Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

TR 33.741
Study on Home Network triggered Primary Authentication

V18.0.1 (Wzip) 2023/03 38 p.

Rapporteur:: Mr. Li, He
HUAWEI TECHNOLOGIES Co. Ltd.

full Table of Contents for TR 33.741 Word version: 18.0.1

1 Scope p. 7

The present document studies the use cases which needs Home Network initiated primary authentication and the associated security threats and requirements. As part of this investigation, the study aims at identifying which network function in the HN is better suitable to trigger the primary authentication, corresponding procedures, the potential impacts on visited and home network, and the potential impacts on existing procedures. Moreover, solutions for potential normative work are also in the scope of this study.

2 References p. 7

3 Definitions of terms, symbols and abbreviations p. 7

3.1 Terms p. 7

3.2 Symbols p. 7

3.3 Abbreviations p. 7

4 Key issues p. 8

4.1 Key Issue #1: Ability of the home network to trigger primary authentication p. 8

4.1.1 Key issue details p. 8

4.1.2 Security threats p. 8

4.1.3 Potential requirements p. 8

4.2 Key Issue #2: Signalling overload due to running the primary authentication for KAF refresh p. 8

4.2.1 Issue details p. 8

4.2.2 Security Threats p. 9

4.2.3 Potential security requirements p. 9

5 Potential solutions p. 9

5.0 Mapping of solutions to key issues p. 9

5.1 Solution #1: HN triggering primary authentication for various scenarios p. 9

5.1.1 Introduction p. 9

5.1.2 Solution details p. 10

5.1.2.1 Procedure for detection of SoR/UPU Counter wraparound in advance and perform re-authentication p. 10

5.1.2.2 Re-authentication due to EPC to 5G mobility p. 11

5.1.2.3 Re-authentication invoked by other AAnF p. 11

5.1.3 Solution Evaluation p. 12

5.2 Solution #2: UDM triggered primary authentication p. 12

5.2.1 Introduction p. 12

5.2.2 Solution details p. 13

5.2.2.1 Procedure p. 13

5.2.2.2 Procedure used for each use case p. 13

5.2.2.3 Service provided by AMF p. 13

5.2.2.3.1 General p. 13

5.2.2.3.2 Namf_HN Authentication service p. 13

5.2.2.3.2.1 Namf_HNAuthentication service operation p. 13

5.2.2.4 Service provided by UDM p. 14

5.2.2.4.1 General p. 14

5.2.2.4.2 Nudm_HN Authentication service p. 14

5.2.2.4.2.1 Nudm_HNAuthentication service operation p. 14

5.2.3 Evaluation p. 14

5.3 Solution #3: Home network triggered authentication solution for LTE to 5G interworking p. 14

5.3.1 Introduction p. 14

5.3.2 Solution details p. 14

5.3.3 Evaluation p. 15

5.4 Solution #4: UDM initiated primary authentication based on a NF request p. 15

5.4.1 Introduction p. 15

5.4.2 Solution details p. 15

5.4.3 Evaluation p. 16

5.5 Solution #5: Using the UDM to start home triggered authentications p. 16

5.5.1 Introduction p. 16

5.5.2 Solution details p. 16

5.5.3 Evaluation p. 18

5.6 Solution #6: UDM initiated primary authentication based on AUSF request p. 18

5.6.1 Introduction p. 18

5.6.2 Solution details p. 18

5.6.3 Evaluation p. 19

5.7 Solution #7: UDM initiated Primary Authentication p. 19

5.7.1 Introduction p. 19

5.7.2 Solution details p. 20

5.7.3 Evaluation p. 21

5.8 Solution #8: Solution to enable UDM in the HN to trigger Primary Authentication p. 21

5.8.1 Introduction p. 21

5.8.2 Solution details p. 21

5.8.3 Evaluation p. 25

5.9 Solution #9: AMF initiated primary authentication based on AUSF request p. 25

5.9.1 Introduction p. 25

5.9.2 Solution details p. 26

5.9.2.1 EPC interworking use case p. 26

5.9.2.2 Namf_UEAuthentication_Authenticate p. 27

5.9.3.2.1 Namf_UEAuthentication_Authenticate service operation p. 27

5.9.3 Evaluation p. 28

5.10 Solution #10: UDM initiated primary authentication based on AAnF request for KAF refresh scenario p. 28

5.10.1 Introduction p. 28

5.10.2 Solution details p. 29

5.10.3 Evaluation p. 30

5.11 Solution #11: Home network triggered primary authentication controlled by the UDM p. 30

5.11.1 Introduction p. 30

5.11.2 Solution details p. 31

5.11.2.1 General p. 31

5.11.2.2 UDM triggered primary authentication during UE Registration p. 31

5.11.2.3 UDM triggered primary authentication after UE Registration p. 32

5.11.2.4 Applicability of the UDM triggered primary authentication procedures to the Use Cases. p. 34

5.11.2.4.1 Interworking use case p. 34

5.11.2.4.2 SoR/UPU wrap around use case p. 34

5.11.2.4.3 Home Network triggered primary authentication for KAF refresh p. 34

5.11.3 Evaluation p. 34

5.12 Solution #12: Delegated Home Network controlled primary authentication p. 35

5.12.1 Introduction p. 35

5.12.2 Solution details p. 35

5.12.3 Evaluation p. 35

6 Conclusions p. 36

A Use cases p. 37

A.1 Use Case #1: Security of Interworking p. 37

A.2 Use Case #2: SoR/UPU Counter Wrap around p. 37

A.3 Use Case #3: KAKMA refresh p. 37

$ Change history p. 38