itu-t Series-Y: Global Information Infrastructure, Internet Protocol Aspects and Next-Generation Networks
The requirements and architectural framework for 5G, NGN, IoT, AI/ML infrastructure, and network slicing — where IMT-2020 security mandates (Y.3101) translate into the 3GPP specifications that operators must implement.
Official Scope
Study Group: SG13 (Future networks, IMT-2020) & SG20 (IoT and Smart Cities)
Active Status: Ongoing
Defines the Global Information Infrastructure (GII), IP aspects of NGN (Next-Generation Networks), IMT-2020 (5G) system requirements (Y.3101), framework for AI/ML integration in networks (Y.3172), IoT functional security (Y.4401), and the architecture for network slicing and cloud-native network functions.
Tactical Security Significance
- Relevance: 🟢 Critical — 5G Core Security, Network Slicing Isolation, AI/ML Infrastructure Security, IoT Device Security
- Key Security Concepts: IMT-2020 Security Requirements (Y.3101), Network Slice Isolation, NWDAF (AI/ML) Security, IoT Device Lifecycle Security (Y.4401), Cloud-Native NF Security
- Attack Surface: 5G network slices (insufficient isolation enables cross-slice attacks), NWDAF data feeds (AI poisoning), IoT devices with weak onboarding (Y.4401 lifecycle), cloud-native NF container environments
Key Recommendations
| ITU Rec | Title | Security Domain | Cross-Reference |
|---|---|---|---|
| Y.2701 | Security requirements for NGN | NGN Security Requirements Baseline | X.805 |
| Y.3101 | Requirements for the IMT-2020 network | 5G System Security Requirements | 3GPP TS 23.501 |
| Y.3111 | Service requirements for 5G network slicing | Network Slice Isolation Security | 3GPP TS 33.501 §11 |
| Y.3172 | Architectural framework for machine learning in future networks | NWDAF AI/ML Security | 3GPP TS 23.288 |
| Y.3300 | Framework for software defined networking (SDN) | SDN Control Plane Security | ONF TR-521 |
| Y.4100 | Common requirements for the Internet of Things | IoT Security Baseline Requirements | ETSI EN 303 645 |
| Y.4401 | Functional framework and capabilities of the Internet of Things | IoT Device Lifecycle Security | 3GPP TS 33.185 |
| Y.4551 | Requirements and capability framework for IoT application security | Application-Layer IoT Security | OWASP IoT Top 10 |
Security Mapping
IMT-2020 Security Requirements (Y.3101) → 3GPP TS 33.501
Y.3101 defines the top-level security requirements for the IMT-2020 (5G) system. Every security clause in 3GPP TS 33.501 traces back to a requirement in Y.3101 — making Y.3101 the authoritative compliance baseline for 5G security audits.
Key Y.3101 security requirements and their 3GPP realizations:
| Y.3101 Requirement | 3GPP Realization |
|---|---|
| User privacy protection | SUCI (SUPI concealment via ECIES) — TS 33.501 §6.12 |
| Mutual authentication | 5G-AKA / EAP-AKA' — TS 33.501 §6.1 |
| Security context isolation per slice | NSSAI-scoped security context — TS 33.501 §11 |
| Inter-operator security | SEPP + N32 TLS — TS 33.501 §13 |
| Lawful interception in 5G | 5G LI architecture — TS 33.127 |
Network Slice Security Isolation (Y.3111)
Y.3111 mandates that network slices must not interfere with each other — traffic and security contexts must be isolated. Insufficient slice isolation enables cross-slice attacks, where a compromised slice gains access to resources or data belonging to other tenants.
- Threat: A compromised IoT slice (e.g., smart meter network) escalates privileges or leaks traffic into a mission-critical slice (e.g., emergency services UE slice) due to shared UPF or AMF without proper isolation
- Mitigation: Enforce dedicated AMF instances per high-security slice; apply Network Slice Admission Control (NSAC) per Y.3111; validate isolation boundaries at each slice handoff with slice-aware firewall policies
NWDAF AI/ML Security — Model Poisoning Attack (Y.3172)
The NWDAF (Network Data Analytics Function) uses AI/ML models trained on live network data to enable intelligent network management. Y.3172 defines the framework — but AI model inputs are a new attack surface.
- Threat: An attacker who can influence network telemetry data (e.g., by generating synthetic UE behavior at scale) poisons the NWDAF training data → NWDAF makes systematically wrong decisions (misrouting, incorrect load balancing, false fraud detection clearance)
- Mitigation: Implement input validation and anomaly detection on NWDAF training feeds; version-control AI models with rollback capability; use federated learning with differential privacy where sensitive data feeds into training pipelines
IoT Device Security Lifecycle (Y.4401)
Y.4401 defines the functional framework for IoT — including onboarding, identity provisioning, and decommissioning. Weak onboarding (default credentials, no device certificate) is the primary IoT attack vector.
- Attack: IoT devices deployed without individual device certificates use shared credentials → compromise of one device credential enables mass device impersonation or botnet recruitment
- Mitigation: Enforce PKI-based device identity per Y.4401 §8.3; require unique per-device credentials; implement device lifecycle management (onboard → operate → decommission) with audit trail
graph LR
Y3101[Y.3101 IMT-2020 Requirements] -->|Realized by| TS33501[3GPP TS 33.501]
Y3111[Y.3111 Network Slicing] -->|Slice Isolation| SliceSec[Slice Security Context]
Y3172[Y.3172 AI/ML Framework] -->|NWDAF| NWDAF[Analytics Security]
Y4401[Y.4401 IoT Framework] -->|Device Lifecycle| IoTSec[IoT Identity & Onboarding]
TS33501 --> AKA[5G-AKA / SUCI]
TS33501 --> SEPP[SEPP / N32]
SliceSec --> NSAC[NSAC / Slice-aware FW]
Operational Audit
- Y.4401 IoT Security Audit Checklist: Device lifecycle and functional security checklist for IoT deployments under Y.4401.
Generation-Specific Bridges
- 3GPP Rel-15: 5G Security Baseline: Y.3101 requirements → TS 33.501 implementation for initial 5G deployment
- 3GPP Rel-18: 5G Advanced: Y.3172 NWDAF AI/ML security evolution in 5G-Advanced
- 3GPP Rel-19: 6G Candidate: Y.3101 successor requirements for IMT-2030 (6G)
!NOTE This series is part of the master Series Tracker.