Network Layer Security:
Security Mechanisms:

IPsec (Internet Protocol Security): Encrypts and authenticates IP packets
at the network layer.

Firewalls and Network Address Translation (NAT): Control and monitor
incoming/outgoing traffic.

Carrier-grade NAT (CGNAT): Protects mobile subscribers behind carrierlevel firewalls.
1. IPsec (Internet Protocol Security):
What It Is:
IPsec is a suite of protocols designed to secure IP communications by
authenticating and encrypting each IP packet of a communication session.

Operates at Layer 3 (Network Layer) of the OSI model.

Secures end-to-end or site-to-site communication across untrusted
networks like the Internet or mobile carrier networks.

Commonly used in VPNs (Virtual Private Networks) for secure remote
access.
Goals of IPsec
1. Confidentiality: Prevents data from being read by unauthorized parties
(via encryption).
2. Integrity: Ensures data hasn't been altered in transit.
3. Authentication: Verifies the identity of the sender and receiver.
4. Anti-replay protection: Detects and prevents repeated or delayed
packets.
Two Modes of Operation
Transport Mode

Encrypts only the payload (data) of the IP packet.

IP header remains intact.

Used for end-to-end communication, e.g., between two devices.
Tunnel Mode

Encrypts the entire IP packet, including the header.

A new IP header is added for routing.

Used for network-to-network (site-to-site) VPNs or device-to-gateway
connections.
IPsec in Mobile Wireless Networks
Use Cases:

Mobile VPNs: Secure connection from smartphones to corporate
networks.

Carrier networks: Securing backhaul and management traffic between
cellular network elements.

VoLTE/IMS: Used to encrypt voice over LTE signaling in some operator
deployments.
Benefits:

Device-level encryption, independent of apps or OS.

Works over Wi-Fi, 4G, and 5G.

Offers a unified secure tunnel for all IP-based mobile communications.
2. Firewalls and Network Address Translation (NAT)—
key security mechanisms in mobile and wireless networks. These technologies
are essential for protecting devices and managing traffic in both mobile and
enterprise environments.
What is NAT?
NAT is a technique where a router or gateway modifies the source or
destination IP address of packets as they pass through.
NAT enables devices in a private network to access external public networks
(like the internet) using a single public IP address.
Type
Description
Static NAT
Maps one private IP to one public IP.
Dynamic NAT
Maps private IPs to a pool of public IPs.
PAT (Port Address
Maps many private IPs to one public IP using
Translation) / NAT Overload different ports. Most common form of NAT.
Carrier-Grade NAT (CGNAT)
Large-scale NAT used by ISPs and mobile
carriers.
How NAT Works:
Example:

A mobile device with IP 10.0.0.5 sends a request to a website.

NAT translates the IP to 203.0.113.1 and assigns a port (e.g., 45001).

The server replies to 203.0.113.1:45001, and NAT routes it back to
10.0.0.5.
Why NAT is Used in Mobile Networks

Conserves IPv4 addresses by allowing many devices to share one public
IP.

Enhances security by hiding internal IP addresses.

Facilitates private addressing in home, enterprise, and mobile carrier
networks.
NAT Security Benefits

Prevents direct incoming connections to devices (i.e., unsolicited
external access).

Obfuscates internal IP addresses, making it harder for attackers to
target specific devices.

Adds a layer of isolation between the user and internet.
3. Carrier-grade NAT (CGNAT):
Carrier-grade NAT (CGNAT), also known as Large Scale NAT (LSN), is a type of
Network Address Translation that enables thousands or millions of users to
share a limited pool of public IPv4 addresses.
Purpose:

Extend the life of IPv4 by reducing the number of public IP addresses
needed.

Secure mobile and broadband subscribers by shielding their private IP
addresses.

Act as a gateway between private mobile subscriber networks and the
public internet.
How CGNAT Works
Basic Flow:
1. Mobile users are assigned private IP addresses (e.g., 10.0.0.0/8).
2. When a user initiates internet access, CGNAT translates the internal IP
and port to a shared public IP and a unique port.
3. CGNAT maintains a mapping table of:
o
Internal IP and port ⇔ Public IP and port.
4. When responses return from the internet, CGNAT matches the entry
and routes the packet back to the correct user.
Why CGNAT is Important in Mobile Networks

Mobile networks can have tens of millions of subscribers.

Public IPv4 space is limited (about 4.3 billion addresses total).

IPv6 adoption is growing but still not universal.

Without CGNAT, ISPs would run out of IPv4 addresses.
Security Benefits of CGNAT
Security Aspect
Details
Prevents external devices from initiating direct connections to mobile
Device isolation
users.
IP obfuscation Masks internal IP addresses from the public network.
DDoS
Reduces exposure of individual users to direct attacks.
mitigation
Session control Helps operators detect unusual or malicious traffic behavior.
Common Use Cases
1. Mobile networks (3G/4G/5G):
o
Millions of mobile users share thousands of public IPs.
2. ISPs with home broadband:
o
CGNAT used when IPv6 isn't fully deployed.
3. IoT device management:
o
Isolate and protect devices from direct public exposure.