Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.754 Word version: 19.0.0

1… 5…

5 Key issues p. 9

5.1 Key Issue #1: Authentication of UE in ATSSS over Non-Integrated Non-3GPP Access p. 9

5.1.1 Key issue details p. 9

5.1.2 Security threats p. 10

5.1.3 Potential security requirements p. 10

5.2 Key Issue #2: Confidentiality and integrity protection of the communication between UE and 5GCore in Non-Integrated Non-3GPP Access. p. 10

5.2.1 Key issue details p. 10

5.2.2 Security threats p. 10

5.2.3 Potential security requirements p. 11

6 Solutions p. 11

6.0 Mapping of solutions to key issues p. 11

6.1 Solution #1: Using 3GPP security context to derive authentication pre-shared key for NIN3A p. 11

6.1.1 Introduction p. 11

6.1.2 Solution details p. 11

6.1.3 Evaluation p. 12

6.2 Solution #2: AUSF based authentication mechanism for UE and UPF p. 12

6.2.1 Introduction p. 12

6.2.2 Solution details p. 13

6.2.2.1 Delivery of UPF information p. 13

6.2.2.2 Authentication based on AUSF p. 13

6.2.3 Evaluation p. 14

6.3 Solution #3: Authentication, confidentiality, and integrity protection of UE in ATSSS while selecting MPQUIC p. 14

6.3.1 Introduction p. 14

6.3.2 Solution details p. 15

6.3.3 Evaluation p. 16

6.4 Solution #4: Secure Authentication and Connectivity for UE in ATSSS over NIN3A p. 16

6.4.1 Introduction p. 16

6.4.2 Solution details p. 16

6.4.3 Evaluation p. 19

6.5 Solution #5: UE authentication and traffic protection in ATSSS-Lite p. 19

6.5.1 Introduction p. 19

6.5.2 Solution details p. 19

6.5.2.1 Background p. 19

6.5.2.2 UE authentication and PDU establishment over 3GPP access p. 20

6.5.2.3 UE authentication over non-3GPP access p. 21

6.5.2.4 UPF IP address exposure p. 22

6.5.3 Evaluation p. 22

6.5.3.1 UE authentication (KI#1) p. 22

6.5.3.2 Confidentiality and integrity protection (KI#2) p. 23

6.5.3.3 Privacy considerations (KI#1) p. 23

6.5.3.4 System impact p. 23

6.6 Solution #6: Using IPsec to authenticate UE and UPF for non-3GPP access p. 23

6.6.1 Introduction p. 23

6.6.2 Solution details p. 23

6.6.3 Evaluation p. 25

6.7 Solution #7: Omitting IPsec for MPQUIC traffic over non-3GPP access p. 25

6.7.1 Introduction p. 25

6.7.2 Solution details p. 26

6.7.3 Evaluation p. 27

6.8 Solution #8: User plane data protection mechanism between UE and UPF p. 27

6.8.1 Introduction p. 27

6.8.2 Solution details p. 28

6.8.3 Evaluation p. 28

7 Conclusions p. 28

7.1 Key Issue #1: Authentication of UE in ATSSS over Non-Integrated Non-3GPP Access p. 28

7.2 Key Issue #2: Confidentiality and integrity protection of the communication between UE and 5GCore in Non-Integrated Non-3GPP Access. p. 28

$ Change history p. 29