6GTRUSTWORTHINESS

CONSIDERATIONS

byNGMNAlliance

Version:1.0

Date:04.10.2023

DocumentType:FinalDeliverable(approved)

ConfidentialityClass:P-Public

Project:6GTrustworthinessConsiderations

Approvedby/Date:NGMNBoard,14September2023

ForPublicdocuments(P):

?2023NextGenerationMobileNetworksAlliancee.V.Allrightsreserved.Nopartofthisdocumentmaybereproducedortransmittedin

anyformorbyanymeanswithoutpriorwrittenpermissionfromNGMNAlliancee.V.

TheinformationcontainedinthisdocumentrepresentsthecurrentviewheldbyNGMNAlliancee.V.ontheissuesdiscussedasofthedate

ofpublication.Thisdocumentisprovided“asis”withnowarrantieswhatsoeverincludinganywarrantyofmerchantability,non-infringement,

orfitnessforanyparticularpurpose.Allliability(includingliabilityforinfringementofanypropertyrights)relatingtotheuseofinformation

inthisdocumentisdisclaimed.Nolicense,expressorimplied,toanyintellectualpropertyrightsaregrantedherein.Thisdocumentisdistri-

butedforinformationalpurposesonlyandissubjecttochangewithoutnotice.

2

EXECUTIVESUMMARY

Asthemobileindustrycontinuestolookatthenextgenerationofmobilenetworks,

NGMNAlliance(NGMN)isfirmlyestablishedasaleadingforcedrivingdiscussionson

thedevelopmentof5Gandemerging6Gusecases[1].Whileattentionisoftenfocused

onextendingexcitingapplicationssuchasimmersiveextendedreality(XR),digitaltwin,

interactingcobots,andtrustednativeAI,NGMNfirmlybelievesitisessentialtoestablish

theindisputabletrustworthinessofthe6Gnetwork.

Consideringthis,NGMNhasidentifiedseveraltechnologytrendsthatwillinfluence

thetrustworthinessofa6GnetworkincludingnetworkAI,opensource,virtualisation

andcontainerization,andquantumcomputingwhichmightbringnewsecuritythreats.

6Gnetworksmustthereforehaveaninherenttrustworthinessdesigntopromotethe

effectivenessofsecurityprotectionandenhancetheabilityofprivacyprotection,such

astrustedcomputingandblockchain.

Inthesubsequentsectionsofthispublication,wepullallthesetechnologytrendstoge-

ther,providingtheindustrywithcomprehensiveguidancetoensuretrustworthinessin

the6Gnetwork.Byembracingaholisticapproachtosecurityandprivacy,wecannot

onlyenabletherealisationoffuture6Gusecasesbutalsosafeguardtheinterestsand

trustofend-users.

3

01INTRODUCTION

Themobilenetworkisacriticalelementofbothsocietal?Reliability:Theabilityofthemobilenetworktodeli-

andindustrialdevelopment.6Gtelecommunicationsverstableandpredictableperformanceinexpected

systemdevelopmentshavealreadybegunintheindustryconditions.

withNGMNhavingidentifiedthat6Gneedstobedriven

bysocietalgoals,marketexpectationsandoperational?Resilience:Theabilityofthemobilenetworktowithstand

necessities.6Gwillenableandextendbothcurrent5Guseinstability,unexpectedconditions,andgracefullyreturn

casesaswellas6Genvisionedusescases[2].6Gmobiletopredictable,butpossiblydegraded,performance.

networkinfrastructuremustsupportcurrentandenvisio-

nedusecasesandbeabletoadapttonewtechnologies?Safety:Theabilityofthemobilenetworkstoensurethe

andberesilienttonewattackvectors.A6Gmobilenet-absenceofcatastrophicconsequencesonthelife,health,

workshouldbetrustedtodelivertheseusecasesacrossproperty,ordataofmobilenetworksstakeholdersand

severaltrustworthinessaspectsincludingsecurity,privacy,thephysicalenvironment.Notethatalthoughmobile

reliability,resilience,andsafety[3].networkshavedifferentmechanismstoprotectthe

dataintransmission,thereisstillnowaytoguarantee

Thetermof“trustworthiness”inthispublicationiscom-theauthenticityofthedataorigin.

posedofthefollowingfiveaspectsbyreferringtothe

NationalInstituteofStandardsandTechnology’s[NIST]Trustworthinessisrelatedtotheabilitytomitigatethe

definition[3]withminoradaptationstothemobilenetworks:securityrisksinthemobilenetwork.Eventhoughthe

abovefiveaspectsareconsideredinthedesignphaseof

?Security:Theabilityofthemobilenetworkstoensurethatthemobilenetwork,thetrustworthinessofthemobile

allitsinfrastructure,processes,mechanisms,protocolsnetworksystemismostlydependentonoperators’de-

andservices,physicalorcyber,areaffordedinternalorploymentimplementationandconfiguration.Whenthe

externalprotectionfromunintendedandunauthorisedfivedimensionsoftrustworthinessareapplied,acommon

access,change,damage,destruction,oruse.Securitypracticeshouldbefollowedtoensuretherobustnessof

usuallyconsistsofthefollowingthreefacets:themobilenetworkwhileatthesametime,consistent

monitoringandassessmentisalsorequiredtoenhance

?Confidentiality:Preservingauthorisedrestrictionsthetrustworthiness.

onaccessanddisclosureoftheinformationbeing

transferredbetweenparties.Thispublicationfurtheranalysesthekeydriversand

typicalusecasesinrelationto6Gtrustworthinessand

?Integrity:Guardingagainstimpropermodificationdeliversthe6Gsecurityrequirementscoveringtheaspects

ordestructionofinformationintransitandincludesofsecurity,reliability,privacy,resilienceandsafety.Sec-

ensuringnon-repudiationandauthenticity.tion2investigatesthekeydriversof6Gtrustworthiness

includingsocietal,networkevolution,servicedrivenand

?Availability:Ensuringtimelyandreliableaccesstosecuritytechnologydrivendemands.Section3details

anduseofthemobilenetwork.thespecificusecaseanalysiswithsecurityrisksand

requirementsanalysed,followedbyasummaryof6G

?Privacy:Theabilityofthemobilenetworktopreventtrustworthinessrequirementswithclassificationand

entities(people,machines)fromgainingaccesstoper-consolidationinSection4.NGMNprovidesguidanceto

sonaldatastoredin,createdby,ortransitingamobilethe6Gtechnologydesign,describedinSection5,inorder

networkoritscomponentssuchthatindividualsortofulfilthetrustworthinessneedsforthecustomersand

groupscanobscurethemselvesorinformationaboutMobileNetworkOperators(MNOs).

themselvesfromothers.Privacyisaconditionthat

resultsfromtheestablishmentandmaintenanceofa

collectionofmethodstosupportthemitigationofrisks

toindividualsarisingfromtheprocessingoftheirper-

sonalinformationwithinoramongsystemsorthrough

themanipulationofphysicalenvironments.

5

02KEYDRIVERSOF6G

TRUSTWORTHINESS

2.1SOCIETALDEMANDSnewnetworkfeature,willintegratewithcommunication

capabilitiestoachieveserviceintegration,whichwillde-

TheUnitedNationsSustainableDevelopmentGoals(UNmandagilesecuritymechanismnegotiationandultra-fi-

SDGs)haveidentifiedaccesstomobileconnectivityasane-grainedsecurityscheduling.Tocontinuouslyimprove

keydriverofsustainableeconomicgrowthandassociatedtheuserexperience,the6Gnetworkwillbecomemore

societaldevelopment.Publicsafetyanddataprivacypro-distributedandprovideuniqueservicescentredonusers.

tectionsarethefoundationofsocietaldevelopment.6GisThiswillrequireappropriateadaptationinthe6Gsecurity

envisagedtofurtherenhancepublicsafetyanddataprivacyarchitecture.Ascomputingpowerbecomesthenewdriver

whileenablingsocietaldevelopmentthroughusecasesofnetworkevolution,thecomputingcollaborationand

likesmartcity,intelligentinteractivesystems,intelligentintelligentconnectionwillbecomeinherentattributesof

medicaltreatment,smarttransportation,educationandthenetwork,withbuilt-insecurityanessentialfeature.

smartretail.Theseusecasesareimportantforboththe

developmentandgrowthoftheglobalsociety.Significant

exposureofprivacysystemsandheavyprocessingof2.3SERVICEDRIVENDEMANDS

userdataapplications(e.g.,industrialintelligentcontrol,Theextensivecoverage,connectivityandreliablenetwork

driverlessvehicles,virtualrealityandotherhigh-techcapabilityof6Gwillenableitscommunicationinfrastruc-

relatedindustries)willrequirefundamentalprotectionsturetodevelopfromtheInternetofEverything(IoE)tothe

bebuiltinto6G.Basically,thehighertheimpactofdataintelligentinternet.Itwillnotonlyprovidemorecoverage,

andcontrolsystemsexposure,themoreprotectionsbutalsomakethedigitalworldandthephysicalworld

andreliabilitythatneedstobebuiltin.Thismeans6Gdeeplyintegrated,people'sliveswillincreasinglyrelyon

trustworthinessrequirementsmustalignwithsocietalreliablenetworkoperation.Inthe6Gera,immersiveex-

demandinsecuringanindividual’sdailyactivitiesandperience,telepresence,multimodalinteraction,sensing

societalchallenges.andXRtechnologymaybecomemainstreamapplications.

Fromtheinterconnectionofallthingstointelligence,the

2.2NETWORKEVOLUTIONservicevalueofthe6Gnetworkinthefuturewillalsobe

enhanced,thiswillundoubtedlyhaveagreatimpacton

DEMANDSinterestdrivenattackers.Manyofthoseservicesrequire

The6Gnetworkisexpectedtoprovidecoverageinhard-to-highdata-rates,lowlatencyaswellasprecisepositioning

reachruralareas,andthismayincludenon-conventionalandsensing,servedbydifferentendpointsinthe6Gnet-

solutionssuchasnon-terrestrialhigh-altitude-platformswork,e.g.,intheedgeorinthecloud.Forcriticalservices

orsatellite-basedservicestodelivermobileservices.Thisastrictend-to-endisolationandprotectionofnetwork

convergencewillcreatemassivedataandresourceswhichslicesincludingtheRadioAccessNetwork(RAN)maybe

willincreasinglyrelyonreliablenetworkoperation.Furt-required.6Gisthereforerequiredtoprovidestronger

hermore,mitigationmustbeprovidedagainstvulnerabi-securityprotectioncapabilities.Atthesametime,due

litiesinthenetworkduetocomponentandfunctionalitytotheenhancedflexibilityanddynamicexpansionof

splitsintroducedbyvirtualisation.Sensingnetwork,asathenetwork,the6Gsecuritycapabilitiesarerequiredto

befine-grainedandflexibleondemand,toensurethe

dynamicadaptationofthenetwork,theuserdemands

andbusinessscenarios.

6

2.4SECURITYTECHNOLOGIES

DRIVENDEMANDS

Therapiddevelopmentofnewtechnologiesandnew

ideaswillbecomeoneofthekeydrivingforcesofsecurity

evolution.Securitytechnologyismovingforwardswith

morenativeintelligenceandflexibility.Thedevelopment

ofthesenewtechnologies/principleswillpromotethe

effectivenessofsecurityprotectionandenhancetheab-

ilityofprivacyprotection.Itisnecessarytoconsiderhow

tointroduceandapplythesenewtechnologiesin6Gto

improvethelevelofsecurityprotection,suchastrusted

computing,blockchain,zerotrust,etc.;Thedevelopment

ofsometechnologieswillbringsomechallengestothe

securityoftheexistingcommunicationsystem.Forexam-

ple,quantumcomputingtechnologybringsriskstothe

existingcryptosystem.Itisnecessarytoconsiderhowto

dealwiththeimpactofsuchnewtechnologies.AIandML

areexpectedtobeintegratedbydesigninthe6Garchi-

tecture,thoughthisbringsmorerisksandvulnerabilities

tothesystem,thesecanbeleveragedtoautomatedetec-

tionofnewthreats,anomaliesandcyberattacks.Further

AIcanassisttopredictthebreachriskofthedifferent

assetsandnetworkfunctionsinthesystem,considering

theindividualthreatexposuresothatcountermeasures

tomitigatevulnerabilitiescanbeplanned.Anotherappli-

cationofAIisendpointprotection,whereAIcandetect

novelmalwareandransomwarewheresignature-based

detectionmechanismswouldfail.

7

03USECASESANALYSIS

3.1ENHANCEDHUMAN?PrivacyanddataprotectioninMetaverse:InMe-

taverseanavatarrepresentingausercansmoothly

COMMUNICATIONtraversebetweendifferent“worlds”,allofwhichasa

Fromthesecurityperspective,XRimmersiveholographicwholecompriseaMetaverse.Agooddesignoffedera-

telepresenceandmultimodalcommunicationfortele-tionofauthenticationandidentityisexpectedtoallow

operationseemslikelytoattractmoresecurityattacksasmoothtraverseofanavatarbetween“worlds”.A

becauseofitscoexistencewithpotentialadversaryentitiesMobileNetworkOperator(MNO)thatoffersasystem

inanopenenvironmentanditsincreasedpointsofattacktoenterMetaverse,orotherbusinessentities,which

withdatafrommultiplesourcesandsensors.Thethreatsaresufficientlytrustedbyusers,maybeabletoassist

andrequirementsnon-exhaustivelyincludethefollowing:realisationofMetaverseinthisaspect.Ifauserisled

toamalicious“world“byafakeuserconsentfora

?Privacyofhumanbiometricdata:Ononehand,inXRprompt-lesstraversetothemalicious“world”,theuser

applicationsbiometrics-basedauthenticationismoremightbeexposedtomaliciousactivities.Userconsent

widelyused,suchasfingerprint,eyescan,facerecogni-needstobewellprotected,inparticularwithregardto

tionetc.Ontheotherhand,humancentricmultimodalintegrity.Anavataristobeuniqueandshouldnotbe

sensorydataincludinghuman’saudio,video,taste,odour,easilycopiedforusetorepresentsomeoneelse.Copy

hapticandemotioninformationcouldbetransferredandreuseofavatardataneedstobeprevented.When

inbulkintheoverallnetwork.Duetotheirrevocablegivingtheuser’sinformationtoany“world”,national

natureofhumanbiometricdata,itrepresentsaveryand/orregionalregulationanduser’sconsentneeds

importantprivacyissuetobetackledby6G.tobeconsidered.

?Protectionoftheinterfacebetweenthephysicaland3.2ENHANCEDMACHINE

virtualworld:XRimmersiveholographictelepresence

communicationenablesthedigitalrepresentationoftheCOMMUNICATION

physicalworldinavirtualnetwork(digitaltwinnetwork).Theenhancedmachinecommunicationcanbedescribed

Duetothedenseandreal-timeinteractionbetweenwithsomegenericusecasessuchasrobotnetworkfabric

thetwinnetworkandthephysicalnetwork,thevirtualwhereforexampleautonomousmobilerobots,drones,

twinnetworkitselfmayhavevariousunknownsecurityautomaticguidedvehicles(AGV)willbemovingthroughthe

vulnerabilities,andtheinteractioninterfacebetweenthesmartcityandprovideparceldeliveryservicesorservices

twowillbepotentiallyvulnerabletoexternalattacks,forpersonaluse.Theserobotscommunicatewithboth

resultinginthevirtualtwinnetworkgivingwronginst-the6Gnetworkandeachotherandthecommunication

ructionstothephysicalnetwork,threateningthedevicerequiresahighreliabilityandlowlatencytoavoidcollisi-

security,networksecurityandbusinesssecurityintheons.Toavoidaccidentsanddamagetohumans,robotsas

physicalnetwork.Technologiestoensurethesecuritywellastheircommunicationsmustbesecuredtoprotect

ofthetwinnetworkitselfanditsinteractionwiththeagainsthijackingandmalevolentmanipulation.Sincethe

physicalnetworkarethereforesignificant.robotsmoveautonomouslyandrelyontheinformation

receivedfromthenetworktotakedecisions,theintegrity

?Preventionofdevicecompromise:Enhancedhumanoftherelevantdataneedstobeguaranteed.

communicationreliesonthedeploymentofdevicesand

sensorsinanopenenvironment,andhenceismoreinAnotherfurtherenhancedusecasewillbeinteracting

dangerofbeingcompromisedthroughphysicalcontactcollaborativerobots(cobots),cobotsprovideacloserinter-

orvisualobservationbyexternalattacks.Asaresultofactionbetweenhumansandrobotsandshouldinterpret

devicecompromise,user’scredentialscanbestolenorthehumanactionsinordertoassistthehumans.Those

directlyaccessed.Itisthereforecrucialtopreventanex-cobotscouldbeaseparatemachineoramachinecloseto

ternalattackfromdirectlyexploitingsuchacompromise.thehumane.g.,exoskeletonoradaptivewheelchair.The

detectionofthehumanactionmaybebasedonmachine

8

learningandartificialintelligence;thus,theintegrityofmaybeinvadedbyexternalhackers,andmaliciousentities

themachinelearningmodelmustensureanyresultinginsidethesourcetracingsystemsmaybetamperedwith

decisionofthecobotdoesnotleadtodamageorinjuriesatlowcost.Thus,amoredecentraliseddatastorageand

tothehumans.Furthercommunicationwithsensorsorsourcetracingsystemneedstobeconsidered.

the6Gnetworkmustbeprotectedtoavoidfalsedecisions

thatleadtowrongactionsnotintendedbythehumans.

Ingeneral,hijackingandmalevolentmanipulationonro-3.3ENABLINGSERVICES

bots[4]canincludeintentionmodificationattacks,whereDataSecurityandprivacyarethecrucialaspectstomost

thecommandmessagesfromacontrollertotherobotoftheenablingserviceswhichrelyon6Gcommunication

aremodifiedtoredirectthemessagesortomodifythesuchas3Dhyper-accuratepositioning,localisation,and

dataonthetargetrobot.Intentionmodificationattackstracking,interactivemapping,digitalhealthcare,automatic

includesDenialofServiceattacks(DoS).Robothaltingdetection,recognitionandinspection,smartindustry,and

asaresultofaDoSattackmaycausetherobottostoptrustedcompositionofservices.

orperformundesiredmovements.Therecanalsobea

delayinrespondingtodirectioncommandsforrobots?Securityandprivacyinpositioning,localisation,and

subjecttoDoSattacks,thusthattherobotathighspeedtracking:Positioningandtrackingservicesassociated

doesnotreacttonavigationcommandsinstantlyandmaytodevicesusedbyhumanandnon-humanassetsare

thereforecauseaccidents.bothcriticaltosecurityandsafetyaspositioningservice

compromise(e.g.,tamperingofcommunicationlinks,

Intentionmodificationattacksareperformedbyanadver-gainingoflocationdataandcontrollingbyimpersona-

saryasakindofmaninthemiddleattack(MitM)wherethetion)mayleadtoillegitimatetrackingofhumanusers.

messagesfromtherobottothecontrolleraremanipulatedSimilarlyfornon-humanassetssuchasdevices,objects,

andthecontrolleridentifiesthemaslegitimatefeedbackrobots,drones,vehicles,positioningservicecompromise

andusesthemasinputforthenextcontrolmessagesmayleadtovariousriskssuchasexecutingmalicious

whichcanleadtowrongcontroldecisions.controls,hijackofdevices,forcingintoaccidentsto

impactthedependentbusinessetc.

Thehijackingattackisverycrucialsincetheadversary

takesovercontroloftherobotandexecutescommands?Datasecuritywithinteractivemappinganddigital

notintendedbythelegitimatecontrollerandcanleadtwins:Asdigitaltransformationunlocksnewvalueit

toservicedisruptionforthetimethehijackingattackisalsobringsnewthreatlandscape.Incaseofinteractive

carriedout.mappinganddigitaltwinsitisessentialtoidentifyand

adoptmetricsthatdefineanaccuratevirtualdigital

For6Gmultidomainheterogeneousinterconnection,themodelrelatedtoareal-timephysicalrepresentation.

massivediversityandconcurrencyofsensorsmayaccessLackofconformancetostandardmetricsforthevirtual

thenetworkfrequently,lightweightaccessauthenticationdigitaltwinwillgreatlyimpactnotonlytheoperation

mustbeenabledwithoutcompromisingsecurity.analysisandobservationsbutalsothesecurityandcyber

resiliencewhentherespectivephysicaldeviceormodel

TheevolutionofInternetofVehicles(IoV)willgenerateisutilised.Furtheravirtualdigitalmodelduringitstes-

alargeamountofdatawhichshouldnotbetamperedting,feedbackdriveniterativeconstruction,observation

with.Theinformationexchangedincludestheintrinsicandanalysisphasecaninvolvemultiplestakeholders

attributesofentitiesanddynamicinteractiondataoftocollaborateandoperatethevirtualdigitalmodel.If

entities.Entityintrinsicattributesincludevehicleintrinsicthevirtualdigitaltwinmodelprocessinginvolvesany

information,suchasvehiclemodel,engineparameters,business-criticaldataorreal-timeuserdata,lackofsuf-

fuelconsumption,vehiclecondition,etc.Userprivacyficientcriticaldatatranslationsandprocesshidingwill

informationincludesIDcardinformation,phonenumber,revealthesensitivedatathusimpactingthebusiness

drivers’licenseinformation,andbankaccount;inherentandprivacyrequirement.

informationaboutroadsidefacilities,suchassensortype

andlocation.TheIoVsourcetracingsystemisacontrol

systemthatcantrackdataintheIoVforward,backward,or

directionless.Traditionalcentralisedsourcetracingsystems

9

?Securedatastorage,processing,andexposurecontrol?Trustedcompositeservicesanduser-controlled

fordigitalhealthcare:In-bodydevicesandwearables-privacy:Compositeservicesinvolvesconvergentnet-

baseddatacollection,processingandmedicalinferenceworkstooffervariedon-demandend-userserviceswith

dataexposurearecriticaloperationsassociatedtodigitalenhancedhumanandmachinecommunication.Asit

healthcare.Ifanyofthedatalinksarecompromised,itrequirestrustworthyrelationshipstobeset-upwhena

mayleadtoseriousrisksassociatedtothehealthcarenewon-demandserviceisrequestedbytheend-users/

system’sreputation.Inmostofthecases,thedatadevice,itisahugechallengetoofferidentityverification

processingassociatedtohealthcaremaybeprocessedcontrolincompliancewithallregionalregulations.Most

attheend-deviceorifadvancedmedicalprocessingisservicesubscriptionactivationsrequiresubmissionofuser

required,thedatamaybeprocessedinindependentdocuments(e.g.,passport,nationalidentitycard,driving

devices/gateways,whereifsufficientdataprocessinglicenseetc.)andverificationofuserdocumentsbythird

securityandstoragesecurityisnotadopted,thismayparties.Governmentdatabasesarealsousedtoenable

leadtodataleakageanddatamanipulationforvariedtheserviceprovider(s)toperformidentityverification.

reasons(e.g.,personalgainssuchasinsurancebenefits).Butiftheidentitydocumentsareforgedandmisused

Theprocessingdevicesshouldensurenon-repudiationbythethirdpartyoriftheidentityrelateddocument

(e.g.,withdistributedledgerssupportingbothonchainarecompromisedatthethirdparty’spremise,itmay

andoffchainstorage)andthecommunicationlinksleadtoseriousissuessuchasserviceproviderfines(if

shouldbesufficientlyauthenticated(i.e.,multimodal),thebreachisidentified),serviceproviderreputational

authorisedandsecured.harm[5],andtheend-usermayfacelegalissues,ortheir

safetyputatriskiftheiridentityismisused.Blockchain

?Securityforintelligenceandautomation:Smartbaseddigitalidentitysuchasdecentralisedidentityand

andintelligentdevicesareexpectedtobedeployedself-sovereignidentity[6]canenabletheend-usersto

formonitoringservicessuchastomonitorvitalsignshavecontrolovertheiridentity(i.e.,serviceidentity)

inhealthcare/criticalunits,tomonitorpassengersandandcontrolovertheidentityinformationdisclosed(e.g.,

belongingsduringsafetycheck-ins(e.g.,inairport),controlleddatadisclosure).

crowdscreening(e.g.,inanymallorsensitivepublic

spots/privatesports)etc.IfsuchmonitoringdevicesandOverall,selectiveapplicationofsecuritybythecommunica-

associatedcommunicationlinksarecompromised,falsetionnetworkshould