MVNO Security

A Mobile Virtual Network Operator (MVNO) is a carrier that sells mobile service to subscribers without owning the radio access network. MVNOs rely on a host Mobile Network Operator (MNO) for radio and, depending on the model (Full MVNO, Light MVNO, MVNE-hosted, reseller), for part or all of the core network. That split creates a security model that is materially different from a vertically integrated operator: identity, signaling, and lawful-interception responsibilities sit on different sides of a commercial boundary, and every attacker path crosses at least one contractual interface.

This hub aggregates everything the Ultimate Guide covers on MVNO security: the trust boundary between the MVNO core (HLR/HSS for a Full MVNO, or host-provided identity for lighter models), the roaming and interconnect exposure MVNOs inherit through the host, SS7 and Diameter risks that manifest specifically at MVNO-scale traffic patterns, IMSI-privacy considerations for MVNOs operating across multiple host networks, and the regulatory posture MVNOs must maintain under NIS2, national telecom regulators, and GSMA scheme participation.

The MVNO model does not reduce the attack surface — it redistributes it. A Light MVNO inherits the host's signaling exposure without owning the controls that would mitigate it; a Full MVNO owns its HLR/HSS and therefore owns the SS7/Diameter attack surface directly. The chapters and FAQs below map to both models.

Frequently asked questions about mvno security

How should an MVNO scope its own security responsibilities vs. the host MNO?

The split depends on the MVNO model. A Full MVNO owns its HLR/HSS and therefore owns the SS7/Diameter attack surface directly, plus subscriber-data protection and lawful interception on its own subscribers. A Light MVNO or reseller inherits the host's signaling exposure but retains responsibility for BSS/OSS, IT-side data protection, KYC and fraud controls on its customer base. Both models require contractual clarity on incident reporting, LI, GDPR/NIS2 accountability and vulnerability remediation SLAs with the host — captured in the MVNO/MNO wholesale agreement.

How do MVNOs handle security differently from MNOs?

MVNOs (Mobile Virtual Network Operators) lease radio and core infrastructure from host MNOs, which means they depend on the MNO's signaling security, RAN encryption, and physical infrastructure protection. MVNOs typically control their own BSS, subscriber management, and sometimes their own core elements (full MVNO). Security responsibility is split by contract, and MVNOs must verify that the host MNO's signaling firewall and roaming protections adequately cover their subscribers.

What is the Home Subscriber Server (HSS) and why is it a high-value target?

The HSS stores subscriber authentication vectors (Ki, OPc), subscription profiles, and location data for every subscriber on the network. Compromising the HSS would allow an attacker to clone SIM credentials, track any subscriber, or impersonate the network. It is one of the most security-critical nodes and is typically placed in highly protected network zones.

What is an IMSI catcher and how does it work?

An IMSI catcher (also called a "Stingray" or fake base station) impersonates a legitimate cell tower to force nearby mobile devices to connect to it. Once connected, the attacker can capture the device's IMSI/IMEI, intercept unencrypted communications, perform man-in-the-middle attacks, and track the device's physical location. 5G's SUCI mechanism partially mitigates this by concealing the permanent identifier.

What are roaming attacks and why are they difficult to prevent?

Roaming attacks exploit the interconnect signaling between operators (SS7, Diameter, GTP) to perform location tracking, call/SMS interception, and fraud while the attacker operates from a remote network. They are difficult to prevent because roaming requires operators to accept certain signaling messages from partner networks, and legitimate roaming traffic can be hard to distinguish from malicious queries.

What is GSMA FS.19 for Diameter roaming security?

GSMA FS.19 is the Diameter Interconnect Security recommendations document, structurally analogous to FS.11 for SS7. It defines category-based filtering for Diameter roaming and interconnect messages (S6a, S9, S6d, S13, Rx) covering subscriber tracking, information disclosure, denial of service, and fraud/interception scenarios. Diameter firewalls at the DEA (Diameter Edge Agent) implement these categories at the LTE/4G roaming boundary.

What is home-routed vs local-breakout roaming and what are the security implications?

In home-routed roaming, subscriber data traffic is tunneled back to the home operator's packet gateway (P-GW/UPF) even when the subscriber is abroad, which preserves lawful-intercept in the home country and centralizes policy control but adds latency. In local-breakout, the visited network breaks the data session out locally, reducing latency but exposing user traffic to visited-network policies and lawful-intercept. The security trade-offs cover interception exposure, DPI visibility, IP identity leakage, and the differing FS.11/FS.19 controls each model requires.

What are the SEPP requirements for 5G roaming under 3GPP Release 16+?

Under 3GPP TS 33.501 the SEPP is mandatory for inter-PLMN N32 signaling: mutual TLS on N32-c for the negotiation of security capabilities, and either TLS or PRINS on N32-f for the actual JSON-based service traffic. When IPX providers must modify messages, PRINS is required so that sensitive IEs (SUPI, location, keys) are JWE-encrypted end-to-end while non-sensitive IEs remain modifiable under a signed patch. OAuth 2.0 tokens issued by the home NRF authorize NF-to-NF calls across the boundary.

What is the ROI of deploying a roaming/signaling firewall for a mid-size MNO?

Direct ROI usually comes from three streams: (1) fraud reduction — blocking SS7 SMS/USSD abuse, MAP AnyTime-Interrogation location scraping, and IRSF pumping typically pays back the platform within 12–18 months for a national operator; (2) regulatory posture — NIS2, national telecom regulators and GSMA scheme participation increasingly require FS.11/FS.19/FS.20 controls; (3) subscriber-trust events avoided (SIM-swap-adjacent attacks, mass location exposure). ROI is best measured against a baseline signaling anomaly count captured in a 30-day pre-deployment monitoring window.

How does BGP RPKI protect an operator's roaming infrastructure?

Publishing Route Origin Authorizations (ROAs) for the IPX/GRX prefixes hosting SEPP, DEA and NEF endpoints, and enabling RPKI Origin Validation on the border routers, blocks accidental and malicious BGP hijacks of those prefixes. An attacker who cannot hijack the path cannot MITM the N32 or S8 flow at the IP layer, even if the application-layer controls (TLS/PRINS/IPsec) are strong. RPKI is a low-effort, high-leverage control that most Tier-1 IPX carriers now require or strongly encourage.

See all telecom security FAQs

Related glossary terms

Browse the full telecom security glossary

More on Mvno Security

Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.