Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.700-32 Word version: 19.0.0

1… 5…

5 Key issues p. 9

5.1 Key Issue #1: Authentication and Authorization of Human User ID p. 9

5.1.1 Key issue details p. 9

5.1.2 Security threats p. 9

5.1.3 Potential security requirements p. 10

5.2 Key Issue #2: User privacy p. 10

5.2.1 Key issue details p. 10

5.2.2 Security threats p. 10

5.2.3 Potential security requirements p. 10

5.3 Key issue #3: Authentication and Authorization of one or more non-3GPP devices behind one gateway UE or 5G-RG p. 10

5.3.1 Key issue details p. 10

5.3.2 Security Threats p. 10

5.3.3 Potential security requirements p. 10

6 Solutions p. 11

6.0 Mapping of Solutions to Key Issues p. 11

6.1 Solution #1: User authentication and authorization of human user p. 11

6.1.1 Introduction p. 11

6.1.2 Solution details p. 11

6.1.3 Evaluation p. 12

6.2 Solution #2: User Authentication and Authorization via AMF p. 12

6.2.1 Introduction p. 12

6.2.2 Solution details p. 13

6.2.3 Evaluation p. 14

6.3 Solution #3: User Authentication and Authorization over NAS p. 14

6.3.1 Introduction p. 14

6.3.2 Solution details p. 15

6.3.3 Evaluation p. 16

6.4 Solution #4: Security protection of human user privacy p. 16

6.4.1 Introduction p. 16

6.4.2 Solution details p. 16

6.4.2.1 KUIA deriving p. 16

6.4.2.2 User_ID activation and privacy protection p. 17

6.4.2.3 Derivation of User-ID related material p. 18

6.4.3 Evaluation p. 19

6.5 Solution #5: User authentication and authorization p. 19

6.5.1 Introduction p. 19

6.5.2 Solution details p. 19

6.5.3 Evaluation p. 20

6.6 Solution #6: Human User authentication of through NAS procedure p. 20

6.6.1 Introduction p. 20

6.6.2 Solution Details p. 20

6.6.3 Evaluation p. 22

6.7 Solution #7: Authentication and Authorization of Human User ID p. 22

6.7.1 Introduction p. 22

6.7.2 Solution Details p. 23

6.7.4 Evaluation p. 24

6.8 Solution #8: User authentication with preconfigured credential p. 24

6.8.1 Introduction p. 24

6.8.2 Solution details p. 24

6.8.2.1 Description p. 24

6.8.2.2 User authentication procedure with the UAAF deployed by operator p. 25

6.8.2.3 User authentication procedure with the AAA-S deployed by third party p. 26

6.8.3 Evaluation p. 27

6.10.1 Introduction p. 30

6.10.2 Solution details p. 30

6.10.3 Evaluation p. 31

6.11 Solution #11: Re-using existing mechanisms for user privacy p. 31

6.11.1 Introduction p. 31

6.11.2 Solution details p. 31

6.11.3 Evaluation p. 31

6.12 Solution #12: authorization of non-3GPP devices behind 5G-RG p. 32

6.12.1 Introduction p. 32

6.12.2 Solution details p. 32

6.12.3 Evaluation p. 33

6.13 Solution #13: Authentication and Authorization procedure of N3D behind gateway UE or 5G-RG p. 33

6.13.1 Introduction p. 33

6.13.2 Solution details p. 33

6.13.2.1 Authentication Procedure p. 33

6.13.2.2 Re-Authentication procedure p. 36

6.13.2.3 Authentication and Authorization revocation p. 36

6.13.4 Evaluation p. 37

6.14 Solution #14: Authentication and authorization of non-3GPP devices p. 37

6.14.1 Introduction p. 37

6.14.2 Solution details p. 37

6.14.3 Evaluation p. 37

6.15 Solution #15: Authentication of user behind the UE p. 37

6.15.1 Introduction p. 37

6.15.2 Solution details p. 38

6.15.2.1 Concept p. 38

6.15.2.2 Solution flow p. 38

6.15.3 Evaluation p. 40

6.16 Solution #16: User Authentication and Authorization p. 40

6.16.1 Introduction p. 40

6.16.2 Solution details p. 41

6.16.2.1 User Initiated procedure p. 41

6.16.2.2 Network Initiated procedure p. 42

6.16.3 Evaluation p. 43

6.17 Solution #17: Solution for exposure privacy issue p. 44

6.17.1 Introduction p. 44

6.17.2 Solution details p. 44

6.17.2.1 Exposure of user profile information p. 44

6.17.2.2a Exposure of linked UE subscription information associated with User Identifier p. 44

6.17.2.2b Exposure of linked UE subscription information associated with User Identifier to AMF/SMF (internal NFs) p. 45

6.17.3 Evaluation p. 46

6.18 Solution #18: User privacy during the connection with 5GC p. 47

6.18.1 Introduction p. 47

6.18.2 Solution details p. 47

6.18.2.1 Mobility or attaching to other access scenarios: p. 48

6.18.3 Evaluation p. 48

6.19 Solution #19: User privacy protection p. 48

6.19.1 Introduction p. 48

6.19.2 Solution details p. 49

6.19.3 Evaluation p. 49

6.20 Solution #20: privacy protection for user ID over the air p. 50

6.20.1 Introduction p. 50

6.20.2 Details p. 50

6.20.3 Evaluation p. 50

6.21 Solution #21: A&A of non-3GPP devices behind UE or 5G-RG based on secondary authentication p. 50

6.21.1 Introduction p. 50

6.21.2 Solution details p. 50

6.21.3 Evaluation p. 51

6.22 Solution #22: User authentication with credentials derived by AUSF p. 51

6.22.1 Introduction p. 51

6.22.2 Solution details p. 51

6.22.2.1 Description p. 51

6.22.2.2 User activation procedure with the AUSF and UIMF p. 52

6.22.2.3 Key hierarchy for user authentication with derived credential p. 54

6.22.2.4 User authentication procedure with the UAAF p. 54

6.22.2.5 Derivation of KUIA and KUSER p. 55

6.22.3 Evaluation p. 56

6.23 Solution #23: User Authentication with EAP-PSK p. 56

6.23.1 Introduction p. 56

6.23.2 Solution details p. 57

6.23.3 Evaluation p. 58

6.24 Solution #24: User ID privacy protection based on EAP-TLS protocol using pseudonym mechanism p. 58

6.24.1 Introduction p. 58

6.24.2 Solution details p. 58

6.24.3 Evaluation p. 59

6.25 Solution #25: User Authentication with Certificate Generated by an authorized UE p. 60

6.25.1 Solution Introduction p. 60

6.25.2 Solution Details p. 60

6.25.3 Evaluation p. 61

6.26 Solution #26: User authentication with credentials derived by UIMF p. 61

6.26.1 Introduction p. 61

6.26.2 Solution details p. 61

6.26.2.1 Description p. 61

6.26.2.2 KUIA generation by AUSF and UE during Registration procedure p. 62

6.26.2.3 KUSER generation by UIMF and UE during User Authentication procedure p. 64

6.26.2.4 User authentication between UE and UAAF p. 65

6.26.2.5 Key hierarchy and derivation p. 66

6.26.3 Evaluation p. 66

6.27 Solution #27: User privacy protection for UIP exposure based on RNAA p. 67

6.27.1 Introduction p. 67

6.27.2 Solution details p. 67

6.27.3 Evaluation p. 67

7 Conclusions p. 67

7.1 Key issue #1: Authentication and Authorization of Human User ID p. 67

7.2 Key issue #2: User privacy p. 67

7.3 Key issue #3: Authentication and Authorization of one or more non-3GPP devices behind one gateway UE or 5G-RG p. 68

$ Change history p. 69