@@anandr.prasad26 Thanks for your prompt response.Yes it's related to the fact that when emergency session is in place, UE sends the SUPI as it's not mandatory to send SUCI in this scenario, and this represents a security risk.
@@Anasovitchcisco Simple response to your question is “no”. You are welcome to bring enhancement through to 3GPP SA3. As background see details below. Couple of points (1) 3GPP defines specifications (not standards) that should be applicable around the globe thus also various commercial and regulatory considerations (2) Emergency call should be possible, depending on regulation, even without a SIM and (3) privacy is an optional feature. If regulations require only authenticated emergency calls and either operator or regulations require privacy to be enabled then you will have SUCI in every case. Otherwise, so as to support someone in emergency, you have to allow unauthenticated emergency calls even without a SUCI.
@@anandr.prasad26 Thanks a lot for your response. Indeed it depends on each operator's strategy and implementation. However from security perspective, it still represents a threat. It could be interesting to implement ephemeral identity in the EC uses case, and this could be food for thought. Thank you!
Excellent presentation/summary of 5G Security. One more thing you could add is about the security risk exposure of the 5G VNF Orchestration tools like Kubernetes that are used for all practical deployments of 5G Networks. I meant the vulnerabilities of the VNFs across all the 5G network elements (in vRAN , vMEC and v5GCore VNFs)
Thanks! We completely agree with your comment, will take care of it in follow up webinar. You can find some information regarding NFV security in my RSA 2019 talk: th-cam.com/video/DeTASrRYalE/w-d-xo.html
Thanks for viewing! Feel free to comment or question. We at wenovator will do our best to respond.
Thanks Dr Ananad for this presentation. Any improvement of SUPI being sent on clear in emergency mode?
@@Anasovitchcisco Thanks. Is query regarding unauthenticated emergency session?
@@anandr.prasad26 Thanks for your prompt response.Yes it's related to the fact that when emergency session is in place, UE sends the SUPI as it's not mandatory to send SUCI in this scenario, and this represents a security risk.
@@Anasovitchcisco Simple response to your question is “no”. You are welcome to bring enhancement through to 3GPP SA3. As background see details below.
Couple of points (1) 3GPP defines specifications (not standards) that should be applicable around the globe thus also various commercial and regulatory considerations (2) Emergency call should be possible, depending on regulation, even without a SIM and (3) privacy is an optional feature.
If regulations require only authenticated emergency calls and either operator or regulations require privacy to be enabled then you will have SUCI in every case. Otherwise, so as to support someone in emergency, you have to allow unauthenticated emergency calls even without a SUCI.
@@anandr.prasad26 Thanks a lot for your response. Indeed it depends on each operator's strategy and implementation. However from security perspective, it still represents a threat. It could be interesting to implement ephemeral identity in the EC uses case, and this could be food for thought. Thank you!
Excellent presentation/summary of 5G Security. One more thing you could add is about the security risk exposure of the 5G VNF Orchestration tools like Kubernetes that are used for all practical deployments of 5G Networks. I meant the vulnerabilities of the VNFs across all the 5G network elements (in vRAN , vMEC and v5GCore VNFs)
Thanks! We completely agree with your comment, will take care of it in follow up webinar.
You can find some information regarding NFV security in my RSA 2019 talk: th-cam.com/video/DeTASrRYalE/w-d-xo.html
Excellent explanation about 5G security, much useful.
Thanks and much appreciated!
how did you do it can you share with me , thank you