EU outlines 5G rules: You don't have to keep 'risky' vendors completely Huawei

Re: HCSEC is auditing Huawei code

The majority of the code runs on x86 servers - if you give it away, what are customers going to buy? Your installation and support services?

Re: HCSEC is auditing Huawei code

I assume Europe is prepared to trust its own manufacturers but other stuff, and that most certainly includes that from US vendors, should be audited in the same way. Why should they object if they've nothing to hide?

Re: HCSEC is auditing Huawei code

Are Cisco, Ericsson, Nokia, Intel, Qualcomm, etc, components manufactured exclusively outside of China?

Re: HCSEC is auditing Huawei code

The equivalent is KNOWN to have backdoors for five eyes.

Re: 4 companies?

Do ZTE or open RAN vendors have customer trials targetting widespread deployment yet?

My understanding is that Huawei is closest to having an operational 5G standalone solution, with Samsung close (but not so popular outside of South Korea). Nokia and Ericsson have trials of non-standalone solutions (5G clients on a 4G core) but are still a year or two off progressing to an operational 5G standalone solution.

I am aware of one-off ZTE trials but they don't appear to be progressing to anything larger at present.

In 2-3 years time when 5G is widespread, I would still expect ZTE to be one of the 4 big players ahead of Samsung, but they tend to support the more cost conscious end of the market.

Re: It is all trade war.

National security for the US is the domination of as many markets as possible and to keep the dollar as the predominant means of international exchange, I doubt it was ever really about China's ability to spy on anyone as much as cornering the market on 5G to the point that it would be difficult for anyone else to compete.

As things are Huawei seems to be much further ahead in most aspects of 5G and certainly more ready for roll out than most.

The US is still trying to overcome China's dominance of the highly strategic rare earths market and has been playing catch up there for at least 5 years so 5G added to that is too much for them.

Re: It is all trade war.

"It is data that is going to be using this network, data (much to the spies annoyance) is now end to end encrypted so what ever network it goes over it is “secure”."

In a typical 4G deployment (and I would assume, proposed 5G deployments), control plane and data plane traffic is already encrypted between mobile devices and endpoints within the 4G (5G) network. This is before any client side encryption (i.e. HTTPS) is included in the picture that attempts to provide end-to-end encryption.

Being able to see where devices register on the network and if they are active or not are still useful, even within encryption. Being able to impersonate another device is also useful. Knowing where a device is to allow you to swap it with a "bugged" device or to install software via an existing weakness to allow further monitoring allow you to bypass the encryption altogether.

You decide whether encryption is sufficient if you have something to hide.

Re: NCSC reported on alternative 5G vendors?

Sometimes, sort of. So some of it begins here-

https://en.wikipedia.org/wiki/Common_Criteria

With ISO 15408. So I could issue a bid requiring security targets per that, and tender responses show how they'd meet the security requirements. Shortlisted bidders would then be invited to submit reference design(s) to a certification lab, and results used to score and award contracts. But that's an expensive and time consuming process. On the plus side, vendors can submit stuff for independent certification and then make claims about it's compliance with ISO 15408. Like 'Windows is Secure!'*

Bid stuff would be confidential, vendor's own tests results and might be published.

Then there's-

https://en.wikipedia.org/wiki/Evaluation_Assurance_Level

Which gives a kind of 'approval rating', which can get used in marketing.. But also with caveats, ie the EAL rating is based on a defined Security Target, which generally means a specific version and configuration. And it's an expensive process for vendors, especially as updates should mean resubmission. Example here-

https://www.cisco.com/c/en/us/solutions/industries/government/global-government-certifications/common-criteria.html

*when installed on a server, inside a safe filled with concrete and dropped into the Marianas Trench.

Re: Huawei again?

True and I upvoted you.

But one caveat: the west is losing its soul and jobs and skills by always choosing the cheapest. It might well be very advantageous to pay more now in order to keep Nokia and Ericsson in fighting shape. Too much of our industrial strength has already been undermined by our focus on the short term. When deploying 5G we should think about who will be there to deploy 6G and 7G, whatever these will be.