Release 16 and 17: filling in what the first 5G set left open

Release 16 is the phase where 5G stopped being a mobile network with an improved radio and became something deployable in settings that had not previously had a mobile network at all. It specified operation over unlicensed spectrum, industrial communication with deterministic timing, direct vehicular communication on the new radio, convergence with wireline access, and networks operated privately for a single organisation.

Each of those extends a security assumption instead of adding a mechanism. A private network for one organisation cannot assume that authentication rests on a subscription issued by a public operator, so credentials have to be able to come from somewhere else. Industrial deployments put the network inside a plant where the consequences of a fault are physical, which changes what availability means. Convergence with wireline means a subscriber can arrive over a connection with entirely different properties from a radio link.

Two additions are security features in their own right. Authentication specific to a network slice was specified, so that gaining access to the network does not by itself grant access to a particular slice, which is the control that makes slice separation something more than a configuration. And a framework was added for deriving application-level keys from the subscriber’s existing network credentials, so that an application can rely on the operator’s authentication.

Release 16 is also where protection against false base stations became a formal study item. That it was still a study and not a specification is the honest measure of the difficulty: the exposure sits in the exchange that precedes any established trust, so a countermeasure has to be usable by a device that has nothing to check against yet.

Release 17 continued in the same direction. It specified a reduced-capability device class for equipment that sits between a narrowband sensor and a handset, added support for non-terrestrial access so that satellite links become part of the same system instead of a parallel one, and further developed multicast delivery and edge computing.

The security consequences are mostly consequences of the device class and the link. A reduced-capability device has a smaller budget for cryptographic work and a longer service life than a handset, which is the constraint that first appeared with the machine-type categories in Release 13 and has recurred in every release since. A non-terrestrial link has a long propagation delay and a footprint that crosses jurisdictions, which affects protocol timing assumptions and raises questions about which country’s rules apply to a given attachment.

Edge computing has a different shape of consequence. Moving processing close to the subscriber reduces the distance data travels, and it relocates that data into a facility that is physically less defensible than a central site. This is the same trade the archive’s own work describes for surveillance estates on the video surveillance page: the exposure is not removed, it is moved somewhere with different properties.

Taken together, the pattern is that the interesting security work after the first 5G set is about boundaries. Between slices, between a private network and a public one, between wireline and radio access, between an application and the network that authenticated its user, between an edge site and a core.

That is a recognisable continuation of what the archive’s own specifications were concerned with. The project’s work on segmentation, access control and holding a virtualised core to a known state is boundary work, written when the core was first becoming software and the boundaries were first becoming configuration. The vocabulary has changed and the concern has not.