Voice over New Radio (VoNR) is the native voice service of the 5G standalone (SA) core. It carries calls as IP Multimedia Subsystem (IMS) sessions over the 5G New Radio air interface, without dropping back to 4G to complete the call. For a security team the important point is not that VoNR is new, but that it is familiar: VoNR does not invent a fresh voice security model, it moves the existing IMS and SIP voice model onto the 5G SA core. Most of the VoLTE and IMS attack surface travels with it, and a small number of 5G specific behaviours, above all EPS fallback, decide whether an operator has actually reduced voice risk or simply relocated it.
This article explains what VoNR is, how it differs from VoLTE architecturally, what its security model looks like under 3GPP and GSMA, where the practical exposure sits, and what operators should test and monitor as they turn on 5G voice.
What is VoNR (voice over New Radio)?
VoNR is voice delivered as an IMS session over 5G NR in a standalone 5G network. The radio and the packet core are 5G, but the voice service itself lives in the IMS, and call signalling uses the Session Initiation Protocol (SIP) exactly as it does for Voice over LTE (VoLTE). In a standalone network that supports VoNR, the call is set up and carried end to end over 5G, with no transition to the 4G Evolved Packet Core (EPC) to place the call.
That last point is what separates VoNR from earlier 5G voice options. Non-standalone (NSA) 5G has no VoNR at all: the control plane still relies on the 4G core, so voice is delivered as VoLTE over the LTE anchor, or, where VoLTE is not available, the call uses circuit switched fallback (CSFB) to complete on 2G or 3G. VoNR only becomes possible once the operator has deployed a 5G standalone core with the AMF, SMF and UPF in place and an IMS that is provisioned for 5G access. Understanding whether a given network is NSA or SA is therefore the first question in any VoNR security review, because it determines which voice path is actually in use.
How VoNR differs from VoLTE architecturally
The IMS core is broadly the same in VoNR and VoLTE. The Proxy, Serving and Interrogating Call Session Control Functions (P-CSCF, S-CSCF, I-CSCF), the Telephony Application Server (TAS) and the subscriber data roles carried by the HSS or the 5G Unified Data Management (UDM) function all carry over. The SIP and Session Description Protocol (SDP) dialogues that establish, modify and tear down a call look familiar to anyone who has audited a VoLTE deployment.
What changes is the connectivity layer underneath the IMS. VoLTE runs over the 4G EPC and uses dedicated bearers to carry media and signalling. VoNR runs over the 5G SA core and uses 5G quality of service (QoS) flows instead: typically 5QI 1 for conversational voice media and 5QI 5 for IMS signalling. Registration to the IMS happens over a dedicated IMS data network name (DNN) and its own protocol data unit (PDU) session, rather than an APN and default bearer. Upstream, the subscriber is authenticated with 5G-AKA or EAP-AKA prime, and the permanent identity (the SUPI) is concealed on the air interface as a SUCI rather than being exposed as an IMSI.
For a defender, the practical consequence is that VoNR splits into two layers with different owners. The IMS and SIP layer behaves like VoLTE and inherits its issues. The 5G SA transport layer, the AMF, SMF, UPF, the QoS flows and the PDU sessions, is where the genuinely new behaviour lives, and where the 5G specific misconfigurations show up. A VoNR assessment has to cover both, and it has to cover how they interact when the network falls back to 4G.
The VoNR security model under 3GPP and GSMA
VoNR security is layered across several specifications rather than defined in a single document, and it helps to keep the layers separate when scoping a review.
3GPP TS 33.501 defines the security architecture for the 5G system: primary authentication, the key hierarchy, NAS and AS protection over 5G access, and the protection of the service based interfaces inside the core. This is the layer that authenticates the subscriber and protects the 5G signalling that VoNR depends on to get a PDU session and QoS flows in the first place.
3GPP TS 33.203 defines IMS access security, including IMS-AKA for authenticating the subscriber to the IMS and the use of IPsec on the Gm interface between the device and the P-CSCF. This is the layer that protects the SIP registration and session signalling once the device can reach the IMS. Media confidentiality and integrity on the user plane are provided by the Secure Real-time Transport Protocol (SRTP), negotiated in the SDP.
On the operator and interoperability side, GSMA NG.114 is the IMS profile for voice, video and messaging over the 5G system, the VoNR era successor to the VoLTE profile IR.92. It defines the mandatory and optional features that make voice work consistently across networks and across roaming, and it is the reference an operator should map its VoNR configuration against. A security model that is technically present but not enforced consistently across access types and roaming partners is where most real world VoNR weakness accumulates.
Where VoNR inherits IMS and SIP risk
Because VoNR keeps the IMS and SIP core, it also keeps the IMS and SIP attack surface. Moving voice to 5G does not retire any of the following, and each should be tested on the VoNR path rather than assumed to be resolved.
SIP parsing and robustness at the P-CSCF remain a primary concern. The P-CSCF is the first IMS element the device talks to, and it parses attacker influenced SIP and SDP. Malformed, oversized or unexpected messages that a hardened stack rejects cleanly can degrade or crash a weaker one, so fuzzing and robustness testing of the signalling path stay relevant on 5G.
Identity and header handling is the second area. SIP headers such as P-Asserted-Identity and History-Info carry trust and routing meaning, and mishandling them can enable caller identity spoofing, information disclosure or call manipulation. The trust rules for these headers, and where they are inserted or stripped, need to be validated on the VoNR configuration and at the interconnect boundary.
Enumeration and information exposure is the third. Registration and provisioning responses can leak whether a subscriber exists, which capabilities are enabled, or details about network topology. These behaviours are independent of the radio generation, so they carry straight from VoLTE to VoNR. The same is true of interconnect exposure: VoNR calls that cross to other networks meet the same SIP trust boundary problems that the wider interconnect community has been hardening for years, in the same spirit as the signalling recommendations in GSMA FS.21. For a broader treatment of the IMS and SIP surface itself, see our post on IMS and SIP protocol security.
EPS fallback: the VoNR security question that actually matters
The single most important VoNR specific behaviour is EPS fallback, and it is often the point where a 5G voice rollout quietly reintroduces 4G risk. When a subscriber tries to place a VoNR call and the network cannot complete it over 5G, because VoNR is not deployed in that area, the radio conditions do not support it, or policy prevents it, the network redirects the device to the 4G EPS and the call completes as VoLTE.
This has three consequences that belong in the threat model. First, the fallback call inherits the full LTE and VoLTE exposure, including the Diameter signalling and interworking that a pure 5G path would avoid. Second, the transition is triggerable: anything that influences whether VoNR can complete, including radio conditions, also influences whether the call drops to 4G, which turns fallback into a potential downgrade lever rather than a purely benign resilience feature. Third, and most practically, an operator that supports both paths is running two voice security postures at once, and the weaker of the two sets the real risk level.
The correct response is to treat the fallback path as fully in scope. Both the VoNR path and the VoLTE fallback path should be assessed, the conditions that trigger fallback should be understood and monitored, and the two paths should not be allowed to drift into different, unmanaged configurations. Where the fallback lands on Wi-Fi calling instead, the same logic extends to VoWiFi and the ePDG, which brings its own IPsec and interworking surface.
The media plane, SRTP and voice fraud
On the user plane, media confidentiality depends on SRTP being both negotiated and enforced. The security question is not only whether SRTP is available but whether it can be silently downgraded or stripped during session negotiation, and whether an unencrypted media path is ever accepted. Media protection that is optional in practice is close to no media protection at all, so the enforcement behaviour, not just the capability, is what an assessment needs to confirm.
Voice fraud persists across both the 5G and the fallback paths, because fraud largely targets the service logic rather than the radio. Toll fraud, international revenue share fraud, supplementary service abuse such as unauthorised call forwarding, and routing manipulation are all as relevant on VoNR as they were on VoLTE. Because VoNR and its fallback can present two paths to the same subscriber and the same TAS logic, controls have to be consistent across both, or an attacker will simply use whichever path is less controlled.
What operators should test and monitor for VoNR
A practical VoNR security programme comes down to confirming that the model is not just present but enforced, and that the 5G path and its fallback are held to the same standard. In priority order:
- Test both the VoNR path and the EPS fallback (VoLTE) path, and treat the weaker of the two as your real posture.
- Validate P-CSCF SIP and SDP robustness against malformed and unexpected signalling.
- Confirm SRTP is negotiated and cannot be silently downgraded or stripped, on both paths.
- Scope the trust rules for identity headers such as P-Asserted-Identity and History-Info, including at the interconnect boundary.
- Understand and monitor the conditions that trigger EPS fallback, so a downgrade does not go unnoticed.
- Check that voice fraud controls in the TAS apply consistently to VoNR and to fallback calls.
- Map the deployed configuration against GSMA NG.114 and the relevant parts of 3GPP TS 33.203 and TS 33.501, and close the gaps between the profile and the live network.
Treated this way, VoNR is a manageable evolution rather than a new class of risk. The failure mode to avoid is assuming that moving voice onto 5G removed the IMS, SIP and VoLTE surface, when in practice it carried that surface across and, through EPS fallback, kept a live path back to it.
If you are turning on 5G voice and want an independent view of the VoNR and fallback paths, or a signalling assessment that covers both, get in touch at [email protected].
