Encapsulating Security Payload

Description

Encapsulating Security Payload (ESP) is a mandatory component of the IP Security (IPsec) protocol suite, extensively adopted within 3GPP specifications to secure IP-based traffic between network functions and user equipment. As defined by IETF RFC 4303 and referenced in 3GPP specs, ESP operates in either transport mode or tunnel mode. In transport mode, ESP protects the payload of an IP packet (e.g., TCP/UDP data) by inserting an ESP header between the original IP header and the payload; this mode is typically used for end-to-end security between hosts. In tunnel mode, ESP encapsulates the entire original IP packet (header and payload) within a new IP packet with an ESP header, creating a secure tunnel; this is commonly used for gateway-to-gateway security, such as securing the N3 interface between a gNB and the UPF in 5G. The ESP protocol provides several security services: confidentiality through encryption of the payload (using algorithms like AES-GCM), data integrity and origin authentication via an Integrity Check Value (ICV) computed over the ESP packet (excluding the IP header), and anti-replay protection through a sequence number. Its operation involves Security Associations (SAs) managed by Internet Key Exchange (IKE), which define the cryptographic algorithms, keys, and parameters for the secure session. Within 3GPP, ESP is mandated for protecting control plane and user plane traffic on many reference points, ensuring that signaling and data traversing untrusted networks (e.g., between a gNB and the 5G Core over a transport network) remain protected from eavesdropping and tampering.

Purpose & Motivation

ESP exists to provide a standardized, robust method for securing IP communications, which became critically important as 3GPP networks evolved from predominantly circuit-switched to all-IP architectures (starting with GPRS and IMS). The problem it solves is the inherent lack of security in the base IP protocol, which transmits data in clear text, vulnerable to interception, modification, and replay attacks. The creation and adoption of ESP within 3GPP were motivated by the need to protect sensitive user data and network signaling as traffic began to traverse public or shared transport networks (like backhaul links). Historically, earlier mobile generations had limited cryptographic protection confined to the radio interface; ESP extended this security end-to-end across the IP network. It addresses the limitations of previous, often proprietary, link-layer security solutions by providing a network-layer security standard that is interoperable, scalable, and independent of the underlying link technology. Its use in 3GPP enables secure network slicing, trusted interconnection between operators, and protection of NFs in a virtualized, cloud-native environment.