End-to-access edge security

Description

End-to-access edge security is a 3GPP security architecture concept defined primarily for IMS-based media services. It refers to the protection of media that extends between an IMS User Equipment (UE) and the first IMS core network node in the media path, without being terminated by any intermediary node. This means that the security association is established directly between the UE and the edge of the IMS core network, typically the P-CSCF or a media gateway acting as the security endpoint. The protection covers both confidentiality and integrity of the media streams, and it is designed to prevent eavesdropping or tampering on the access network segment.

The architecture is specified in 3GPP TS 33.328, which defines the security mechanisms for IMS media plane, and related specifications such as TS 23.334 (IMS Application Level Gateway) and TS 29.334 (I1 interface). The concept relies on the establishment of security keys and algorithms negotiated during session setup, often using protocols like SRTP (Secure Real-time Transport Protocol) or IPsec. The UE and the first IMS core node perform mutual authentication and key agreement, and then apply encryption and integrity protection to the media packets. Because the protection is terminated at the first core node, any intermediate nodes (e.g., proxies, border gateways) cannot decrypt or modify the media, which enhances privacy and trust.

In practice, end-to-access edge security is used in VoLTE (Voice over LTE) and VoNR (Voice over New Radio) deployments to secure the media path from the handset to the IMS core. It complements other security layers such as end-to-end security (between two UEs) and hop-by-hop security. The first IMS core node in the media path is typically the P-CSCF for SIP signalling, but for media it could be an IMS-AGW (Access Gateway) or a Media Resource Function (MRF). The security association is often established using the IMS AKA (Authentication and Key Agreement) procedure, which generates session keys that are then used for media protection.

The key components involved include the UE, the P-CSCF, the IMS-AGW, and the key management functions. The UE must support the required security protocols and algorithms, and the network must be configured to enforce the protection. The security policy is negotiated during session initiation, and if the UE or network does not support the required security, the session may be rejected or fall back to unsecured mode depending on operator policy. The specifications also define the interfaces and procedures for key distribution and security mode negotiation.

End-to-access edge security is important because it protects the most vulnerable part of the media path—the radio access and backhaul—from eavesdropping and man-in-the-middle attacks. It also ensures that the media is not exposed to untrusted intermediate nodes. This is particularly relevant for regulatory compliance and user privacy. The concept has been stable across releases from Rel-9 to Rel-19, with no significant changes to the definition, indicating a mature and well-understood security mechanism.

Purpose & Motivation

End-to-access edge security was created to address the need for protecting IMS media streams over the access network, where the risk of eavesdropping and tampering is highest. Before its introduction, media could be sent in clear text over the radio and backhaul, exposing user conversations to potential interception. While end-to-end security between UEs provides the strongest protection, it is not always feasible due to interoperability, lawful interception, or transcoding requirements. End-to-access edge security offers a balanced approach: it secures the media from the UE to the first trusted core network node, ensuring that the access leg is protected while allowing the core network to perform necessary functions such as transcoding or lawful interception under strict controls.

The motivation also stems from the need to comply with regulatory requirements for privacy and to prevent fraud. In many jurisdictions, operators are required to protect user communications over the access network. End-to-access edge security provides a standardized way to achieve this without requiring end-to-end encryption, which could hinder lawful interception. It also allows the network to apply quality-of-service policies and media adaptation based on the content, which would be impossible if the media were encrypted end-to-end.

Historically, the concept was introduced in 3GPP Release 9 as part of the IMS media plane security enhancements. It built upon earlier work on IMS security (e.g., TS 33.203 for SIP signalling) and extended protection to the media plane. The specifications TS 33.328 and TS 23.334 define the architecture and procedures. Since then, the definition has remained unchanged, indicating that the fundamental approach has been stable and continues to be relevant in modern networks including 5G.