Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 40

5G NSA vs. SA Deployment Modes

Recommended resources

Introduction

Welcome to the first lesson in our module on 5G Architecture and Security. In the previous module, we concluded our hands-on exploration of 4G attacks by successfully executing a downgrade attack. You configured a rogue 4G base station to lure a UE and then redirect it to a less-secure 2G network, demonstrating how attackers can bypass modern security protections by exploiting backward-compatibility features.

Now, we shift our focus to the next generation: 5G. While it promises significant security enhancements, it also introduces new architectures and complexities. Understanding these foundations is essential before we can analyze its vulnerabilities.

In this lesson, you will learn to differentiate between 5G Non-Standalone (NSA) and Standalone (SA) deployment modes. This distinction is the most fundamental concept in 5G architecture. It determines whether the 5G service is an extension of an existing 4G network or a completely new, independent system. This choice has profound implications for network capabilities, performance, and—most importantly for our course—the security landscape and potential attack vectors.

1. The Rationale for Two Deployment Modes

Before diving into the technical details, it's helpful to understand why two primary deployment modes exist. Upgrading a national cellular network is an immense and costly undertaking. The transition from 4G to 5G was designed to be more gradual than previous generation shifts.

To understand the operator's perspective and the motivation for this phased approach, please watch the beginning of the following video.

What is 5G Non-Standalone and Dual Connectivity? EN-DC & NR-DC Explained

This video, 'What is 5G Non-Standalone and Dual Connectivity?' from the Wireless Explained channel, provides an excellent high-level overview of the strategic thinking behind the 5G rollout.

Watch the first 1 minute and 49 seconds (00:00 - 01:49). Pay attention to the explanation of why a 'smoother, step-by-step approach' was needed for the 5G transition and why operators chose to deploy 5G base stations first.

As the video explains, operators wanted to offer 5G services—primarily higher speeds—quickly and without the massive initial expense of replacing their entire core network. This led to the creation of two paths:

  1. Non-Standalone (NSA): The fast-to-market option. Deploy new 5G radios but continue using the existing, proven 4G core network.
  2. Standalone (SA): The ultimate goal. Deploy both new 5G radios and a completely new 5G core network to unlock the full potential of 5G.

2. Architectural Differences: NSA vs. SA

Now let's examine the technical architecture of each mode. The core difference lies in which core network is used and how control signals are handled.

5G SA vs 5G NSA: Difference between standalone & non standalone 5G

The video '5G SA vs 5G NSA' by Commsbrief provides a clear, detailed breakdown of both architectures, visualizing how the radio and core networks interact.

Please watch the segment from 02:48 to 07:12. As you watch, focus on identifying: Which core network each mode uses (EPC vs. 5GCN). How the control plane (signaling) and user plane (data) are handled in NSA. The concept of dual connectivity in the NSA model. The advanced features that SA enables (like network slicing).

To summarize and reinforce the key points from the video:

Non-Standalone (NSA) Architecture

  • Core Network: Uses the existing 4G Evolved Packet Core (EPC). This is the same core network we've been discussing in our 4G modules.
  • Radio Access: The user's device (UE) connects to both a 4G base station (eNodeB) and a 5G base station (gNodeB) simultaneously.
  • Control Plane: All control signaling (connection management, mobility, authentication) is anchored in the 4G network. The eNodeB acts as the master node.
  • User Plane: The user's data can be split across both the 4G and 5G radio links to increase throughput. This is known as E-UTRAN New Radio – Dual Connectivity (EN-DC). The 5G gNodeB acts as a secondary node, essentially providing a data speed boost.

Standalone (SA) Architecture

  • Core Network: Uses the new, cloud-native 5G Core (5GC).
  • Radio Access: The UE connects only to a 5G base station (gNodeB).
  • Control & User Planes: Both signaling and user data are handled end-to-end by the 5G network. There is no dependency on the 4G EPC.

The image below provides a clear visual comparison of these architectures.

5G Architecture SA vs NSA Deployment Comparison
Comparison of 4G, 5G NSA, and 5G SA architectures. In 5G NSA, the 5G gNB acts as a secondary data pipe, while the 4G eNB and EPC manage control functions. In 5G SA, the gNB and the new 5GC handle all functions independently.

3. Security Implications of NSA vs. SA

The architectural choice between NSA and SA has direct and significant consequences for network security—it defines the entire attack surface.

Standalone (SA) vs Non-Standalone (NSA) 5G Security

The article 'Standalone (SA) vs Non-Standalone (NSA) 5G Security' from P1 Security connects these architectural differences directly to security risks and considerations. This is crucial for understanding where vulnerabilities may lie.

Please read the first two main sections: 'Understanding Non-Standalone (NSA) 5G Architecture' and 'Exploring Standalone (SA) 5G Architecture'. Focus on the security aspects mentioned for each deployment model.

Based on the article, we can summarize the security posture of each mode:

  • NSA Security Posture:

    • Inherits Legacy Vulnerabilities: Because NSA relies on the 4G EPC, it also inherits the known weaknesses of 4G protocols like Diameter and GTP. An attacker with knowledge of 4G security flaws will find a familiar environment.
    • A Stepping Stone: It offers a marginal security improvement at the radio layer but does not address fundamental flaws in the core network design.

  • SA Security Posture:

    • Addresses Legacy Flaws: The 5GC was designed to fix many of 4G's security issues. We will see in a later lesson how it protects against IMSI catching by using encrypted subscriber identifiers (SUCI).
    • Introduces New Attack Surfaces: The 5GC is built on a Service-Based Architecture (SBA), where network functions are virtualized and communicate using web technologies like HTTP/2 and REST APIs. This creates a completely new attack surface. Your background in web security will be directly applicable here, as securing the 5GC involves protecting against API-level attacks, container vulnerabilities, and misconfigurations common in cloud-native environments.

Conclusion

In this lesson, we have established the fundamental difference between the two 5G deployment strategies. This knowledge is the bedrock for understanding 5G security.

Key Takeaways:

  • 5G NSA (Non-Standalone) is a transitional deployment that adds 5G radio capabilities to an existing 4G core network (EPC). It enabled a faster rollout of 5G's enhanced speeds.
  • 5G SA (Standalone) is an end-to-end 5G system, featuring both 5G radio (NR) and a new, cloud-native 5G Core (5GC). It is required for advanced 5G use cases like ultra-low latency services and network slicing.
  • NSA uses EN-DC (Dual Connectivity), where the 4G eNodeB is the master for control signaling, and the 5G gNodeB provides a secondary data path.
  • The deployment mode critically defines the security model. NSA inherits 4G's vulnerabilities, while SA fixes many legacy issues but introduces a new, web-centric attack surface based on its Service-Based Architecture.

Preview of the Next Lesson:

Now that we understand the high-level architectures, we will begin to dismantle the "black box" of the Standalone 5G network. In the next lesson, we will identify the key functions of the 5G core (5GC). You'll be introduced to the new set of acronyms—AMF, SMF, UPF, AUSF, and UDM—that replace their 4G counterparts and form the foundation of the modern, service-based mobile network.