VoLTE & VoNR Security
Voice over LTE (VoLTE) and Voice over New Radio (VoNR) deliver mobile voice as a packet-switched IMS service. The signaling plane is SIP over Diameter-authenticated IMS registration; the media plane is RTP, optionally SRTP. Every mobile operator that has shut down its 2G/3G circuit-switched voice runs its subscribers' calls through this stack, which means the IMS core is now first-class critical infrastructure and its attack surface is a first-class operator concern.
This hub aggregates everything the Ultimate Guide covers on VoLTE/VoNR security: the IMS architecture (P-CSCF at the edge, I-CSCF for interrogation, S-CSCF as the serving proxy, HSS as the identity anchor), the SIP-specific attack surface (registration hijack, INVITE fuzzing, header injection, identity spoofing, SIP torture cases, transport downgrade), the Diameter interfaces that bind IMS to the mobility core (Cx/Dx to HSS, Sh to AS, Rx to PCRF), the media-plane options (RTP vs SRTP, SDES vs DTLS-SRTP), IMS-AKA authentication and its interaction with EPS-AKA, and the migration considerations from VoLTE (IMS over EPC) to VoNR (IMS over 5GC).
VoLTE/VoNR sits at the intersection of SIP, Diameter, and radio-side security. A hardened IMS core still fails if the SBC leaks internal topology in Via headers, if the Cx interface is exposed to a compromised HSS peer, or if lawful-intercept segregation between HPLMN and VPLMN is not correctly wired. The chapters and FAQs below cover the full stack.
Frequently asked questions about volte & vonr security
How does VoLTE differ from VoNR from a security perspective?
VoLTE carries voice over the LTE packet core using IMS with Diameter Cx/Sh/Rx and SIP signaling, secured by IMS-AKA, IPsec on Gm, and SRTP on the media plane. VoNR carries voice over 5G New Radio using the same IMS core but reached via the 5G service-based architecture and N32/SEPP for roaming. VoNR inherits IMS-layer security largely unchanged while gaining 5G radio and core protections (SUCI, 256-bit keys, SBA TLS). SIP-layer risks — registration hijack, INVITE fuzzing, toll fraud — apply to both.
How is P-CSCF discovered by a VoLTE UE?
A VoLTE UE discovers its P-CSCF via one of three mechanisms (3GPP TS 23.228, TS 29.061): DHCPv4/DHCPv6 options (RFC 3319/3361/3646), Protocol Configuration Options (PCO) delivered in the EPS attach/PDN Connectivity Request, or DNS NAPTR/SRV lookup on the home domain. In practice PCO is the mainstream path in commercial VoLTE deployments; DNS is used mainly for IMS interworking and enterprise SIP trunks.
What is IMS-AKA and how is it different from 5G-AKA?
IMS-AKA is the authentication and key agreement procedure used between an IMS subscriber (UE) and the IMS core (S-CSCF via I-CSCF), based on a separate IMS identity (IMPI/IMPU) and the ISIM application on the SIM card. It reuses the AKA challenge-response mechanism from 3G but at the IMS layer, and derives keys used for IPsec on the Gm interface. 5G-AKA operates at the access layer between the UE and the AMF/AUSF and secures the primary network attach. Both can run for the same subscriber: 5G-AKA for network access, IMS-AKA for VoLTE/VoNR service.
How does SIP relate to mobile network security?
SIP (Session Initiation Protocol) is used for VoLTE and VoNR voice call signaling over IP. While SIP supports TLS for transport security, implementations often rely on the underlying network's security. Vulnerabilities include SIP message spoofing, toll fraud, caller-ID manipulation, and denial-of-service through SIP flooding attacks.
Is VoLTE traffic encrypted end-to-end?
No. VoLTE is encrypted hop-by-hop, not end-to-end. The Gm reference point between the UE and P-CSCF is protected by IPsec ESP (IMS-AKA), and media between the UE and access gateway is optionally SRTP; but signaling and media inside the operator core, between IMS and the interconnect, and across the peer network are handled in cleartext or under separate transport security. Lawful interception assumes exactly this model. Fully end-to-end encrypted voice requires OTT applications on top of the mobile data channel.
What is an IMSI catcher and how does it work?
An IMSI catcher (also called a "Stingray" or fake base station) impersonates a legitimate cell tower to force nearby mobile devices to connect to it. Once connected, the attacker can capture the device's IMSI/IMEI, intercept unencrypted communications, perform man-in-the-middle attacks, and track the device's physical location. 5G's SUCI mechanism partially mitigates this by concealing the permanent identifier.
Related glossary terms
- IMS IP Multimedia Subsystem
- RTP Real-time Transport Protocol
- VoIP Voice over IP
- VoLTE Voice over LTE
- VoNR Voice over New Radio
- IMS-AKA IMS Authentication and Key Agreement
- I-CSCF Interrogating Call Session Control Function
- MTSI Multimedia Telephony Service for IMS
- P-CSCF Discovery Proxy-CSCF Discovery
- CSCF Call Session Control Function
Related comparisons
More on Volte Security
Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.