Content for TS 33.501 Word version: 19.0.0

1… 4… 5… 5.3… 5.9… 5.10… 6… 6.1.3… 6.1.4… 6.2… 6.2.2… 6.3… 6.4… 6.5… 6.6… 6.7… 6.8… 6.9… 6.10… 6.11 6.12… 6.13 6.14… 6.15… 6.16… 7… 7A… 7A.2.3… 7B… 8… 9… 10… 11… 12… 13… 13.2.2… 13.2.4… 13.3… 13.4… 14… 15… 16… A… B… C… D… E… F… G… I… I.9… J… K… M… N… O… P… R S… T… U… V… W… X… Y… Z…

6.14 Steering of roaming security mechanism 6.14.1 General 6.14.2 Security mechanisms 6.14.2.1 Procedure for steering of UE in VPLMN during registration 6.14.2.2 Procedure for steering of UE in VPLMN or HPLMN after registration 6.14.2.3 SoR Counter
...

6.14 Steering of roaming security mechanism p. 116

6.14.1 General p. 116

This clause describes the security functions necessary to support steering of the UE in the VPLMN during registration procedure and also after registration as described in TS 23.122 Annex C. The security functions are described in the context of the functions supporting the control plane solution for steering of roaming in 5GS.

If the control plane solution for Steering of Roaming is supported by the HPLMN, the AUSF shall store the latest KAUSF after the completion of the latest primary authentication.

The content of the Steering List as well as the conditions for sending it to the UE are described in TS 23.122 Annex C. The Steering List includes either a list of preferred PLMN/access technology combinations, a secured packet or the HPLMN indication that 'no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed and thus no list of preferred PLMN/access technology combinations is provided'.

6.14.2 Security mechanisms p. 117

6.14.2.1 Procedure for steering of UE in VPLMN during registration p. 117

The security procedure for the case where the UE registers with VPLMN AMF is described below in Figure 6.14.2.1-1:

Reproduction of 3GPP TS 33.501, Fig. 6.14.2.1-1: Procedure for providing list of preferred PLMN/access technology combinations during registration in VPLMN

Figure 6.14.2.1-1: Procedure for providing list of preferred PLMN/access technology combinations during registration in VPLMN

Step 1.

The UE initiates registration by sending Registration Request message to the VPLMN AMF.

Step 2-3.

The VPLMN AMF executes the registration procedure as defined in subclause 4.2.2.2.2 of TS 23.502. As part of the registration procedure, the VPLMN AMF executes primary authentication of the UE and then initiates the NAS SMC procedure, after the authentication is successful.

Step 4-5.

The VPLMN AMF invokes the Nudm_UECM_Registration message to the UDM and registers access with the UDM as per step 14a in subclause 4.2.2.2.2 of TS 23.502.

Step 6.

The VPLMN AMF invokes Nudm_SDM_Get service operation message to the UDM to get amongst other information the Access and Mobility Subscription data for the UE (see step 14b in subclause 4.2.2.2.2 of TS 23.502).

Step 7.

The UDM decides to send the Steering of Roaming Information, and obtains a list of preferred PLMN/access technology combinations and optional additional SoR information (e.g. SOR-CMCI and the "Store the SOR-CMCI in the ME" indicator), or a secured packet list as described in TS 23.122.

If the UDM determines that the UE is configured to not expect to receive Steering of Roaming Information at initial registration and if the UDM determines that no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed, then the UDM may not piggyback Steering of Roaming Information at all in the Nudm_SDM_Get response and hence the following steps are omitted.

Step 8-9.

The UDM shall invoke Nausf_SoRProtection service operation message to the AUSF to get SoR-MAC-IAUSF and CounterSoR as specified in subclause 14.1.3 of this document. The UDM shall select the AUSF that holds the latest KAUSF of the UE.

If the HPLMN decides that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall set accordingly the ACK Indication included in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-MAC-IIUE, as specified in subclause 14.1.3 of this document.

The details of the CounterSoR are specified in subclause 6.14.2.3 of this document. The inclusion of the Steering List and the SoR header in the calculation of SoR-MAC-IAUSF allows the UE to verify that the received Steering of Roaming Information is not tampered with or removed by the VPLMN. The expected SoR-MAC-IIUE allows the UDM to verify that the UE received the Steering of Roaming Information.

Step 10.

The UDM responds to the Nudm_SDM_Get service operation to the VPLMN AMF, which shall include the SoR transparent container as specified in clause 6.1.6.3.2 of TS 29.503 if the VPLMN AMF support SoR transparent container, or shall include individual IEs comprising the ACK Indication, the list of preferred PLMN/access technology combinations or secured packet (if provided), SoR-MAC-IAUSF and CounterSoR within the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-MAC-IIUE.

Step 11.

If the SoR transparent container is received from the UDM, the VPLMN AMF shall include the received SoR transparent container in the Registration Accept message and send it to the UE. If the individual IEs are received from the UDM, the VPLMN AMF shall construct the SOR header based on the ACK Indication and the list of preferred PLMN/access technology combinations or secured packet (if provided) received from the UDM and include it in the SOR transparent container as specified in clause 9.11.3.51 of TS 24.501. The vPLMN shall also include SoR-MAC-IAUSFand CounterSoR(both also received from the UDM) in the constructed SoR transparent container, and convey the constructed SoR transparent container to the UE in the Registration Accept message.

Step 12.

On receiving the Registration Accept message with the SoR transparent container from the AMF the UE shall calculate the SoR-MAC-IAUSF in the same way as the AUSF (as specified in Annex A.17) on the SoR transparent container, including the CounterSoR and the SoR header, and verifies whether it matches the SoR-MAC-IAUSF value received in the Registration Accept message. Based on the SoR-MAC-IAUSF verification outcome, the behaviour of the UE is specified in TS 23.122.

Step 13.

If the UDM has requested an acknowledgement from the UE and the UE verified that the SoR transparent container received in step 12 has been provided by the HPLMN, then the UE shall send the Registration Complete message to the serving AMF. The UE shall generate the SoR-MAC-IUE as specified in Annex A.18 and includes the generated SoR-MAC-IUE in a SOR transparent container in the Registration Complete message.

Step 14.

The AMF sends a Nudm_SDM_Info request message to the UDM. If a transparent container with the SoR-MAC-IUE was received in the Registration Complete message, then if the AMF supports SoR transparent container, the AMF shall include the received SoR transparent container in SoR transparent container in the Nudm_SDM_Info request message, otherwise, the AMF shall include the SoR-MAC-IUE in the received SoR transparent container in the Nudm_SDM_Info request message.

Step 15.

If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering of Roaming Information in step 10, then the UDM shall compare the received SoR-MAC-IUE with the expected SoR-MAC-IIUE that the UDM stored temporarily in step 10.

If the UDM supports Home triggered authentication (see clause 6.1.5), the UDM based on its local policy may decide to trigger a primary authentication to refresh the SoR counter based on the value of counter received in step 9.

6.14.2.2 Procedure for steering of UE in VPLMN or HPLMN after registration p. 119

The security procedure for the steering of UE in VPLMN after registration is described below in Figure 6.14.2.2-1:

Reproduction of 3GPP TS 33.501, Fig. 6.14.2.2-1: Procedure for providing list of preferred PLMN/access technology combinations after registration

Figure 6.14.2.2-1: Procedure for providing list of preferred PLMN/access technology combinations after registration

Step 1.

The UDM decides to notify the UE of the changes to the Steering of Roaming Information by the means of invoking Nudm_SDM_Notification service operation.

Step 2-3.

The UDM shall invoke Nausf_SoRProtection service operation message by including the ACK Indication and optionally the list of preferred PLMN/access technology combinations or secured packet or SoR transparent container (only if transparent container is supported by the AMF) to the AUSF to get SoR-MAC-IAUSF and CounterSoR as specified in subclause 14.1.3 of this document. The UDM shall select the AUSF that holds the latest KAUSF of the UE.

If the HPLMN decided that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall set accordingly the ACK Indication included in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-MAC-IIUE, as specified in subclause 14.1.3 of this document.

The details of the CounterSoR are specified in subclause 6.14.2.3 of this document. The inclusion of the Steering List and the SOR header in the calculation of SoR-MAC-IAUSF allows the UE to verify that the Steering of Roaming Information received is not tampered with or removed by the VPLMN. The inclusion of these information in the calculation of the expected SoR-MAC-IIUE allows the UDM to verify that the UE received the Steering of Roaming Information.

Step 4.

The UDM shall invoke Nudm_SDM_Notification service operation, which contains the SoR transaprent container as specified in clause 6.1.6.3.2 of TS 29.503 if the VPMN AMF support SOR transparent container, or contains individual IEs including an optional the list of preferred PLMN/access technology combinations or secured packet, the ACK Indication, SoR-MAC-IAUSF, and CounterSoR within the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-MAC-IIUE.

Step 5.

Upon receiving the Nudm_SDM_Notification message, if the SoR transparent container is included in the message, the AMF shall send a DL NAS Transport message to the served UE. including the received SoR transparent container; otherwise, the AMF shall construct the SOR transparent container (including the SOR header) as specified in clause 9.11.3.51 of TS 24.501 based on the ACK Indication, the Steering List, SoR-MAC-IAUSF and CounterSoR received from the UDM, and send the constructed SoR transparent container included to the served UE in a DL NAS Transport message.

Step 6.

On receiving the DL NAS Transport message, the UE shall calculate the SoR-MAC-IAUSF in the same way as the AUSF (as specified in Annex A.17) on the received SoR transparent container, including the CounterSoR and the SoR header and verify whether it matches the SoR-MAC-IAUSF value received in the DL NAS Transport message.

Step 7.

If the UDM has requested an acknowledgement from the UE and the UE verified that the Steering Information has been provided by the HPLMN, then the UE shall send the UL NAS Transport message to the serving AMF. The UE shall generate the SoR-MAC-IUE as specified in Annex A.18 and includes the generated SoR-MAC-IUE in a SOR transparent container in the UL NAS Transport message.

Step 8.

The AMF shall send a Nudm_SDM_Info request message to the UDM. If a SOR transparent container with the SoR-MAC-IUE was received in the UL NAS Transport message, the AMF shall include the received SoR transparent container in the Nudm_SDM_Info request message if the AMF supports SoR transparent container, otherwise, the AMF shall include the SoR-MAC-IUE in the Nudm_SDM_Info request message.

Step 9.

If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall compare the received SoR-MAC-IUE with the expected SoR-MAC-IIUE that the UDM stored temporarily in step 4.

6.14.2.3 SoR Counter p. 120

The AUSF and the UE shall associate a 16-bit counter, CounterSoR, with the key KAUSF.

The UE shall initialize the CounterSoR to 0x00 0x00 when the newly derived KAUSF is stored (see clause 6.2.2.2). The UE shall store the SoR counter. If the USIM supports both 5G parameters storage and 5G parameters extended storage, then CounterSoR shall be stored in the USIM. Otherwise, CounterSoR shall be stored in the non-volatile memory of the ME

To generate the SoR-MAC-IAUSF, the AUSF shall use the CounterSoR. The CounterSoR shall be incremented by the AUSF for every new computation of the SoR-MAC-IAUSF. The CounterSoR is used as freshness input into SoR-MAC-IAUSF and SoR-MAC-IUE derivations as described in the Annex A.17 and Annex A.18 respectively, to mitigate the replay attack. The AUSF shall send the value of the CounterSoR (used to generate the SoR-MAC-IAUSF) along with the SoR-MAC-IAUSF to the UE. The UE shall only accept CounterSoR value that is greater than stored CounterSoR value. The UE shall store the received CounterSoR, only if the verification of the received SoR-MAC-IAUSF is successful. The UE shall use the stored CounterSoR received from the HPLMN, when deriving the SoR-MAC-IUE for the SoR acknowledgement.

The AUSF and the UE shall maintain the CounterSoR for lifetime of the KAUSF.

The AUSF that supports the control plane solution for steering of roaming shall initialize the CounterSoR to 0x00 0x01 when the newly derived KAUSF is stored (see clause 6.2.2.1). The AUSF shall set the CounterSoR to 0x00 0x02 after the first calculated SoR-MAC-IAUSF, and monotonically increment it for each additional calculated SoR-MAC-IAUSF. The SoR Counter value of 0x00 0x00 shall not be used to calculate the SoR-MAC-IAUSF and SoR-MAC-IUE.

The AUSF shall suspend the SoR protection service for the UE, if the CounterSoR associated with the KAUSF of the UE, is about to wrap around. When a fresh KAUSF is generated for the UE, the CounterSoR at the AUSF is reset to 0x00 0x01 as defined above and the AUSF shall resume the SoR protection service for the UE.