5G-PPP Phase 1 · Public reference archive
The 5G security research archive: where mobile network threats arise
5G-ENSURE mapped the 5G security and privacy exposure of a mobile network, then specified working enablers against it. The figure below is that map; everything under it is the record.
- 23deliverables
- 20enablers
- 5clusters
The 5G security exposure map
Figure 1. Exposure points are keyed where they arise, not where they are fixed. Each key names the enabler cluster that answers it. Select a key to pick out its enablers in the catalogue below.
T3Enablers
Mobile network threats and the enablers specified against them
20 enablers were specified across 5 clusters. The cluster number is the task that produced the enabler, so an identifier locates the work as well as naming it. Mobile network threats do not divide neatly by layer, which is why one cluster, security monitoring, cuts across all of them instead of sitting inside one.
| Cluster | Enabler | Concern |
|---|---|---|
| T3.1 | Fine-grained authorization | Authorization decisions between network functions |
| T3.1 | IoT group AKA | Group authentication for constrained devices |
| T3.2 | Privacy-enhanced identity protection | Concealment of subscriber identifiers |
| T3.2 | Device identifier privacy | Exposure of permanent device identifiers |
| T3.2 | Device-based anonymization | Anonymization performed at the device |
| T3.2 | Privacy policy analysis | Machine analysis of a stated privacy policy |
| T3.3 | Trust builder | Trust relationships across network domains |
| T3.3 | Trust metric enabler | Quantified trust in a network element |
| T3.3 | VNF certification | Integrity of virtualised network functions |
| T3.3 | Security indicator | Security state signalled to the subscriber |
| T3.4 | PulSAR | Anomaly detection and alert correlation |
| T3.4 | Generic collector interface | Uniform collection of monitoring data |
| T3.4 | MTG | Monitoring traffic generation for test |
| T3.4 | SSSR | System security state representation |
| T3.4 | Satellite network monitoring | Monitoring across a satellite segment |
| T3.5 | Micro-segmentation | Segment boundaries inside the network |
| T3.5 | Access control | Access control at management interfaces |
| T3.5 | Bootstrapping trust | Establishing trust in a new element |
| T3.5 | Compliance | Checking configuration against policy |
| T3.5 | Flow control | Constraining traffic between segments |
DRepository
Deliverables in the research archive
Every public deliverable, at its own reference. Documents carry the identifier they were cited under. 24 were published and 23 survive here: the security architecture, the enabler specifications, the testbed, and the project’s own reporting.
- D2.7
Security architecture (final)Work package 2 · Security architecture
PDF - D2.5
Trust model (final)Work package 2 · Security architecture
PDF - D3.6
Security enablers open specifications, v2.0Work package 3 · Enablers
PDF - D3.4
Security enablers documentationWork package 3 · Enablers
PDF - D4.1
5G security testbed architecture, v1.0Work package 4 · Testbed
PDF - D4.4
Evaluation of the security enablers: results of the testbed runsWork package 4 · Testbed
PDF
Advertisement
T3.2Privacy
Subscriber identity on the air interface
In earlier mobile generations the permanent subscriber identifier travelled across the radio link in the clear during attach. Anything listening nearby could read it, which is what makes a passive receiver enough to place a known subscriber at a location.
5G answers this by concealing the identifier before it leaves the device: the permanent identity is encrypted to the home network’s public key, and only the concealed form is transmitted. The receiving network can route the request without being able to read the identity, and a passive listener learns nothing durable.
The T3.2 cluster covers the parts of that problem the specification alone does not settle: where anonymization should happen, what a device can do on its own behalf, and how a stated privacy policy can be checked rather than trusted. It is also the part of 5G security most visible to subscribers, because identifier exposure is what turns a radio protocol detail into a tracking capability.
WP2Architecture
Network resilience as an architecture property
Confidentiality and authentication are only part of the problem. A network assembled from virtualised functions on shared infrastructure can fail in ways a monolithic core could not: a hypervisor fault, a mis-scaled function, a slice that borrows capacity from its neighbour. Network resilience is the property that has to survive those conditions, and it is designed in at the architecture level instead of added by a control at the edge.
That is why network resilience sits in the architecture deliverables; no single enabler carries it. The trust model, the risk assessment and the final architecture each treat availability and isolation as first-order requirements, and the monitoring cluster exists so that a degradation is observed while it is still recoverable.
Read together, the architecture documents and the enabler specifications describe one 5G security position from two directions: what the network should guarantee, and what a concrete component has to do to deliver it.
QQuestions
Questions and answers
What was 5G-ENSURE?
A research project in the first phase of the European 5G Public-Private Partnership, funded under Horizon 2020. It produced a security architecture for 5G, a set of enablers against specific mobile network threats, and a testbed on which they were demonstrated.
What is an enabler?
A specified, implementable component and not a recommendation. Each one states the problem it addresses, the interfaces it needs and the assumptions it makes, so it can be built and tested on its own.
Where can the deliverables be downloaded?
Every public deliverable is listed on the deliverables page and served at the address it was cited under, so an existing reference still resolves. The research archive keeps both of the address forms the documents were published at.
How do the figure keys relate to the enabler clusters?
Each of the five keys marks a point where a 5G network is exposed and names the cluster that answers it. Selecting a key picks out that cluster’s rows in the catalogue, so the exposure and the specified response can be read together.