Application Layer Security

Description

Application Layer Security (ALS) is a security mechanism defined in 3GPP specifications to protect HTTP messages exchanged between Network Functions (NFs) in different Public Land Mobile Networks (PLMNs). It operates on the N32-f interface, which connects the Security Edge Protection Proxies (SEPPs) of two PLMNs. The N32-f interface is used for inter-PLMN signaling in 5G roaming, carrying messages between NFs such as the Session Management Function (SMF), Policy Control Function (PCF), and Network Repository Function (NRF). ALS provides protection at the application layer, meaning it secures the HTTP messages themselves, independent of the transport layer security (TLS) that may also be applied. This ensures end-to-end security between the communicating NFs, even if the transport layer is terminated at the SEPPs.

In the 5G Service-Based Architecture (SBA), NFs communicate using HTTP/2 over the N32-f interface. The SEPPs act as intermediaries, forwarding messages between PLMNs. Without ALS, the SEPPs would have access to the message content, which could be a privacy concern. ALS encrypts and integrity-protects the HTTP payload, so only the originating and destination NFs can read or modify the message. The SEPPs can still perform necessary functions like routing and policy enforcement based on the message metadata, but they cannot access the protected content. This is achieved through the use of JSON Web Encryption (JWE) and JSON Web Signature (JWS) as defined in IETF RFC 7516 and 7515. The sending NF applies ALS to the HTTP message, and the receiving NF verifies and decrypts it. The SEPPs may add their own security headers but cannot alter the protected parts.

ALS is part of the broader security framework for inter-PLMN communication, which also includes transport layer security (TLS) and SEPP-level security. The 3GPP specifications TS 33.501 and TS 33.828 define the procedures for ALS. The mechanism involves the exchange of security keys between the SEPPs or between the NFs. In practice, the NFs may use the SEPP as a key distribution point or may establish keys directly. The ALS protection is applied to the HTTP message body and selected headers. The SEPPs can also perform message filtering and validation to prevent attacks. ALS ensures that even if a SEPP is compromised, the confidentiality and integrity of the NF-to-NF communication are maintained.

The evolution of ALS reflects the changing security requirements in mobile networks. In earlier releases (Rel-8 to Rel-11), application layer security was defined more generically as security applied on payload data, independent of the transport mechanism. This definition was used in the context of IMS and other services. With the introduction of 5G and the SBA, the definition was refined in Release 16 to specifically address the protection of HTTP messages on the N32-f interface. This change reflects the shift from traditional telecom protocols to web-based protocols in 5G. The new definition emphasizes the role of SEPPs and the N32-f interface, which are unique to 5G roaming. The generic concept of protecting payload data remains, but the application is now tightly integrated with the 5G core network architecture.

In summary, Application Layer Security is a critical component of 5G inter-PLMN security. It provides end-to-end protection for NF-to-NF communication, enabling secure roaming and service delivery across different operators. By securing the application layer, it complements transport layer security and ensures that sensitive signaling information is not exposed to intermediaries. As 5G networks evolve, ALS will continue to adapt to new threats and architectural changes, such as network slicing and edge computing.

Purpose & Motivation

Application Layer Security exists to address the security challenges of inter-PLMN communication in 5G networks. In earlier generations, inter-PLMN signaling was often protected by dedicated protocols like SS7 or Diameter with their own security mechanisms. With 5G adopting HTTP/2-based Service-Based Architecture, new security mechanisms were needed to protect HTTP messages between NFs in different PLMNs. The N32-f interface, which connects SEPPs, is a potential point of attack or privacy leakage. ALS ensures that the content of the messages is protected end-to-end, so even the SEPPs cannot read or modify it. This is crucial for maintaining subscriber privacy and network integrity. The motivation for ALS also includes the need to support flexible security policies, such as allowing SEPPs to perform mediation while ensuring that the core message remains confidential. The generic definition from earlier releases was too broad and did not address the specific architecture of 5G. The refined definition in Release 16 provides clear guidance for implementing ALS in the 5G SBA, enabling secure and interoperable roaming between operators.