Over time mobile networks have been evolving in terms of security to reach truly secure infrastructure for personal and machine-type communications. Here we provide an overview of security techniques in mobile networks.

The first generations of mobile networks 2G and 3G rely on user credentials stored in the device, namely on the tamper proof universal integrated circuit card (UICC) on which the Universal Subscriber Identity Module (USIM) resides as trust anchor and the Mobile Equipment (ME). The ME and the USIM together form the User Equipment that use the information stored in the USIM to authenticate the user behind the mobile device. In the early infrastructure of mobile networks, authentication was mainly towards the device, while the device did not properly authenticate the network which leads to security threads based on fake base stations. The rapid deployment of mobile networks made them an attractive target for malicious attacks, but new generations of mobile networks have been incrementally fixing those threats identified in earlier mobile networks.

Thus, in 4G, the security solution consists of encryption of the radio interface, IPSec tunnels between the (physical) core elements and authorization from AKA (Authentication and Key Agreement). The AKA is used first for authentication of both the network and the user and second for user identification based on tamper-proof SIM cards. The 4G security architecture in a typical operator deployment is illustrated in the following figure.

LTE/4G end to end security.

4G Security is built on prior 2G/3G security mechanisms with some improvements that include better security algorithms, longer keys, extended key hierarchy and the introduction of new features to address backhaul and relay node security.

The current mobile network generation, 5G, brings a new paradigm where mobile infrastructure is extended beyond consumer traffic towards machine type communications. According to 3GPP TS 33.401 “In a Standalone (SA) 5G system, the trust model has evolved. Trust within the network is considered as decreasing the further one moves from the core. This has impact on decisions taken in 5G security design.” 

5G defines new functions such as the AUthentication Function (AUSF) that keeps a key for reuse, derived after authentication, in case of simultaneous registration of a UE in different access network technologies, i.e. 3GPP access networks and non-3GPP access networks such as IEEE 802.11 Wireless Local Area Network (WLAN). 

Moreover, today’s network services follow the 5G Service Based Architecture (SBA) as defined in 3GPP TS 23.501. The interfaces between these services are based on common web technologies: HTTP/2 communications protocol, JSON file format and REST architectural style. These web technologies are used in the interfaces of the services managed by the operator as well as in the interfaces of the Network Exposure Function (NEF) which opens the network to the third-party services. Even though HTTP/2 does not include a requirement to use TLS for encryption, according to 5G specifications it must be used between the network services. 

As a conclusion, 5G opens up mobile infrastructure towards native development of third-party web services supporting not only consumer data but also machine-based communications and integrates web security technologies on top of mobile specific security technologies.

5G incrementally fixes threats identified in the architecture or design in earlier 2G-4G mobile networks.

Furthermore, 5G integrates new security technologies such as AAA solutions used in fixed networks to seamless integrated 5G system as part of non-public industrial networks.