threats from a 3GPP architecture per- spective and concentrate only on those security topics that concern the user plane. A good summary of generic operational IPv6 security concerns can be found in [171]. The attacks, vulnerabilities and security threats discussed in the following sections do not form a definitive list. They represent the set that the authors were aware of and have also been documented in IETF for the purpose of fixing the vulnerabilities found. 4.10.1 IPv6 Addressing Threats This section discusses several known IPv6 addressing exploiting vulnerabilities in the context of the 3GPP architecture. We only consider user plane addressing which concerns the UE, thus we are not going to look into attacks and vulnerabilities that directly target the GPRS or EPC core network nodes on their transport and control planes. We also concentrate only on remote network attacks since there can be exactly one end host on the 3GPP link, which makes on-link local area network attacks less important. IPv6 address architecture has been criticized for its privacy issues. Specifically, SLAAC configured addresses tend to have a permanent cookie in the form of the EUI-64 based IID. If the EUI-64 is derived from a MAC address, or from any fixed identifier, then IPv6 in 3GPP Networks independent of changing prefix the IID remains the same, allowing tracking of the device/user globally. Privacy addresses [109], which are supported today in practically every modern operating system, solve the issue of the IID being a permanent cookie. Pri- vacy addresses then have a new set of issues such as the address changing too frequently, for example, from the network access control and its resource consumption point of view. The recent work on stable privacy addresses [172] makes the IID remain the same for a longer time, practically as long as the link gets renumbered or the end host changes to another link that has a different prefix. In 3GPP networks, the generation of a new stable privacy address would take place during each PDN Co