5G Security from a Network Operator s Point of View

Transcription

1 5G Security from a Network Operator s Point of View China Mobile ITU Workshop on 5G Security 1

2 Outline 1 Evolution of trust model from 2G to 5G 2 Major 5G security issues 3 Activities related to 5G security in SG17 and a proposed work plan 4 Some strategic thoughts of 5G security 2

3 Evolution of Trust Model Trust Closed Network Specialized Protocol Mutual Trust Closed Network Specialized Protocol Trust User A MNO A MNO B User B MNO/ 3 rd Party Services User A Distrust Closed Network Specialized Protocol Closed Network Specialized Protocol Distrust Mutual MNO A Trust MNO B User B MNO: Mobile Network Operator 3

4 Evolution of Trust Model MNO/ 3 rd Party Services/Applications User A Distrust IP-based Protocols In Doubt? MNO A MNO B User B IP-based Protocols Distrust 4

5 Evolution of Trust Model Verticals Distrust MEC Ext. DN Network Slicing IT-based networks Internet Network Capability Exposure Distrust Slice Tenents Network Slicing IT-based networks MEC Distrust User A/ Device A MNO A Common HW Platform MNO B User B/ Device B 5

6 Evolution of Trust Model Evolution of trust model has a great influence on the security design of 5G, eg. 5G AKA (previously called EPS-AKA*) is designed to mitigate the distrust between MNOs, enhancing the control of home network when the user is roaming. Security isolation between network slices is vital for the success of the new 5G network architecture, and it is also a major concern for the verticals because they are supposed to be the mainstream of slice tenants. It is still in doubt whether the common HW(Hardware) platform could provide the same security as the traditional blackbox equipments, especially with the report on the recently disclosed CPU vulnerabilities (Meltdown and Spectre). So it is necessary to impose a security baseline for the network infrastructure, such as NFV SCAS (SeCurity ASsurance). 6

7 Outline 1 Evolution of trust model from 2G to 5G 2 Major 5G security issues 3 Activities related to 5G security in SG17 and a proposed work plan 4 Some strategic thoughts of 5G security 7

8 UE Security of User Equipment Major 5G Security Issues Network Capability Exposure Securely expose network capabilities Expose security capabilities Service Security of traditional and vertical services MEC Network Slicing Decentralized authentication Security of 3 rd party apps RAN (CU/DU) Split Termination point of UP security F1 interface security Multi Access Technologies Unified authentication framework Air interface privacy Legacy USIM access to 5G Fake base stations Cloud Computing Security isolation of slices Slice authentication and access control Privacy preservation for slice users Service Based Architecture NF authorizaion and access control Security of interface protocols NFV SDN Security enables & security management Security of cloud computing Trutsted computing 8 Security of NFV Security of SDN Security by SDN

9 International SDOs related to 5G Security 1986~ 1988~ 1995~ 1998~ 2006~ ipsecme IP Security Maintenance and Extensions tls SCP Smart Card Platform SAGE Security Algorithm Group of Experts FASG Fraud and Security Group SIM Subscriber Identity Module SA3 Security SCT Security Competence Team Transport Layer Security 9

10 Outline 1 Evolution of trust model from 2G to 5G 2 Major 5G security issues 3 Activities related to 5G security in SG17 and a proposed work plan 4 Some strategic thoughts of 5G security 10

11 Activities related to 5G Security in SG17 Q2/17 (Security architecture and framework) network aspects including SDN for 5G security.1038,.sdnsec-3,.ssc,.srnv, etc Q6/17 (Security aspects of telecommunication services, networks and IoT) mobile and infrastructure aspects for 5G security ,.sdnsec-1, etc Q7/17 (Secure application services) application/service aspects for 5G security.srfb, etc Q8/17 (Cloud Computing Security) Cloud computing and big data infrastracture for 5G security.sgtbd, etc Q11/17 (Generic technologies to support secure applications) cryptographic profiles for 5G security.509, etc 11

12 A proposed work plan on 5G security in SG17 SG17 s opportunity in the 5G end-to-end security picture at least resides in: Generic Security Enabler: Q4, Q9, Q10, Q11, etc. Service/Application security: Q2, Q5, Q8, etc. Cloud, Big Data and SDN/NFV security: Q2, Q3, Q6, Q7, Q13, etc. And here are some initial proposals for specific 5G security issues which SG17 may work on: 5G security in Quantum Computing era 5G IDM 5G trust management, feasibility study on a global PKI to support 5G security, optimization of PKI for IoT and ITS/V2, etc. 5G network infrastructure security, including SDN/NFV security, Cloud Computing security, Big Data security, etc. China Mobile brings some new work item proposals in this area: Security Guideline for 5G Network in the Quantum Computing Era(C242) Guideline on Software-defined Security in SDN/NFV Network (C249) 12

13 Outline 1 Evolution of trust model from 2G to 5G 2 Major 5G security issues 3 Activities related to 5G security in SG17 and a proposed work plan 4 Some strategic thoughts of 5G security 13

14 Some Strategic Thoughts of 5G Security 5G proposes a vision of Communications change the society. It puts great emphasis on the mutual trust and cooperation between telecom operators and the verticals. It is an opppotunity of industry confusion, cross- border exploitation and ecosystem reconstruction. 5G is the integration of various new radio, network and IT technologies. And it is an important turning point for telecom network reconstruction. Evolution of 5G security technologies are driven by two wheels: The ever-lasiting and upgrading battles around vulnerabilites and amends Great variety of use cases, and evolving new technologies 5G security design should be based on 3 important assumptions: Upgrading of computing power Change of trust model Evolution of network architecture The lifetime of 5G is still long. The whole 5G ecosystem shoud be prepared to confront up-springing new risks. 14

15 Thank you Merci Cпасибо 谢谢 شكرا Gracias ありがとう감사합니다 15