Content for  TR 33.854  Word version:  17.1.0

The solution address key issue #1 and #6. This solution assumes the following based on clause 4.2 of TR 23.754, Architecture assumptions:

• A UAV is assigned, a CAA-level UAV Identity by functions in the aviation domain (e.g. USS) or by functions in the USS/UTM.
• The 3GPP CN is aware of the CAA-level UAV Identity. A mapping is possible in the mobile operator network and in the UAS application layer outside of 3GPP between the 3GPP UAV ID and the CAA-level UAV ID.

The solution also further assumes that, the long-term security credentials for UAV were also assigned and provided along with the CAA-level UAV ID by the USS/UTM which is out of 3GPP scope. This solution is applicable to EPC and 5GS.The solution addresses the following:

• Enables USS/UTM to authenticate and authorize the UAV(s) to access and use the USS/UTM services securely.

UAS Authentication and Authorization (UAA) Revocation:

Applicability to EPS: The UAS Authentication and Authorization procedure and revocation procedure described in this section can be applicable to EPS, with the adaptation of MME, SMF+PGW-C, UPF+PGW-U and HSS+UDM respectively as described in the steps below. UFES can act as a UAS NF or UAS control function in the 3GPP network which can be a standalone network function, or a service offered by the SCEF in the EPS instead of NEF in the 5GS. For the UAA revocation procedure, the MME, S-GW+PGW-C and HSS will be involved in EPS. The message name used in EPS procedure can be aligned with SA2 where required during the normative work. The steps related to UAA for an UAV in EPS scenario is described as follows: The UAA revocation in EPS for any UAV can be performed as follows:

The solution allows USS/UTM (post successful UAA) to send the UAS security context (a security information and identifier), UAS ID, Auth Token and lifetime to the UAV. Following a successful UAA, the solution requires generation of authorization information (i.e., Auth Token) by USS/UTM to allow authorization information to be provided to the UAV to enable further UAS service authorization. The UAS security context can be used to set up secure connection between UAV and USS/UTM. As TR 23.754 allows sending new CAA level UAV ID to UAV, a dedicated identifier is most crucial to be provided by the USS/UTM to identify the security context provided to the UAV. The Auth Token can be used to enable authorization of UAV for subsequent UAS service. The UAS ID can allow identification of an UAS formed by the UAV, USS/UTM and UAV-C as applicable (UAS ID generation is up to USS/UTM and it is outside the scope of 3GPP). AMF in 5GS and SMF+PGW-C in EPS: On a successful UAA, store information such as authentication result (i.e., success) along with information received in UAS authentication response (i.e., CAA level UAV ID, UAS ID, Auth Token and lifetime. Optionally UAVC ID if received), which can enable subsequent UAS service authorization. On a UAA Revocation Notified by USS/UTM, release PDU session/PDN Connection by indicating UAA Revocation Indication and CAA Level UAV ID to UAV. Delete any UAV related information locally stored related to CAA level UAV ID. UE: On a successful UAA, store information such as authentication result (i.e., success) along with information received in UAS authentication response (i.e., CAA level UAV ID, UAS Security Context, UAS ID, Auth Token and lifetime. Optionally UAVC ID if received), which can enable subsequent UAS service authorization and security set up. On receiving UAA Revocation Indication and CAA Level UAV ID, delete all information related to UAA such as UAS Security Context, UAS ID, Auth Token, lifetime, and any CAA level UAV ID (if meant for temporary use). Credentials used by UAV and UTM/USS are out of 3GPP scope.