5G use cases create a need for enhanced broadband, massive machine-type communications, and ultra-reliable and low latency communications over its predecessor, 4G-LTE, as shown in the figure below. Services based on these use cases will require high-speed data, reduced latency, improved efficiency, better mobility support, higher connection density, and the capability to connect billions of devices. New opportunities arise for businesses and industries to digitize applications and services. The convergence of new applications and wireless devices increases the possibility of security threats in 5G.
Compared to 4G, 5G technology unites the worlds of telecom and IT with diverse applications and billions of connected devices. However, cloud and edge computing distribution with APIs for connecting to external networks bring more security risks and threats. The diagram below compares architectural differences between 4G and 5G networks. In addition to moving to a cloud-based architecture, the service communications in the network will be API-based. 5G expects to support a large, diverse, and densely deployed set of new devices.
Why are there more security challenges for 5G?
5G networks are subject to many new security challenges because of a more extensive suite of services, a more flexible architecture, exposure to external networks, and a broader services community.
Some key examples of security challenges in 5G include:
- A Larger Attack Surface – 5G supports varied applications that increase its service footprint. In addition, many devices and cells in both public and private networks grow touch points, increasing the attack threat surface.
- Network Function Virtualization – vRAN (virtualized RAN) brings more software-based network functions, and Open RAN initiatives of the O-RAN Alliance bring software from multiple RAN vendors and AI/ML applications from a more extensive ecosystem adding new security threats.
- A Diverse Set of Services and Devices – 5G brings more diverse service opportunities targeting billions of connected devices. Unfortunately, IoT devices are inherently insecure; security is often not built-in by design.
- The Functional Disaggregation of Services using API-based Communication – Unlike 4G, 5G network functions communicate with each other over service-based interfaces that uses REST APIs. These APIs offer more openness for external application functions to communicate with the network, which makes the 5G network more vulnerable to various attacks.
- The Introduction of New Business Models – 5G network slicing allows enterprises to obtain a slice of an end-to-end 5G network, giving them significant control over configuring and managing their slice and network resources and possibly opening a security vulnerability. Likewise, MEC applications being more remote, it becomes vulnerable to numerous attacks.
What are some potential security threats in 5G?
With multiple potential attack vectors, there are several possible new security threats in a 5G network. The chart below outlines possible areas of concern to 5G security, covering the air interface, the Radio Access Network, the 5G Core network, and interconnection to services networks. Additionally, there are threats to the applications themselves beyond the network threats.
Examples of 5G device-related threats include:
- The large number of devices deployed in 5G networks using diverse applications from multiple vendors brings a direct potential threat for unauthorized access.
- Adding more utility and support for more IoT devices in 5G could encourage the connection of billions of new devices with varied security capabilities. But unfortunately, this adds billions of possible breach points, leading to more software insecurities.
- Malware can infect innocent devices and put them under the control of a centralized server. A command-and-control server can then manipulate the infected devices to perform distributed Denial-of-Service (DDoS) attacks.
Summary
5G promises nearly endless communications possibilities and more opportunities for more security-associated risks. These security threats in 5G are not just limited to the ever-increasing body of new applications but also at the network infrastructure and service levels. Communications service providers in the 5G space will need to implement more substantial, broader security methods to address these threats.