Tech-invite3GPPspaceIETFspace
21222324252627282931323334353637384‑5x

Content for  TR 33.702  Word version:  19.0.0

Top   Top   Up   Prev   Next
1…   4…   5…   6…

 

5  Key issuesp. 11

5.1  Key issue #1: Security aspect of UE connecting to a new TNAP within the same TNGF.p. 11

5.1.1  Key issue detailsp. 11

When UE moves from TNAP1 to TNAP2, where both TNAPs are nearby or overlapping, the UE connectivity can break while connecting to the new TNAP2. Additionally, UE also goes through another full primary authentication procedure, even though the second non-3GPP access connects to the same TNGF.
A new full primary authentication may lead to additional signalling and may cause latency in the UE connection. If the full primary authentication is skipped, it provides connection time optimisation, but then the security aspect of UE to target TNAP/TNGF should be studied.
Up

5.1.2  Threatsp. 12

Not applicable.

5.1.3  Potential security requirementsp. 12

The 5GS should support a mechanism to establish secure connection for the UE switching from one TNAP to another TNAP within the same TNGF without performing full primary authentication.
While switching from one TNAP to another TNAP within the same TNGF, the interface between UE and the new TNAP shall be confidentiality, integrity, and replay protected.

5.2  Key issue #2: Security aspect of AUN3 device connecting to a new 5G-RG within the same W-AGF.p. 12

5.2.1  Key issue detailsp. 12

When AUN3 device moves from 5G-RG1 to 5G-RG2, where both 5G-RG are nearby or overlapping, the AUN3 device connectivity can break while connecting to the new 5G-RG2. Additionally, AUN3 also goes through another full primary authentication procedure, even though both 5G-RGs connect to the same W-AGF.
A new full primary authentication may lead to additional signalling and may cause latency in the AUN3 device connection. If the full primary authentication is skipped, it provides connection time optimisation, but then the security aspect of the AUN3 device to target 5G-RG should be studied.
Up

5.2.2  Threatsp. 12

Not applicable.

5.2.3  Potential security requirementsp. 12

The 5GS should support a mechanism to establish secure connection for the AUN3 device switching from one 5G-RG to another 5G-RG within the same W-AGF without performing full primary authentication.
While switching from one 5G-RG to another 5G-RG within the same W-AGF, the interface between AUN3 device and the new 5G-RG shall be confidentiality, integrity, and replay protected.

5.3  Key issue #3: Security aspect of N5CW device connecting to a new TWAP within the same TWIF.p. 12

5.3.1  Key issue detailsp. 12

When the N5CW device moves from TWAP1 to TWAP2, where both TWAPs are nearby or overlapping, the N5CW device connectivity can break while connecting to the new TWAP. Additionally, the N5CW device also goes through another full primary authentication procedure, even though both TWAPs connect to the same TWIF.
A new full primary authentication may lead to additional signalling and may cause latency in the N5CW device connection. If the full primary authentication is skipped, it provides connection time optimisation, but then the security aspect of the N5CW device to target TWAP should be studied.
Up

5.3.2  Threatsp. 12

Not applicable.

5.3.3  Potential security requirementsp. 13

The 5GS should support a mechanism to establish secure connection for the N5CW device switching from one TWAP to another TWAP within the same TWIF without performing full primary authentication.
While switching from one TWAP to another TWAP within the same TWIF, the interface between the N5CW device and the new TWAP shall be confidentiality, integrity, and replay protected.

5.4  Key issue #4: Security aspect of UE connecting to a new WLAN AP connected via the same NSWOF.p. 13

5.4.1  Key issue detailsp. 13

When UE moves from WLAN AP1 to WLAN AP2, where both WLAN APs are nearby or overlapping, the UE connectivity can break while connecting to the new WLAN AP. Additionally, UE also goes through another full authentication procedure at the NSWOF as defined in Annex S of TS 33.501, even though both WLAN APs connect to the same NSWOF.
A new full authentication may lead to additional signalling and may cause latency in the UE connection. This is inefficient and disrupts the user experience. If the full authentication is skipped, it provides connection time optimisation, but then the security aspect of the UE to target WLAN should be studied.
Up

5.4.2  Threatsp. 13

Not applicable.

5.4.3  Potential security requirementsp. 13

The 5GS should support a mechanism to authenticate the UE switching from one WLAN AP to another WLAN AP connected to the same NSWOF without performing full authentication.

Up   Top   ToC