Content for TS 33.533 Word version: 18.3.0

6.2 Security for Ranging/SL positioning UE discovery 6.2.1 General 6.2.2 Security requirements 6.2.3 Security procedures for ProSe capable UEs 6.2.4 Security procedures for V2X capable UEs 6.3 Authorization for Ranging/SL positioning service 6.3.1 General 6.3.2 Authorization requirements 6.3.3 Procedures of UE role authorization for discovery 6.3.4 Procedures of UE authorization for Ranging/SL positioning communication 6.3.5 Procedures for authorization of AF/5GC NF/LCS Client for Ranging/SL positioning service exposure 6.3.5.0 General 6.3.5.1 Authorization for the home GMLCs 6.3.5.2 Authorization for the anchor GMLCs 6.3.6 Procedures for authorization of UE for Ranging/SL positioning service exposure 6.3.6.1 General 6.3.6.3 Authorization procedure for Ranging/SL positioning service exposure through PC5 6.3.7 Procedure of UE privacy verification for UE-only operation
...

6 Security for Ranging/SL positioning features p. 11

6.2 Security for Ranging/SL positioning UE discovery p. 11

6.2.1 General p. 11

For ProSe capable UEs, the discovery procedures of both Model A and Model B defined in clause 6.3.2 of TS 23.304 are used for Ranging/SL Positioning UE discovery.

For V2X capable UEs, the procedures for V2X communication defined in clause 6.3.3 of TS 23.287 are used for Ranging/SL Positioning UE discovery.

6.2.2 Security requirements p. 11

The 5G system shall support integrity protection, confidentiality protection and anti-replay protection of discovery messages.

The SLPKMF shall be able to provision discovery security materials to ProSe capable UEs. The discovery security materials are associated with the Ranging/SL Positioning application identifier defined in TS 23.586 and used to protect the integrity of discovery messages and privacy sensitive information (e.g. UE identity) in the messages.

The ciphering algorithm for discovery message confidentiality shall be configured by the network during discovery key request procedure.

6.2.3 Security procedures for ProSe capable UEs p. 11

The security mechanisms for both models of restricted 5G ProSe UE-to-Network Relay Discovery defined in clause 6.1.3.2 of TS 33.503 are reused for ProSe capable UEs to provide protection for Ranging/SL positioning UE discovery with the following changes:

SLPKMF rather than 5G DDNMF/5G PKMF is used to provision discovery security materials for Ranging/SL positioning UE discovery.
Ranging/SL Positioning application identifier (as defined in clause 3.1 of TS 23.586) instead of the Relay Service Code (RSC) is included in the Discovery Key Request/Response messages.
The SLPKMF of the monitoring/discoverer UE discovers the SLPKMF(s) of potential announcing/discoveree UE(s) supporting the Ranging/SL Positioning application identifier based on a configured list of PLMNs supporting the corresponding Ranging/SL Positioning application.

6.2.4 Security procedures for V2X capable UEs p. 11

Based on clause 5.3.3.1 of TS 33.536, the Direct Communication Request (DCR) message is not protected for V2X capable UEs.

6.3 Authorization for Ranging/SL positioning service p. 11

6.3.1 General p. 11

According to clause 4.1 of TS 23.586, a UE capable of Ranging/SL Positioning may take different roles in various Ranging/SL Positioning operations. Each of the UEs in a Ranging/SL Positioning service acts in its own authorized role. The UE shall follow the policy/parameters defined in clause 5.1 of TS 23.586 for authorization with the network. Clause 5.6 of TS 23.586 also specifies that Ranging/SL Positioning service can be exposed to an authorized SL Positioning Client UE, 5GC NF or AF or LCS client to obtain the relative or absolution distance/direction result between two UEs capable of Ranging/SL positioning.

This clause specifies the authorization requirements and procedures for the operations in Ranging/SL positioning services wherever authorization or privacy check is required.

6.3.2 Authorization requirements p. 12

The 5G system shall support the authorization of the role of the UE (e.g. as a Target UE/SL Reference UE/SL Positioning Server UE/Located UE) in a Ranging/Sidelink Positioning service.

The 5G system shall support authorization of the UE for Ranging/SL positioning communication in unicast mode, broadcast/groupcast mode.

The 5G system shall support authorization of the AF, 5GC NF, LCS Client or SL Positioning Client UE for Ranging/SL Positioning service exposure.

The 5G system shall support privacy protection of the to-be-measured UEs for Ranging/SL Positioning service exposure.

6.3.3 Procedures of UE role authorization for discovery p. 12

For ProSe capable UEs, the role of the UE shall be authorized by the network during the procedure of discovery security materials provisioning. The UE role authorization shall be performed via the SLPKMF through Discovery Key Request/Response messages during the security procedure for Ranging/SL positioning discovery as defined in clause 6.2.3 when the UE role is included in the Discovery Key Request. The authorization information used to check whether the UE is allowed to act the announced role in a Ranging/SL positioning service is included in UE subscription data or provisioned to the UE based on TS 23.586. The SLPKMF may retrieve subscription information from the UDM or use locally configured information for authorizing the role of the UE. After UE role authorization check, the SLPKMF provisions discovery security materials to the UE, which indicates the successful authorization of the UE role.

If the UE announces its role to the peer UE(s) in DCR and DCA messages, the UE role authorization may be performed by the peer UE against its locally configured information, which can be provisioned by the application. If the UE role is not acceptable, the peer UE shall discard or reject the request directly.

6.3.4 Procedures of UE authorization for Ranging/SL positioning communication p. 12

The details of UE authorization for Ranging/SL positioning communication in unicast mode are specified in clause 6.4.3.

The details of UE authorization for Ranging/SL positioning communication in broadcast/groupcast mode are specified in clause 6.4.4.

6.3.5 Procedures for authorization of AF/5GC NF/LCS Client for Ranging/SL positioning service exposure p. 12

6.3.5.0 General p. 12

For the authorization of the AF, 5GC NF or LCS client for Ranging/SL Positioning service exposure, the SL-MT-LR procedure specified in TS 23.273 is taken as the baseline. The authorization shall be performed towards all the n UEs (n ≥ 2), i.e. UE1, UE2, ..., UEn in the request message. If all of the UEs grant permission for Ranging/SL Positioning exposure, the GMLC shall forward the service request from the AF,5GC NF or LCS client to the AMF. If none of the UEs grants permission for Ranging/SL Positioning exposure, the GMLC shall reject the service request. If part of the UEs grant and part of the UEs don't grant permission for Ranging/SL Positioning exposure, the GMLC shall decide to proceed with or reject the service request from the AF, 5GC NF or LCS client based on the privacy check results of the n UEs and a criterion up to implementation, e.g. a local rule configured by the network operator. If the GMLC decides to accept the service request, it shall only include the identities of the UEs granting permission in the service request forwarded to the AMF.

When receiving the Ranging/SL Positioning service request from the AF,5GC NF or LCS client, the GMLC (i.e. anchor GMLC) interacts with the UDM to check the UE privacy profile. for Ranging/SL Positioning service as specified in Annex B for the UEs belonging to the same PLMN If any of n UEs belong to different PLMNs, then the anchor GMLC sends a request to the Home GMLC of each of those UEs to check the Ranging/SL positioning privacy profiles of the UEs.

6.3.5.1 Authorization for the home GMLCs p. 13

The Home GMLCs of each of those UEs queries the UDM in its own PLMN to check the UE privacy profile and sends back the privacy check result to the anchor GMLC. When the Home GMLC of each of those UE checks UE Ranging/SL Positioning privacy profile and if privacy check related action (e.g. notification, verification) towards the UE is required, the Home GMLC of each of those UEs shall retrieve the serving AMF from the UDM of each of the UEs and trigger privacy check of the UE towards the serving AMF of each of these UEs via VGMLC, using Ngmlc_Location_ProvideLocation and Namf_Location_ProvidePositioningInfo message which include the indicator of privacy related action for the UE and location type indicating "notification only". The serving AMF shall respond to the Home GMLC of each of the UEs with privacy check results of the UE. If the Ranging/SL Positioning service exposure is disallowed by the UE, or signalling connection establishment fails for UE notification (including UE notification with privacy verification), the serving AMF shall also include failure cause for the UE in the response message to the Home GMLC.

6.3.5.2 Authorization for the anchor GMLCs p. 13

The anchor GMLC interacts with the AMF of the target UE (which is treated as UE1 in clause 6.20.3 of TS 23.273) to request the ranging/SL positioning result of UEs based on the SL-MT-LR procedure as specified in clause 6.20.3 of TS 23.273, which may include an indication of a privacy related action, for each of the UEs if privacy related action is required by the UEs based on privacy profile check result from UDM and if the UEs belonging to the same PLMNand served by the same AMF as the target UE.

If one or more UEs are served by different AMF(s) and privacy related action is required, the anchor GMLC triggers privacy check of these UEs towards the serving AMF(s) of these UEs via VGMLC, using Ngmlc_Location_ProvideLocation and Namf_Location_ProvidePositioningInfo message which include the indicator of privacy related action for each of the UEs and location type indicating "notification only". If the indicator of privacy check related action for each of the UEs indicates that the UEs shall either be notified or notified with privacy verification, a notification invoke message is sent to each of the UEs by the serving AMF(s) if the NAS connection is established. The serving AMF(s) shall respond to the anchor GMLC with privacy check results of the UEs. If the Ranging/SL Positioning service exposure is disallowed by the UE, or NAS connection establishment fails for UE notification (including UE notification with privacy verification), the serving AMF(s) shall also include failure cause for each of the UE(s) in the response message to the anchor GMLC.

6.3.6 Procedures for authorization of UE for Ranging/SL positioning service exposure p. 13

6.3.6.1 General p. 13

According to clause 5.6.2 of TS 23.586, Ranging/SL Positioning service can be exposed to the SL Positioning Client UE through PC5. The SL Positioning Client UE shall be authorized for Ranging/SL Positioning service exposure.

6.3.6.2 Void

6.3.6.3 Authorization procedure for Ranging/SL positioning service exposure through PC5 p. 13

For Ranging/SL Positioning service exposure through PC5 (i.e. clause 6.7.1.1 of TS 23.586), the SL Positioning Client UE authorization is triggered by the Reference/Target UE during PC5 link establishment. The authorization can be performed by the network via the SLPKMF for ProSe capable UEs or by the Reference/Target UE if the authorization information is available in the UE.

For UE-only operation or before triggering SL-MO-LR for Network based operation, the UE1 receiving the Ranging/SL positioning request shall send a supplementary RSPP signalling message to UE2/../UEn to trigger privacy check for Ranging/SL positioning service exposure through PC5. The supplementary RSPP message shall include Client UE's user info ID that is received by UE1 from the Client UE. The UE1 and UE2/../UEn shall perform UE privacy check as described in clause 6.3.7 to determine whether their location related information can be exposed to Client UE.

If the Client UE is not authorized, the Ranging/SL Positioning service request shall be rejected.

6.3.7 Procedure of UE privacy verification for UE-only operation p. 14

For UE-only Operation in which the network is not involved in Ranging/Sidelink positioning, the authorization for UE privacy is based on the local configured privacy verification information to determine whether its location related information can be exposed to the UE(s) indicated in the supplementary RSPP signalling message. If the privacy verification information allows location exposure, the UE (e.g. Located UE) accepts the request to expose its location related information and proceeds. If the UE has no local privacy verification information or the privacy verification information disallows location exposure, the UE shall return privacy check reject message.

To enable privacy check of exposure to a SL Positioning Client UE via the peer UE, the peer UE shall include the user info ID of the SL Positioning Client UE in the supplementary RSPP signalling message to the UE from which the location information or related results are to be exposed.