Content for  TS 33.128  Word version:  18.7.0

The IRI-POI in the AAnF (AKMA Anchor Function), the IRI-TF in the AAnF, and the MDF2 shall be provisioned. Details of provisioning of an IRI-POI at a network internal AF (Application Function) making use of AKMA services of the AAnF is in general service specific and not part of the present clause. Generally, triggering, rather than provisioning, could in some cases be necessary for the AF. An application independent generic triggering mechanism is defined in clause 7.9.1.2.3. Provisioning of CC-intercept at the AF is service specific and not covered in the present document.

The IRI-POI and IRI-TF present in the AAnF are provisioned over LI_X1 by the LIPF using the X1 protocol as described in clause 5.2.2. The IRI-POI and IRI-TF in the AAnF shall support the following target identifier formats:

• SUPI, given in either SUPIIMSI or SUPINAI formats as defined in ETSI TS 103 120 [6] clause C.2.

Table 7.9.1.2-1 shows the minimum details of the LI_X1 ActivateTask message used for provisioning the IRI-POI and IRI-TF in the AAnF.

The IRI-POI present in the AF shall be triggered by the IRI-TF present in the AAnF over LI_T2 using the X1 protocol as described in clause 5.2.2. An AAnF can provide services for several different types of applications. Triggering could be service/application specific, which can effect whether or not certain conditional fields are included in the xIRI described in clause 7.9.1.4 below. For all AFs a priori known to match the scope of the warrant, when the IRI-TF in the AAnF detects that an A-KID has been associated with a SUPI (see clause 7.9.1.3.2), it shall send an ActivateTask message to the IRI-POI present in the AF. The same shall apply if the AAnF detects that the A-KID of a target changes due to primary authentication. For AFs not a priori known at the AAnF, the ActivateTask message shall instead be sent when the IRI-TF in the AAnF detects that the AF performs an AKMA application key get associated with the A-KID. The ActivateTask message shall contain at least the following information.

When the IRI-POI present in the AF detects that a UE has requested the use of a targeted A-KID, it shall continue to generate xIRI events for that A-KID until it detects that the UE has requested the use of a different A-KID, at which point it shall implicitly deactivate the previous Task. In addition, the AAnF may at any time issue a DeactivateTask message against the Task, at which point the AF shall cease interception of the A-KID and remove the Task as per ETSI TS 103 221-1 [7] clause 6.2.3.

The IRI-POI present in the AAnF shall send the xIRIs over LI_X2 for each of the events listed in clause 7.9.3.1 of TS 33.127, the details of which are described in the following clauses.

The IRI-POI in the AAnF shall generate an xIRI containing an AAnFAnchorKeyRegister record when the IRI-POI present in the AAnF detects reception of an AKMA-context, i.e. an (A-KID, KAKMA)-pair associated with a target, from the AUSF, see clause 7.1.2 of TS 33.535.

The IRI-POI in the AAnF shall generate an xIRI containing an AAnFAKMAApplicationKeyGet record when the IRI-POI present in the AAnF detects an AKMA application key get from an AF (directly or via NEF), see clauses 7.1.3 and 7.3.1 of TS 33.535.

The IRI-POI in the AAnF shall generate an xIRI containing an AAnFStartOfInterceptWithEstablishedAKMAKeyMaterial record when the IRI-POI present in the AAnF detects that interception is activated on a target UE that has already established AKMA key material.

The IRI-POI in the AAnF shall generate an xIRI containing an AAnFAKMAContextRemovalRecord when the IRI-POI present in the AAnF receives a request from an NF to delete AKMA context, see clause 7.1.4 of TS 33.535.

The IRI-POI present in the AF shall send the xIRIs over LI_X2 for each of the events listed in clause 7.9.3.1 of TS 33.127, the details of which are described in the following clauses.

The IRI-POI in the AF shall generate an xIRI containing an AFAKMApplicationKeyRefresh record when the IRI-POI present in the AF detects that a KAF-key previously obtained from an AAnF is being locally refreshed by the Ua* security protocol in use, see clause 6.4.3 of TS 33.535.

The IRI-POI in the AF shall generate an xIRI containing an AFStartOfInterceptWithEstablishedAKMAApplicationKey record when the IRI-POI present in the AF detects interception is being triggered on a target UE that has already established AKMA application key.

The IRI-POI in the AF shall generate an xIRI containing an AFAuxiliarySecurityParameterEstablishment record when the IRI-POI present in the AF detects that security parameters for the Ua* security protocol in use have been established with the target UE, or, when they have been updated without the associated AKMA application key having been refreshed according to clause 7.9.1.4.3.

The IRI-POI in the AF shall generate an xIRI containing an AFApplicationKeyRemoval record when the IRI-POI present in the AF detects that an AKMA-derived AF-specific key is deleted or otherwise decommissioned.