Content for TR 33.854 Word version: 17.1.0
6.14 Solution #14: Authorization of UAV/UAVC pairing when connected to 5GS
6.14.1 Solution overview
6.14.2 Solution details
6.14.3 Solution evaluation
...
...
6.14 Solution #14: Authorization of UAV/UAVC pairing when connected to 5GS p. 50
6.14.1 Solution overview p. 50
This solution addresses Key issue #2: Pairing authorization for UAV and UAVC.
6.14.2 Solution details p. 50
6.14.2.1 General p. 50
The solution uses a UAV Flight Enablement Subsystem (UFES) as a single point of contact between the PLMN and USS/UTM in order to limit the impact on the 3GPP system, although it is not strictly necessary for authentication and authorization solution to work. The authentication and authorization procedures are shown when connected to 5GS and the authentication/authorization takes place during PDU connection establishment. The procedure in 6.14.2.2 are used to authenticate and authorize a UAV to allow pairing with a UAVC.
6.14.2.2 Pairing authentication and authorization p. 50
Figure 6.14.2.2-1 shows how the UAV can be authenticated and authorized by the USS/UTM to allow a connection with a paired UAVC. The flows assume that the UAV has already connected to 5GS and been authorized to act as a UAV (see for example solution #6.8).
Figure 6.14.2.2-1: Authentication and authorization of a connection between a UAV and UAVC
(⇒ copy of original 3GPP image)
(⇒ copy of original 3GPP image)
In the following steps, if multiple PDU sessions are established for UAV to USS/UTM and UAV to UAVC communications, respectively, the first PDU session established is for UAV to USS communications. In case of multiple PDU sessions, the UAV provides the information related to authorizing the pairing between the UAV and UAVC only during the establishment of the PDU session for UAV to UAVC communications.
The steps are as follows:
Step 1.
The UAV sends a PDU Session Establishment Request to the SMF with an indication that the PDU session is for UAV operation. The UAV also include the Aviation Connectivity payload which contains the allocated CAA-Level UAV ID and flight/pairing information.
Step 2.
The SMF obtains the SM information from the UDM.
Step 3.
The SMF requests a UAV authentication and authorization from the UFES and includes the Aviation Connectivity payload in the request.
Step 4.
The UFES forwards the information to the USS/UTM.
Step 5a. and 5b.
There can be several round trips required for authentication of the UAV by the USS/UTM depending on the authentication method used by the USS/UTM and UAV. The authentication method and the content of messages used for authentication are out of scope of 3GPP. The content of the messages is carried in containers that are passed along and not processed by the entities between the UAV and USS/UTM.
Step 6.
On a successful authentication and authorization of the UAV, the USS/UTM stores the 3GPP UAV ID with the CAA-level UAV ID. The UTMS/USS informs the UFES that the UAV has been successfully authenticated and authorized by the USS/UTM. The USS/UTM includes authorization information for both the network and the UAV.
Step 7.
The UFES further informs the SMF that the UAV has been successfully authenticated and authorized by the USS/UTM. The UFES passes the received authorization information onto the SMF. The SMF stores the network authorization information as part of the UE context. The network authorization information further contains the information whether USS/UTM authentication and authorization is required during future registrations and whether to allow UE to establish PDU session(s) dedicated for the UAS service with or without further USS/UTM authentication and authorization. The network part of the authorization data contains authorization information applicable to existing PDU sessions, which influence SMF decisions for the traffic of PDU sessions. For example, the information may indicate to disable all connectivity of the UAV except for the connectivity to USS/UTM.
Step 8.
The SMF triggers a PDU Session Establishment Accept message to the UE. The message procedure contains the UAV authorization information. Part of the contents of the UAV authorization information may be passed to the UAV without modification by any entities between USS/UTM and UAV. The UAV authorization information contains any needed aviation information, e.g. a new CAA-level UAV ID.
Step 9.
If multiple PDU sessions are used, then the UE triggers a PDU establishment for C2 traffic. This follows steps 1 to 8. In the case of C2 traffic, the USS/UTM provides the necessary information on the UAV-C to allow the network to set the traffic filters in the PDU session to allow connectivity to the UAV-C.
Step 10.
The SMF establishes the necessary flow(s) to enable the communication between the UAV and UAVC and C2 traffic can be sent between the UAV and UAVC.
6.14.2.3 Revocation p. 52
Figure 6.14.2.3-1 shows how the authorization for some connectivity can be revoked.
Step 1.
The USS/UTM decides to revoke the UAV's authorization for some connectivity.
Step 2.
The USS/UTM sends an Authorization Revoke request to the UFES including the 3GPP UAV ID and details of the connectivity (e.g. UAV-C's IP address) to be revoked (e.g. a pairing with a UAV-C is no longer needed). Before proceeding with the revocation, the UFES checks that the USS/UTM was the one that authorized the UAV.
Step 3.
The UFES passes the Authorization Revoke request to the relevant SMF(s) which are selected based on the details of the connectivity to be revoked.
Step 4.
The SMF removes the connectivity of the UAV based on the received details (e.g. prevents the UAV from communicating with the UAV-C). This is performed using PDU session release (e.g. when removing one of multiple PDU sessions) or PDU session modification (e.g. when restricting connectivity in the single PDU case).
Step 5.
The SMF confirms to the UFES that the revocation of connectivity has happened.
Step 6.
The UFES confirms to the USS/UTM that the revocation of connectivity has happened.
6.14.3 Solution evaluation p. 52
This solution addresses key issue #2 for a UAV connected to a 5G core network. The solution provides a method for the USS/UTM to authenticate and authorize a UAV before the UAV can obtain connectivity from the 3GPP system and in particular before a connection between a paired UAV and UAV-C can be enabled. The solution also provides a method or revoking the authorization.
