Protect the S1 interface between eNodeB and EPC using IPsec in tunnel mode where the backhaul traverses untrusted networks. Use certificate based authentication with a dedicated PKI and rotate credentials on a defined cadence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.