Content for TR 33.794 Word version: 19.0.0
5 Security Analysis and Considerations
6 Key issues
7 Solutions
8 Conclusions
A Known API Security Risks
$ Change history
5 Security Analysis and Considerations p. 10
5.1 Use cases for security evaluation and monitoring p. 10
5.1.0 General p. 10
5.1.1 Use case #1: Information on Malformed Message p. 11
5.1.1.1 Description p. 11
5.1.1.2 Relevant data p. 11
5.1.1.3 Evaluation of the identified data p. 11
5.1.2 Use case #2: Massive number of SBI Messages p. 11
5.1.2.1 Description p. 11
5.1.2.2 Relevant data p. 12
5.1.2.3 Evaluation of the identified data p. 12
5.1.3 Use case #3: Unauthorized/failed authentication NF service access request p. 12
5.1.3.1 Description p. 12
5.1.3.2 Relevant data p. 13
5.1.3.3 Evaluation of the identified data p. 13
5.1.4 Use case #4: Reconnaissance p. 13
5.1.4.1 Description p. 13
5.1.4.2 Relevant data p. 14
5.1.4.3 Evaluation of the identified data p. 14
5.1.5 Use case #5: Abnormal SBI Call Flow p. 14
5.1.5.1 Description p. 14
5.1.5.2 Relevant data p. 14
5.1.5.3 Evaluation of the identified data p. 15
5.1.6 Use case #6: API Security Risks p. 15
5.1.6.1 Description p. 15
5.1.6.2 Relevant data p. 16
5.1.6.3 Evaluation of the identified data p. 16
5.1.7 Use case #7: Attacks on network slices p. 16
5.2 Security mechanism for dynamic policy enforcement p. 17
6 Key issues p. 19
6.1 Key Issue #1: Data exposure for security evaluation and monitoring p. 19
6.1.1 Key issue details p. 19
6.1.2 Security threats p. 19
6.1.3 Potential security requirements p. 19
6.2 Key Issue #2: Security mechanisms for policy enforcement at the 5G SBA p. 20
6.2.1 Key issue details p. 20
6.2.2 Security threats p. 20
6.2.3 Potential security requirements p. 20
6.3 Mapping of Solutions to Key Issues p. 20
7 Solutions p. 21
7.1 Solution #1: Network assisted potential data collection and exposure for security evaluation and monitoring p. 21
7.2 Solution #2: Potential data collection and direct exposure for security evaluation and monitoring p. 24
7.3 Solution #3: New Data Collection NFs p. 26
7.3.1 Introduction p. 26
7.3.2 Solution details p. 27
7.3.2.1 General p. 27
7.3.2.2 SDPI registration and data collection rule configuration p. 27
7.3.3.2 Data Collection p. 28
7.3.2.4 Data delivery p. 29
7.3.3 Evaluation p. 30
7.4 Solution #4: Security data collection and exposure to enable detection of compromised NFs in SBA layer p. 30
7.5 Solution #5: Security log events and counter collection for evaluation and monitoring. p. 32
7.6 Solution #6: Data Collection using DCCF p. 33
7.6.1 Introduction p. 33
7.6.2 Solution details p. 34
7.6.2.1 NF profile updates p. 34
7.6.2.2 Data Collection Configuration p. 34
7.6.2.3 Data delivery p. 35
7.6.2.4 Security data p. 35
7.6.3 Evaluation p. 35
7.7 Solution #7: Security data collection and exposure to enable detection of API security risks p. 36
7.8 Solution #8: Using security log events, counters and protocol signaling monitoring p. 38
7.8.1 Introduction p. 38
7.8.2 Solution details p. 38
7.8.2.1 General p. 38
7.8.2.2 Use case #1: Information on Malformed Message p. 38
7.8.2.3 Use case #2: Massive number of SBI Messages p. 38
7.8.2.4 Use case #3: Unauthorized/failed authentication NF service access request p. 38
7.8.2.5 Use case #4: Reconnaissance p. 39
7.8.2.6 Use case #5: Abnormal SBI Call Flow p. 39
7.8.2.7 Use case #6: API Security Risks p. 39
7.8.3 Evaluation p. 39
7.9 Solution #9: Security Policy enforcement in SBA p. 39
7.10 Solution #10: Enhancement of SBA access control decision mechanisms p. 41
7.11 Solution #11: Dynamic Security Policy Enforcement Framework p. 43
7.12 Solution #12: Policy enforcement using NRF configuration and short access token lifetime p. 45
7.12.1 Introduction p. 45
7.12.2 Solution details p. 45
7.12.2.0 Overview p. 45
7.12.2.1 Policy Enforcement at the NF subject to an attack p. 47
7.12.2.2 Policy Enforcement at NF producers p. 47
7.12.2.3 Policy Enforcement at NF consumers p. 47
7.12.2.4 Policy Enforcement at the NRF p. 47
7.12.2.5 Policy Enforcement at the SCP p. 48
7.12.2.6 Summary p. 48
7.12.3 Evaluation p. 48
8 Conclusions p. 50
8.1 Key Issue #1: Data exposure for security evaluation and monitoring p. 50
8.2 Key Issue #2: Security mechanisms for policy enforcement at the 5G SBA p. 50
A Known API Security Risks p. 51
A.1 Description p. 51
$ Change history p. 54
