IP Security

IPsec is the IETF protocol suite (RFCs 4301-4309 and 7296) that provides authentication, integrity, and encryption at the IP layer. It supports two modes: transport mode for end-to-end protection of payloads and tunnel mode for site-to-site VPNs. In mobile networks, IPsec is mandatory for backhaul protection between eNB/gNB and the security gateway, for S1/N3 traffic, and is widely used to protect Diameter and GTP between roaming partners. IKEv2 handles key exchange, with strong cipher suites (AES-GCM, SHA-2, ECDHE) recommended.

Categories: Radio Access NetworkCore NetworkSignaling

IPsec in context

The radio access network is the layer where mobile devices attach to the operator's infrastructure. Attacks in this layer include IMSI catching, rogue base stations, downgrade attacks and jamming, and defenses hinge on mutual authentication, integrity-protected signaling and Open RAN supply-chain hygiene.

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

To place IPsec in the wider telecom-security picture, review IMS-AKA, Diameter, LTE, User Plane Security, S1AP and RANAP.

Related terms

Related topic hubs

  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • Diameter Security 4G/LTE Diameter threats across IPX/roaming and DEA defenses.
  • GTP Security GTP-C/GTP-U threats across S5/S8, N3/N9 and GRX/IPX borders under GSMA FS.20.
  • Diameter Firewall GSMA FS.19 screening at the Diameter Edge Agent on S6a/S9/S13.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.