Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.839 Word version: 17.1.0

1… 4… 6…

6 Proposed solutions p. 20

6.0 Mapping of Solutions to Key Issues p. 20

6.1 Solution #1: DNS request protection p. 21

6.1.1 Introduction p. 21

6.1.2 Solution details p. 21

6.1.3 Solution Evaluation p. 21

6.2 Solution #2: Authentication between EEC and ECS based on primary authentication p. 22

6.2.1 Introduction p. 22

6.2.2 Solution details p. 22

6.2.2.1 Procedure p. 22

6.2.2.2 Derivation of Kedge and Kedge ID p. 23

6.2.2.3 Generation of MACEEC p. 23

6.2.3 Solution Evaluation p. 23

6.3 Solution #3: Authentication/Authorization framework for Edge Enabler Client and Servers p. 24

6.3.1 Introduction p. 24

6.3.2 Solution details p. 24

6.3.3 Solution evaluation p. 26

6.4 Solution #4: Authentication/Authorization framework for Edge Enabler Client and Servers p. 26

6.4.1 Introduction p. 26

6.4.2 Solution details p. 27

6.4.3 Solution evaluation p. 28

6.5 Solution #5: Authentication and Authorization between the Edge Enabler Client and the Edge Enabler Server p. 29

6.5.1 Introduction p. 29

6.5.2 Solution details p. 29

6.5.3 Solution evaluation p. 30

6.6 Solution #6: Authentication and Authorization between the Edge Enabler Client and the Edge Enabler Server p. 30

6.6.1 Introduction p. 30

6.6.2 Solution details p. 31

6.6.3 Solution evaluation p. 32

6.7 Solution #7: Authentication and Authorization with the Edge Data Network p. 32

6.7.1 Solution overview p. 32

6.7.3 Solution evaluation p. 35

6.8 Solution #8: Authentication between EEC and EES p. 36

6.8.1 Solution overview p. 36

6.8.2 Solution details p. 36

6.8.3 Solution evaluation p. 37

6.9 Solution #9: Authentication and authorization between EEC and ECS based on AKMA p. 37

6.9.1 Introduction p. 37

6.9.2 Solution details p. 38

6.9.3 Solution Evaluation p. 39

6.10 Solution #10: Authentication and Authorization between the Edge Enabler Client and the Edge Configuration Server p. 39

6.10.1 Introduction p. 39

6.10.2 Solution details p. 40

6.10.3 Solution Evaluation p. 40

6.11 Solution #11: Authentication between EEC and ECS p. 40

6.11.1 Solution overview p. 40

6.11.2 Solution details p. 41

6.11.3 Solution evaluation p. 42

6.12 Solution #12: Onboarding and authentication/authorization framework for Edge Enabler Server and Edge Configuration Server p. 42

6.12.1 Introduction p. 42

6.12.2 Solution details p. 43

6.12.3 Solution evaluation p. 44

6.13 Solution #13: Transport security for EDGE-1-9 interfaces p. 44

6.13.1 Introduction p. 44

6.13.2 Solution details p. 44

13.2.0 General p. 44

6.13.2.1 Type A p. 44

6.13.2.2 Type B p. 44

6.13.2.3 Type C p. 45

6.13.3 Solution Evaluation p. 45

6.14 Solution #14: Protection of Network Information Provisioning to Local AF directly p. 45

6.14.1 Solution overview p. 45

6.14.2 Solution details p. 46

6.14.3 Solution evaluation p. 46

6.15 Solution #15: Network capability re-exposure via Edge Enabler Server p. 47

6.15.1 Introduction p. 47

6.15.2 Solution details p. 47

6.15.3 Solution Evaluation p. 47

6.16 Solution #16: EEC authentication and authorization framework with ECS and EES p. 48

6.16.1 Introduction p. 48

6.16.2 Solution details p. 48

6.16.3 Solution Evaluation p. 49

6.17 Solution #17: EEC/EES/ECS authentication and transport protection with TLS p. 50

6.17.1 Solution overview p. 50

6.17.2 Solution details p. 50

6.17.2.1 Authentication and transport protection for the EDGE-1, EDGE-3, EDGE-4, EDGE-6 and EDGE-9 interfaces p. 50

6.17.2.2 Authentication of the GPSI in EEC-EES/ECS communication p. 51

6.17.3 Solution evaluation p. 52

6.18 Solution #18: Authentication and Authorization Framework for EDGE-4 interfaces using Primary authentication and proxy interface p. 53

6.18.1 Introduction p. 53

6.18.2 Solution details p. 54

6.18.3 Solution Evaluation p. 55

6.19 Solution #19: Authentication/authorization between UE and Edge Data Network based on the secondary authentication p. 55

6.19.1 Introduction p. 55

6.19.2 Solution details p. 55

6.19.3 Solution Evaluation p. 56

6.20 Solution #20: Authentication and authorization in EES capability exposure based on CAPIF p. 56

6.20.1 Introduction p. 56

6.20.2 Solution details p. 56

6.20.3 Solution Evaluation p. 57

6.21 Solution #21: security for the interface between the SMF and LDNSR p. 57

6.21.1 Solution overview p. 57

6.21.2 Solution details p. 57

6.21.3 Solution evaluation p. 58

6.22 Solution #22: Authorization during Edge Data Network change p. 58

6.22.1 Introduction p. 58

6.22.2 Solution details p. 58

6.22.3 Solution Evaluation p. 60

6.23 Solution #23: Authentication and Authorization between EEC and ECS/EES p. 60

6.23.1 Solution overview p. 60

6.23.2 Solution details p. 60

6.23.3 Solution evaluation p. 60

6.24 Solution #24: Using TLS with AKMA to protect edge interfaces p. 61

6.24.1 Solution overview p. 61

6.24.2 Solution details p. 61

6.24.2.1 General p. 61

6.24.2.2 Shared key-based UE authentication with certificate-based AF authentication p. 61

6.24.2.2.1 General p. 61

6.24.1.2.2 Procedures p. 61

6.24.2.3 Shared key-based mutual authentication between UE and AF p. 62

6.24.2.3.1 General p. 62

6.24.2.3.2 Procedures p. 62

6.24.3 Solution evaluation p. 62

6.25 Solution #25: Practical authorization during Edge Data Network change p. 62

6.25.1 Introduction p. 62

6.25.2 Solution details p. 63

6.25.3 Solution Evaluation p. 64

6.26 Solution #26: GBA-based solution for EEC authentication and authorization framework with ECS and EES p. 64

6.26.1 Introduction p. 64

6.26.2 Solution details p. 64

6.26.3 Solution Evaluation p. 66

6.27 Solution #27: Using TLS with Edge Security Service to protect edge interfaces p. 67

6.27.1 Solution overview p. 67

6.27.2 Solution details p. 68

6.27.3 Solution evaluation p. 70

6.28 Solution #28: Authentication between EEC and ECS based on AKMA p. 70

6.28.1 Introduction p. 70

6.28.2 Solution details p. 70

6.28.2.1 Procedure p. 70

6.28.2.2 Derivation of Kedge and Kedge ID p. 71

6.28.2.3 Generation of MACEEC p. 72

6.28.3 Solution Evaluation p. 72

6.29 Solution #29: Using TLS with GBA to protect edge interfaces p. 72

6.29.1 Solution overview p. 72

6.29.2 Solution details p. 72

6.29.2.1 General p. 72

6.29.2.2 Shared key-based UE authentication with certificate-based AF authentication p. 72

6.29.2.2.1 General p. 72

6.29.2.3 Shared key-based mutual authentication between UE and AF p. 72

6.29.2.3.1 General p. 72

6.29.3 Solution evaluation p. 73

6.30 Solution #30: An AKMA-based solution for authentication and interface protection between EEC and EES/ECS p. 73

6.30.1 Solution overview p. 73

6.30.2 Solution details p. 73

6.30.3 Solution evaluation p. 74

6.31 Solution #31: Enhancing TLS with GBA for usage with Edge p. 75

6.31.1 Solution overview p. 75

6.31.2 Solution details p. 75

6.31.3 Solution evaluation p. 75

7 Conclusions p. 75

7.1 Conclusions for Key Issue #1 p. 75

7.2 Conclusions for Key Issue #2 p. 76

7.3 Conclusions for Key Issue #3 p. 76

7.4 Conclusions for Key Issue #4 p. 76

7.5 Conclusions for Key Issue #5 p. 76

7.6 Conclusions for Key Issue #6 p. 76

7.7 Conclusions for Key Issue #7 p. 77

7.8 Conclusions for Key Issue #8 p. 77

7.9 Conclusions for Key Issue #9 p. 77

7.10 Conclusions for Key Issue #10 p. 77

$ Change history p. 78