Tracking Area Update (TAU) Security
The Tracking Area Update (TAU) is the LTE EPS mobility procedure a UE uses to tell the network it has moved into a new Tracking Area, that its periodic TAU timer expired, or that its combined EPS/IMSI attach state needs refreshing. It is defined in 3GPP TS 23.401 and the EMM signaling in TS 24.301, and it carries directly into the 5G Registration procedure (TS 23.501 / TS 24.501), the variants (initial, periodic, combined TA/LA, and registration update) and the security questions translate across both generations.
This hub aggregates Ultimate Guide coverage of the TAU signaling flow between the UE, source/target MME (or AMF in 5G) and HSS/UDM over S1-MME, S10, Diameter S6a and 5G SBI; the location-privacy exposure created by GUTI / 5G-GUTI reallocation and IMSI fallback; the integrity-protection gaps abused via inter-MME TAU and TAI-spoofing attacks at the Diameter Edge Agent or SEPP boundary; and the operator-side controls (Diameter edge agents, GTP firewalls, SEPP/PRINS in 5G SBA) that contain TAU-class abuse on a live network. See also the related Routing Area Update (RAU) hub for the GPRS predecessor.
In-depth chapters
- Core Components and Functions of Mobile NetworksNetwork functions and their security implications from 2G through 5G standalone.
Frequently asked questions about tracking area update (tau) security
What is the NAS protocol in LTE/5G?
The Non-Access Stratum (NAS) protocol handles signaling between the UE and the core network for session management, authentication (EPS-AKA/5G-AKA), and mobility. NAS messages can be integrity-protected and encrypted. Security vulnerabilities arise when null ciphering is allowed or when pre-authentication messages are exploited for device fingerprinting or denial-of-service.
How does 5G-AKA differ from EPS-AKA in LTE?
5G-AKA enhances EPS-AKA with home-network verification of authentication results, SUPI concealment via SUCI, support for 256-bit key derivation, and binding of the serving network name into the authentication process. These changes prevent certain impersonation attacks and add an extra layer of home-network control over roaming authentication.
What is the Evolved Packet Core (EPC) in LTE?
The EPC is the core network architecture for 4G/LTE, comprising the MME (Mobility Management Entity) for signaling, the S-GW (Serving Gateway) for user-plane routing, the P-GW (PDN Gateway) for external connectivity, and the HSS (Home Subscriber Server) for authentication data. All control-plane traffic between these nodes is protected by IPsec tunnels in compliant deployments.
How does 5G handle integrity protection on the user plane?
5G mandates that devices and gNodeBs support user-plane integrity protection (UP IP) as defined in 3GPP TS 33.501, but activation is not required in all scenarios—operators may disable it for high-throughput data sessions due to processing overhead. For low-bandwidth, high-security use cases (e.g., IoT command-and-control), UP IP is strongly recommended. This is a significant improvement over LTE, where UP IP was neither mandatory to support nor commonly deployed.
What is IMS-AKA and how is it different from 5G-AKA?
IMS-AKA is the authentication and key agreement procedure used between an IMS subscriber (UE) and the IMS core (S-CSCF via I-CSCF), based on a separate IMS identity (IMPI/IMPU) and the ISIM application on the SIM card. It reuses the AKA challenge-response mechanism from 3G but at the IMS layer, and derives keys used for IPsec on the Gm interface. 5G-AKA operates at the access layer between the UE and the AMF/AUSF and secures the primary network attach. Both can run for the same subscriber: 5G-AKA for network access, IMS-AKA for VoLTE/VoNR service.
Are commercial IMSI catcher detection apps reliable?
Mixed. Apps that rely only on unprivileged Android APIs can flag some GSM-era anomalies (unexpected LAC changes, missing neighbor cells, weak ciphering indicators) but cannot inspect the LTE/5G radio stack in depth and often produce false positives. Reliable detection today combines dedicated SDR-based probes, network-side anomaly detection on the RAN and core (unexpected paging, TAU/RAU patterns), and passive sensor networks. Consumer apps are useful as awareness tools but not a substitute for operator-side detection.
How has mobile network security evolved from 2G to 5G?
Security has progressed from the weak, one-way authentication of 2G (GSM) to mutual authentication and stronger encryption in 3G (UMTS), then to EPS-AKA and IPsec-protected backhaul in 4G (LTE). 5G introduces SUPI/SUCI privacy, 256-bit keys, service-based architecture with TLS, and network slicing isolation—each generation addressing the shortcomings of its predecessor.
What is the Security Edge Protection Proxy (SEPP) in 5G?
The SEPP is a mandatory 5G network function that sits at the operator's roaming boundary, replacing the unsecured SS7/Diameter interconnect model. It provides end-to-end message-level security (via JOSE/JWE) and transport-layer protection (TLS 1.3) for all inter-operator signaling, enforcing topology hiding and message filtering at the roaming edge.
What is 5G standalone (SA) vs. non-standalone (NSA) and which is more secure?
5G NSA uses a 5G radio layer anchored to a 4G LTE core, inheriting LTE's security properties and limitations. 5G SA deploys the full 5G core (5GC), enabling native 5G security features like SUCI, SEPP, SBA with TLS, and network slicing. SA is significantly more secure because it eliminates the 4G trust-model dependencies and enables end-to-end 5G security controls.
How do you assess the security of a 5G core network?
Assessing a 5G core involves testing the SBA interfaces (HTTP/2 APIs) for injection and authorization flaws, evaluating NRF access controls and OAuth 2.0 token validation, testing SEPP configuration and inter-PLMN security, verifying slice isolation, and auditing the container/cloud infrastructure hosting the network functions. Each 5G-specific function (AMF, SMF, UPF, etc.) has unique security test cases.
How does VoLTE differ from VoNR from a security perspective?
VoLTE carries voice over the LTE packet core using IMS with Diameter Cx/Sh/Rx and SIP signaling, secured by IMS-AKA, IPsec on Gm, and SRTP on the media plane. VoNR carries voice over 5G New Radio using the same IMS core but reached via the 5G service-based architecture and N32/SEPP for roaming. VoNR inherits IMS-layer security largely unchanged while gaining 5G radio and core protections (SUCI, 256-bit keys, SBA TLS). SIP-layer risks — registration hijack, INVITE fuzzing, toll fraud — apply to both.
What are the top security risks in a private 5G deployment?
Enterprise/private 5G (SNPN/PNI-NPN under 3GPP TS 23.501) inherits the standard 5G threat model plus enterprise-specific risks: weak site-to-site connectivity between distributed UPFs, misconfigured slice isolation, exposed OAM/O1 interfaces on the RAN, use of test/default SUCI provisioning, and unpatched containerized NFs on shared enterprise Kubernetes. GSMA PN.01 and ENISA "5G for Verticals" describe the baseline hardening; add strict OT/IT segmentation and per-slice policy on the AMF/SMF.
Related glossary terms
More on Tracking Area Update
Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.