First Principles

White paper

for Securing 5G
The Design, Deployment,
Operation and Innovation
of Secure 5G Networks
December 2019
 White paper

Contents
I. Introduction and Executive summary.............................................................................................................................................3
A. The 5G Security Imperative.........................................................................................................................................................3
B. Key Principles for Addressing 5G Security Risks.............................................................................................................3
C. Partnering with Government and Other Stakeholders..................................................................................................4
II. Embedded Security: Network Design and Deployment ....................................................................................................5
A. Security in the Supply Chain and Network Equipment.........................................................................................................5
1. Trusted Supply Chain.............................................................................................................................................................5
2. Equipment Testing and Device Configuration...........................................................................................................6
B. Security by Design: Developing and Implementing 5G’s New Security Features............................................. 7
1. Overview of 5G Standards for Security........................................................................................................................ 7
a. The 3GPP Standards Development Process.................................................................................................... 7
b. Verizon’s Role in Advancing and Implementing 5G Security Standards.............................................8
2. Deploying 5G’s New Security Features........................................................................................................................9
a. Wireless Subscriber Authentication......................................................................................................................9
b. Authenticating the Network......................................................................................................................................9
c. Registering a New Phone: Binding the Security Relationship with the Provider...........................10
d. Protecting the User Equipment’s Identity.........................................................................................................10
e. The Key Agreement Procedure.............................................................................................................................10
f. Security Edge Protection Proxy and Other 5G Security Architecture Features.............................11
III. Continuous Security: Network Operation and Innovation..............................................................................................11
A. Operational Security......................................................................................................................................................................11
1. Corporate Policy and Governance..................................................................................................................................11
2. Security Operations.............................................................................................................................................................12
3. Software and Hardware Vulnerability Management ..........................................................................................13
B. The Cyber-Physical Convergence: Real-World Safety and Security ..................................................................13
1. Physical Security.....................................................................................................................................................................13
a. Partitioned Access Control Systems..................................................................................................................13
b. Systems Surveillance 24/7/365...........................................................................................................................13
c. Network Access Control and Cell Site Security...........................................................................................14
2. Securing the IoT and Devices that Connect to the Network...........................................................................14
C. Looking Ahead.................................................................................................................................................................................15
1. Open RAN and Virtualization Standards.....................................................................................................................15
2. Security Opportunities through Network Slicing and Multi-access Edge Compute .........................15
3. Future 5G Security Opportunities ..............................................................................................................................15
IV. Conclusion.................................................................................................................................................................................................16
Appendix: Glossary..................................................................................................................................................................................... 17

2
 White paper

I. Introduction and Executive summary security technologies and features for 5G in the context of the
existing security features of Verizon’s network, and will set forth
A. The 5G Security Imperative generally applicable principles that can guide all stakeholders as
they do their parts to secure 5G communications.
The advent of 5G wireless communications constitutes a
new era of network connection that will revolutionize many
B. Key Principles for Addressing 5G Security Risks
aspects of commerce and our personal lives. As with previous
advancements in wireless communications, the transition Experts at Verizon and other private sector and government
from 3G and 4G to 5G will provide dramatic increases in entities have identified several cybersecurity risks that will
both bandwidth and upload/download speeds, along continue, or arise anew, in the 5G network environment.
with extraordinary decreases in latency. Together, these Verizon is approaching these concerns in two phases, guided
improvements will not only expand technical capabilities but by first principles in security that have undergirded our
also drive exponential increases in the number of connected previous networks and that we can use with greater efficiency
devices in every sector of the economy, ranging from and effect in 5G.
autonomous and connected vehicles to remote surgery. Design and Deployment.
The 5G revolution will also expand the “attack surface” Verizon is designing and deploying its 5G network with security
for cyber threats, including sabotage and espionage by as a central element of the network. As discussed below in
sophisticated actors, both through the convergence of the Section II, Verizon relies exclusively on trusted vendors that
cyber and physical worlds and through the massive increase have undergone our rigorous supply-chain vetting processes.
in all types of commercial and personal data. Technology We routinely assess the software and hardware that goes into
advancements as far back as the control of fire and the our network, and we employ rigorous, documented policies
invention of the wheel have created opportunities for both and procedures for secure configuration and operation of
good and bad, and there is no doubt that criminals, spies and equipment and devices we deploy throughout the network.
saboteurs will seek to leverage 5G to their malicious ends. Components of our 5G infrastructure, even within the network
itself, are required to authenticate to one another prior to
Verizon is designing and deploying its 5G network with full
performing their functions. Further, we leverage the new 5G
awareness of these threats, and we will operate and innovate
architecture and technical standards, which we ourselves have
the security functions of this network in a manner that
helped develop, to provide new security features that did not
accounts for them. Verizon and the communications sector
exist in previous generations of wireless technology.
have a long history of protecting against threats to customers’
security and ensuring the reliability and resilience of Operation and Innovation.
communications services against all manner of hazards, We continually advance security in operating and innovating
including cyber threats. We are building on decades of the functions of all our networks, including 5G. As discussed
experience and technological leadership to do this, and we below in Section III, we begin with the basic fundamentals of
are leveraging the unique benefits of 5G technology to develop securing the physical aspects of and access to various
and operate a more secure network. network components. With the physical network secure, we
employ the innovations of 5G network virtualization – also
Verizon embraces “security by design” principles by
known as “network slicing,” or cloud-enabled specialization of
architecting and deploying its 5G network with security baked
software-defined network functions – which in previous
in from the beginning. Though new threats will try to exploit
generations were conducted through hardware infrastructure.
5G’s expansion of the attack surface, the distinctly new
This virtualization capability sets 5G apart from previous
architecture and capabilities of 5G networks give operators
generations, providing powerful new efficiencies and
opportunities to detect and address cyber threats faster and
effectiveness in communications security.
more efficiently than ever before. In contrast to previous
advancements in wireless technologies, 5G is an altogether Moreover, outside the core network, we secure the Radio
different network technology that will introduce a virtualized, Access Network (RAN) – the antennas and base stations of
cloud-based architecture, enabling highly specialized functions cell towers have long been the most visible elements of
– and security – for different network applications. wireless networks – through advances in Open RAN (O-RAN)
technology, which is bringing the security benefits of network
In short, Verizon will leverage the technological capabilities of
virtualization and related software innovation to the RAN. (In
5G to design, deploy, operate and innovate the functions of its
turn, this software innovation favors a diverse and competitive
5G network to provide best-of-breed security. Our 5G network
market among RAN vendors. This is one way to address the
will provide a brand-new customer experience, but it is also an
recent troubling concentration of the RAN market among
evolution of our state-of-the-art 4G LTE foundation. 5G
suspect vendors.) Finally, Verizon has helped spearhead global
leverages security measures that exist today in the 4G
advances in the security of the Internet of Things (IoT) and the
environment, and it ushers in new innovations such as
other devices that connect to the 5G network, and we are
sophisticated encryption and authentication features, as well
continuing to advance promising new security innovations that
as a new Security Edge Protection Proxy (SEPP) that prevents
will be deployed in the future.
threats from less-secure interconnected networks from
harming 5G networks. This paper will introduce these new

3
 White paper

Overall, Verizon has traditionally implemented a holistic view Verizon’s approach to 5G security is premised on this ethos
of security risk management and will continue to do so in of participation and leadership in public-private collaborative
the 5G environment. Security risks will persist, but we are efforts that are indispensable to communications security.
accounting for these risks in everything that we do to build and For example, we are leaders in the industry-government
operate the network, using 5G-enabled security innovations Supply Chain Risk Management (SCRM) Task Force hosted
to advance the security practices that we have employed and by DHS, involved as the co-chair of one of the working
refined for decades. Verizon’s 5G network presently consists groups. We also co-chair the initiative that the Alliance for
of a new RAN known as New Radio (NR), which is connected Telecommunications Industry Solutions (ATIS) heads to
to the current 4G LTE core. This deployment, referred to as advance supply chain security standards, and we are a leader
Non-Stand Alone (NSA) 5G, already includes several security in Department of Defense efforts to develop methods to
improvements over 4G LTE which are discussed in this paper. operate securely in a “zero trust” network environment.
As Verizon’s trusted vendors begin to support the forthcoming
We have also helped lead multiple landmark industry-
new technical standards for the 5G core standards – due to
government efforts through the Communications Security,
be completed in the coming months – our core network
Reliability and Interoperability Council (CSRIC), the Federal
will migrate to a new 5G core which uses software-based
Communications Commission’s communications security
architecture and network virtualization. When Verizon deploys
advisory committee – including its comprehensive September
a Stand Alone (SA) 5G service – 5G RAN using a virtualized
2018 Report on Best Practices and Recommendations to
5G core – we will implement the cutting-edge technology
Mitigate Security Risks to Emerging 5G Wireless Networks.
solutions for assessing and mitigating risk that are currently
Additionally, with our private sector partners, we were among
being advanced and standardized with Verizon’s active
the founding members of two organizations that will play
leadership in research and development, real-world
significant roles in the future of 5G security: The Council to
deployments, and standards bodies.
Secure the Digital Economy, which among other initiatives is
leading the global effort to advance the security of the IoT, and
C. Partnering with Government and Other Stakeholders
the O-RAN Alliance, which promotes open, interoperable,
Since the threats of the Cold War era, communications standards-based, virtualized RAN.
providers have prioritized partnership with the U.S. government
In short, Verizon operates from the presumption that neither
to ensure the security, reliability and resiliency of our nation’s
the government nor any individual private sector entity can
communications networks.
adequately secure our nation’s communications networks by
The National Coordinating Center for Communications (NCC) itself. That is why we will continue to invest heavily in these
– now also known as the Communications Information Sharing partnerships with the government and other important
and Analysis Center (Comm ISAC) – is the communications stakeholders in the communications and IT sectors.
sector’s security operations center. Physically located in
the Department of Homeland Security (DHS), the NCC/
Comm ISAC is where Verizon and other private sector
communications companies convene with U.S. government
partners to promote the security and reliability of our nation’s
communications infrastructure and services. Established
largely for the purpose of ensuring that the government’s
emergency communications capabilities could continue in the
event of a nuclear war, the NCC/Comm ISAC was the first of
the critical-infrastructure ISACs, setting the model that other
critical-infrastructure sectors such as energy, finance and
transportation later adapted to their own distinct needs.

4
 White paper

In Section II below, we describe Verizon’s security principles in Verizon has developed its supplier risk assessment and
the design and development of our 5G network, first through management discipline over many years. The Supplier Risk
security in the supply chain and network equipment, and next Office (SRO) Program manages the risk assessments of
through developing and implementing 5G’s new security suppliers and their individual engagements in a methodical and
features. In Section III, we describe Verizon’s approach to centralized process. Through the SRO Program, Verizon
security in the operation of our 5G network, both in the identifies, assesses, monitors and manages any risks
present and through future innovations to come. associated with our suppliers throughout the supplier lifecycle,
employing highly trained risk management experts to review
and approve each contract request. The SRO Program has
established a detailed corporate policy that identifies specific
II. Embedded Security: Network Design roles and responsibilities, as outlined briefly below.
and Deployment Senior Executive Responsibility.
Verizon ensures that security is an integral part of designing The Verizon Leadership Committee (VLC), which consists of
and deploying the 5G network. We rely exclusively on trusted the Chief Executive Officer and direct reports, assumes the
network components, managing supply chain security risks ultimate accountability to define strategic direction and
through our rigorous supplier vetting processes. We then work objectives for the SRO Program. On a day-to-day basis, the
with suppliers and engineers to secure these components in Supplier Risk Management Executive Committee1 performs
the equipment and devices we deploy throughout the network. oversight and governance of the SRO Program based on the
Further, we leverage the new 5G architecture and technical VLC’s strategic direction and objectives.
standards, which we ourselves have helped develop, to provide Contract Review and Risk Assessment.
new security features that did not exist in previous generations. The organizational sponsor of a proposed contract, with the
assistance of the Category Sourcing Expert and the SRO,
A. Security in the Supply Chain and Network Equipment must complete a risk questionnaire for each contract and
1. Trusted Supply Chain statement of work under which products or services are
provided by a supplier. The contract’s risk level, determined
Verizon’s trusted supply chain is the foundation of our secure through an assessment under the SRO’s formal Supplier Risk
5G network. Leveraging a diverse, competitive marketplace Management System, drives due diligence by the appropriate
of trusted vendors of network hardware and software is a Risk Expert team.
security imperative for Verizon and other 5G service providers.
This is the fundamental principle of our supply chain security Pre-Contract Due Diligence and Ongoing Testing and Scrutiny.
policy; it guides everything we do in vetting our trusted The SRO has established formal processes for conducting due
suppliers and in testing and configuring the equipment diligence and addressing all assessed risks prior to use of a
and devices we acquire from them. supplier and prior to contract execution for a particular product
or service. This scrutiny covers suppliers of all types.
For both hardware and software, Verizon purchases all our
5G inputs from a small group of sophisticated vendors with Beyond the more focused scrutiny discussed below on
whom we have close, trusted relationships developed through suppliers whose products are pertinent to cybersecurity and
thorough vetting and scrutiny, including pre-deployment testing national security review, our Supplier Risk Management
of equipment. Verizon has long been aware of concerns about Program scrutinizes our suppliers’ general reliability, sound
Chinese technology. We did not use Huawei or ZTE when corporate governance, trustworthiness and legal compliance
building our 3G or 4G networks, and of course will not use culture, including their regimes for complying with the Foreign
them for our 5G infrastructure. Corrupt Practices Act and counter-fraud programs, as well as
their financial viability. Verizon reviews information on suppliers’
Verizon has a complex and rigorous risk management policies and procedures in these areas, along with supporting
framework for identifying and eliminating risks across our evidence for each applicable area of risk.
global supply chain for numerous products and services,
including public cloud services. Verizon’s contractual supplier More specifically, we conduct ongoing due diligence with our
security requirements, which are designed to address risk most in-depth and frequent activities focusing on areas of
management goals, are based on Verizon’s own corporate high risk, such as suppliers of critical equipment that make up
information security policies as well as open industry our networks. (As discussed in the next section regarding
standards and control objectives found in National Institute of equipment testing and device configuration, we also conduct
Standards and Technology (NIST) guidance and additional internal and third-party penetration testing on such equipment,
security standards regimes such as ISO2700x, SSAE16, devices and applications prior to launch.) The following risk
PCI-DSS, HIPAA and others. considerations directly pertinent to cybersecurity and national

1 The Executive Steering Committee for Supplier Risk consists of the following senior executives: Chief Information Security Officer, Chief Security Officer and Chief
Privacy Officer; business unit Chief Financial Officers, Controller and Chief Compliance Officer; and the Senior Vice Presidents for Supply Chain & Real Estate,
Operations and Human Resources. 5
 White paper

security are specifically addressed through our Supplier Risk exploited on two fronts: (1) the “insider threat” from a nefarious
Management Program: actor inside the company, and (2) the external threat from an
• Business Continuity & Resiliency outside hacker. The insights provided by this security risk
assessment determine whether or not changes are required
• Cross Border Data Legal Compliance before Verizon moves forward with the product or service in
• Export Compliance question. We then work with the product or platform vendor to
ensure that we have resolved security concerns prior to launch
• Geopolitical Risk and that we have properly and securely configured the
• HIPAA Compliance equipment and devices in question.
• Information Security and Data Privacy Additionally, Verizon requires that its retail 5G user equipment
– for instance, smartphone handsets – conform to industry
• Physical Security
security standards and to Verizon device security requirements
• Sanctions and Screening and processes. For instance, Verizon mandates the use of
The processes outlined above help ensure that our networks a Universal Mobile Telecommunications System (UMTS)
are built with trusted components derived from a secure Subscriber Identity Module (SIM) card equipped with a
supply chain. Tamper Resistant Element (TRE), so as to prevent the
exposure of Verizon’s network authentication and subscriber
Verizon recognizes that supply chain risk management benefits privacy credentials, which are stored on the Universal SIM
from effective collaboration and information sharing, both among (USIM). The TRE may also function as a secure element,
private sector entities and between the public and private which can be extended to protect services by storing and
sectors. We therefore have taken formal leadership roles in performing cryptographic operations. Further, the user
DHS’s SCRM Task Force and in the ATIS initiative to advance equipment leverages defense-in-depth security principles
supply chain security standards. We also have participated in in its architecture. All network operations relevant to
nascent efforts to advance software supply chain security establishing 5G network connectivity are done in a dedicated
assurance, such as the multi-stakeholder process convened by processor (referred to as the baseband or modem processor),
the National Telecommunications and Information Administration independent from the application processor, providing a layer
(NTIA) to develop best practices for vendors to communicate of protection against escalated privilege attacks, which are
to enterprise buyers the components of the “software bill of common on the main operating system of the device.
materials” – that is, the software supply chain. As discussed in
Section III below, further improvements in software supply chain To promote secure configuration, in addition to industry
security and software security assurance will be an increasingly standards, Verizon also defines and publishes Verizon-specific
important element of Verizon’s holistic approach to 5G security technical requirements to which user equipment vendors must
as it migrates its network to a virtualized 5G core and operates conform. These requirements provide the best experience of
and innovates this sliced network through software and Verizon services to users, ensure seamless integration of
cloud-based functionalities. user equipment and 5G network functions, and address
out-of-scope items in industry-standard specifications,
2. Equipment Testing and Device Configuration such as the following:
After the supplier vetting and scrutiny described above, our • Secure boot and update using roots of trust
next steps in building a secure network foundation include
rigorous inspection and security testing as well as standardized • Discrete hardware or trusted execution environment-based
configuration of the components that make up our network. storage for user application credentials
Secure configuration of network equipment and devices is a • Atomic procedure for firmware update failures
structural necessity in building a secure 5G network.
• Certificate management
For this reason, our technical security experts conduct a
• Signing process of container-based microservice applications
pre-launch security risk assessment for internal and external
branded applications and devices, subjecting critical 5G Verizon performs security testing in-house and via third parties
components to testing to uncover potential security for retail devices. Verizon has a list of approved security labs
vulnerabilities. Our Network Security Team employs a and sends user equipment to these labs for security testing.
dedicated group of specialized security testing experts to vet The devices are assessed for technical compliance with
critical software (including updates) after installation. That Verizon Device Security Retail requirements as well as industry
team, complemented by outside experts, also tests 5G user standards. To promote improvement in user equipment
equipment such as phones, MiFi pucks and 5G home routers. configuration, any problems found during testing are shared
First, through a process called threat modeling, we evaluate with our vendors, who are required to provide fixes within a
specific potential risks that may pertain to deploying the predefined period, depending on severity, as defined by
application or device. Based on specifically identified threats, Verizon’s security processes.
we conduct internal and third-party security testing on device
and application layers to identify vulnerabilities that could be

6
 White paper

3GPP standards ecosystem Other standards bodies

Partners
Organizational Partners and
Market Representation Partners

5G projects

Certification bodies

Formal external liaisons

450 MHz Alliance Eurescom IEEE Liberty Alliance Project Board (PTCRB) TCCA
AISG COST 273 Internet Engineering Task Force (IETF) LTE/SAE Trial Initiative (LSTI) Portable Computer and TIA /TR-45
Bluetooth Broadband Forum (BBF) European Radiocommunications IrDA Metro Ethernet Forum (MEF) Communications Association (PCCA) TIA/TR-47
CableLabs Committee (ERC) International Multimedia National Emergency Number Presence and Availability Management TV-Anytime Forum
International Special Committee on Fixed Mobile Convergence Alliance Telecomunications Consortium (IMTC) Association Next Generation Mobile (PAM) Forum Voice eXtensible Mark-up
Radio Interference (CISPR) (FMCA) Internet Streaming Media Alliance Networks (NENA NGMN) RSA Labs Language(VoiceXML) Forum
CTIA Global Certification Forum (GCF) ISO-ITU expert group oneM2M SDR Forum Wi-Fi Alliance
Digital Video Broadcasting (DVB) Global TD-LTE Initiative (GTI) ISO MPEG/JPEG Open Mobile Alliance (OMA) Sun Microsystems, Inc. Wireless Broadband Alliance (WBA)
Project GPS Industry Council ITU-T SG2 Open Networking Foundation (ONF) Steerco WLAN Smart Card Consortium
Ecma International GSM Association Java APIs for Integrated Open IPTV Forum SyncML Initiative Wireless World Research
Expert Group for Emergency Access HomeRF Forum Networks (JAIN) Object Management Group (OMG) Trusted Computing Group (TCG) Forum (WWRF)
(EGEA) IDB Forum Java Community Process (JCP) PCS Type Certification Review TeleManagement Forum (TMF) World Wide Web Consortium (W3C)

Figure 1: 3GPP interactions with other organizations

B. Security by Design: Developing and Implementing a. The 3GPP Standards Development Process
5G’s New Security Features Verizon is participating in and influencing the 5G standards
setting process through the 3rd Generation Partner Project
Verizon has been operating and improving its state-of-the-art (3GPP), which has previously provided LTE, LTE-Advanced and
4G network for years. We will remain at the cutting edge of LTE Advanced Pro for commercial cellular/mobile systems.
technological advances and standards development regarding There are seven organizational partners in 3GPP which work
the transitions from 3G and 4G to 5G. New 5G security features on the standards and also several peripheral organizations that
in Verizon’s 5G network are enabled by rigorous technical reference or provide input to 3GPP standards (Figure 1).
security standards development processes – in which, as
outlined below, Verizon participates as an industry leader. 3GPP Technical Specification (TS) 33.501 specifies a security
architecture for the 5G network. 2 It includes security features,
1. Overview of 5G Standards for Security mechanisms, and procedures for the 5G New Radio and core.
Technical standards provide a common understanding of This TS leverages security protocols or recommendations from
technical systems among operators, developers and users, organizations such as the Internet Engineering Task Force
which in turn leads to greater stability, ease of use and (IETF) and NIST. Other organizations providing requirements
interoperability. This also leads to greater security because the or recommendations to 3GPP include Next Generation Mobile
standards process is open and transparent. Nothing is or can be Networks Alliance and the International Telecommunication
hidden in the standards process, and this transparency allows Union. Additionally, the European Telecommunication
all parties to perform security analyses of proposed standards Standards Institute (ETSI) has provided security specifications
and to input corrections for any vulnerabilities identified. for network function virtualization and Multi-access Edge
Compute (MEC).

2 3GPP, June 13, 2019, “Security architecture and procedures for 5G System” retrieved from http://www.3gpp.org/ftp//Specs/archive/33_series/33.501/33501-f50.zip. 7
 White paper

The standards development process, including work on b. Verizon’s Role in Advancing and Implementing 5G
security features, benefits from input from companies with Security Standards
real-world experience deploying new technology. It is common Last year, Verizon was the first provider in the world to launch
for companies like Verizon who are “first movers” to deploy a commercial 5G service, and in doing so, we embraced
service using new technology while the standards are still in “security by design” principles that included working with our
development. There is nothing inherently insecure about vendors on cutting-edge security features. For example, our
non-standard, proprietary communications equipment, and deployment uses the same encryption techniques for the link
indeed substantial portions of the communications ecosystem between the consumer device and the edge of our network
(such as most early Wi-Fi routers and all smartphone operating that were later articulated in 3GPP TS 33.501, Security
systems) have involved proprietary, non-standards-based Architecture and Procedures for 5G System (Release 15).
technology during early stages of deployment. That is the path By being out in front of the rest of the industry, we can lead
Verizon took when securely deploying its fixed-wireless 5G the standards process so that eventually all providers will
network to accelerate the 5G ecosystem; now that the deploy equipment with appropriate security features.
standards (with our input into them based on our learning with Verizon continuously monitors and participates in the
real-world deployments) have been issued, we will upgrade the standards development process to identify and prioritize
pre-standard equipment with standards-compliant equipment new security features to be implemented in its network.
to support operational compatibility. Prioritization of feature implementation is based upon a risk
Some policymakers have expressed concerns that China assessment process that evaluates the likelihood and impact
may be influencing the 5G standards to potentially introduce of the threats a given security feature could mitigate. Verizon is
cybersecurity deficiencies into them.3 We do not see evidence already evaluating security enhancements for the 5G core as
of this; even though Chinese-based companies have a we begin planning for future deployment (Figure 2).
large coordinated presence, no single entity can dictate
the consensus-driven technical standards. The standards
processes are public, open and transparent. Although highly
competitive, there is nothing in these processes that has
inhibited Verizon with respect to becoming the first carrier in the
world to launch a 5G service; to the contrary, these processes
are a venue in which we provide influential global leadership.

Testing, trials and

early deployment

Standards Design Procure Deploy and operate

• 3GPP, ETSI • Operations input • Vetted network suppliers • General risk management and issue spotting
• Global subject matter expert • Slicing to isolate resources • Procure only from trusted suppliers • Physical building access control
(SME) input and access • Ongoing security discussion • Identity and element access management
• Public, open code/specifications • MEC to localize processing/storage and analysis • Penetration testing
• 3GPP voting by group, not individuals; • Machine learning and artificial • Internal and external device • Continuous internal vulnerability scans
China has one vote out of seven intelligence to automate detection penetration testing
• SS7 and other firewalls, signaling monitoring
• Signaling, backhaul and airlink security and response
• Incident response center
• User identity privacy • Security planners embedded with
vendor partners • Consumer network traffic monitoring
• Updated/patched regularly
• DNS filtering for known malicious sites
• DDoS monitoring and remediation
• Cloud security team
• External penetration, vulnerability testing
• Large team of dedicated
security professionals

Strategy, architecture and planning

Figure 2: 4G/5G Security Development Process

3 See, e.g., John Eggerton, March 1, 2019, “Sens. Seek Report on China’s Impact on 5G Standards” retrieved from https://www.broadcastingcable.com/news/
sens-seek-report-on-chinas-impact-on-5g-standards. 8
 White paper

User equipment Serving network (roaming network) IP network Home network (provider network)

Managed Unified data

authentication
equipment Distributed Central Unit Authentication Security Authentication
Unit of gNB of gNB and mobility anchor server Authentication
management function function credential
Universal Subscriber repository and
gNB function Security edge Security edge
Identity Module protection protection
processing
proxy proxy function

Non-3GPP N31WF
access

Figure 3: 5G Security Architecture Model

2. Deploying 5G’s New Security Features and key exchange, prevent downgrading of encryption
protocols, and provide protection at the boundaries to other
5G builds upon the security mechanisms of 4G by introducing
networks. These and other security improvements introduced
multiple enhancements, which are discussed in 3GPP TS
in 5G have built upon the security from 4G LTE networks.
33.501, Security Architecture and Procedures for 5G System
(Release 15). The focus of many of the new features involves a. Wireless Subscriber Authentication
mutually authenticating the User Equipment (UE) and the base The goal of subscriber authentication by the home (or provider)
station (gNB) to prevent fraud, service theft and disclosure of network is to ensure that the network that “owns” the mobile
credentials to eavesdroppers. Other improvements update the subscriber (or customer) – as distinct from a serving network
encryption methods and prevent the user’s identity from being to which the subscriber may connect through while roaming –
transmitted over the air in the clear. is the network that actually verifies that the customer is
legitimate. That is, Verizon should verify Verizon customers.
The diagram above (Figure 3) serves as a reference for the
Home network control is a unique feature of 5G, and it means
discussion that follows of the major 5G security features.
that the visited network, or the network the customer is
The security architecture is depicted as an “onion” of ever-
roaming to, must pass the customer’s credentials to the home
increasing trust, with central ovals showing the most trusted
network for final verification. (The roaming network can,
portion of the trust model. In the case of the UE, on the left,
however, refuse a connection from a customer if the presented
the Universal Subscriber Identity Module (USIM) is the portion
credentials are falsified or otherwise out of order.) The serving/
of the UE that is trustworthy. It comprises the USIM and the
roaming network authorizes the UE using the subscription
ME (Mobile Equipment, or the phone itself), the two major
profile vouched for by the home network, which has the final
components of the UE. The USIM is a tamper-proof trust
authorization decision authority. The home network relies upon
anchor that securely stores the user’s authentication
the serving network to deliver all relevant parameters and to
credentials, computes cryptographic keys, and stores the
verify that the device is actually on its network. This enhanced
home network’s public key and other network data. The UE
procedure prevents spoofing of visited networks in attempts to
may connect to either a wireless gNB base station – the
fraudulently obtain service or UE credentials (keys). The
“eNB” of 5G4 – or a non-3GPP network such as Wi-Fi or a
section below on SEPP provides more details of the security
cable network. In the case of the diagram and for the sake of
used at the serving network/home network boundary.
generality, the UE is roaming outside its home network’s access
footprint and has attached to the serving network. The home b. Authenticating the Network
network is shown on the right of the diagram. The serving Regardless of whether the UE is roaming or not, the device will
network and home network are connected to each other via authenticate the network using implicit keys derived from the
an IP network via security gateways (SEPPs, or Security Edge Key Agreement procedure discussed later. Also, the UE will
Protection Proxies). As discussed below, the serving network verify the network regardless of network technology – that is,
and home network cooperate to authenticate the UE, thereby whether connecting to 3GPP (5G) or non-3GPP (Wi-Fi). This
ensuring the security of the 5G service. In any case, whether helps eliminate rogue base station or false base station
the subscriber is roaming or not, the home network has the attacks. The false base station is also known as an “IMSI
final authority regarding authentication of the UE. catcher” or “Stingray.” A false base station can lead to a wide
Some important new security enhancements in 5G are variety of privacy and security problems, such as stolen user
discussed in the following sections. These new features credentials or a user’s location being tracked nefariously. Base
prevent spoofing attempts to fraudulently obtain service or UE station impersonation by criminals and others is a dynamic
credentials, thwart rogue base station impersonations used to problem and is typical of the “arms race” often seen between
track users and steal their credentials (often referred to as technology innovations and those who would exploit it for
“IMSI catchers”), and strengthen subscriber privacy and nefarious reasons.
identity. New protocols and functions improve authentication

4 LTE access networks use base stations that are called eNBs, which utilize 3GPP standards Release 8 up to Release 15. gNB, or “next-generation” NB, supports
next-generation interfaces as described in 3GPP standards Release 15 and onward. 9
 White paper

c. Registering a New Phone: Binding the Security Authentication and Key Agreement have two main goals:
Relationship with the Provider (1) mutual authentication between UE and its home network
The Subscriber Permanent Identifier (SUPI), akin to IMSI in (even though the AKA process may pass through an
4G, is part of the user’s credentials used to authenticate to intervening serving or roaming network), and (2) establishing
the network. The SUPI is contained in the USIM and is typically session keys between the UE and the serving network.
15 digits, composed of the Mobile Country Code (MCC); Components of the process include a permanent UE identifier
the Mobile Network Code (MNC), which identifies the network (a SUPI), the provider’s public key and a sequence number,
operator; and finally the Mobile Subscriber Identification each of which were placed into the 5G device when it was first
Number (MSIN), which is unique to the particular user. When commissioned by the network provider. The UE sends its SUPI,
the phone is commissioned or registered, the network provider encrypted by the home network’s public key so that it is now a
or home network places the SUPI, telephone number, the SUCI, to the home network. The sequence number helps
provider’s public key, and sequence number (SQN) in its protect against replay attacks
network database and in the USIM. This forges the
The end result is the anchor key (Kseaf), which is provided
cryptographic relationship used between the UE and the by the Authentication Server Function (AUSF) of the HN to
network provider and forms the basis of all subsequent the Security Anchor Function (SEAF) of the SN. The anchor
security activity. key is bound to the SN, which prevents other networks from
d. Protecting the User Equipment’s Identity pretending to be a legitimate network. Kseaf is a symmetric key
When the UE seeks to attach to the network, it sends either the shared among 5G entities.
Subscription Concealed Identifier (SUCI, an encrypted form of When the network has the anchor key as a result of the
the SUPI) or the Globally Unique Temporary Identifier UE and the network mutually authenticating each other, the
(5G-GUTI). The UE does not send the SUPI in unencrypted components of the network are able to build the cryptographic
form across the network – instead, the SUCI contains the SUPI, material required to perform the various functions needed to
which is “concealed” or rather encrypted using standardized
keep the network’s integrity, confidentiality and authentication
encryption mechanisms. The home network provider’s public
intact. Kseaf is used to derive signaling and RAN uplink and
cryptographic key is used in the encryption, which conceals
downlink user plane keys for encrypting traffic. Practically
the subscriber’s identity from the roaming network. The SUPI is
every key used in the radio portion of 5G is derived from
extracted from the SUCI by the network using the Subscription
Kseaf. For example, the keys needed to perform the following
Identifier De-Concealing Function (SIDF).
functions are directly or indirectly derived from Kseaf:
If it is not the first time the UE has authenticated, the USIM • Keys for Non-Access Stratum (Non-Access Stratum)
may have been given a 5G-GUTI by the network, which
serves as a proxy or substitute for the SUPI. Because the • Keys for NG-RAN (used by gNB, the 5G base station)
network assigned the GUTI, it can index or cross-reference • Keys for User Plane traffic (Access Stratum)
a corresponding, previously stored SUPI to positively identify
the user. 5G-GUTIs are short-lived, changed frequently and, • Keys for Radio Resource Control (RRC, Access Stratum)
like the SUCI, can serve to hide the identity of the UE. In • Keys for non-3GPP access (Wi-Fi, cable, etc.)
either case, the SUPI is not sent in clear text across the radio
network, which protects the phone against being tracked or With key agreement and derivation complete, all signaling,
having the user’s privacy breached for the purpose of profiling radio resource control traffic, payload traffic and other
or identity theft. This is among the most significant security communications are encrypted for the sake of confidentiality.
improvements in 5G over 4G. That is, unauthorized entities cannot decode and read these
data flows. Furthermore, traffic has integrity, which means it is
The Access and Mobility Management Function (AMF) of
protected by Message Authentication Code (MAC) using
the serving network confirms the SUPI/5G-GUTI based on
derived keys so that recipients know that it has not been
information provided by the home network. The home network
altered or tampered with. Finally, the identity of the UE (the
receives either the user’s SUPI, which is cross-referenced
user and phone) and the identity of the network(s) cannot be
and extracted from the serving network’s database of
impersonated or stolen. Man-in-the-Middle attacks are thus
assigned 5G-GUTIs, or the SUCI, which the home network
thwarted, but efforts in the 5G community continue to develop
“de-conceals” to extract the SUPI.
security measures to address Distributed Denial of Service
e. The Key Agreement Procedure (DDoS) attacks that can take place with messages sent in the
Now that the phone is authenticated, the network performs attachment process prior to authentication (so-called pre-
one of two flavors of key agreement: 5G-Authenticated Key authentication messages). Radio Resource Control (RRC)
Agreement (5G-AKA), or Extensible Authentication Protocol messages are examples of pre-authentication messages that
AKA’ (EAP-AKA’). The protocols are similar. (There is also a could be used, perhaps in volume, by a bad actor to create a
third protocol, EAP-TLS, but it is used only for certain private DDoS attack.
network or IoT applications.)

10
 White paper

The 5G security architecture provides for combined Wi-Fi • The gNB, or base station of 5G, is composed of a Central
and 3GPP authentication (access independent). That is, Unit (CU) and one or more Distributed Units (DUs). Thus,
when connecting to the 5G network via an intervening Wi-Fi the gNB is split between the CU and DU, which are connected
network (non-3GPP), the data will pass through a Non-3GPP via the F1 interface. To promote security on the control
Interworking Function (N3IWF). To secure this portion of the plane and user plane, the F1 interface employs IPsec. In the
network, the UE will establish an IP Security (IPSec) tunnel to control plane, Datagram Transport Layer Security (DTLS)
the N3IWF over which 5G security procedures will take place. is also used.
f. Security Edge Protection Proxy and Other 5G Security The security specifications discussed above are part of 5G
Architecture Features Security Phase 1 from 3GPP Release 15.6 This release has
As shown in Figure 3, the Security Edge Protection Proxy generally focused on the RAN, whereas 5G Security Phase 2,
(SEPP) provides gateway protection when connecting to which will be part of 3GPP’s Release 16 due in the coming
another operator’s network. Different providers connect across months, will focus more on the 5G core and NFV. As such,
an N32 interface. Specifically, the serving network uses the Release 16 will address, among other things, solutions for
N32 to connect to the home network. The SEPP receives and IoT security, which is often considered to be a primary 5G
processes communications between network functions, which cybersecurity risk due to the large number of new devices
include the AUSF, AMF, UDM, etc., per 3GPP TS 23.501, that will be accessing the network.
System Architecture for 5G System. The SEPP protects
application layer control plane traffic between different
network functions, negotiates cipher suites, handles key
management, and performs topology hiding to external III. Continuous Security: Network Operation
networks. It also discards malformed and untrustworthy and Innovation
N32 messages, among other duties.
Verizon further advances security in operating and innovating
Other notable 5G security architecture features include: the functions of its 5G network. We will employ the innovations
The Security Anchor Function (SEAF) plays the role of a of 5G network virtualization and artificial intelligence (AI) to
pass-through authenticator. It also provides the serving provide powerful new efficiencies and effectiveness in
network’s name. SEAF can initiate authentication with the UE, communications security. Verizon’s 5G network creates
and it transparently forwards authentication traffic between opportunities for risk assessments and risk management
the AUSF and the UE. The AUSF (the back-end authentication responses that benefit from greater visibility and more detailed
server) handles authentication requests and informs the UDM insights into the network than in previous generations.
of the results. The UDM provides secure storage for keys and
must be protected against physical attacks. A. Operational Security
• The Security Anchor Function (SEAF) plays the role of a Following the release of 3GPP standards pertaining to the
pass-through authenticator. It also provides the serving 5G core in the coming months, this Non-Stand Alone 5G
network’s name. SEAF can initiate authentication with the deployment, which already includes several improvements
UE, and it transparently forwards authentication traffic over 4G LTE, will transition to Stand Alone 5G service.
between the AUSF and the UE. The AUSF (the back-end When Verizon deploys a Stand Alone 5G service – 5G RAN
authentication server) handles authentication requests and using a virtualized 5G core – we will implement the cutting-edge
informs the Unified Data Management (UDM) of the results. technology solutions for assessing and mitigating risk that are
The UDM provides secure storage for keys and must be currently being advanced and standardized with Verizon’s active
protected against physical attacks. leadership. These advanced virtualization capabilities will
• 5G ensures that available security features are in fact used increase the effectiveness of the state-of-the-art and holistic
between the UE and the network and that the features are security risk management practices described below – namely,
not mistakenly or misleadingly viewed as unavailable, a the corporate governance policies, security monitoring and
protection known as “bidding down attack immunity.” response capabilities, and software vulnerability management
Bidding-down attacks attempt to trick systems into believing processes that Verizon has employed in previous generations
that they must avoid using essential security features for the and will be further improved upon through 5G capabilities.
sake of backward compatibility, so that the attacker can gain 1. Corporate Policy and Governance
advantage. Algorithm negotiation is designed to prevent the A wide range of risk management activities occur continually
use of an ineffective security suite; for instance, an across Verizon’s network footprint, both on customer-facing
attachment request from a UE could be rejected if it tried to products and services that might contain sensitive information
“downshift” to an outdated cipher algorithm. An Anti-Bidding and on internal platforms and networks.
down Between Architectures (ABBA) parameter may be
developed in later 3GPP releases.

5 The N32 interface serves as a new application layer between SEPPs to filter sensitive data attributes during the interconnection.
6 Anand R. Prasad, Alf Zugenmaier, Adrian Escott and Mirko Cano Soveri, August 6, 2018, “3GPP 5G Security” retrieved from
https://www.3gpp.org/news-events/1975-sec_5g 11
 White paper

Verizon’s Corporate Information Security Group internally Role-based Access Control:

publishes a suite of security practices and procedures that Mechanisms that limit availability of information or
align with the NIST Cybersecurity Framework. These formal, processing resources only to authorized user roles or
internal, corporate-wide policies map to each of the applications that require it.
Framework’s five Core Functions – Identify, Protect, Detect,
Respond and Recover – and each sets forth the individual Principle of Least Privilege:
behaviors and business processes that are required for The practice in which a user is granted the minimum
security, as well as the standards for our infrastructure and its level of access to perform actions necessary for the
supporting systems and applications. Verizon also internally job function.
publishes dozens of detailed Corporate Information Security
Standards, which provide detailed descriptions of the
Multi-factor Authentication:
underlying security controls that must be implemented to
Two or more authentications required for remote login.
support each security instruction.
Verizon reviews and updates these policies and standards To identify issues not prevented by other controls, Verizon
annually and on an as-needed basis along with evolving also uses detective mechanisms like intrusion detection and
regulatory compliance obligations, technology capabilities, network Data Loss Prevention (DLP) to analyze network traffic
improvements to industry best practices, field experience and for malware and unauthorized information transmissions.
implementation. The Corporate Information Security Group
gathers recommendations from multiple sources, including Looking forward, the use of AI promises a more efficient
individual contributors’ ideas, results of internal audits and approach to security, allowing continuous monitoring for
business unit audits for compliance. Updates are incorporated potential threats. The 5G network creates the opportunities
into the policy after a rigorous review and approval process, for use of AI in the network through incorporation into the
and they are communicated to internal stakeholders on roughly software-based architecture. Large amounts of data could be
a monthly basis via Security Governance Briefs. quickly analyzed for rapid detection of threats and immediately
mitigated through the combination of AI capabilities with
2. Security Operations security automation. Verizon’s 5G network will increasingly
Verizon invests heavily in securing all of its networks, including create opportunities for better and faster visibility into
5G, against known and potential threats. We continuously network activity, as well as the capability to isolate threats
monitor our networks to identify and respond to threats. and anomalous network activity, all of which naturally will
Our networks are monitored 24/7 by a Security Operations greatly benefit security monitoring and response.
Center to identify potential malicious activity. All of the
relevant connections – including between subscribers and
5G antennas, and among different parts of the 5G networks –
are encrypted to prevent eavesdropping and are appropriately
segmented (e.g., with firewalls and intrusion prevention
systems) to prevent an “infection” associated with one piece
of equipment from affecting the rest of the network.
In addition to those technical controls, Verizon deploys other
preventive controls and strategies, including:

Segregation of Duties:
The practice of dividing steps in a function among
different individuals, keeping a single individual from
being able to subvert the overall process.

Dual Control:
The process of using two or more separate entities
(usually persons) operating in concert to protect
sensitive functions or information. No single person is
permitted to access or use the materials (for example,
the cryptographic key).

12
 White paper

3. Software and Hardware Vulnerability Management B. The Cyber-Physical Convergence: Real-World

Addressing vulnerabilities plays a central role in 5G security Safety and Security
risk management. In addition to procuring software and
hardware from trusted vendors, Verizon has established a In the coming years, potentially millions of new RAN antennas
robust vulnerability management process, outlined in Figure 4 and base stations will connect billions of new devices to each
below. These processes will continue to evolve and will play an other – and to the physical world in which we and our family
increasingly central role through the transition to Stand Alone and friends live. The smart devices enabled by 5G will lock and
5G, with its virtualized, software-defined 5G core. unlock our doors, heat and cool our homes, steer and stop our
cars, track our kids and our vital signs, monitor our babies
sleeping, and allow doctors to treat or even conduct surgery
Discovery on us remotely, along with thousands of other important
New threats functions in our lives. Their security will be, to put it lightly,
quite important in our lives. The reliable functioning of these
devices – protected against sabotage, manipulation, espionage
and AI-powered nefarious uses – will become an increasingly
critical element of communications capabilities the further we
advance into the 5G era.
Vulnerability Securing the cyber-physical convergence is another imperative
Validation Assessment
management for Verizon’s 5G network, because that convergence is where
our network matters most in our customers’ lives.
1. Physical Security
The technical literature addressing 5G security does not
prominently address physically securing access to the
network, but all network security – 5G and otherwise – relies
Remediation
on the security of the infrastructure that enables the network.
With this in mind, Verizon will continue its rigorous physical
Automated tools that remotely and continuously check security measures outlined below.
for known vulnerabilities in operating systems, services
Discovery and devices that could be used to target the company’s
private network.
a. Partitioned Access Control Systems
Verizon enforces its established standards that require that
Assessment
Vulnerabilities detected during the discovery stage are an individual’s access to the network, be it physical or logical
rated and prioritized and documented.
access, is based on the access that the individual needs in
order to do his or her job – no more, no less. The Mobile
Vulnerabilities are addressed based on the priority
Remediation identified in the previous assessment step. Switching Centers (MSCs), Network Equipment Centers (NECs),
Network Operations Centers (NOCs) and other sites housing
After the vulnerabilities are addressed, subsequent
critical equipment are designed and equipped with access
Validation scans are used to validate the successful resolution
of all identified vulnerabilities. control systems with multiple, layered security access zones
such as core equipment spaces, building services spaces, office
Figure 4: Stages of Vulnerability Management spaces, public spaces, shipping/receiving spaces, etc. Critical
spaces are surrounded and shielded by less critical spaces.
Electronic keys control access to the buildings and interior
In addition to the four stages outlined above, we regularly spaces; mechanical keys are issued to only a few critical
monitor various sources to identify trends for potential new personnel as backups. Access to any of those spaces is
vulnerabilities. Tracking vulnerabilities is one measure of how controlled by the access control system for each individual,
well we are performing when it comes to security assessment, according to the legitimate need for his or her access.
evaluation and resolution.
Since not all employees need access to all spaces all the time,
Verizon’s corporate policy requires that patches, fixes the access control systems can be programmed to allow an
and service packs be applied to Information Resources in individual’s access by time of day, day of the week, per room or
a repeatable, prioritized and standardized manner in order space, as required. The access control systems maintain log
to keep Verizon Information Resources secure. files of all access attempts, authorized or unauthorized.
Software vulnerability management will also become more b. Systems Surveillance 24/7/365
effective the further we progress into the Stand Alone 5G MSCs, NECs, NOCs and macro cell sites are designed and
transition, because patches and software upgrades are more equipped with intrusion detection and alarm systems that are
efficiently deployed at scale in a software-oriented network tied into their access control systems. The intrusion detection
than in a largely hardware-based network. system (IDS) includes, but is not limited to, door contacts,
motion detectors, infrared sensors, cameras with motion

13
 White paper

detection, glass break sensors, timers, etc., that will generate leading industry consensus on IoT security technical baseline
alarm signals locally and to remote locations such as the NOCs requirements through the “Convene the Conveners” (C2)
or central station security monitoring points. consensus process.
Alarm conditions of all types, including those from the Access Through the C2 process, Verizon and other CSDE members8 –
Control System (ACS) and IDS, are monitored and logged in supported by the Consumer Technology Association,
the system itself, the local control point, and the NOCs fault USTelecom and more than a dozen other major cybersecurity
management system. In addition, a facility’s IDS may also be and technology organizations, industry associations, consortia
monitored by a third-party central station depending on the and standards bodies – identified baseline IoT security
facility and local assessment of the security environment. requirements for the rapidly growing IoT marketplace.
Local personnel are on-call 24/7 to respond if necessary. There were multiple purposes of this landmark initiative:
c. Network Access Control and Cell Site Security 1. Promoting global harmonization of security specifications
The primary concern regarding cell site security is that the 2. Bolstering global market forces that favor secure devices
distributed nature of 5G, including small cells, might increase
the risk that bad actors could physically tap into Verizon 3. Developing a common language on these issues that
equipment to eavesdrop or to disable it. Verizon’s 5G network, speaks to different policy and technical audiences
and the 4G networks that it currently rides on, are monitored 4. Aligning policy development internationally and in the
24/7 to identify and address potential tampering. As discussed United States
above, all of the relevant data flows – including between
subscribers and 5G antennas, and among different parts of the The resulting C2 Consensus on IoT Device Baseline Security
5G networks – are encrypted and subject to various controls Capabilities, or “C2 Consensus Baseline,” was released on
(e.g., firewalls) to prevent an “infection” associated with one September 17, 2019. We believe that this global market
piece of equipment from affecting the rest of the network. approach, which is supported by U.S. government agencies
and materially aligns with the draft IoT recommendations that
If physical security were to be breached at the cell sites, NIST has developed, will be an effective industry-driven
specific controls are in place to limit the access of an attacker approach to security for the IoT.
to the network. Unused network ports at the cell sites are
disabled to prevent their use by attackers. Equipment at the More specific to Verizon’s participation in the IoT ecosystem,
sites is configured to be automatically provisioned so that we have established rigorous development processes for
attackers cannot overwrite the configuration locally. Finally, Verizon retail IoT devices and network certification security
only network elements authenticated to the Verizon network requirements for IoT devices, and we will continue to do so as
are allowed to connect. Rogue systems will be denied access we further deploy our 5G network. While networks that are less
and will raise an alarm. trustworthy than 5G networks may be appropriate for some
limited IoT use cases where devices do not present significant
Therefore, while bad actors may in some cases have the ability security risks, critical and sensitive IoT applications will benefit
to disable or destroy distributed equipment such as small cells from the enhanced security of 5G networks. This is due to the
that sit at the edge of the network, this risk is more akin to that 5G network’s new capabilities to be configured as needed to
of a physical event (such as a storm) than a cyberattack – that implement traffic segregation via private network Access Point
is, a temporary localized absence of service that prompts our Names (APNs), end-to-end data encryption and enhanced
network resiliency response, rather than a cybersecurity risk authentication requirements, among other security features.
that impacts the rest of the network.
IoT devices that are subject to managed security can benefit
2. Securing the IoT and Devices that Connect to the Network from the enhanced authentication capabilities that 5G offers –
The rapid deployment of billions of new IoT devices carries both in terms of the IoT device authenticating the 5G node it is
significant risks, to the extent that many of these devices have connecting to, as well as the network requiring enhanced
not been developed with certain baseline technical security authentication for connectivity. In addition, with network slicing,
requirements. Largely to help lead a promising effort to IoT devices can be put on an isolated slice so that, for instance,
address these very security challenges – made manifest by the a DDoS attack from the IoT devices cannot impact other slices
IoT-driven Mirai botnet DDoS attack in October 2016 – Verizon on the network.
became a founding and active member of the Council to
Secure the Digital Economy (CSDE). Among several other
significant activities that have been recognized by top leaders
in the U.S. government,7 perhaps the CSDE’s most notable
accomplishment to date is its development of the world’s

7 For example, the Director of DHS’s Cybersecurity and Infrastructure Security Agency (CISA), Christopher Krebs, has recently praised the CSDE and its accomplishments
in his keynote speeches at the DHS CISA 2nd Annual National Cybersecurity Summit, September 26, 2019; and Mobile World Congress Los Angeles 2019, October 22,
2019; and in his testimony at the U.S. Senate Committee on Homeland Security and Government Reform hearing on “Supply Chain Security, Global Competitiveness,
and 5G,” October 31, 2019.
8 Other than Verizon, CSDE’s member companies are Akamai, AT&T, CenturyLink, Cisco, Ericsson, IBM, Intel, NTT, Oracle, Samsung, SAP and Telefónica.
9 See Draft NISTIR 8259 (“Core Cybersecurity Feature Baseline for Securable IoT Devices: A Starting Point for IoT Device Manufacturers), published July 2019. 14
 White paper

C. Looking Ahead with specialized or tailored security for critical systems such as
smart energy meters at distribution stations and generation
Verizon’s state-of-the-art operations regarding network
plants, road sensors providing traffic controls at busy
management, monitoring and response will continue in
intersections, safety messages from autonomous vehicles, or
5G. Moreover, virtualization and other innovations that
connected medical devices and equipment in a hospital.
5G enables, including as described below in the RAN,
will bring new efficiencies and effectiveness to our existing Another component in Verizon’s 5G deployment is the Multi-
security operations. access Edge Compute (MEC) capability. The MEC brings
compute capability geographically closer to the customer, thus
1. Open RAN and Virtualization Standards
enabling extremely low-latency services such as interactive
Beyond the RAN-oriented security features discussed in training. Verizon is considering both public and private MECs.
Section II regarding User Equipment authentication and related Public MECs would be shared resources across multiple
capabilities – all of which are directly relevant to securing the different services, while a private MEC can be dedicated to
edge network – Verizon has been an active leader in other individual customers such as a factory floor for robotics
efforts to secure the edge of the network. Specifically, as an control. In addition to localizing data, a private MEC also allows
early and very active member of the O-RAN Alliance and a customer to physically secure the MEC in their own location,
through our own real-world learning, we have advanced the thus adding another layer of security customized to the
potential for standards-based open interfaces to promote customer’s particular needs.
virtualization of the RAN. This effort produces technical
3. Future 5G Security Opportunities
specification and reference architecture, which conforms to
and influences technical standards, and promotes two Verizon will continue to lead the development of innovative
security benefits. security service concepts and capabilities for 5G. One of the
most important opportunities for future security innovation is
First, virtualization of the RAN will allow for specific security
the utilization of Software Defined Perimeter (SDP) to create
advances at the edge of the network. For instance, as noted
a “zero trust” security layer over a 5G network. Zero trust
above, the flexibility presented by the 5G design to reconfigure
is the concept of verifying user and device identity and
and create segregated network slices can help mitigate
providing access to the appropriate network slice based on
broader damage caused by insecure IoT implementations.
service category or application. Additionally, SDP can also be
Network operators now have the ability to segregate certain
combined with a quantum Random Number Generator (qRNG)
IoT devices from the general population of devices, and this
as an effective countermeasure to future quantum computing
capability will be improved through further virtualization at
encryption attacks.
the edge.
We will also continue to develop and improve upon new
Second, standards-based open interfaces within RAN can
tools such as AI, security automation, virtualization and
facilitate a new competitive and diverse market of RAN
other proactive security measures that create promising
vendors. Open RAN is thus a tool to promote RAN vendor
opportunities for rapidly identifying and mitigating threats
diversity and to level the playing field in a previously hardware-
in a 5G world.
oriented RAN market that has been increasingly consolidated
in recent years. Carriers need to have a robust set of
competitive options to choose from in the trusted vendor
market, and standards-based open RAN can help ensure
that reality. More broadly, open RAN is fundamentally about
software and innovation – where the future of 5G lies,
and where the United States and its allies lead.
2. Security Opportunities through Network Slicing and
Multi-access Edge Compute
Network slicing is the concept of isolating different services
into isolated slices in terms of network resources and traffic.
Network slicing can be thought of as a Virtual Private Network
(VPN) with the addition of network resource allocation and
isolation. Slicing plays an important role in separating and
protecting mission-critical systems from non-managed devices
and systems. As noted above, if there is a DDoS attack on or
emanating from non-managed IoT devices, slicing can ensure
that only the IoT slice is impacted, and that others that manage
mission-critical network functions are not affected. Importantly,
slices can be customized based on mission needs with
different security mechanisms and policies, such as firewall
configurations, access policies, packet inspection and
authentication schemes. This could provide separate slices

15
 White paper

IV. Conclusion
5G communications will bring dramatic new benefits and
capabilities to commerce and personal life. 5G’s new
capabilities will also expand the attack surface for bad actors
at the convergence of the cyber and physical worlds. Verizon is
designing and deploying its 5G network, and will operate and
innovate it, in a manner that accounts for these threats. We
are building on decades of experience, at Verizon and in the
communications sector more broadly, in protecting against
these threats. Our customers’ secure communications, and the
reliability and resilience of our communications services, are
our top priorities.
The new architecture and capabilities of the 5G network will
allow operators to detect and address cyber threats faster and
more efficiently than ever before. Our 5G network will provide
a virtualized, cloud-based architecture that enables highly
specialized security measures for different network applications.
Our first principles in addressing 5G security risks guide us in
the two phases that are crucial to any network.
1. In our design and deployment of this network, we rely
exclusively on trusted network components, with supply
chain security assured through our rigorous supplier vetting
processes. We have strong policies governing the
configuration of these components in all the equipment and
devices we deploy throughout the network. Components of
this network are required to authenticate to one another
prior to performing their functions. We leverage the new 5G
architecture and technical standards, which we ourselves
have helped develop, to provide new security features that
did not exist in previous generations.
2. In our operation and innovation of this network, we
continually advance security in the network. We secure
the physical network, and we employ the groundbreaking
innovations of 5G network virtualization to provide powerful
new efficiencies and effectiveness in communications
security. Outside the core network, we secure the RAN
through advances in open RAN standards and technology,
which in turn promotes a diverse and competitive market
among RAN vendors. Verizon also has helped spearhead
global advances in the security of the IoT and the other
devices that connect to the 5G network, and we will
continue to advance promising new security innovations
that will be deployed in the future.

Finally, because neither the government nor any individual

private sector entity can secure our nation’s communications
networks alone, we will continue to invest heavily in
partnerships with the government and other important
stakeholders in the private sector to secure 5G.

16
 White paper

Appendix: Glossary MCC: Mobile Country Code

3GPP: 3rd Generation Partnership Project MEC: Multi-access Edge Compute
5G: 5th Generation of cellular network technology MNC: Mobile Network Code
ABBA: Anti-Bidding down Between Architectures MSC: Mobile Switching Centers
ACS: Access Control Systems MSIN: Mobile Subscriber Identification Number
AI: Artificial Intelligence N3IWF: Non-3GPP Interworking Function
AKA: Authenticated Key Agreement NCC: National Coordinating Center for Communications
AMF: Access and Mobility Management Function NEC: Network Equipment Center
APN: Access Point Name NG-RAN: Next Generation Radio Access Network
ARPF: Authentication Credential Repository and NIST: National Institute of Standards and Technology
Processing Function NOC: Network Operations Center
ATIS: Alliance for Telecommunications Industry Solutions NR: New Radio
AUSF: Authentication Server Function NSA: Non-Stand Alone
CSDE: Council to Secure the Digital Economy NTIA: National Telecommunications and
CSRIC: Communications Security, Reliability and Information Administration
Interoperability Council O-RAN: Open Radio Access Network
CU: Central Unit of gNB PCI-DSS: Payment Card Industry Data Security Standard
DDoS: Distributed Denial of Service qRNG: quantum Random Number Generator
DHS: Department of Homeland Security RAN: Radio Access Network
DLP: Data Loss Prevention RBS: Rogue Base Station
DTLS: Datagram Transport Layer Security RRC: Radio Resource Control
DU: Distributed Unit of gNB SCRM: Supply Chain Risk Management
EAP-AKA: Extensible Authentication Protocol-Authenticated SDP: Software Defined Perimeter
Key Agreement
SEAF: Security Anchor Function
EAP-TLS: Extensible Authentication Protocol-Transport
Layer Security SEPP: Security Edge Protection Proxy

ETSI: European Telecommunication Standards Institute SIDF: Subscription Identifier De-Concealing Function

FCC: Federal Communications Commission SIM: Subscriber Identity Module

gNB: New Radio (5G) Node B (base station) SQN: Sequence Number

GUTI: Globally Unique Temporary Identifier SRO: Supplier Risk Office

HIPAA: Health Insurance Portability and Accountability Act SSAE: Statement on Standards for Attestation Engagements

IDS: Intrusion Detection System SUCI: Subscription Concealed Identifier

IETF: Internet Engineering Task Force SUPI: Subscriber Permanent Identifier

IMSI: International Mobile Subscriber Identity TRE: Tamper Resistance Element

IoT: Internet of Things TS: Technical Specification

IPSec: IP security UE: User Equipment

ISAC: Information Sharing and Analysis Center UDM: Unified Data Management

ISO: International Organization for Standardization USIM: Universal Subscriber Identity Module

IT: Information Technology UMTS: Universal Mobile Telecommunications System

Kseaf: Security Anchor Function Key VLC: Verizon Leadership Council

LTE: Long-Term Evolution VPN: Virtual Private Network

MAC: Message Authentication Code

Network details & coverage maps at vzw.com. © 2019 Verizon. WP6711121 17