Definition
Security Architecture is an end-to-end security protection system for mobile communication networks, defined by standards such as 3GPP TS 33.501, covering access security, network domain security, user domain security, application domain security, and configurability (NEA/NIA algorithm selection). The security architecture organically integrates authentication, air interface encryption, integrity protection, key management, privacy protection, forming a defense in depth to meet compliance requirements such as GDPR and MLPS (Multi-Level Protection Scheme).
Security Layers and Protection Domains
- Access Stratum: bidirectional authentication between UE and gNB/eNB (5G AKA, EAP-AKA'), user plane and signaling plane encryption (NEA0/128/256), integrity protection (NIA0/128/256), preventing air interface eavesdropping and tampering
- Network Domain: IPSec, TLS, Diameter/HTTP/2 signaling protection between network elements, SEG security gateway isolation, preventing man-in-the-middle attacks and signaling forgery
- User Domain: USIM secure storage, terminal secure boot, TEE/SE isolated sensitive data, preventing terminal-side key leakage
- Application Domain: Business layer encryption, API authentication, VPN tunnels, firewall policies, ensuring business data and user privacy
Key hierarchy and derivation
The security architecture adopts layered key derivation: the root key K is derived from the authentication process, and then successively derives KgNB, KRRCenc, KRRCint, KUPenc, etc., achieving key isolation and forward security. Keys are updated periodically (such as during handover or periodic updates) to reduce the risk of long-term key exposure. 5G introduces SUCI (Subscription Concealed Identifier) in place of IMSI plaintext transmission to enhance privacy protection.
Typical Use Cases
The security architecture runs through the entire lifecycle of the cellular network: terminal access authentication, air interface data encryption, core network signaling protection, IoT device secure access, enterprise private network and public network isolation, etc. In IoT scenarios, the security architecture also needs to consider the computational constraints of low-power terminals, supporting lightweight algorithms and simplified authentication processes (such as EAP-TLS pre-shared keys in 5G IoT).
When SimtoLink's IoT SIM cards access mobile carrier networks, the entire process is protected by a security architecture: the terminal completes network authentication through an authentication protocol, air interface encryption ensures the confidentiality of data over the wireless link, and the core network and platform side use TLS and IPSec MLPS (Multi-Level Protection Scheme) for secure backhaul. When selecting IoT solutions for customers, SimtoLink pays attention to the security level of the carrier network, whether remote eSIM configuration and secure key storage are supported, ensuring compliance and data security of IoT devices in sensitive scenarios such as industrial and financial environments.