SeGW Whitepaper from Radisys
1 like1,770 views
This document discusses securing next generation mobile networks. It outlines how exploding mobile data usage is straining network capacity and driving operators to adopt new technologies like LTE. LTE will increase speeds but use all-IP networks that introduce new security challenges. The document also examines using wireless offload over public internet to relieve congestion and notes this exposes networks to threats on untrusted internet connections. It proposes using a security gateway to help secure these new network architectures from cyber threats.
SeGW Whitepaper from Radisys
- 1. SECURING NEXT GENERATION MOBILE NETWORKS VERSION 1.0 | OCTOBER 2010 ABSTRACT: As IP based telecom networks are deployed, new security threats facing operators are inevitable. This paper reviews the new mobile access paradigms, examines the security challenges, and outlines CONTENTS the technical requirements for a new generation EXECUTIVE SUMMARY.. ............................................2 of security gateways. GROWING MOBILE DEMAND......................................2 EXPANDING MOBILE NETWORK CAPACITY.. ................2 SECURING MOBILE NETWORK BACKHAUL..................3 NETWORK SECURITY TECHNOLOGY REQUIREMENTS...3 LTE SECURITY GATEWAY SOLUTION.. .........................4 CONCLUSION...........................................................4 GLOSSARY..............................................................5 REFERENCES..........................................................5
- 2. RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS EXECUTIVE SUMMARY 3500000 Mobile VoIP Exploding data traffic on mobile networks is 3500000 Mobile Gaming 4% creating congestion and putting unprecedented Mobile P2P 5% Mobile Web/Data 8% CONSUMER INTERNET TRAFFIC pressure on network operators to meet nearly insatiable 3000000 Mobile Video PETABYTES PER MONTH data demand. Most major worldwide mobile operators 17% have announced plans to migrate their networks to Long 2500000 Term Evolution (LTE), an all-IP network that will increase 2000000 broadband capacity to support up to ten times higher data rates and enable an abundance of new mobile 1500000 applications. In the near term, many operators are also 66% considering alternative “wireless offload” solutions 1000000 which route both voice and data traffic over the public Internet to relieve network congestion and improve 500000 coverage. In both situations, operators are exposed to inherent security threats and challenges familiar to 0 2010 2012 2014 enterprise IP networks. As cyber crime becomes more YEAR sophisticated and profitable, these attacks are occurring more frequently and with more severity and complexity. Figure 1. Cisco Global Mobile Data Traffic Forecast (Source: Cisco,2 2010) Mobile networks will have similar security requirements to enterprises, but on a much larger scale. This white paper will examine potential security challenges in both LTE infrastructure and wireless offload deployments, EXPANDING MOBILE introduce the relevant 3GPP standards, and present NETWORK CAPACITY solutions based on an LTE security gateway, or LTE SEG. In recent years, the convergence of telecom and IP networking, have driven new standards, technologies and GROWING MOBILE DEMAND platforms. Persistent growth of bandwidth hungry services and applications has driven the development of LTE, which The increase in demand for mobile bandwidth is supplies the bandwidth needed for these applications, undeniable. Nokia Siemens Networks reported that while lowering operating costs and simplifying network in 2008, their customers saw an increase in High management. LTE delivers four times more downlink Speed Packet Access (HSPA) data traffic of 5.7 times bandwidth and eight times more uplink bandwidth the previous year, and eleven customers saw a ten- than its predecessor, HSPA. It also provides better cell fold increase. “So we’re seeing a significant amount of performance, lower latency and higher Quality of Service stress on the network,” said Patrick Donegan, Senior (QoS), while supporting more users at Analyst, Heavy Reading.1 According to Cisco, mobile data a lower cost per byte. LTE will take many years to rollout traffic will double every year through 2014, increasing and become pervasive, however, and existing cellular approximately 40 times over the next five years (Figure networks are already becoming tapped out. 1). By 2014, seventeen percent of this data will be transmitted over the Internet, much of which will need With smartphones and other wireless devices becoming to be secured. IP has become the de facto transport, not increasingly popular, some operators are looking for near only for user traffic, but also for control within network term wireless offload and coverage solutions. A new study infrastructure. Security threats resulting from untrusted from ABI Research reports that about sixteen percent of network endpoints, shared facilities, and disgruntled data traffic is diverted from mobile networks today and employees are magnified in an all-IP environment. is expected to increase to forty-eight percent by 2015.3 Cisco estimates that by 2014, twenty-three percent of U.S. smartphone traffic could be offloaded through the public Internet, using wireless LANs and femtocells. Even higher percentages are forecasted for Western Europe and Russia. Wireless offload relieves pressure on 3G access networks, but introduces the need for security gateways. WWW.RADISYS.COM | 2
- 3. RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS SECURING MOBILE NETWORK BACKHAUL lub Both LTE access and 3G wireless offload present new 3G Core Network Standard (Trusted) security challenges not encountered in traditional mobile 3G/4G Handset network backhaul, the infrastructure for connecting cell sites to the core network. Historically, backhaul employed UMA-Enabled Wireless dedicated T1 and unshared facilities between macro Dual Mode Femtocell Data Handset Offload cellsites and the core network base stations. LTE phases Up out TDM connected cell sites in favor of Ethernet and IP connections, and for both cost and bandwidth reasons, Public Internet LTE backhaul may leverage commercial broadband links. Wu (Untrusted) LTE networks have more small and distributed cell sites, WiFi Access SEG Point which are difficult and costly to physically protect against criminal activity. Operators are also increasingly sharing Figure 2. Wireless Offload cell sites to get around government limitations and use the best locations. The LTE architecture pushes more mobility function out to the cell sites, enabling hackers to disrupt subscribers and penetrate new data applications. LTE eNodeB And the flat LTE topology provides a direct route from SEG LTE Serving cell sites to the network core, creating the possibility 4G Gateway (SGW) S1 for Denial-of-Service (DoS) attacks and interception of user communications. All these factors drive new WiFi Access Point Backhaul To Packet security requirements in LTE. Network SEG I-WLAN Network 3G or Public Terminating Gateway Internet Wu (TTG) The security exposures in wireless offload applications Voice/Data are more obvious. WiFi access points and femtocells are Femtocell SEG connected over the public Internet and expose the core Femtocell 2G Gateway network to the full range of Internet attacks, including 3G Up address spoofing, identity theft, man-in-the-middle, and DoS. In addition to securing the wireless segment of a Firewall and Tunneling Technology connection with appropriate wireless security like WPA, Figure 3. Securing LTE Access and Wireless Offload Networks mobile devices require end-to-end security to the core network, and network gateways must be appropriately firewalled to protect the core network. The security topology for LTE Access and Wireless Offload networks Security Security is shown in Figure 3. Domain A Domain B NE NE A-1 B-1 Zb Zb NETWORK SECURITY TECHNOLOGY REQUIREMENTS Za Zb SEG A SEG B Zb A security gateway is required to secure the connections between network elements over an “untrusted” communications link. The link may be untrusted Zb Zb because the elements are owned by different operators NE NE A-2 B-2 and therefore reside in different security domains IKE “Connection” (Za interface), or because the elements are owned by ESP Security Association the same operator in the same security domain but are connected in a way that may lead to security breaches Figure 4. Securing LTE Networks because the interfaces are not protected (e.g. no use of Zb between internal elements). The elements may be part of the LTE backhaul network, like cell sites as shown in Figure 4. With IPsec, data is passed between (eNodeBs), or part of the enhanced packet core, the network elements in secure “tunnels” using a like Serving and Packet Gateways (S-GWY, P-GWY). protocol called Encapsulating Security Payload (ESP) which includes subscriber authentication, content The requirements for providing a secure connection integrity and data encryption. These tunnels are set between LTE network elements are specified in the 3GPP up using a protocol called Internet Key Exchange (IKE), Network Domain Security (NDS) standard. The primary which enables the elements to identify each other in requirement is to use Internet Protocol Security (IPsec), a trusted manner called a Security Association (SA). WWW.RADISYS.COM | 3
- 4. RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS The requirements for providing a secure connection SGSN: Service GPRS GGSN: Gateway Support Node GPRS Support Node between a mobile device or femtocell in a wireless offload application share similarities to the NDS scenario. An IPsec tunnel is established between the mobile 3G device or femtocell using IKE; bidirectional security associations are established; and encrypted ESP data is transmitted (Figure 5). Data AAA HSS/ Offload HLR Gn LTE SECURITY Wm GATEWAY SOLUTION SEG An LTE Security Gateway, or LTE SEG, must meet the Internet Wu or Up technology requirements for both LTE and its wireless offload applications predecessors. It should provide very high performance IPsec tunneling and stateful firewall protection and be cost effective for a telecom equipment Figure 5. Securing Wireless Offload Applications manufacturer to deploy in an operator network. cost effectively integrate into the LTE network elements An LTE SEG should adhere to the 3GPP P-G standards in their portfolio. Like other telecom equipment, the LTE and provide high performance IPsec capability, with SEG should have a fault tolerant configuration option carrier-grade reliability and scalability for telecom and meet carrier requirements for high availability and networks. This requires supporting key IETF RFCs for serviceability. Many equipment manufacturers have ESP, IKE and Certificate Management Protocol (CMP) adopted the open, carrier grade Advanced Telecom as required by 3GPP LTE specifications 33.210 and Computing Architecture (ATCA) and would benefit 33.310. Ideally, an LTE SEG will process at least multi- from a blade solution that could be readily integrated Gbps of encrypted IPsec traffic and scale to much higher in spare slots of existing network elements, as well IPsec throughput to support massive amounts of IP as offered as a standalone solution. data from many LTE cell sites. Additionally, in wireless offload applications, a security gateway should secure large numbers of WiFi connected mobile devices and CONCLUSION femtocells and support various authentication schemes The explosion of mobile data applications has begun, appropriate for each device, e.g. reuse of SIM card in and worldwide mobile operators are planning to migrate mobile devices, support for both femtocell smart-card their networks to LTE. The new LTE networks will increase and certificate based schemes, and back-end RADIUS broadband capacity to support higher data rates, simplify support. Wireless offload applications such as I-WLAN network management, and lower transport costs. Whether and Home NodeB femtocells also require associating operators choose to move directly to LTE or enhance the user’s IPsec tunnel with the GTP connection to their current generation networks with wireless offload the packet core. applications, they must address the security issues Another important LTE SEG feature is a stateful firewall, associated with an all-IP network. The financial risk and which can process several million concurrent IP flows, reputation impact associated with any security breach with pre-defined and custom filters, consistency checks in the early stages of a network rollout are too big to and DoS prevention mechanisms. This requires 10G ignore. The 3GPP standards, including NDS, specify ways Ethernet ports and firewall services performed at line rate. to secure user data and protect network elements, but In addition to network security, an LTE SEG should ideally leave many implementation decisions up to the operators. feature static and dynamic Network Address Translation Network security is a major hurdle for LTE equipment (NAT), Virtual Routing (VLAN), DHCP services and traffic vendors because the scope of potential breaches is large, management. the technology is complex, and engineers with relevant security expertise are scarce and expensive. The best Because security technology is complex and engineers solution is a turnkey security gateway that is flexible and with relevant experience are scarce and expensive, most scalable and can be cost effectively integrated to make telecom equipment manufacturers would prefer to buy new network rollouts secure from a complete LTE SEG solution which they can easily and the outset. WWW.RADISYS.COM | 4
- 5. RADISYS WHITEPAPER | SECURING NEXT GENERATION MOBILE NETWORKS GLOSSARY: REFERENCES: The following Glossary is in the order of the acronyms Source: http://www.lightreading.com/video.asp?doc_ 1 appearing in the paper. id=174795. 3GPP: 3rd Generation Partnership Project Source: Cisco Visual Networking Index: Global 2 Mobile Data Traffic Forecast Update, 2009-2014 ATCA: Advanced Telecom Computing Architecture from February 9, 2010 found at http://www.cisco.com/ en/US/solutions/collateral/ns341/ns525/ns537/ns705/ CMP: Certificate Management Protocol ns827/white_paper_c11-520862.html. DoS: Denial-of-Service http://4g-wirelessevolution.tmcnet.com/channels/ 3 e NodeB: enhanced nodeB, LTE radio at a cellsite network-acceleration/articles/95417-wifi-femtocell- others-help-mobile-data-offloading-research.htm. ESP: Encapsulating Security Payload HSPA: High Speed Packet Access IETF: Internet Engineering Task Force IKE: Internet Key Exchange IP: Internet Protocol IPsec: Internet Protocol Security I-WLAN: Interworking-Wireless Local Area Network LTE: Long Term Evolution (one flavor of 4G) NAT: Network Address Translation NDS: Network Domain Security P-GWY: Packet Gateway QoS: Quality of Service S1-U: ser-plane (mobile) traffic between U LTE eNodeB (cellsites) Serving-Gateway (S-GWY) packet core elements SA: Security Association SEG: Security Gateway S-GWY: Serving Gateway T1: Data Circuit Running at 1.544 Mbit/s Line Rate TDM: Time Division Multiplexed WPA: Wireless Protected Access Corporate Headquarters 5445 NE Dawson Creek Drive Hillsboro, OR 97124 USA Phone: 503-615-1100 Fax: 503-615-1121 Toll-Free: 800-950-0044 www.radisys.com info@radisys.com ©2010 RadiSys Corporation. RadiSys is a registered trademark of RadiSys Corporation. Convedia is a registered trademark of RadiSys Corporation. *All other trademarks are the properties of their respective owners. 10-218-00 October 2010 WWW.RADISYS.COM | 5