The GSMA’s announcement of the Open Connect initiative has proved a useful stimulus for conversation with a diversity of companies. The Open Connect programme aims, like previous ones, to add APIs into the telecom networks.

“I can’t see operators going for it,” commented an anonymous contact at ETSI’s MWC networking party. “They’d be giving up some control of the network. Telecoms networks are great at securing endpoints, but in between the aim is to move data as fast as possible. If you have APIs intruding, you’d open up an attack surface and compromise that security.”

Would a zero-trust approach to network-building deal with that problem, 6GWorld wondered.

“It might,” conceded the partygoer, “But it opens up two other challenges. Firstly, zero-trust means authentication every step of the way through the system. With pressures on to lower latency, that’s a problem. Secondly, every time there’s a software update your network elements have to re-confirm that they can trust each other. With a proliferation of network elements you have to make sure that all of their updates synchronise properly or else your network crashes.”

While not 100% sure that these comments reflects state of the art security knowledge, they certainly reflect the state of the art for most telecoms network architects. That brief interaction set the scene for debates and discussions to dig into the future of security.

There are calls for security-by-design principles to be applied to 6G, not least in the ITU’s technology directions paper. This is a far cry from previous generations of telecoms. However, we are already seeing changes in security approaches caused by the threats of quantum computing breaking current encryption methods; APIs are proliferating between open network elements; and the complexity within and between networks is expanding drastically.

Dynamic Security

“There is a risk of conflicting pressures – for security taking up more capacity or more time,” observed Keijo Mononen, “But I think that’s also the driver for new technologies.”

Ericsson’s GM for Security Solutions, Technologies & New Businesses was talking to 6GWorld about the new elements needed in security as we move forward. He argued that fundamentally a new security approach needs to be developed.

While current security technologies will still be relevant, “The thing is that the networks are becoming dynamic,” he explained. “Distributed security needs to be dynamic and distributed as well. And there you need a management layer, an automated security assurance layer that is monitoring, going horizontally. That way you have the security posture and the policy set in a consistent way throughout the network. You need to correlate and bring together data to identify these problems and then security needs to be adaptive as well.”

This seems difficult, to say the least.

“It is a challenge because in critical infrastructures like telecom networks, you don’t go and change things just like that. So this also requires a kind of holistic view, as well as standardisation of how we’re going to approach things; and products need to take this adaptability into consideration too.”

Questions about the structure of the future security landscape are also top of mind for Palo Alto Networks’ CTO for Service Providers Keith O’Brien, who is focussing on the open, containerised environments found in 5G and later in 6G.

“You have multi-vendor environments in ORAN, and there’s a lot of concern around supply chain attacks. We’ve seen this already in the industry – maybe not as much in mobile, but just the general industry. Somehow malware gets inserted into the vendor’s supply chain and the vendor’s not aware of it, right? How can we detect that as it makes it out into production?”

While security hygiene is important, an increasingly diverse supply chain with components or sub-components developed all over the world can create problems with certifying that hygiene at every step. This is, ultimately, something which will be susceptible to testing. A diversified supply chain for open networks is definitely appealing, but there will no doubt be competition based on the security credentials of the supply chain backing up any vendors.  

Trust and Swagger

All of this brings us back not only to security but to trust. If even your supply chain is suspect, are there ways to establish what can be trusted without breaking the design parameters of the system itself? Yes, according to Mononen.

“You need to build the trust between different entities. In 6G we are not only talking about security orchestration but we say trust orchestration as well.”

This may be one way around the challenge of zero-trust environments as laid out at the start of the story. Mononen is enthusiastic.

“It can also change the policy dynamic. ‘Hey, now you need to prove that you are yourself even better’ or ‘which location are you in?’ And you can dynamically ask for more requirements on a person or a thing.”

Trust, in this case, is something the telecoms industry is familiar with from hardware roots of trust in phones. Expanding that – in hardware or software – is quite a leap and once again has implications for the industry’s structure.

“That component will need remote attestation capabilities,” Mononen explained. “Meaning that you have some body that can kind of confirm that this thing is trusted here. So this type of thing will come.”

However, he warned, we are stepping away from an environment of physically quite remote cell towers to hardware much closer to the end user.

“It is absolutely crucial that the device identities can be trusted because if that trust is lost, then you cannot have networks. And that’s why, in our industry, we are very good at making sure that these identities are trusted with a hardware root of trust. The number of identities and the importance of trusted identities will grow.”

Conversely, to O’Brien not relying on trust is the key – rather, limiting what can be done in a network regardless of the trust status of different elements.

“3GPP has swagger files, like definition files for API calls. We can take that swagger file and import it into our security controls, and in a 5G core, we know that there’s only certain REST API calls that should be going between these microservice applications. If one of the microservices is compromised or taken over by an attacker, normally an attacker wants to start popping around taking over the network. We stop that by only allowing traffic between these microservices which is defined by 3GPP. So they’re not going to be able to start mounting file systems remotely and scanning the network.

“We had meetings yesterday on how we can take that same idea, but in a MEC environment, in an edge environment.”

Startup Bloxtel takes yet another approach, aiming to reinvent authentication for a distributed era. CEO Izzo Wane explained that, to date, authentication between a SIM or eSIM and the network has been managed as a symmetric system. “Essentially this means that the device can authenticate by default with only the mobile network core of the home mobile network operator,” Wane explained.

“Then roaming agreements take that forward to other networks. Those roaming agreements are complicated enough across a few hundred networks. With the spread of private networks it will rapidly stop being practically scalable.”

Wane argues that an asymmetric form of authentication, whereby a SIM profile holds a decentralised identity that authenticates to a distributed ledger, would be much more effectively able to scale as well as removing points of vulnerability in the storage of public keys. Such an approach would allow for direct authentication onto the network connected to. While this wouldn’t do away with roaming agreements it would eliminate the need for authentication back to the ‘home’ network, reducing latency and potentially reshaping how roaming agreements need to be structured or monitored.

Using current technology to reduce the complexity and vulnerability of telecoms systems seems sensible. However, it will be interesting to see the response to a concept like this – it is very different in approach from traditional telecoms networking. To what extent a conservative industry will adopt this idea, or understand the technology deeply enough to be confident in such a solution, any time soon remains to be seen. There are certainly growth areas in IoT, private networks and more where these ideas may be more easily trialled and adopted before they gain wider traction. In this case, it may be a matter of earning trust within the telecoms community itself.

That said, while future networks pose unique security challenges, new solutions may be part and parcel of the technology’s evolution. O’Brien, for example, is enthusiastic about the increased location accuracy promised in 6G.

“The more precise you can get with location, you can start building security policy on that; so, based on where somebody physically is even within an office, I may want to apply a different security policy to that user.”

Mononen is also enthusiastic, but keen to underline the scope of the work involved.

“6G will be so fundamental, it needs to be very resilient as well; it needs to be capable of handling different type of crises. The telecom networks are resilient, but it will take another step for 6G.”