SECURING NEXT GENERATION MOBILE NETWORKS

VERSION 1.0 | OCTOBER 2010

ABSTRACT: As IP based telecom networks are deployed, new security threats facing operators are inevitable. This paper reviews the new mobile access paradigms, examines the security challenges, and outlines the technical requirements for a new generation of security gateways.

CONTENTS EXECUTIVE SUMMARY .............................................2

GROWING MOBILE DEMAND .....................................2

EXPANDING MOBILE NETWORK CAPACITY .................2

SECURING MOBILE NETWORK BACKHAUL .................3

NETWORK SECURITY TECHNOLOGY REQUIREMENTS ..3

LTE SECURITY GATEWAY SOLUTION ..........................4

CONCLUSION ..........................................................4

GLOSSARY..............................................................5

REFERENCES .........................................................5

RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS

WWW.RADISYS.COM | 2

EXECUTIVE SUMMARYExploding data traffic on mobile networks is creating congestion and putting unprecedented

pressure on network operators to meet nearly insatiable data demand. Most major worldwide mobile operators have announced plans to migrate their networks to Long Term Evolution (LTE), an all-IP network that will increase broadband capacity to support up to ten times higher data rates and enable an abundance of new mobile applications. In the near term, many operators are also considering alternative “wireless offload” solutions which route both voice and data traffic over the public Internet to relieve network congestion and improve coverage. In both situations, operators are exposed to inherent security threats and challenges familiar to enterprise IP networks. As cyber crime becomes more sophisticated and profitable, these attacks are occurring more frequently and with more severity and complexity. Mobile networks will have similar security requirements to enterprises, but on a much larger scale. This white paper will examine potential security challenges in both LTE infrastructure and wireless offload deployments, introduce the relevant 3GPP standards, and present solutions based on an LTE security gateway, or LTE SEG.

GROWING MOBILE DEMANDThe increase in demand for mobile bandwidth is undeniable. Nokia Siemens Networks reported that in 2008, their customers saw an increase in High Speed Packet Access (HSPA) data traffic of 5.7 times the previous year, and eleven customers saw a ten-fold increase. “So we’re seeing a significant amount of stress on the network,” said Patrick Donegan, Senior Analyst, Heavy Reading.1 According to Cisco, mobile data traffic will double every year through 2014, increasing approximately 40 times over the next five years (Figure 1). By 2014, seventeen percent of this data will be transmitted over the Internet, much of which will need to be secured. IP has become the de facto transport, not only for user traffic, but also for control within network infrastructure. Security threats resulting from untrusted network endpoints, shared facilities, and disgruntled employees are magnified in an all-IP environment.

EXPANDING MOBILE NETWORK CAPACITYIn recent years, the convergence of telecom and IP networking, have driven new standards, technologies and platforms. Persistent growth of bandwidth hungry services and applications has driven the development of LTE, which supplies the bandwidth needed for these applications, while lowering operating costs and simplifying network management. LTE delivers four times more downlink bandwidth and eight times more uplink bandwidth than its predecessor, HSPA. It also provides better cell performance, lower latency and higher Quality of Service (QoS), while supporting more users at a lower cost per byte. LTE will take many years to rollout and become pervasive, however, and existing cellular networks are already becoming tapped out.

With smartphones and other wireless devices becoming increasingly popular, some operators are looking for near term wireless offload and coverage solutions. A new study from ABI Research reports that about sixteen percent of data traffic is diverted from mobile networks today and is expected to increase to forty-eight percent by 2015.3 Cisco estimates that by 2014, twenty-three percent of U.S. smartphone traffic could be offloaded through the public Internet, using wireless LANs and femtocells. Even higher percentages are forecasted for Western Europe and Russia. Wireless offload relieves pressure on 3G access networks, but introduces the need for security gateways.

Figure 1. Cisco Global Mobile Data Traffic Forecast (Source: Cisco,2 2010)

0

500000

1000000

1500000

2000000

2500000

3000000

3500000

3500000

2010 2012 2014

4%5%8%

17%

66%

CON

SUM

ER IN

TER

NET

TR

AFF

IC

PET

AB

YTES

PER

MO

NTH

YEAR

Mobile VoIPMobile Gaming Mobile P2PMobile Web/DataMobile Video

RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS

WWW.RADISYS.COM | 3

SECURING MOBILE NETWORK BACKHAULBoth LTE access and 3G wireless offload present new security challenges not encountered in traditional mobile network backhaul, the infrastructure for connecting cell sites to the core network. Historically, backhaul employed dedicated T1 and unshared facilities between macro cellsites and the core network base stations. LTE phases out TDM connected cell sites in favor of Ethernet and IP connections, and for both cost and bandwidth reasons, LTE backhaul may leverage commercial broadband links. LTE networks have more small and distributed cell sites, which are difficult and costly to physically protect against criminal activity. Operators are also increasingly sharing cell sites to get around government limitations and use the best locations. The LTE architecture pushes more mobility function out to the cell sites, enabling hackers to disrupt subscribers and penetrate new data applications. And the flat LTE topology provides a direct route from cell sites to the network core, creating the possibility for Denial-of-Service (DoS) attacks and interception of user communications. All these factors drive new security requirements in LTE.

The security exposures in wireless offload applications are more obvious. WiFi access points and femtocells are connected over the public Internet and expose the core network to the full range of Internet attacks, including address spoofing, identity theft, man-in-the-middle, and DoS. In addition to securing the wireless segment of a connection with appropriate wireless security like WPA, mobile devices require end-to-end security to the core network, and network gateways must be appropriately firewalled to protect the core network. The security topology for LTE Access and Wireless Offload networks is shown in Figure 3.

NETWORK SECURITY TECHNOLOGY REQUIREMENTSA security gateway is required to secure the connections between network elements over an “untrusted” communications link. The link may be untrusted because the elements are owned by different operators and therefore reside in different security domains (Za interface), or because the elements are owned by the same operator in the same security domain but are connected in a way that may lead to security breaches because the interfaces are not protected (e.g. no use of Zb between internal elements). The elements may be part of the LTE backhaul network, like cell sites (eNodeBs), or part of the enhanced packet core, like Serving and Packet Gateways (S-GWY, P-GWY).

The requirements for providing a secure connection between LTE network elements are specified in the 3GPP Network Domain Security (NDS) standard. The primary requirement is to use Internet Protocol Security (IPsec),

as shown in Figure 4. With IPsec, data is passed between the network elements in secure “tunnels” using a protocol called Encapsulating Security Payload (ESP) which includes subscriber authentication, content integrity and data encryption. These tunnels are set up using a protocol called Internet Key Exchange (IKE), which enables the elements to identify each other in a trusted manner called a Security Association (SA).

Figure 2. Wireless Offload

Wu

SEG

Dual ModeHandset

WiFi Access Point

Up

UMA-Enabled Femtocell

Wireless Data

Of�oad

Standard 3G/4G Handset

lub

3G Core Network (Trusted)

Public Internet(Untrusted)

Figure 3. Securing LTE Access and Wireless Offload Networks

Wu

I-WLANTerminating Gateway (TTG)

4G

3G

2G3G

SEG

SEG

SEG

LTE eNodeB

To Packet Network

Voice/Data

S1

LTE Serving Gateway (SGW)

Firewall and Tunneling Technology

Up

Femtocell Gateway

Femtocell

Backhaul Network or Public Internet

WiFi Access Point

Figure 4. Securing LTE Networks

Security Domain A

Security Domain B

Za

NEA-1

Zb

IKE “Connection”ESP Security Association

Zb

Zb

ZbNEA-2

Zb ZbSEG A

NEB-1

NEB-2

SEG B

RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS

WWW.RADISYS.COM | 4

The requirements for providing a secure connection between a mobile device or femtocell in a wireless offload application share similarities to the NDS scenario. An IPsec tunnel is established between the mobile device or femtocell using IKE; bidirectional security associations are established; and encrypted ESP data is transmitted (Figure 5).

LTE SECURITY GATEWAY SOLUTION An LTE Security Gateway, or LTE SEG, must meet the technology requirements for both LTE and its wireless offload applications predecessors. It should provide very high performance IPsec tunneling and stateful firewall protection and be cost effective for a telecom equipment manufacturer to deploy in an operator network.

An LTE SEG should adhere to the 3GPP P-G standards and provide high performance IPsec capability, with carrier-grade reliability and scalability for telecom networks. This requires supporting key IETF RFCs for ESP, IKE and Certificate Management Protocol (CMP) as required by 3GPP LTE specifications 33.210 and 33.310. Ideally, an LTE SEG will process at least multi-Gbps of encrypted IPsec traffic and scale to much higher IPsec throughput to support massive amounts of IP data from many LTE cell sites. Additionally, in wireless offload applications, a security gateway should secure large numbers of WiFi connected mobile devices and femtocells and support various authentication schemes appropriate for each device, e.g. reuse of SIM card in mobile devices, support for both femtocell smart-card and certificate based schemes, and back-end RADIUS support. Wireless offload applications such as I-WLAN and Home NodeB femtocells also require associating the user’s IPsec tunnel with the GTP connection to the packet core.

Another important LTE SEG feature is a stateful firewall, which can process several million concurrent IP flows, with pre-defined and custom filters, consistency checks and DoS prevention mechanisms. This requires 10G Ethernet ports and firewall services performed at line rate. In addition to network security, an LTE SEG should ideally feature static and dynamic Network Address Translation (NAT), Virtual Routing (VLAN), DHCP services and traffic management.

Because security technology is complex and engineers with relevant experience are scarce and expensive, most telecom equipment manufacturers would prefer to buy a complete LTE SEG solution which they can easily and

cost effectively integrate into the LTE network elements in their portfolio. Like other telecom equipment, the LTE SEG should have a fault tolerant configuration option and meet carrier requirements for high availability and serviceability. Many equipment manufacturers have adopted the open, carrier grade Advanced Telecom Computing Architecture (ATCA) and would benefit from a blade solution that could be readily integrated in spare slots of existing network elements, as well as offered as a standalone solution.

CONCLUSIONThe explosion of mobile data applications has begun, and worldwide mobile operators are planning to migrate their networks to LTE. The new LTE networks will increase broadband capacity to support higher data rates, simplify network management, and lower transport costs. Whether operators choose to move directly to LTE or enhance their current generation networks with wireless offload applications, they must address the security issues associated with an all-IP network. The financial risk and reputation impact associated with any security breach in the early stages of a network rollout are too big to ignore. The 3GPP standards, including NDS, specify ways to secure user data and protect network elements, but leave many implementation decisions up to the operators. Network security is a major hurdle for LTE equipment vendors because the scope of potential breaches is large, the technology is complex, and engineers with relevant security expertise are scarce and expensive. The best solution is a turnkey security gateway that is flexible and scalable and can be cost effectively integrated to make new network rollouts secure from the outset.

Figure 5. Securing Wireless Offload Applications

Wu or Up

Wm

GnHSS/HLR

Data Of�oad

Internet

3G

SEG

SGSN: Service GPRS Support Node

GGSN: Gateway GPRS Support Node

AAA

WWW.RADISYS.COM | 5

RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS

Corporate Headquarters5445 NE Dawson Creek Drive

Hillsboro, OR 97124 USA Phone: 503-615-1100

Fax: 503-615-1121 Toll-Free: 800-950-0044

www.radisys.com info@radisys.com

©2010 RadiSys Corporation. RadiSys is a registered trademark of RadiSys Corporation. Convedia is a registered trademark of RadiSys Corporation.

*All other trademarks are the properties of their respective owners. 10-218-00 October 2010

GLOSSARY:The following Glossary is in the order of the acronyms appearing in the paper.

3GPP: 3rd Generation Partnership Project

ATCA: Advanced Telecom Computing Architecture

CMP: Certificate Management Protocol

DoS: Denial-of-Service

eNodeB: enhanced nodeB, LTE radio at a cellsite

ESP: Encapsulating Security Payload

HSPA: High Speed Packet Access

IETF: Internet Engineering Task Force

IKE: Internet Key Exchange

IP: Internet Protocol

IPsec: Internet Protocol Security

I-WLAN: Interworking-Wireless Local Area Network

LTE: Long Term Evolution (one flavor of 4G)

NAT: Network Address Translation

NDS: Network Domain Security

P-GWY: Packet Gateway

QoS: Quality of Service

S1-U: User-plane (mobile) traffic between & LTE eNodeB (cellsites) & Serving-Gateway (S-GWY) packet core elements

SA: Security Association

SEG: Security Gateway

S-GWY: Serving Gateway

T1: Data Circuit Running at 1.544 Mbit/s Line Rate

TDM: Time Division Multiplexed

WPA: Wireless Protected Access

REFERENCES:1 Source: http://www.lightreading.com/video.asp?doc_id=174795.

2 Source: Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update, 2009-2014 from February 9, 2010 found at http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.html.

3 http://4g-wirelessevolution.tmcnet.com/channels/network-acceleration/articles/95417-wifi-femtocell-others-help-mobile-data-offloading-research.htm.