5G standardisation: how 3GPP releases and security standards are set

It is tempting to picture a standard as a document that appears when the technology is ready. The reality is closer to the opposite: the document is the record of an argument that has already been settled among the organisations that will have to implement it, and the interesting work happens before anything is published.

This shapes what a research project can usefully do. Producing a better design is necessary and nowhere near sufficient, because the design has to be carried into the room by somebody entitled to be there. 5G standardisation was therefore treated here as an activity with its own reporting instead of as an outcome that would follow automatically from good results. There are three separate reports on it, and a brochure written to explain the landscape to people outside it.

• PDF Brochure on 5G standardisation
• D5.2 First report on communication, marketing and standardisation
• D5.3 Second report on communication, marketing and standardisation
• D5.5 Third report on communication, marketing and standardisation
• PDFThe role of security in 5G standards: ITU-T, with an ETSI example

3GPP works in releases: a release is frozen at a set date, and everything agreed by then goes in while everything else waits for the next one. The effect is that 3GPP releases act as a clock for the whole industry, because a feature that misses a freeze is years away, not months.

The first complete 5G specifications landed in Release 15, and it was deliberately split so that operators could deploy the new radio against their existing core before the new core was ready. That decision is a security fact as much as a commercial one: a network running the new radio on the old core inherits the old core’s security properties, including the identity handling that the new system was designed to fix.

Reading across successive 3GPP releases is also how the strata question earlier in this archive is best understood. The stratum model in use came from a specification written for an earlier system, was carried forward into the security architectures of the two generations that followed, and arrived in the 5G discussion still lacking any place to put management, which is exactly what happens to a structure that is inherited rather than re-derived.

ETSI occupies an unusual position: it is both one of the regional partners that constitute 3GPP and a standards body publishing in its own right. For this subject the second role matters most, because network functions virtualisation (the thing that makes a 5G core software on shared infrastructure) was specified at ETSI and not in 3GPP. A security architecture for 5G therefore has to reconcile two families of specification that were written by different groups for different purposes.

Around them sit other bodies whose output lands in the same networks: the internet protocols that a service-based core is built from, the trust and identity work that certificate handling depends on, and the industry associations that turn all of it into operator requirements. None of these owns 5G security on its own, and the gaps between them are where a research contribution has the most room.

The instrument connecting the technical work to the security standards process was a roadmap, issued three times over the life of the project: an early vision, an update, and a final version. Its function was to say which enablers were ready to be argued for, and where, at a point when the specifications were still open enough to absorb them.

A roadmap that is republished twice is admitting something useful. Some of what looked promising at the outset did not survive contact with the standards process, and some problems only became visible once the architecture was more settled. Security standards develop the same way, by revision and argument instead of by discovery, and the three editions are a record of that instead of a series of corrections.

What can be said about outcomes should be said carefully. The concerns raised here appear in the specifications that followed, and the identity concealment that closes the exposure described elsewhere in this archive is the clearest example. Attributing any specific clause to any specific contribution would be a stronger claim than the documents support.

Most of the argument happened in rooms rather than in deliverables, and what survives of it is the slide decks: two project workshops, the ETSI Cyber Security Workshop, a public consultation walkthrough, and the overview talks given as the work was introduced. They are shorter than the deliverables and more direct about what was unresolved at the time.

Alongside them sit the wider phase-one publications: the 5G-PPP white paper on the security landscape, the annual journal, and the outcome report from the EuCNC security workshop. Each is held at the address it was issued from.