Content for  TR 22.859  Word version:  18.2.0

There are more and more IoT devices or none-3GPP devices, e.g. media server, printer, smart thermostat/sprinkler/blinds, NAS server, smart plug, smart watch, smart pet collar, earbuds, VR goggle headset, smart garage door, etc., that can provide services for users at home or out of home in the home settings. These devices are usually behind a wireless gateway. In recent years, there are some security risks found in such settings due to port forwarding and unsecure connectivity provided by the wireless gateway for in home devices. When considering the gateway with 5G capability for accessing 5G services, , it is important to enable the support of the secure connectivity for allowing authorized users from anywhere in the world to access authorized services provided by these IoT devices or none-3GPP devices in terms of user authentication and authorization. These IoT devices or non-3GPP devices acting as a PIN Elements can be smart plug, smart watch, smart pet collar, earbuds, VR goggle headset, etc. that usually are connected to the UE as a PIN Element with Gateway Capability via non-3GPP access, e.g. WLAN, Bluetooth®. When the UE moves, the PIN moves with the UE and its associated PIN Elements. These PIN Elements authorized to communicate with each other are regarded in a Personal IoT Network (PIN). There are other IoT devices, or non-3GPP devices usually stationary connected to the eRG using non-3GPP access (WLAN, wireline), e.g. media server, printer, smart thermostat, smart sprinkler, smart blinds, smart garage, etc. These IoT devices or non-3GPP devices authorized to communicate with each other directly or via the eRG are regarded in a Customer Premises Network (CPN). Figure 5.5.1-1 shows the scenarios of the 5G network enabling connectivity service support for the UE using direct network connection (case a) or direct device connection or PIN direct connection (case b and case c) to access services provided by PIN Element. Each PIN Element may provide one or more services. For example, the PIN Element is a smart watch, earbuds, VR goggles, media server, smart TV, smart video doorbell, etc., which provide one media service. For another example, the PIN Element is a NAS server which can provide multiple services, e.g. media service, web server service, live security cams services, etc.

In Figure 5.5.1-1, a user using an authorized UE, e.g. smartphone or tablet, accesses the service A provided by an PIN Element which has connection with PIN Element with Gateway Capability via a non-3GPP access technologies, e.g. WLAN, Bluetooth®, etc. Case (a): Case (b): Case (c): To avoid the potential security/privacy risks that invade the PIN Elements and services, it is important that the 5G network can enable supports of secure access to the PIN Elements and their services for authenticated and authorized users. According to clause 26a of TS 22.101, an "User" to be identified could be

• an individual human user, using a UE with a certain subscription, or
• an application running on or connecting via a UE, or
• a device ("thing") behind a gateway UE.

In the context of PIN (personal IoT network), a "User" includes a service ("application") running on or connected via a PIN Element behind a PIN Element with Gateway Capability. The following service aspects for IoT device and non-3GPP device as PIN Element connected to the 5G network via a PIN Element with Gateway Capability, needs to be considered:

• User Identity and user authentication;
  1. User Identity of PIN Element or application running on PIN Element;
  2. The authentication of User Identity or application running on the PIN Element;
• Access to PIN Element or its application running on the PIN Element;
• User Profiles and User Identifiers for PIN Element or its applications provided by an PIN Element;
• UE policies in the home settings.

The Incruedible family adopts civilian identities and lives at suburbs for a normal life to hide their superheroes identities. To ensure secure communication for the Incruedible family accessing services of PIN Elements from anywhere in the world, Mr. Incruedible sets up many PIN Elements and subscribes to a reliable network operator's services, which can act as User Identity provider and provide secure access to his PIN Elements and the applications running on or connected to the PIN Element behind the PIN Element with Gateway Capability, for all UEs of his family, including smartphones, tablets.

The Incruedible family can safely live with hidden superheroes identities by securely accessing application of the PIN Elements from anywhere in the world without compromising the security of the PIN Elements/services at home.

Referring to clause 26a of TS 22.101, the user to be identified could be an individual human user, using a UE with a certain subscription, or an application running on or connecting via a UE, or a device ("thing") behind a gateway UE. The following service requirements have been supported:

• The 3GPP network shall be able to provide a User Identifier for a non-3GPP device that is connected to the network via a UE that acts as a gateway.
• The 3GPP network shall support to perform authentication of a User Identity used by devices that are connected via a UE that acts as a gateway.
• The User Identifier may be provided by some entity within the operator's network or by a 3rd party.
• The 3GPP system shall be able to take User Identity specific service settings and parameters into account when delivering a service.
• The 3GPP system shall be able to store and update a User Profile for a user.
• The 3GPP System shall support to authenticate a User Identity to a service with a User Identifier.
• When a user requests to access a service, the 3GPP System shall support authentication of the User Identity with a User Identifier towards the service if the level of confidence for the correct association of a User Identity with a User Identifier complies to specified policies of the service.
• A service shall be able to request the 3GPP network to only authenticate users to the service for which the association of the user with a User Identifier has been established according to specified authentication policies of the service.
• Subject to operator policy, the 3GPP system shall be able to update User Profile related to a User Identifier, according to the information shared by a trusted 3rd party.
• The User Profile may include one or more pieces of the following information:
  • additional User Identifiers of the user's User Identities and potentially linked 3GPP subscriptions,
  • used UEs (identified by their subscription and device identifiers),
  • capabilities the used UEs support for authentication,
  • information regarding authentication policies required by different services and slices to authenticate a user for access to these services or slices.
  • User Identity specific service settings and parameters.
    Those shall include network parameters (e.g. QoS parameters), IMS service (e.g. MMTEL supplementary services) and operator deployed service chain settings.
  • User Identity specific network resources (e.g., network slice).

The following service requirement in clause 26a of TS 22.101 provide the principle for user centric identifiers and authentication by the 3GPP system:

• The 3GPP System shall support operators to act as User Identity provider and to authenticate users for accessing operator and non-operator deployed (i.e. external non-3GPP) services.

This use case and requirements consider that the application running on the PIN Element is a non-operator deployed (i.e. external non-3GPP) services behind a PIN Element with Gateway Capability in a PIN.

[PR-5.5.6-1]: [PR-5.5.6-2]:

PIN elements (e.g. media server, printer, smart thermostat/sprinkler/blinds, smart lightning system, NAS server, etc.) can be located behind a PIN Element with Gateway Capability (e.g., a residential gateway with PIN capability, or a UE with gateway PIN capability). This PIN Element with Gateway Capability can host, or locally be connected to, significant compute and storage resources. , which can host an Application Server. An application on an Application Server can be either in the MNO domain (i.e. a trusted application) or external to the MNO domain (i.e. an authorized third-party application). An AS can be useful to process sensitive data locally. Data generated by some PIN elements can be sensitive, it is therefore important to limit the scope of its dissemination (e.g. temperature and light readings can be used to know if there is someone at home). The AS can also be useful to perform latency sensitive processing. For games and office applications it can be beneficial to render a latency sensitive application locally. The AS can be accessed by local users located in the PIN network, or by remote users connected through the 5G network. The AS can be hosted on a locally connected hardware hosting platform (e.g., a game console, an application server), and/or be embedded in a PIN Element with Gateway Capability (e.g., leveraging virtualization technology to host AS on the PIN element). While an AS can be a standalone service, it can also be an on-site extension of an in-network service hosted on a hosting environment such as an edge computing platform. In this case, the service operator (e.g., a MEC server operator), can influence discovering/authorizing/orchestrating an AS. The AS can be under the control of a 5G network operator, a customer or an authorized third party.

Case (a): Case (b): Service aspects:

1. Deployment of an AS on a hosting platform on, or locally attached to, a PIN Element with a Gateway Capability hosted Service Hosting Environment and hosted on the applications by service provider.
2. Access to AS hosted in PIN, by UE2 outside of home.
3. Additional aspects are already covered in clause 5.4 and clause 5.5 of TR 22.858. Therefore no specific new routing support is needed between PIN element/UE1 and AS:
   1. Access to AS in PIN by UE1 or PIN device from inside home.
4. Access to services offered by PIN elements or UE1 from AS in PIN.

User deploys PIN elements behind a PIN Element with Gateway Capability and subscribes with a service provider for AS. This subscription can be directly with the service provider(s), or through a 5G network operator.

1. Setup:
   1. Hosting environment is installed on PIN Element with Gateway Capability or other PIN element with compute/storage capability (by service provider, 5G network operator or User). User requests some compute/storage resources (in PIN Element with Gateway Capability or other PIN element with compute/storage capability) to be reserved for usage by the hosting environment
      b) Service provider can provide and configure an AAA server to control access to AS hosted in PIN.
   2. AS is enabled on hosting environment (by service provider, 5G network operator or User).
2. Using an AS:
   1. User installs client applications on UE, e.g. a client application that configures temperature at home based on time or day or other triggers.
   2. Service provider provisions corresponding serving AS in hosting environment in PIN.
   3. Client application on UE connects through 5G network to serving AS in PIN, after authorisation from AAA server. User configures application through the client. The serving AS can communicate with PIN element, e.g. to collect and process data locally.

The user can install and use a different UE application supported by the service provider. The service provider deploys corresponding AS in PIN. Suitable AS include all kind of applications acting on privacy sensitive data, and, when the client UE is at home or close to home, latency sensitive rendering or interactive application components for games or office applications.

The following potential requirements defined in TR 22.858 partly cover the use case functionality: The following 3GPP solutions are incompatible with this use case as they address different areas of the 3GPP system architecture:

[PR 5.6.6-1] [PR 5.6.6-2] [PR 5.6.6-3] [PR 5.6.6-4]

There are many attractions around the world that are very popular with tourists. Some of the things to see at an attraction have a lot of history or a lot information to be convey about it e.g. how it works etc. In order to help the tourists and provide them with more information tourists can participate in tours, be they either audio tours where by the tourist is given a digital media player, the digital media player being configured for the tourist language or a personalised tour where a tour guide provides a description. In the latter case the tour guide probably gives the tour in one language and can also answer questions. In both the audio tour and tour guide tour a headset and digital media device are provided to the tourist. The headsets and media devices are usually all the same meaning that the tourist is unfamiliar with how they operate. In addition, a large number of these need to be maintained by the tour company including spares in case there are operational problems. Batteries also need to be charged. When digital media device is provided if additional information for tourists needs to be added / removed all of the digital media players need to be updated. This use case looks at how a user with a smartphone and set of wearable devices can participate in a tour without specialised equipment.

Each tourist has a smartphone (UE) (PIN Element) and at least one of smart earbuds and eye glasses (additional PIN Elements). The later 2 are collectively known as wearables. The collection of all 3 is known as a Personal IoT Network. The earbuds and eye glasses communicate wirelessly using PIN direct connections. Tourists use their PINs for listening to music, watching videos and having messenger application video and phone calls. The earbuds will play notifications, sound and the eye glasses will display video images and notifications. A tour guide has a smartphone (UE), smart earbuds and eye glasses. The earbuds and/or eyeglasses may be IoT devices that communicate with the UE within the PIN. In popular tourist destinations the Quality Tour Guide (QTG) has a Service Level Agreement (SLA) with service provider C to ensure that the tour guide tours are of the best quality. QTG has been authorised by service provider C to be able to add tourists into QTG PIN. Service provider C also ensures that the security of the service provided to QTG is such that those that have not been authorised by QTG to join the group cannot hear or see QTG tour. Cheaper Tour Guide (CTG) has the same equipment but does not have an SLA, they cannot guarantee a high level of security as QTG can to their tour participants.

Terracotta Warriors is a very popular place in China where millions of visitors go each year. Peng (uses service provider A) and Pan (uses service provider B) have decided to visit and are going to take a tour with Quality Tour Guide (QTG) (uses service provider C). They also invite their friend Adrian (uses service provider D from another country, data roaming is turned off) to join. While Adrian is on his way to meet his friends he listens to music on his earbuds from his smartphone. Meanwhile Pongo and Poppet have also decided to visit but have decided to take a tour with Cheaper Tour Guide (CTG). When Peng, Pan and Adrian arrive at QTG their earbuds provide a notification sound and the smart glasses provide a visual indication that QTG service is available. They all acknowledge on their smartphone that they authorise QTG to provide the service. In the authorisation information collateral provided by QTG it indicates that QTG has no access to personal information from tour participants (e.g. phone number, IMEI, UICC ID etc) however QTGs service provider will have access to such information for quality assurance purposes. The collateral also indicates that QTG requires access to microphone, earbuds and display capabilities. Pan further configures the service so that he can get notifications from all his other services while Peng has chosen to not be disturbed while in the tour. Adrian has no data service and can only participate in the tour offered by QTG but can still listen to his music. QTG is notified that 3 tourists are ready for a tour and sees a picture of them on their headset. Pongo and Poppet arrive at CTG where they scan a QR code for the CTG service. CTG receives notification that 2 tourists are ready for a tour. QTG and CTG take their respective tourists to the 1st sight of a clay warrior. It is very busy at the exhibit with lots of tourists and other tour guides giving their tours. QTG, and CTG give basically the same tour. At this exhibit they provide a verbal description of the clay figure, provide some pictures of the clay figure being excavated and small video clip from the farmer who discovered the clay figure. As Peng, Adrian and Pan listen it is just like standing next to the tour guide with no other tourists, the audio quality is superb. As the pictures are displayed on the smartglasses with some audio description the video then starts to play and can be seen on the smartglasses. Suddenly Pan receives a notification on the glass's and less pounced notification tone of a WeChat group message, it is from their manager Fei who wants to talk to Pan and Peng. Peng does not get the notification as he has opted not to be disturbed. Adrian has no other service apart from the tour. Pan receives a messenger application call from Fei, the audio from the video display is muted and the messenger application is received from the smartphone UE. Pan walks into a huge metal structure, as Pan is on the messenger application call all of the sudden the call stops. Pan looks at his phone and notices that there is no cellular service. While Peng, Adrian and Pan were having their tour Poppet and Pongo were receiving the same type of tour from CTG. Poppet and Pongo's audio quality was not as good as Peng and Pan's, and when the video stream was playing at times the sound would be lost or a video frame corrupted. The problems seemed to get worse when there were more people around, especially when it got very crowded. Later that week QTG receives a bill from service provider C indicating that 3 tourists used the service for time Y and consumed Z bytes of data.

Service provider C is provided with a set of records indicating that QTG used a specific amount of PIN data. Service provider C is provided with the identities of the UEs that joined QTG PIN. All the individuals had successful tours.

Clause 6.9.2 of TS 22.261 contains requirements for UE communications with the 5GS using a relay and direct device communications. Clause 6.3 of TS 22.261 contains requirement

• The 5G system shall support the capability to operate in licensed and/or unlicensed bands.

Clause 26a of TS 22.101. Clause 6.3.2 of TS 22.261 and clauses 7A - 7C of TS 22.278 contains requirements. See clause 5.4.5 for an analysis of these requirements.

[PR 5.7.6-1] [PR 5.7.6-2] [PR 5.7.6-3] [PR 5.7.6-4] [PR 5.7.6-5] [PR 5.7.6-6] [PR 5.7.6-7]

In a home network, services are provided for e.g. home automation and wireless hi-fi, which often are based on e.g. UPnP/DNLA, Bonjour and other protocols that can make extensive use of discovery and other broadcast-type messages. The user wants to be able to use the service via both the home network (e.g. Wi-Fi) as well as via the public network. Several services make extensive use of broadcast messages, e.g. smart home systems. The status or discovery-like messages in e.g. UPnP/DNLA, Bonjour and other protocols are broadcast to all 'participating' IoT devices in the network. This is less of a problem when the service is used in a home network (e.g. via LAN) only. However, when the PIN is used outside the home network via a public network (e.g. smartphone joins the PIN via the 3GPP Network), the phone still receives all broadcast messages. This can cause increased messaging to the UE, while these messages are not always relevant to the user. The user should have the choice to receive discovery and status messages on demand, or filtered (e.g. only when there is a status change) when using the service via the public network. Furthermore, the 5G system needs to ensure that the service discovery messages are authentic and sent in sufficiently low numbers as to be not present an obstacle to useful transmissions within the PIN.

The following pre-conditions apply to this use case:

• IoT devices and the residential gateway are connected to an in-home network
• Service discovery protocols are used to discover services, provide service control and exchange service status
• The residential gateway has a subscription to the 5G system
• IoT devices do not have an individual subscription to the 5G system

Mary has a smart home system in her home, in which wireless hi-fi systems (IoT device) are connected to a media server (IoT device) via a non-3GPP wireless radio technology in an in-home network. The IoT devices use a broadcast-based service discovery to find other IoT devices in the network. If Mary wants to control the IoT devices in this smart home system, she uses her smartphone which is also connected to the same in-home network. Mary is in her living room and wants to turn on the hi-fi system to listen to music from her media server. Mary can easily do this using her smartphone. It is a nice day outside and Mary decides to sit in the garden. Mary wants to listen to the music outside but cannot hear the music, so she tries to change the volume of the wireless hi-fi system using her smartphone. However, Mary discovers that she is using the public network instead of the in-home network, and therefore cannot control the smart home system using her smartphone. Mary is unhappy with the situation and therefore she purchases a solution from her network operator that allows her to control the wireless hi-fi system via the public mobile network using her smartphone. Now she can control the music from her smartphone, even when she is outside. Fortunately, the operator solution filters the broadcast traffic, so that these broadcast messages are not counted for the amount of data she is sending via the mobile network.

The person can control the wireless Hi-Fi system indoor and outdoor, using both in the in-home network and via the public mobile network (PLMN).

3GPP TS 22.261 specifies service discovery for UEs, but not in the context of a PIN.

[PR 5.8.6-1] [PR 5.8.6-1a] [PR 5.8.6-2] [PR 5.8.6-3] [PR 5.8.6-4]

Due to the increasing costs and pressure on the healthcare system, care providers, insurance companies and people themselves are looking at new ways to monitor their health, and manage people's health remotely. One way this could be achieved until now is that people buy for example a smartwatch or step counter themselves, pair it to their phone, and download an application to their phone to monitor some of their health data. As the requirements for these devices are getting more demanding, requiring to monitor additional physiological data with higher accuracy and improved reliability, and moving towards cloud/edge based analysis of these streams of data, also the requirements on the underlying network connections and manageability of these devices gets more demanding. It also should be made as easy as possible for the user to be able to connect and manage these networked health devices. In this use case, Fred has been feeling exhausted in the last weeks and went to his general practitioner for a check up. The general practitioner performed a thorough exam and told Fred that he is quite worried about his health, given that his blood pressure is way too high, his cholesterol is at alarming levels, and that he has initial signs of diabetes and heart problems. If Fred continues like this, he has a serious chance of heart failure or ending up in the hospital. Next to some medicines, his general practitioner subscribes him to a new program offered by his insurance company in cooperation with a health provider to monitor Fred's health. This new program includes a 24/7 wearable monitoring device combined with a cloud service operated by the health provider for early detection and warning of heart arrhythmia and heart failure and hypertension. The device will be sent to Fred's home in a few days.

Fred has a 5G enabled mobile phone UE with a USIM and a valid 5G subscription, and supports the PIN gateway UE function. Fred also has a Wi-Fi Access Point at home that may be integrated in or associated with a residential gateway connected to the 5G network. The 24/7 wearable monitoring device uses non-3GPP RAT (e.g. Wi-Fi) and may not be equipped with a (e)UICC. This use case assumes that the health provider has an SLA with Fred's mobile operator and that the insurance company either pays or allows Fred to get reimbursed for any additional data or subscription extensions.

Fred receives a package that includes a 24/7 wearable monitoring device from his insurance company. The package also includes a set of instructions to follow. All he has to do is use the camera on his 5G enabled UE to scan a QR code on the wearable monitoring device (or e.g. touch the device with NFC). Fred unpacks the 24/7 wearable monitoring device and scans the QR code using his 5G enabled UE, acting as a PIN gateway UE. Upon doing this, a sequence of events is initiated, which includes the provisioning of credentials (and other configuration information) onto the 24/7 wearable monitoring device enabling it to setup an identifiable connection to an application server through the 5G core network to which the 5G enabled UE is connected. The connection may be an indirect network connection through the 5G enabled UE, and may be operated by a slice that offers the QoS and reliability guarantees required for this application. In order to facilitate that the 24/7 wearable monitoring device can always connect to the application server, without requiring the 5G enabled UE to be always available or nearby (e.g. wearing the 24/7 wearable monitoring device under the shower, in bed or when the 5G enabled UE is out-of-energy), the 24/7 wearable monitoring device also gets temporary credentials to allow the device to temporarily disconnect from the 5G enabled UE and directly connect to the 5G core network via non-3GPP access to communicate with the application server.

The data from the 24/7 wearable monitoring device is continuously sent to the application server through the 5G network. Fred feels very safe knowing that his health is constantly being monitored.

From TS 22.261 "Service requirements for the 5G system": The connection between a remote UE and a relay UE shall be able to use 3GPP RAT or non-3GPP RAT and use licensed or unlicensed band. The 5G system shall support a secure mechanism for a home operator to remotely provision the 3GPP credentials of a uniquely identifiable and verifiably secure IoT device. Note that the above requirement only partially covers the above mentioned uses case. 3GPP currently relies on the external GSMA remote provisioning framework to perform this function. However, the remote provisioning framework requires a (e)UICC to be supported on the UE, which is not required in this use case. This requirement may need to be further clarified or additional requirements may need to be added to cover non-UICC, non-3GPP RAT devices and the use of a gateway UE to be involved in the provisioning or communication. From TS 22.101 "Service aspects; Service principles": The 3GPP network shall be able to provide a User Identifier for a non-3GPP device that is connected to the network via a UE that acts as a gateway. The 3GPP network shall support to perform authentication of a User Identity used by devices that are connected via a UE that acts as a gateway. A subscriber shall be able to link and unlink one or more user Identities with his 3GPP subscription. The User Identifier may be provided by some entity within the operator's network or by a 3rd party. The 3GPP system shall support to interwork with a 3rd party network entity for authentication of the User Identity. The 3GPP system shall support to perform authentication of a User Identity regardless of the user's access, the user's UE and its HPLMN as well as the provider of the User Identifier. The 3GPP system shall support user authentication with User Identifiers from devices that connect via the internet; the 3GPP system shall support secure provisioning of credentials to those devices to enable them to access the network and its services according to the 3GPP subscription that has been linked with the User Identity.

[PR 5.9.6-1] [PR 5.9.6-2]