Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.739 Word version: 18.1.0

1… 5…

5 Key issues p. 12

5.1 General p. 12

5.2 Key issues related with 5G System Enhancements for Edge Computing p. 12

5.2.1 Key issue #1.1: How to authorize PDU session to support local traffic routing to access an EHE in the VPLMN p. 12

5.2.1.1 Key issue details p. 12

5.2.1.2 Threats p. 12

5.2.1.3 Potential security requirements p. 12

5.2.2 Key issue #1.2: Security of EAS discovery procedure via V-EASDF in VPLMN p. 12

5.2.2.1 Key issue details p. 12

5.2.2.2 Threats p. 12

5.2.2.3 Potential security requirements p. 13

5.3 Key issues related with enhanced architecture for enabling Edge Applications p. 13

5.3.1 Key Issue #2.1: Authentication and authorization of the EEC/UE by the ECS/EES p. 13

5.3.1.1 Key issue details p. 13

5.3.1.2 Security threats p. 13

5.3.1.3 Potential security requirements p. 13

5.3.2 Key issue #2.2: Authentication mechanism selection between EEC and ECS/EES p. 14

5.3.2.1 Key issue details p. 14

5.3.2.2 Security threats p. 14

5.3.2.3 Potential security requirement p. 14

5.3.3 Key issue #2.3: Authentication and Authorization between V-ECS and H-ECS p. 14

5.3.3.1 Key issue details p. 14

5.3.3.2 Threats p. 14

5.3.3.3 Potential security requirements p. 14

5.3.4 Key issue #2.4: Transport security for the EDGE10 interface p. 15

5.3.4.1 Key issue details p. 15

5.3.4.2 Threats p. 15

5.3.4.3 Potential security requirements p. 15

5.3.5 Key issue #2.5: Authentication and Authorization between AC and EEC p. 15

5.3.5.1 Key issue details p. 15

5.3.5.2 Threats p. 15

5.3.5.3 Potential security requirements p. 15

5.3.6 Key issue #2.6: New KI on authorization between EESes p. 15

5.3.6.1 Key issue details p. 15

5.3.6.2 Threats p. 16

5.3.6.3 Potential security requirements p. 16

5.3.7 Key issue #2.7: EEC provided information verification p. 16

5.3.7.1 Key issue details p. 16

5.3.7.2 Threats p. 16

5.3.7.3 Potential security requirements p. 17

6 Proposed solutions p. 17

6.0 Mapping of Solutions to Key Issues p. 17

6.1 Solution #1: Authentication and authorization between EEC hosted in the roaming UE and ECS p. 18

6.1.1 Solution overview p. 18

6.1.2 Solution details p. 19

6.1.3 Solution evaluation p. 20

6.2 Solution #2: Authentication and authorization between EEC hosted in the roaming UE and EES p. 20

6.2.1 Solution overview p. 20

6.2.2 Solution details p. 21

6.2.3 Solution evaluation p. 22

6.3 Solution #3: Authentication mechanism selection between EEC and ECS p. 22

6.3.1 Solution overview p. 22

6.3.2 Solution details p. 23

6.3.2.1 ECS configuration p. 23

6.3.3 Solution evaluation p. 24

6.4 Solution #4: Authentication mechanism selection between EEC and EES p. 24

6.4.1 Solution overview p. 24

6.4.2 Solution details p. 24

6.4.2.1 EES profile p. 25

6.4.3 Solution evaluation p. 25

6.5 Solution #5: 5GC-based authentication mechanism selection between EEC and ECS/EES p. 25

6.5.1 Solution overview p. 25

6.5.2 Solution details p. 26

6.5.3 Solution evaluation p. 27

6.6 Solution #6: ECS/EES authentication method information provisioning p. 27

6.6.1 Solution overview p. 27

6.6.2 Solution details p. 27

6.6.3 Solution evaluation p. 27

6.7 Solution #7: Negotiation procedure for the Authentication and Authorization p. 28

6.7.1 Solution overview p. 28

6.7.2 Solution details p. 28

6.7.3 Solution evaluation p. 29

6.8 Solution #8: Authentication mechanisms selected by ECS/EES p. 29

6.8.1 Solution overview p. 29

6.8.2 Solution details p. 29

6.8.2.1 Authentication between EEC and ECS p. 29

6.8.2.2 Authentication between EEC and EES p. 29

6.8.3 Solution evaluation p. 29

6.9 Solution #9: Authentication mechanism selection procedure between EEC and ECS p. 29

6.9.1 Solution overview p. 29

6.9.2 Solution details p. 30

6.9.3 Solution evaluation p. 30

6.10 Solution #10: Authentication mechanism selection procedure between EEC and EES p. 30

6.10.1 Solution overview p. 30

6.10.2 Solution details p. 30

6.10.3 Solution evaluation p. 31

6.11 Solution #11: Authentication mechanism selection procedure among EEC, ECS, and EES p. 31

6.11.1 Solution overview p. 31

6.11.2 Solution details p. 31

6.11.3 Solution evaluation p. 32

6.12 Solution #12: Authorization for PDU session supporting local traffic routing to access an EHE in the VPLMN p. 33

6.12.1 Introduction p. 33

6.12.2 Solution details p. 33

6.12.3 Solution evaluation p. 33

6.13 Solution #13: A solution for authentication of EEC/UE and GPSI verification by EES/ECS p. 33

6.13.1 Solution overview p. 33

6.13.2 Solution details p. 33

6.13.3 Solution evaluation p. 35

6.14 Solution #14: A solution for authentication of UE and GPSI verification by EES/ECS p. 35

6.14.1 Solution overview p. 35

6.14.2 Solution details p. 35

6.14.3 Solution evaluation p. 36

6.15 Solution #15: Authentication algorithm selection procedure between EEC and ECS p. 36

6.15.1 Solution overview p. 36

6.15.2 Solution details p. 36

6.15.3 Solution evaluation p. 38

6.16 Solution #16: Authentication algorithm selection procedure between EEC and EES p. 38

6.16.1 Solution overview p. 38

6.16.2 Solution details p. 38

6.16.3 Solution evaluation p. 39

6.17 Solution #17: Using existing AKMA/GBA negotiation mechanism p. 40

6.17.1 Solution overview p. 40

6.17.2 Solution details p. 40

6.17.2.1 Shared key based EEC/UE authentication and certificate based ECS/EES authentication p. 40

6.17.2.2 Shared key based mutual authentication p. 40

6.17.2.2.1 Shared key based mutual authentication in TLS 1.2 p. 40

6.17.2.2.2 Shared key based mutual authentication in TLS 1.3 p. 41

6.17.2.3 Handling EEC authentication negotiation failure p. 41

6.17.2.4 GPSI verification p. 41

6.17.3 Solution evaluation p. 41

6.18 Solution #18: Authentication and Authorization between V-ECS and H-ECS p. 42

6.18.1 Solution overview p. 42

6.18.2 Solution details p. 42

6.19 Solution #19: Authorization of V-ECS in roaming scenario p. 42

6.19.1 Solution overview p. 42

6.19.2 Solution details p. 42

6.19.3 Solution evaluation p. 43

6.20 Solution #20: Transport security for the EDGE10 interface p. 43

6.20.1 Solution overview p. 43

6.20.2 Solution details p. 43

6.20.3 Solution evaluation p. 44

6.21 Solution #21: Using local policy on authorization between EESes p. 44

6.21.1 Solution overview p. 44

6.21.2 Solution details p. 44

6.21.3 Solution evaluation p. 44

6.23 Solution #23: EAS discovery procedure protection p. 45

6.23.1 Solution overview p. 45

6.23.2 Solution details p. 45

6.23.3 Solution evaluation p. 45

6.24 Solution #24: Public key signature based ECS/EES authentication p. 46

6.24.1 Solution overview p. 46

6.24.2 Solution details p. 46

6.24.3 Solution evaluation p. 46

6.25 Solution #25: Utilizing Token-Based Solutions for EEC authentication p. 46

6.25.1 Solution overview p. 46

6.25.2 Solution details p. 47

6.25.3 Solution evaluation p. 47

6.26 Solution #26: Using authorization token on authorization between EESes p. 47

6.26.1 Solution overview p. 47

6.26.2 Solution details - Target EES Decided ACR p. 47

6.26.3 Solution details: Source EAS decided ACR p. 49

6.26.4 Solution details: S-EES executed ACR p. 50

6.26.5 Solution evaluation p. 52

6.27 Solution #27: Token-based solution for authorization between EESes p. 52

6.27.1 Solution overview p. 52

6.27.2 Solution details p. 52

6.27.3 Solution evaluation p. 53

6.28 Solution #28: Usage of randomly generated ticket to verify EEC provided IP address p. 53

6.28.1 Solution overview p. 53

6.28.2 Solution details p. 53

6.28.3 Solution evaluation p. 54

6.29 Solution #29: Authorizing the Service Consumer when Resolving an IP Address to a UE ID p. 55

6.29.1 Solution overview p. 55

6.29.2 Solution details p. 55

6.29.3 Solution evaluation p. 55

6.30 Solution #30: Usage of existing public IP address to verify EEC provided IP address p. 58

6.30.1 Solution overview p. 58

6.30.2 Solution details p. 58

6.30.3 Solution evaluation p. 59

6.31 Solution #31: AKMA/GBA based verification of EEC provided IP address p. 60

6.31.1 Solution overview p. 60

6.31.2 Solution details p. 60

6.31.3 Solution evaluation p. 61

6.32 Solution #32: KDF based verification of EEC provided IP address p. 61

6.32.1 Solution overview p. 61

6.32.2 Solution details p. 61

6.32.3 Solution evaluation p. 61

6.33 Solution #33: Verification of EEC provided IP address p. 62

6.33.1 Solution overview p. 62

6.33.2 Solution details p. 62

6.33.3 Solution evaluation p. 62

6.34 Solution #34: Verification of EEC provided IP address using access token p. 63

6.34.1 Solution overview p. 63

6.34.2 Solution details p. 63

6.34.3 Solution evaluation p. 63

7 Conclusions p. 64

7.1 Conclusions for Key Issue #2.4 p. 64

7.2 Conclusions for Key Issue #2.3 p. 64

7.3 Conclusions for Key Issue #2.5 p. 64

7.4 Conclusions for Key Issue #1.1 p. 64

7.5 Conclusions for Key Issue #2.1 p. 64

7.6 Conclusions for Key Issue#2.2 p. 64

7.7 Conclusions for Key Issue #2.6 p. 65

7.8 Conclusions for Key Issue #1.2 p. 65

7.9 Conclusions for Key Issue #2.7 p. 65

$ Change history p. 66