Content for TS 33.503 Word version: 18.3.0

1… 4… 5… 6… 6.1.3.2… 6.1.3.2.2.2 6.1.3.2.3 6.1.3.3… 6.2… 6.3… 6.3.3.2… 6.3.3.3… 6.3.4… 6.4… 7… A…

5.1 General 5.2 Network domain security 5.2.1 General 5.2.2 Security of Npc2 reference point 5.2.3 Security of UE - 5G DDNMF interface 5.2.4 Security of service-based interfaces used in 5G Prose 5.2.5 Security for UE - 5G PKMF interface
...

5 Common security procedures p. 11

5.1 General p. 11

This clause describes the security requirements and procedures that are commonly applied to different modes of ProSe communication, including unicast mode ProSe Direct Network Communication and unicast mode ProSe Indirect Network Communication via the 5G ProSe UE-to-Network Relay.

5.2 Network domain security p. 12

5.2.1 General p. 12

5G Prose uses several interfaces between network entities, e.g. Npc4 between the 5G DDNMF and the UDM, Npc8 between the 5G DDNMF and the PCF (see TS 23.304). This clause describes the security for those interfaces.

5.2.2 Security of Npc2 reference point p. 12

5.2.2.1 General p. 12

Npc2 is the reference point between the ProSe Application Server and the 5G DDNMF as specified in clause 4 of TS 23.304. When the ProSe Application Server is in a 3rd party's network, the Npc2 comprises two interfaces, i.e. the service-based interface between the 5G DDNMF and the NEF, and the N33 interface between the NEF and the Prose Application Server. When the Prose Application Server is in a MNO's network, the Npc2 is a purely service-based interface.

5.2.2.2 Security requirements p. 12

When the ProSe Application Server is controlled by a 3rd party, requirements on security aspects of NEF are captured in clause 5.9.2.3 of TS 33.501.

5.2.2.3 Security procedures p. 12

When the ProSe Application Server is controlled by a 3rd party, security procedures specified in clause 12 of TS 33.501 is applicable.

When the Prose Application Server is controlled by a MNO, security procedures specified in clause 13 of TS 33.501 is applicable.

As specified in TS 23.304, the 5G System architecture supports the service based Npc2 interface between 5G DDNMF and ProSe Application Server and optionally supports PC2 interface between the 5G DDNMF and the ProSe Application Server. The security of PC2 reference point specified in TS 33.303 shall be reused.

5.2.3 Security of UE - 5G DDNMF interface p. 12

5.2.3.1 General p. 12

PC3a is the reference point between the 5G Prose-enabled UE and the 5G DDNMF as specified in clause 4.2.5 of TS 23.304.

5.2.3.2 Security requirements p. 12

3rd parties shall not be allowed to provide configuration data impacting the 5G ProSe-related network operations to the 5G ProSe-enabled UE. The 5G ProSe-enabled UE and the 5G DDNMF shall mutually authenticate each other.

The transmission of the material for 5G Prose discovery between the 5G DDNMF and the 5G ProSe-enabled UE shall be integrity protected.

The transmission of the material for 5G Prose discovery between the 5G DDNMF and the 5G ProSe-enabled UE shall be confidentiality protected.

The transmission of the material for 5G Prose discovery between the 5G DDNMF and the 5G ProSe-enabled UE shall be protected from replays.

5.2.3.3 Security procedures for configuration transfer to UICC p. 12

See clause 5.3.3.1 in TS 33.303.

5.2.3.4 Security procedures for PC3a using GBA p. 13

For the security procedures for protecting data transfer between the UE and the 5G DDNMF on the PC3a interface, the use of either TLS v1.2 or TLS v. 1.3, as described in clause 5.3.3.2 in TS 33.303 applies with the following modifications:

The ProSe function is replaced by the 5G DDNMF.
Confidentiality protection shall be enabled.

5.2.3.5 Security procedures for PC3a using AKMA p. 13

Security procedures specified in clause B.1.3.2 of TS 33.535 is applicable with the additional changes:

The 5G DDNMF takes the role of AF.
Confidentiality protection shall be enabled.

5.2.3.6 Privacy issue in PC3a interface p. 13

PC3a interface will be used to transfer the configuration data that is used to perform 5G ProSe Direct Discovery. According to clause 6.3.1.4 of TS 23.304, the UE identity is included in the Discovery Request message. Privacy of UE identity is ensured by the confidentiality protection over PC3a interface.

5.2.4 Security of service-based interfaces used in 5G Prose p. 13

5.2.4.1 Security requirements p. 13

The 5G Prose network entities shall be able to authenticate the source of the received data communications.

The transmission of data between 5G Prose network entities shall be integrity protected.

The transmission of data between 5G Prose network entities shall be confidentiality protected.

The transmission of data between 5G Prose network entities shall be protected from replays.

5.2.4.2 Security procedures p. 13

Npc4, Npc6, Npc7, Npc8, Npc9 and Npc10 specified in clause 4.2.5 of TS 23.304, Npc11 and Npc12 specified in clause 4.2.2 are realized by corresponding NF service-based interfaces, therefore security procedures specified in clause 13 of TS 33.501 apply to these interfaces.

5.2.5 Security for UE - 5G PKMF interface p. 13

5.2.5.1 General p. 13

The 5G ProSe-enabled UEs have interactions with the 5G PKMF over the PC8 interface in the ProSe features described in clause 4.2.2.

5.2.5.2 Security requirements p. 13

The 5G PKMF for commercial services and for public safety services provides the security keys and security material affecting the 5G ProSe-related network operations to the 5G ProSe-enabled UE for discovery of a 5G ProSe UE-to-Network Relay, PC5 communication with a 5G ProSe UE-to-Network Relay, discovery of a 5G ProSe UE-to-UE Relay, and PC5 communication with a 5G ProSe UE-to-UE Relay.

The 5G ProSe-enabled UE and the 5G PKMF shall mutually authenticate each other.

The 5G System shall support that the transmission of the security keys and security material between the 5G PKMF and the 5G ProSe-enabled UE shall be integrity protected.

The 5G System shall support that the transmission of the security keys and security material between the 5G PKMF and the 5G ProSe-enabled UE shall be confidentiality protected.

The 5G System shall support that the transmission of the security keys and security material between the 5G PKMF and the 5G ProSe-enabled UE shall be protected from replays.

The 5G System shall support that the transmission of the UE identity on the PC8 interface shall be confidentiality protected.

5.2.5.3 Security procedures for PC8 using GBA p. 14

For the security procedures for protecting data transfer between the UE and the 5G PKMF on the PC8 interface, the use of either TLS v1.2 or TLS v.1.3, as described in clause 5.3.3.2 of TS 33.303 applies with the following modifications:

The ProSe function is replaced by the 5G PKMF.
Confidentiality protection shall be enabled.

5.2.5.4 Security procedures for PC8 using AKMA p. 14

Security procedures specified in clause B.1.3.2 of TS 33.535 is applicable with the additional change:

The 5G PKMF takes the role of AF.
Confidentiality protection shall be enabled.