5G Security White Paper
First principlesDecember 2019, If you'd like to receive new articles, solutions briefs, whitepapers and more—just let us know. Experts at Verizon and other private sector and government entities have identified several cybersecurity risks that will continue, or arise anew, in the 5G network environment. Verizon is approaching these concerns in two phases, guided by first principles in security that have undergirded our previous networks and that we can use with greater efficiency and effect in 5G. Verizon is designing and deploying its 5G network with security as a central element of the network. As discussed below in Section II, Verizon relies exclusively on trusted vendors that have undergone our rigorous supply-chain vetting processes. We routinely assess the software and hardware that goes into our network, and we employ rigorous, documented policies and procedures for secure configuration and operation of equipment and devices we deploy throughout the network. Components of our 5G infrastructure, even within the network itself, are required to authenticate to one another prior to performing their functions. Further, we leverage the new 5G architecture and technical standards, which we ourselves have helped develop, to provide new security features that did not exist in previous generations of wireless technology. Moreover, outside the core network, we secure the Radio Access Network (RAN) – the antennas and base stations of cell towers have long been the most visible elements of wireless networks – through advances in Open RAN (O-RAN) technology, which is bringing the security benefits of network virtualization and related software innovation to the RAN. (In turn, this software innovation favors a diverse and competitive market among RAN vendors. This is one way to address the recent troubling concentration of the RAN market among suspect vendors.) Finally, Verizon has helped spearhead global advances in the security of the Internet of Things (IoT) and the other devices that connect to the 5G network, and we are continuing to advance promising new security innovations that will be deployed in the future. Overall, Verizon has traditionally implemented a holistic view of security risk management and will continue to do so in the 5G environment. Security risks will persist, but we are accounting for these risks in everything that we do to build and operate the network, using 5G-enabled security innovations to advance the security practices that we have employed and refined for decades. Verizon's 5G network presently consists of a new RAN known as New Radio (NR), which is connected to the current 4G LTE core. This deployment, referred to as Non-Stand Alone (NSA) 5G, already includes several security improvements over 4G LTE which are discussed in this paper. As Verizon's trusted vendors begin to support the forthcoming new technical standards for the 5G core standards – due to be completed in the coming months – our core network will migrate to a new 5G core which uses software-based architecture and network virtualization. When Verizon deploys a Stand Alone (SA) 5G service – 5G RAN using a virtualized 5G core – we will implement the cutting-edge technology solutions for assessing and mitigating risk that are currently being advanced and standardized with Verizon's active leadership in research and development, real-world deployments, and standards bodies. Verizon ensures that security is an integral part of designing and deploying the 5G network. We rely exclusively on trusted network components, managing supply chain security risks through our rigorous supplier vetting processes. We then work with suppliers and engineers to secure these components in the equipment and devices we deploy throughout the network. Further, we leverage the new 5G architecture and technical standards, which we ourselves have helped develop, to provide new security features that did not exist in previous generations. Verizon's trusted supply chain is the foundation of our secure 5G network. Leveraging a diverse, competitive marketplace of trusted vendors of network hardware and software is a security imperative for Verizon and other 5G service providers. This is the fundamental principle of our supply chain security policy; it guides everything we do in vetting our trusted suppliers and in testing and configuring the equipment and devices we acquire from them. For both hardware and software, Verizon purchases all our roles and responsibilities, as outlined briefly below. The Verizon Leadership Committee (VLC), which consists of the Chief Executive Officer and direct reports, assumes the ultimate accountability to define strategic direction and objectives for the SRO Program. On a day-to-day basis, the Supplier Risk Management Executive Committee performs oversight and governance of the SRO Program based on the VLC's strategic direction and objectives. The organizational sponsor of a proposed contract, with the assistance of the Category Sourcing Expert and the SRO, must complete a risk questionnaire for each contract and statement of work under which products or services are provided by a supplier. The contract's risk level, determined through an assessment under the SRO's formal Supplier Risk Management System, drives due diligence by the appropriate Risk Expert team. The SRO has established formal processes for conducting due diligence and addressing all assessed risks prior to use of a supplier and prior to contract execution for a particular product or service. This scrutiny covers suppliers of all types. Beyond the more focused scrutiny discussed below on suppliers whose products are pertinent to cybersecurity and national security review, our Supplier Risk Management Program scrutinizes our suppliers' general reliability, sound corporate governance, trustworthiness and legal compliance culture, including their regimes for complying with the Foreign Corrupt Practices Act and counter-fraud programs, as well as their financial viability. Verizon reviews information on suppliers' policies and procedures in these areas, along with supporting evidence for each applicable area of risk. More specifically, we conduct ongoing due diligence with our most in-depth and frequent activities focusing on areas of high risk, such as suppliers of critical equipment that make up our networks. (As discussed in the next section regarding equipment testing and device configuration, we also conduct internal and third-party penetration testing on such equipment, devices and applications prior to launch.) The following risk considerations directly pertinent to cybersecurity and national security are specifically addressed through our Supplier Risk Management Program:,The processes outlined above help ensure that our networks are built with trusted components derived from a secure supply chain. Verizon recognizes that supply chain risk management benefits from effective collaboration and information sharing, both among private sector entities and between the public and private sectors. We therefore have taken formal leadership roles in DHS's SCRM Task Force and in the ATIS initiative to advance supply chain security standards. We also have participated in nascent efforts to advance software supply chain security assurance, such as the multi-stakeholder process convened by the National Telecommunications and Information Administration (NTIA) to develop best practices for vendors to communicate to enterprise buyers the components of the "software bill of materials" – that is, the software supply chain. As discussed in Section III below, further improvements in software supply chain security and software security assurance will be an increasingly important element of Verizon's holistic approach to 5G security as it migrates its network to a virtualized 5G core and operates and innovates this sliced network through software and cloud-based functionalities. After the supplier vetting and scrutiny described above, our next steps in building a secure network foundation include rigorous inspection and security testing as well as standardized configuration of the components that make up our network. Secure configuration of network equipment and devices is a structural necessity in building a secure 5G network. Verizon has been operating and improving its state-of-the-art,Technical standards provide a common understanding of,Verizon is participating in and influencing the 5G standards The Subscriber Permanent Identifier (SUPI), akin to IMSI in,When the UE seeks to attach to the network, it sends either the Subscription Concealed Identifier (SUCI, an encrypted form of the SUPI) or the Globally Unique Temporary Identifier (5G-GUTI). The UE does not send the SUPI in unencrypted form across the network – instead, the SUCI contains the SUPI, which is "concealed" or rather encrypted using standardized encryption mechanisms. The home network provider's public cryptographic key is used in the encryption, which conceals the subscriber's identity from the roaming network. The SUPI is extracted from the SUCI by the network using the Subscription Identifier De-Concealing Function (SIDF). If it is not the first time the UE has authenticated, the USIM may have been given a 5G-GUTI by the network, which serves as a proxy or substitute for the SUPI. Because the network assigned the GUTI, it can index or cross-reference a corresponding, previously stored SUPI to positively identify the user. 5G-GUTIs are short-lived, changed frequently and, like the SUCI, can serve to hide the identity of the UE. In either case, the SUPI is not sent in clear text across the radio network, which protects the phone against being tracked or having the user's privacy breached for the purpose of profiling or identity theft. This is among the most significant security improvements in 5G over 4G. one of two flavors of key agreement: 5G-Authenticated Key Agreement (5G-AKA), or Extensible Authentication Protocol AKA' (EAP-AKA'). The protocols are similar. (There is also a third protocol, EAP-TLS, but it is used only for certain private Following the release of 3GPP standards pertaining to the The practice of dividing steps in a function among different individuals, keeping a single individual from being able to subvert the overall process. The process of using two or more separate entities (usually persons) operating in concert to protect sensitive functions or information. No single person is permitted to access or use the materials (for example, the cryptographic key). Mechanisms that limit availability of information or processing resources only to authorized user roles or applications that require it. The practice in which a user is granted the minimum level of access to perform actions necessary for the job function. Two or more authentications required for remote login. To identify issues not prevented by other controls, VerizonAddressing vulnerabilities plays a central role in 5G security The resulting C2 Consensus on IoT Device Baseline Security 5th Generation of cellular network technology,: Anti-Bidding down Between Architectures,: Access Control Systems,: Artificial Intelligence,: Authenticated Key Agreement,: Access and Mobility Management Function,: Access Point Name,: Authentication Credential Repository and,: Alliance for Telecommunications Industry Solutions,: Authentication Server Function,: Council to Secure the Digital Economy, Communications Security, Reliability and,: Central Unit of gNB,: Distributed Denial of Service,: Department of Homeland Security,: Data Loss Prevention,: Datagram Transport Layer Security,: Distributed Unit of gNB,: Extensible Authentication Protocol-Authenticated,Extensible Authentication Protocol-Transport,: European Telecommunication Standards Institute,: Federal Communications Commission,: New Radio (5G) Node B (base station),: Globally Unique Temporary Identifier,: Health Insurance Portability and Accountability Act,: Intrusion Detection System,: Internet Engineering Task Force,: International Mobile Subscriber Identity,: Internet of Things,: IP security,: Information Sharing and Analysis Center,: International Organization for Standardization,: Information Technology,: Security Anchor Function Key,: Long-Term Evolution,: Message Authentication Code,: Mobile Country Code,: Multi-access Edge Compute,: Mobile Network Code,: Mobile Switching Centers,: Mobile Subscriber Identification Number,: Non-3GPP Interworking Function,: National Coordinating Center for Communications,: Network Equipment Center,: Next Generation Radio Access Network,: National Institute of Standards and Technology,: Network Operations Center,: New Radio,: Non-Stand Alone,: National Telecommunications and,: Open Radio Access Network,: Payment Card Industry Data Security Standard,: quantum Random Number Generator,: Radio Access Network,: Rogue Base Station,: Radio Resource Control,: Supply Chain Risk Management,: Software Defined Perimeter,: Security Anchor Function,: Security Edge Protection Proxy,: Subscription Identifier De-Concealing Function,: Subscriber Identity Module,: Sequence Number,: Supplier Risk Office,: Statement on Standards for Attestation Engagements,: Subscription Concealed Identifier,: Subscriber Permanent Identifier,: Tamper Resistance Element,: Technical Specification,: User Equipment,: Unified Data Management,: Universal Subscriber Identity Module,: Universal Mobile Telecommunications System,: Verizon Leadership Council,: Virtual Private Network,The Executive Steering Committee for Supplier Risk consists of the following senior executives: Chief Information Security Officer, Chief Security Officer and Chief Choose your country to view contact details. Existing customers, to your business account or . If you are already a Verizon customer, we have several options to help you get the support you need. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. We use both third party and first party cookies for this purpose. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. These cookies may be set through our site by Verizon and third parties. They are used to present Verizon advertising on third party sites that you may visit. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising from Verizon. BackClear Filters,All Consent Allowed
Learn more