5G-ENSURE_D3.1 5G-PPP security enablers technical roadmap (early vision)

This document provides an early vision (at M4) of the 5G security and privacy enablers proposed by the 5G-ENSURE project, and that are planned to be developed through two major releases: v1. 0 (R1) due at M11/Sep’16 and v2.0 (R2) due at M22/Aug’17. It details the Technical Roadmap for v1.0 (R1) in terms of enablers in scope and their features, while providing insights for v2.0 (R2) enablers that will be fully detailed in an update of this deliverable (D3.5 due at M13/Nov’16) taking account of the progress and achievements made by that time. Enablers envisioned are here presented organized in categories, which represent major security areas recognized as topmost priorities for 5G-PPP & 5G Security: Authentication, Authorization and Accountability (AAA); Privacy; Trust; Security Monitoring and Network management & virtualization isolation. They are also presented following a common template covering each of the following key aspects: product vision, technology area, security aspects, security challenges, technical roadmap for first release vs. next release.
In the AAA category the main focus is on 5G users’ authentication, authorization and accounting, but the contribution of the AAA enablers goes beyond the incremental improvements to security that one would expect in a next-generation network. The evolving 5G network will support an unpredictable number of devices due to the boom of Internet of Things (IoT), whose security these enablers will aim to address. Moreover, the enablers target to integrate authentication and authorization functions between satellite and terrestrial systems.
The main objective of the 5G-Ensure Privacy enablers is to identify in advance 5G user privacy requirements and to provide security mechanisms able to prevent privacy violations by adopting a proactive, privacy-by-design approach. For each 5G use case, the privacy mitigation technology (e.g., anonymity by using temporary identity, access control mechanisms, new encryption system and procedures, etc.) was also investigated so as to satisfy privacy requirements. The privacy enablers aim to enhance user data protection by proposing solutions at several layers: at the network layer, as well as application layer, i.e., privacy as a service.
The Trust category will provide trust models which will address the complex relationships between the many actors in 5G networks including the machine-to-machine interactions characterising the next generation networks. The trust model needs to address the different aspects of trust, between automated systems (M2Mt), between human stakeholders holding responsibilities for different parts of 5G networks, between user and network operators and between users of the network (U2Ut), trust that a human stakeholder has towards a system (U2Mt), that an automated system (machine) has in users that it interacts with.
5G-ENSURE project also aims at providing new innovative solutions ensuring the highest level of security and resilience in 5G network. Mobile networks will dramatically evolve with the fifth generation of networks compared to 3/4G, in particular with new concepts and technologies such Internet of Things, infrastructure virtualization (SDN, NFV), network resource sharing, new access interfaces, dynamic network topologies, slicing and so forth. These technologies introduce new security and resilience and provide new opportunities to implement extensive and accurate security solutions. Thus, new innovative approaches to predict and counter these challenges will be considered by the category devoted to Monitoring the 5G security.
The management of 5G networks will fundamentally change through applying the principle of software- defined networking (SDN). While 4G networks already have a clear split between data plane and management plane, the adoption of SDN in 5G networks will change network management into a more centralized approach. Centralized control of the overall network infrastructure has a huge pot ential of simplifying network management and for offering new, richer, and more flexible network services. The aim of the security enablers provided in the Management category is secure the network’s control plane and the virtualized networks on top of it, and to secure network services and provide new security services.
The present document gives an overview of the initial set of enablers and security features envisaged/proposed by each category, together with the rationale behind them and their scheduling. It also details, at features level, the ones carefully selected for their relevance (especially from the 5G Use Cases perspective although if not uniquely), and in scope of the first release (v1.0/R1), while giving insights for enablers/features planned for next release (v2.0/R2). Overall, this deliverable paves the way towards the first release of 5G-ENSURE security enablers whose open specifications are one of the next steps. It also contributes to further progress on 5G Security Vision in terms of both the Technical Roadmap requested and its implementation. Last but not least it is also source for further collaboration with 5G-PPP Projects mainly through 5G-PPP Security Working Group about to be launched, this considering specific interest some of these projects did already exhibit and without presuming of additional security enablers they may add and/or even contribute.