5G Security: Standard and Technologies Dr. Haiguang Wang, Senior Researcher， Huawei International Oct 18, 2017 HUAWEI TECHNOLOGIES CO., LTD. HUAWEI TECHNOLOGIES CO., LTD. 华为保密信息，未经授权禁止扩散 Page 1 Contents 1 5G Security Standardization in 3GPP 2 Key Technologies for 5G Security 3 Forward Thinking: IoT Security for 5G 4 Summary HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 2 5G: Diverse Use Cases Enhanced Mobile Broadband Gigabytes in a second 3D video and UHD screens Work and play in the cloud Smart Home/Building Augmented reality Industry automation Voice Mission-critical applications Smart City Self-driving cars Massive Machine Type Ultra-Reliable and Low-Latency Communications Communications Source: ITU-R M.[IMT.VISION] HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 3 5G: Stringent Requirements G Latency Throughput Connections Mobility Flexibility 5 1 ms 10 Gbit/s 1M 500 km/h Slicing end-to-end per connection per square for express trains Flexible and on latency kilometer demand 30–50x 100x 100x 1.5x NaaS E T 30–50ms 100 Mbit/s 10,000 350 km/h Inflexible L HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 4 5G Security Timelines in 3GPP 3GPP SA3 5G Security 3GPP 5G Security 1. TR 33.899 (TS33.501) SA3 5G Security Phase 1 Study Item: Technical Report on 5G Security (TS33.401) SA3 5G Security Phase 1 Architecture and (Non-Standalone NR) Functions, Frozen (TR33.899) SA3 Study on 5G Security Phase 1 SA3 Security Study on 5G 2. TS 33.401 Slicing Mgmt Work Item: System Architecture Evolution (SAE); Security architecture 3. TS 33.501 Work Item: Standard on 5G Security Architecture and Functions 4. NEW TR Study Item: Network Slicing Security Management， SBA， IPX http://www.etsi.org/technologies-clusters/technologies/5g HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 5 5G Security Technologies Technologies Specified as of March 2018 TS 33.501 o Security architecture 1 Security Architecture o Primary authentication 2 Security requirement and features • Unified authentication framework with EAP Security procedure between UE and 3 support: 5G-AKA and EAP-AKA’, EAP-TLS 5G Network Functions 4 Security for non-3GPP Access o Secondary Authentication 5 Security of interworking • Authentication with DN: EAP methods Security procedures for non-service 6 based interfaces o Security context management Security aspects of IMS emergency 7 session handling o Mobility support Security procedures between UE and 8 external data networks o Multiple registration Security aspects of network exposure 9 function o Non-3GPP access 10 Service Based Interfaces o Security for Service based architecture Ann For key derivation and authentication ex procedures o Privacy Protection • Public key encryption of subscription permanent identifier (SUPI) HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 6 Contents 1 5G Security Standardization in 3GPP 2 Key Technologies for 5G Security 3 Forward Thinking: IoT Security for 5G 4 Summary HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 7 Security Architecture 4G Security Architecture (TS 33.401) 5G Security Architecture (TS 33.501) Application Application Stratum (IV) stratum User Application (IV) Provider Application User Application Provider Application Home Stratum/ Home (I) (I) (I) Serving Stratum (I) (I) ME USIM (III) stratum/ (III) (V) USIM HE Serving (II) HE (II) Stratum (I) (I) (I) SN SN Transport Transport Stratum 3GPP AN (I) (II) stratum (I) ME AN (I) (II) (I) Non-3GPP AN I. Network access security (I) I. Network access security (I) II. Network domain security(II) II. Network domain security (II) III. User Domain Security(III) III. User Domain Security(III) IV. Application domain security (V) IV. Application domain security (V) V. SBA domain security (V) V. Visibility and configurability of security (VI) VI. Visibility and configurability of security (VI) E n h 1. AN : 3GPP and non-3GPP access network treated more equally in access network. a n ec 2. SN HE(V) : interface for Service-based Architecture m e n t HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 8 Unified Authentication Framework • Build up an unified authentication framework for different access technology, enable security context sharing among different access technology:  ARPF: credential repository  AUSF: authentication server  SEAF: security anchor  EAP framework are supported, a critical step for 5G to become an open network platform  EAP extended type, EAP-5G, is used to carry the NAS signaling over untrusted N3GPP link  EAP-5G is an vendor specific message format to carry NAS signaling between UE and N3IWF. HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 9 Authentication Protocols： EPS-AKA vs. 5G-AKA 4G: EPS-AKA 5G: EPS-AKA UE AMF/SEAF AUSF ARPF UE MME HSS Registration Auth. Req Attach Auth. Get Req Auth. Data Req Generate AV Generate AV Auth. Get Resp Auth. Data Resp Store XRES* Calculate HXRES* XRES Auth. Req Auth. Resp Auth. Resp (RES) Store HXRES* RES ? XRES Auth. Req SMC RES* Auth. Resp Security Context Security Context Calculate HRES* and compare HXRES* RES* RES* verification SMC Security Context Security Context HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 10