TR 33.896
Study of Security aspects on User Consent for 3GPP Services
Phase 2

3GPP‑Page

V18.0.1 (Wzip) 2023/06 18 p.

Rapporteur:: Mrs. Rong, Wu
HUAWEI TECHNOLOGIES Co. Ltd.

full Table of Contents for TR 33.896 Word version: 18.0.1

1 Scope p. 6

The present document is to investigate potential enhancements of 5GS that would enable broader use cases in relation with user consent.

The following aspects are in the scope of the study:

Investigating the potential issues and solutions with user consent for:
- eNA in case of roaming.
- MEC in case of roaming.
- NTN.
- AI/ML for NG-RAN.
Investigating the potential generic security requirements, services and guidance for user consent derived from objective 1.

Even where solutions exist to obtain user consent, collection and exposure of user sensitive data should be minimized and identification of the users should only be allowed where critical to the operation of the related feature.

2 References p. 6

3 Definitions of terms, symbols and abbreviations p. 6

3.1 Terms p. 6

3.2 Symbols p. 6

3.3 Abbreviations p. 7

4 Overview p. 7

5 Key issues p. 7

5.1 Key Issue #1: User consent for roaming case in eNA p. 7

5.1.1 Key issue details p. 7

5.1.2 Security threats p. 7

5.1.3 Potential security requirements p. 7

5.2 Key Issue #2: User consent for NTN p. 7

5.2.1 Key issue details p. 7

5.2.2 Security threats p. 8

5.2.3 Potential security requirements p. 8

5.3 Key Issue #3: Unified framework for user consent related data retrieval, notification, and revocation p. 8

5.3.1 Key issue details p. 8

5.3.2 Security threats p. 8

5.3.3 Potential security requirements p. 8

5.4 Key Issue #4: Guidance for Enforcing User Consent p. 8

5.4.1 Key issue details p. 8

5.4.2 Security threats p. 9

5.4.3 Potential security requirements p. 9

6 Solutions p. 9

6.0 Mapping of solutions to key issues p. 9

6.1 Solution #1: User consent obtained by the NTN-RAN in non-mobility use case p. 9

6.1.1 Introduction p. 9

6.1.2 Solution details p. 9

6.2 Solution #2: User consent revocation obtained by the NTN-RAN p. 11

6.2.1 Introduction p. 11

6.2.2 Solution details p. 11

6.3 Solution #3: User Consent for UE Data Exposure to HPLMN in the Roaming case p. 13

6.3.1 Introduction p. 13

6.3.2 Solution details p. 13

6.3.3 Evaluation p. 14

6.4 Solution #4: User Consent for UE Data Exposure to VPLMN in the Roaming case p. 15

6.4.1 Introduction p. 15

6.4.2 Solution details p. 15

6.4.3 Evaluation p. 16

6.5 Solution #5: Central authorization for user consent handling p. 16

6.5.1 Introduction p. 16

6.5.2 Solution details p. 16

6.5.3 Evaluation p. 16

7 Conclusions p. 16

7.1 Conclusion for Key Issue #1 p. 16

7.2 Conclusion for Key Issue #2 p. 17

7.3 Conclusion for Key Issue #3 p. 17

$ Change history p. 18