The 5G core network (5GCN) rose to public consciousness with the hullabaloo over Huawei’s involvement in the roll-out in some markets, where it has often been confined just to the RAN, on the grounds that it posed less threat to national security there.
Whatever the reality of such perceptions, the controversy did focus minds on the critical role of 5G core in meeting many of the promises for new cases and particularly for underpinning network slicing upon which operators are pinning future revenue hopes. The way the 5G core is implemented will be critical for performance and especially satisfying demands for ultra-low latency, as well as security.
This had led to increased focus on 5G core among operators and their technology vendors, with a spate of announcements and developments over the last few months, as MNOs start to plan migration from first-phase 5G Non-Standalone deployments, which use the LTE core, to 5G Standalone, which implements 5GCN.
The vendors are leaping on the opportunity. Among the announcements was one, at the start of February, from a Moscow-based provider of vulnerability and compliance assessment, Positive Technologies. Its 5G Security Program is pitched particularly at the 5G Core. The company stressed both the need to comply with stricter regulations over subscriber privacy, as enshrined in legislation such as the UK’s proposed Telecoms Security Bill, and rising sophistication in attacks in the 5G era.
The company was offering its 5G SA/NSA Core Security Assessment, designed to audit against threats arising from HTTP/2, the current version of the HTTP web protocol for data transmission, as well as among other things the SS7/Diameter signaling protocol more specifically for communication between IP elements in an LTE core.
Ericsson also ran with these themes during a recent webinar on 5G core where security issues loomed large. The company, like Positive Technologies, highlighted the growing threat posed by more sophisticated attacks that exploited some of the capabilities of 5G infrastructures. The point was made that 5G is inherently more secure than 4G/LTE but that the attack surface, as the cybersecurity industry likes to call it, has also expanded.
Two factors were cited, one being the gathering proliferation of IoT deployments and devices. “We are adding more IoT devices and more subscribers, with less control over actors coming through,” said Ericsson’s VP and head of architectural technology and E2E solutioning for its North America Digital Services unit, Arvinder Anand.
He noted a sharp rise in DDOS (distributed denial of service) attacks on mobile networks resulting from this explosion in IoT devices, up by 500% over one quarter at the start of 2020, according to the Q1 2020 DDOS Threat Report from Nexusguard, a firm specializing in that field. After this spectacular spike, the rate of increase in DDOS attacks settled down to about threefold on an annual basis over the rest of 2020, still representing a rapid escalation resulting from the rise in access to services over mobile networks. Reduced latency over mobile networks was also making some applications such as gaming more popular, in turn presenting new targets for recruitment in DDOS attacks.
The second factor increasing the mobile attack surface under 5G was the increasing sophistication, resulting not just from technological advances within the traditional hacking community but the growing involvement and investment by major state players, notably Russia and China in the case of western democracies at least.
This was dramatically demonstrated in December 2020 when Californian cybersecurity firm FireEye, with clients including government agencies and major enterprises around the world, was hacked in an advanced attack in which many of its tools were stolen or compromised.
The firm and the USA’s Federal Bureau of Investigation (FBI) pointed the finger at Russian intelligence agencies, partly on account of the technical process involved described as “novel techniques” that have not yet been revealed. While Russia may be an economic minnow compared to the heydays of the former Soviet Union and a diminished military power as well, it retains great expertise in several areas of science and technology, including cyberwarfare.
The attack was of course embarrassing for the company, rather like a vendor of security locks being burgled, but may lead to improved defenses by serving as a wakeup call. That said, the investigation is ongoing and it is still not clear what the full outcome was.
What is known is that the attack was advanced but the tools stolen were not on the whole, being largely iterations to attack simulations already in the public domain and used to stress test security, imitating methods already known. This led to speculation that the attackers were after something bigger, although whether that is the case and if so whether they were after all successful, is not clear. It looks most likely though that the attackers were after insights into how FireEye defends its customers, or even just making mischief.
Whatever the case, it emphasized once again the old adage that determined attackers will always breach perimeter walls or firewalls and so defense in depth is critical to respond quickly to invasions once they have occurred. This brings us back to that Ericsson webinar and the company’s own Integrated Packet Core Firewall for 5G, launched in September 2020.
This on the surface sounds like a firewall that itself might be vulnerable once breached, but Anand insisted that this was not so and that it was part of a broader defense in depth package. Following the earlier lead by cybersecurity firms such as FireEye, Ericsson has employed machine learning for detecting changes in behavior within the core that are indicative of an attack having already taken place. “This is dynamic pattern learning, with closed loop automation enabling interaction between recognition and decision making,” said Anand.
This then appears to be an application of what is called heuristic security, applying algorithms to enable attacks to be snuffed out as quickly as possible after they have occurred but before they have been able to achieve their full objectives. Such measures could be various, including immediate shutdown of illicit live video streams from a pirate that had gained access to a live source, or temporary blocking of servers or devices subject to recruitment for a DDoS attack. It could also involve protection of critical software or data.
But of course such defenses are not always inviolable, as appears to have been proven in that FireEye attack. The key though is that they should be highly adaptive and quick to respond to any indications that an attack might have occurred, which inevitably requires automation because there would not be time in many cases to defer to human experts.
This then requires a balance between security and avoidance of too many false positives, which would impair network performance and availability. It also requires embedding of the security functions so that they do not impact latency during their normal engagement, which as Anand acknowledged was critical for the 5G core.
The phrase ‘security by design’ cropped up here, with Anand emphasizing how important this was for optimum performance and minuimum impact on the user experience, as well as for maximum security. Anand was quite correct to present security as a critical component for network slicing, where operators will be under pressure to demonstrate that they can emulate the protections of private networks within their allocated spectrum. They also need to ensure that variable levels of guaranteed QoS can be provided on a per-slice basis.
Nokia has also been active on the 5G core front, with the latest development being its announcement in January 2021 of its selection as technology provider and collaborator by the National Cybersecurity Center of Excellence (NCCoE) 5G Cybersecurity Project. The objective is to identify relevant 5G use cases and demonstrate how the components of the 5G architecture can mitigate identified risks and meet those industry sectors’ compliance requirements.
Nokia said it will first attempt to exploit standardized 5G security features defined by 3GPP and then determine enhanced cybersecurity capabilities that will need to be subsequently developed and then built into network equipment, as well as end user devices.
This once again touched on ‘security by design’, as NIST Chief of Applied Cybersecurity Kevin Stine pointed out. “5G will touch every aspect of our lives and security must be integrated up front rather than an add-on element of 5G networks,” he said.
This underlined the fact that while 5G brings new capabilities, they tend to address more minor vulnerabilities already known about. A notable example is that within the 5G core, the IMSI (international mobile subscriber identity) is encrypted for the first time. Since the IMSI identifies the subscriber this makes unauthorized location tracking, eavesdropping or intrusion much harder.
But at the same time, 5G introduces new APIs that can themselves be used to enhance security but also present new openings for hackers. That is why 5G is sometimes presented as both more secure and more vulnerable than its predecessors.
Huawei contends that sound architectural design should overlay the new inherent security features to make defense easier. It has adopted a distributed architecture for its 5G core based on complete separation between the higher level user plane and underlying network control plane.
Admittedly such separation was specified by 3GPP in its Release 14 specifications to support applications where the two would operate more independently, as in some IoT domains. But Huawei has been quick to exploit this to underpin different deployment scenarios as a prelude for network slicing, so that for example it can be deployed at the network edge to minimize roundabout traffic latency for applications such as extended reality and unattended automated vehicle control. It could also help reduce congestion through greater partitioning and logical separation of data traffic within the overall core infrastructure.