Tech-invite  3GPPspace  IETFspace
21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x

Content for  TS 33.401  Word version:  18.1.0

Top   Top   Up   Prev   Next
1…   4   5…   6…   6.2…   7…   7.2.5…   7.2.8   7.2.9…   7.3…   8…   9…   10…   11…   15…   A…   B…   C…   C.1.6   C.2…   C.2.7   C.2.8   C.3…   C.4.7   D…   E…   E.2…   E.3…   F…   G…   H…   I…   K… 
H LTE-WLAN RAN level integration using IPsec tunnelling  H.1 General  H.2 Security of LTE-WLAN integration using IPsec Tunnelling  H.3 Addition and modification of DRB in LTE-WLAN integration  H.4 Security Key for IKEv2 handshake  H.5 Handover procedures  H.6 LWIP radio link failure 
...

 

H (Normative)  LTE-WLAN RAN level integration using IPsec tunnelling |R13|  p. 159

H.1  General  p. 159

This clause describes the security functions necessary to support LTE-WLAN integration using IPsec tunnelling as described in TS 36.300.
The LTE-WLAN integration architecture is shown in Figure H.1-1 and the protocol stack in Figure H.1-2.
Copy of original 3GPP image for 3GPP TS 33.401, Fig. H.1-1: LTE-WLAN integration architecture using IPsec tunnelling
Figure H.1-1: LTE-WLAN integration architecture using IPsec tunnelling
(⇒ copy of original 3GPP image)
Up
Copy of original 3GPP image for 3GPP TS 33.401, Fig. H.1-2: LTE-WLAN integration using IPsec tunnelling protocol stack
Figure H.1-2: LTE-WLAN integration using IPsec tunnelling protocol stack
(⇒ copy of original 3GPP image)
Up
For LTE-WLAN integration using IPsec tunnelling the integration happens using PDCP SDUs above the PDCP layer. The eNB controls activation of the integration based on the UE connectivity with a specific WLAN. Once the integration is activated, the eNB segregates incoming DL packets towards the UE for offloading via the WLAN at a layer above PDCP. The UL packets from the UE are aggregated by the eNB at the same logical point.
Since PDCP security is bypassed for the data routed through the WLAN and security of the legacy WLAN is not assumed, security for the PDCP SDUs and protection of the operator network shall be achieved in the following way:
  • A LWIP-SeGW shall be placed between the eNB and the WLAN network for security of packets that traverse WLAN and to protect the Operator's network.
  • The interface between the eNB and the LWIP-SeGW shall be confidentiality and integrity protected by NDS/IP TS 33.210.
  • An UE-specific IPsec security association tunnel shall be established between the UE and the public IP port of the LWIP-SeGW in tunnel mode.
  • In addition to terminating IPsec from the UE, the LWIP-SeGW shall perform rate limitation for DoS protection on the eNB and its backhaul links.
  • UEs, including authenticated and authorized UEs using LWIP, shall not have IP connectivity to the eNB.
  • IP headers created by the UE in LTE WLAN integration using IPsec tunnelling shall not be parsed by the eNB.
  • The UE and the LWIP-SeGW function shall perform mutual authentication in the phase 2 of the IKEv2 handshake during the IPsec tunnel establishment, using the authentication key derived from the current AS security association.
  • The LWIP-SeGW shall enforce binding of an authenticated UE to its IP address, and apply anti-spoofing measures on received packets for the UE's outer and inner IP source address(es).
  • The LWIP-SeGW shall ensure that uplink traffic sent by a UE is only sent towards the correct eNB by conveying the traffic to a GTP-U tunnel over Xw.
In addition, before the IPsec tunnel is established between the UE and the LWIP-SeGW, and before the offload can be performed, the UE needs to obtain IP connectivity across the WLAN network, which may require an access authentication independent of the EPC authentication, and is outside the scope of this specification.
Up

H.2  Security of LTE-WLAN integration using IPsec Tunnelling  p. 160

H.2.1  eNB to UE interaction for setting up the LWIP offload  p. 160

When the eNB initially establishes LWIP with the UE, the eNB and the UE shall generate the LWIP security key, LWIP-PSK, as specified in clause H.4, to be used as the PSK for the IPsec tunnel set up between the UE and the LWIP-SeGW, as described in clause H.2.2.
The eNB shall provide to the UE, over the secure RRC signalling, the following parameters:
  • IP address of the LWIP-SeGW for the IKEv2 handshake,
  • The Initiator Identity value, IDi, that the UE shall use in the IKEv2 handshake.
  • LWIP counter that the UE shall use in LWIP-PSK derivation.
Up

H.2.2  UE to LWIP-SeGW interaction for setting up the LWIP offload  p. 161

LTE-WLAN integration (LWIP) over legacy WLAN is secured using an IPSec in a tunnel mode established between the UE, via the WLAN, and the LWIP-SeGW function. The IPsec in tunnel mode is established using the IKEv2 handshake based on the pre-shared key, PSK as specified in IETF RFC 7296 [38]. The UE and LWIP-SeGW shall use the LWIP-PSK as the PSK for authentication in the second phase of IKEv2.
In the IPsec tunnel between the UE and the LWIP-SeGW, the inner IP addresses shall be identical to the outer IP addresses. I.e., in UL the source IP address shall be the IP address of the UE in the WLAN network and the destination IP address shall be the public IP address of the SeGW, and in DL the source IP address shall be the public IP address of the SeGW and the destination IP address shall be the IP address of the UE in the WLAN network.
If the UE is located behind a NAT, the following will hold for the IPsec tunnel between the UE and the LWIP-SeGW:
  • In UL between the UE and the NAT, the source IP address will be the local address of the UE in the WLAN.
  • In DL between the LWIP-SeGW and the NAT, the destination IP address will be the public IP address under which the UE located behind the NAT is reachable.
  • The NAT will then overwrite the address of the UE in the outer IP header during transport.
When conducting the IKEv2 handshake, the UE shall use the value of IDi and the IP address of the LWIP-SeGW received from the eNB.
The LWIP-SeGW shall use the received value of IDi to locate the corresponding LWIP-PSK.
After successful completion of the IKEv2 handshake, the LWIP-SeGW and the UE shall store the LWIP-PSK. When the IKEv2 SA is deleted, the LWIP-SeGW and the UE shall delete the LWIP-PSK.
For LWIP offloaded traffic, the eNB shall only be reachable through the LWIP-SeGW.
The LWIP-SeGW shall allow communication of the UE only to the eNB that initiated the LWIP offload, and only to the interface on this eNB allowed for the LWIP offload.
The profiles for IKEv2 and IPsec ESP as defined in TS 33.210 shall be used.
Up

H.2.3  eNB to LWIP-SeGW interaction for setting the LWIP offload  p. 161

The PDCP SDUs between the eNB and LWIP SeGW shall be encapsulated in a tunnelling protocol as specified in TS 36.300 in order to avoid that the eNB needs to interpret IP packets coming from the UE.
The eNB shall inform the LWIP-SeGW function of the expected initiation of IKEv2 handshake by a UE, for subsequent establishment of the IPsec, and provide the following parameters:
  • the Initiator ID value, (IDi) that the UE will use in the IKEv2 handshake,
  • the LWIP-PSK.
The standardized Xw interface between the eNB and the LWIP-SeGW is specified in TS 36.300 and it shall be confidentiality and integrity protected by NDS/IP TS 33.210.
Up

H.3  Addition and modification of DRB in LTE-WLAN integration  p. 162

All DRBs associated with the same UE and routed through WLAN shall use the same IPSec tunnel established between the UE and the LWIP-SeGW function. The eNB manages the DRB addition and deletion as specified in TS 36.300. When the last DRB between the eNB and UE is deleted, the eNB shall instruct the LWIP-SeGW and the UE to release the IPsec tunnel.

H.4  Security Key for IKEv2 handshake  p. 162

H.4.0  LWIP counter maintenance  p. 162

The eNB shall associate a 16-bit counter, LWIP counter, with the EPS AS security context.
The LWIP counter is used when computing the LWIP-PSK for the IPSec tunnel set up. The UE and the eNB shall treat the LWIP counter as a fresh input to LWIP-PSK derivation. That is, the UE assumes that the eNB provides a fresh LWIP counter for each LWIP-PSK derivation and does not need to verify the freshness of the LWIP counter.
The eNB maintains the value of the LWIP counter for a duration of the current AS security context between UE and eNB. The UE does not need to maintain the LWIP counter after it has computed the LWIP-PSK since the eNB provides the UE with the current LWIP counter value when the UE needs to compute a new LWIP-PSK.
The eNB that supports the LWIP shall initialize the LWIP counter to '0' when the KeNB in the associated AS security context is established or refreshed. The eNB shall monotonically increment the LWIP counter for each subsequent calculation of the LWIP-PSK.
If the eNB decides to turn off the LWIP and instruct the termination of the IPSec tunnel and later decides to re-start the LWIP using IPSec tunnel without updating the KeNB, the LWIP counter value shall keep increasing, thus keeping the computed LWIP-PSK fresh.
The eNB shall refresh the KeNB of the AS security context associated with the LWIP counter before the LWIP counter wraps around. Re-freshing the KeNB is done using intra cell handover procedure as described in clause 7.2.9.3 of the present specification.
Up

H.4.1  Security Key (LWIP-PSK) Derivation  p. 162

The UE and eNB shall derive the security key LWIP-PSK for the IPsec tunnel set up as shown on the Figure H.4.1-1 and defined in Annex A.16 of the present document.
Copy of original 3GPP image for 3GPP TS 33.401, Fig. H.4.1-1: LWIP-PSK Derivation
Figure H.4.1-1: LWIP-PSK Derivation
(⇒ copy of original 3GPP image)
Up

H.4.2  Security key (LWIP-PSK) update  p. 162

The eNB may update the LWIP-PSK for any reason by releasing the IPSec tunnel and restarting it in the following way . The eNB shall instruct the LWIP-SeGW function to release the current IPSec tunnel, and provide a new LWIP-PSK to support establishment of the new IPsec tunnel. The eNB shall instruct the UE over the RRC signaling to re-initiate the IKEv2 using the new LWIP-PSK to establish a new IPsec tunnel.

H.5  Handover procedures  p. 163

During S1 and X2 handover, the IPsec tunnel between the UE and the LWIP-SeGW shall be released. The eNB shall instruct the LWIP-SeGW and the UE to release the IPsec. Both the LWIP-SeGW and the UE shall delete the LWIP-PSK.

H.6  LWIP radio link failure  p. 163

When a LTE radio link failure is detected, the IPsec tunnel between the UE and the LWIP SeGW shall be released, either by the eNB informing the LWIP-SeGW of this event, or at the UE. Both the LWIP-SeGW and the UE shall delete the LWIP-PSK.
If the IPsec tunnel between the UE and the LWIP-SeGW is released due to WLAN connectivity issues, a fresh LWIP IPsec tunnel set up may be performed when WLAN wireless connectivity is restored.

Up   Top   ToC