Tactical Mapping: itu-t Y.3101 (5G IMT-2020 Core Security)

🏗️ 1. Service-Based Architecture (SBA) Security

The SBA is the foundational architecture of the 5G Core (5GC). It uses HTTP/2 with JSON over TLS for inter-NF (Network Function) communication.

🛡️ NRF Security (Network Repository Function)

• Mandate: NRF is the "Source of Truth" for NF discovery.
• Vulnerability: Rogue NF registration (Shadow NF).
• Tactical Response: Enforce Mutual TLS (mTLS) with internal PKI for all NFs.
• Y.3101 Alignment: Functional requirements for authentication and authorization (Clause 8.1.1).

🛡️ SEPP (Security Edge Protection Proxy)

• Mandate: All roaming signaling (N32 interface) must pass through a SEPP.
• Vulnerability: Insecure PLMN-to-PLMN roaming (SS7-style attacks on HTTP/2).
• Tactical Response: PRTLS (PRotocol-level TLS) with JSON-level integrity protection.
• Y.3101 Alignment: Inter-provider security requirements.

📡 2. Network Slicing & Isolation (Slice Security)

Slicing allows for logically separated networks on shared infrastructure.

🛡️ Slice Isolation Guardrails

• Vector: Traffic from a "Basic IoT" slice leaking into a "Critical Infrastructure" slice.
• Tactical Response: Hardened network separation at the UPF (User Plane Function) using VLAN/VXLAN tagging and dedicated hardware resources where necessary.
• Y.3101 Alignment: Isolation and resource management (Clause 8.3.1).

⚙️ 3. Control and User Plane Separation (CUPS)

Y.3101 emphasizes the separation of control (Signaling) and user plane (Payload) to improve scalability and security.

🛡️ PFCP Security (Packet Forwarding Control Protocol)

• Mandate: The N4 interface between SMF (Session Management Function) and UPF must be secured.
• Vulnerability: Redirecting user traffic to a rogue destination via a malicious PFCP message.
• Tactical Response: Use IPsec or DTLS for the N4 interface as per Y.3101 security mandates.

🧪 Operational Audit Reference

Use the Y.3101 5G Core Security Audit to verify these core functions in your 5G SA (Standalone) deployment.

Generated by TelcoSec-ITU-Navigator Logic Engine.