infecting IoT devices that are part of a \"smart home<\/a><\/noindex>\", with types of malware such as Ransomware and extortion programs<\/a><\/noindex>. There are also possible scenarios for taking control of unmanned vehicles, which receive commands and navigation information through the \"cloud\". Formally, this vulnerability stems from the decentralization of next-generation networks, but the next point will highlight the issue of decentralization more explicitly.<\/p>\n

Decentralization and expanding network boundaries<\/h3>\n

\nLearn more<\/b>Peripheral devices acting as local network cores route user traffic, handle requests, and perform local caching and storage of user data. Thus, the boundaries of 5th generation networks are expanding beyond the core to the edge, including local databases and 5G-NR (5G New Radio) radio interfaces. This creates a potential attack vector for the computational resources of local devices, which are inherently less secure than the central network core nodes, aimed at causing denial of service. This could result in internet outages for entire regions, malfunctions of IoT devices (such as in smart home systems), and unavailability of emergency alert services IMS.<\/p>\n

\"Introduction
\n
\nHowever, ETSI and 3GPP have currently published more than 10 standards addressing various aspects of 5G network security. The overwhelming majority of the mechanisms described there aim to protect against vulnerabilities (including those mentioned above). One of the main standards is TS 23.501 Version 15.6.0<\/a><\/noindex>, which describes the security architecture of 5th generation networks.<\/p>\n

5G Architecture<\/h1>\n

\n\"Introduction
\nFirst, let\u2019s turn to the key principles of 5G network architecture, which will help fully reveal the meaning and responsibilities of each software module and security function within 5G.<\/p>\n