Content for TR 33.855 Word version: 16.1.0
4 Key Issues p. 13
4.1 General SBA Key Issues p. 13
4.1.1 Key Issue #1: Confidentiality protection of signalling messages p. 13
4.1.1.1 Issue description p. 13
4.1.1.2 Threat description p. 13
4.1.1.3 Potential security requirements p. 14
4.1.2 Key Issue #2: Integrity protection of signalling messages while allowing for modifications p. 14
4.1.2.1 Issue description p. 14
4.1.2.2 Threat description p. 14
4.1.2.3 Potential security requirements p. 14
4.1.3 Key Issue #3: Replay protection of signalling messages p. 14
4.1.3.1 Issue description p. 14
4.1.3.2 Threat description p. 15
4.1.3.3 Potential security requirements p. 15
4.1.4 Key Issue #4: NF-NF Authentication p. 15
4.1.4.1 Issue description p. 15
4.1.4.2 Threat description p. 15
4.1.4.3 Potential security requirements p. 15
4.1.5 Key Issue #5: NF-NF Authorization p. 15
4.1.5.1 Issue description p. 15
4.1.5.2 Threat description p. 15
4.1.5.3 Potential security requirements p. 15
4.1.6 Key Issue #6: NF-NRF Authentication p. 16
4.1.6.1 Issue description p. 16
4.1.6.2 Threat description p. 16
4.1.6.3 Potential security requirements p. 16
4.1.7 Key Issue #7: NF-NRF Authorization p. 16
4.1.7.1 Issue description p. 16
4.1.7.2 Threat description p. 16
4.1.7.3 Potential security requirements p. 16
4.1.8 Key Issue #8: NRF-NRF Authentication p. 17
4.1.8.1 Issue description p. 17
4.1.8.2 Threat description p. 17
4.1.8.3 Potential security requirements p. 17
4.1.9 Key Issue #9: NRF-NRF Authorization p. 17
4.1.9.1 Issue description p. 17
4.1.9.2 Threat description p. 17
4.1.9.3 Potential security requirements p. 17
4.1.10 Key Issue #20: Protection of SeCoP interfaces p. 17
4.1.10.1 Issue description p. 17
4.1.10.2 Threat description p. 18
4.1.10.3 Potential security requirements p. 18
4.1.11 Key Issue #21: Secure message transport via the SeCoP p. 19
4.1.11.1 Issue description p. 19
4.1.11.2 Threat description p. 19
4.1.11.3 Potential security requirements p. 19
4.1.12 Key Issue #22: Authorization of NF service access in Indirect Communication p. 19
4.1.12.1 Issue description p. 19
4.1.12.2 Threat description p. 19
4.1.12.3 Potential security requirements p. 20
4.1.13 Key Issue #23: NF to NF authentication and authorization in Indirect communication p. 20
4.1.13.1 Issue description p. 20
4.1.13.2 Threat description p. 20
4.1.13.3 Potential security requirements p. 20
4.1.14 Key Issue #24: Service access authorization based on NF Set p. 20
4.1.14.1 Issue description p. 20
4.1.14.2 Threat description p. 20
4.1.14.3 Potential security requirements p. 21
4.1.15 Key Issue #25: Indirect communication in roaming scenarios p. 21
4.1.16 Key Issue #26: Protection of N9 interface p. 21
4.1.16.1 Issue description p. 21
4.1.16.2 Threat description p. 21
4.1.16.3 Potential security requirements p. 21
4.1.17 Key Issue #27: Support of a UP gateway function on the N9 interface p. 22
4.1.17.1 Issue description p. 22
4.1.17.2 Threat description p. 22
4.1.17.3 Potential security requirements p. 23
4.1.18 Key Issue #28: Service access authorization in the delegated "Subscribe-Notify" scenarios p. 23
4.1.18.1 Issue description p. 23
4.1.18.2 Threat description p. 23
4.1.18.3 Potential security requirements p. 23
4.1.19 Key Issue #29: Resource level authorization of NF consumers p. 23
4.1.19.1 Issue description p. 23
4.1.19.2 Threat description p. 23
4.1.19.3 Potential security requirements p. 24
4.1.20 Key Issue #30: Service access authorization for non-delegated subscribe-notify p. 24
4.2 SEPP-/N32-specific Key Issues p. 24
4.2.1 Key Issue #10: Termination points of N32 security p. 24
4.2.1.1 Issue description p. 24
4.2.1.2 Threat description p. 24
4.2.1.3 Potential security requirements p. 24
4.2.2 Key Issue #11: Local provisioning of SEPP protection policies p. 25
4.2.2.1 Issue description p. 25
4.2.2.2 Threat description p. 25
4.2.2.3 Potential security requirements p. 25
4.2.3 Key Issue #12: Provisioning of SEPP protection policies over N32 p. 25
4.2.3.1 Issue description p. 25
4.2.3.2 Threat description p. 25
4.2.3.3 Potential security requirements p. 25
4.2.4 Key Issue #13: SEPP session setup p. 26
4.2.4.1 Issue description p. 26
4.2.4.2 Threat description p. 26
4.2.4.3 Potential security requirements p. 26
4.2.5 Key Issue #14: Application of ciphering and integrity protection to JSON object using JOSE p. 26
4.2.5.1 Issue description p. 26
4.2.5.2 Threat description p. 26
4.2.5.3 Potential security requirements p. 27
4.2.6 Key Issue #15: Malicious messages received on the N32 interface p. 27
4.2.6.1 Issue description p. 27
4.2.6.2 Threat description p. 29
4.2.6.3 Potential security requirements p. 29
4.2.7 Key Issue #16: N32 error signalling p. 29
4.2.7.1 Issue description p. 29
4.2.7.2 Threat description p. 29
4.2.7.3 Potential security requirements p. 29
4.2.8 Key Issue #17: Modifications by authorized intermediaries on N32 p. 30
4.2.8.1 Issue description p. 30
4.2.8.2 Threat description p. 30
4.2.8.3 Potential security requirements p. 30
4.2.9 Key Issue #18: Inter-PLMN routing and TLS p. 30
4.2.9.1 Key issue detail p. 30
4.2.9.2 Security threats p. 31
4.2.9.3 Potential security requirements p. 31
4.2.10 Key Issue #19: Configurational error handling by the SEPP p. 31
5 Void
