Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

TR 33.738
Study on Security aspects of Enablers for
Network Automation for the 5G System
Phase 3

V18.1.0 (Wzip) 2023/09 68 p.

Rapporteur:: Mr. Liu, Chang
China Mobile Com. Corporation

full Table of Contents for TR 33.738 Word version: 18.1.0

1 Scope p. 8

The present document studies the security aspects of enablers for network automation for the 5G system based on the outcome of TR 23.700-81. More specifically, the present document will identify security issues and requirements and provide corresponding security solutions related to the following scenarios:

Security aspects of potential architecture enhancement: roaming, supporting federated learning, interaction between NWDAF and MDAS/MDAF, etc.
Handling of sensitive information inherent to application detection, roaming and location information.
KIs from R17 which do not have enough time to proceed, e.g. NWDAF detection related issues.
Any further security enhancements which need to be studied based upon the ongoing SA2 eNA Phase 3 work

2 References p. 8

3 Definitions of terms, symbols and abbreviations p. 8

3.1 Terms p. 8

3.2 Symbols p. 9

3.3 Abbreviations p. 9

4 Overview p. 9

5 Key issues p. 9

5.1 Key Issue #1: Protection of data and analytics exchange in roaming case p. 9

5.1.1 Key issue details p. 9

5.1.2 Security threats p. 9

5.1.3 Potential security requirements p. 10

5.2 Key Issue #2: Authorization of selection of participant NWDAF instances in the Federated Learning group p. 10

5.2.1 Key issue details p. 10

5.2.2 Security threats p. 10

5.2.3 Potential security requirements p. 10

5.3 Key Issue #3: Security for AI/ML model storage and sharing p. 11

5.3.1 Issue details p. 11

5.3.2 Security Threats p. 11

5.3.3 Potential security requirements p. 11

5.4 Key Issue #4: Anomalous NF behaviour detection by NWDAF p. 11

5.4.1 Issue details p. 11

5.4.2 Security Threats p. 12

5.4.3 Potential security requirements p. 12

5.5 Key Issue #5: KI on Security for NWDAF-assisted application detection p. 12

5.5.1 Key issue details p. 12

5.5.2 Security threats p. 12

5.5.3 Potential security requirements p. 12

5.6 Key Issue #6: Key issues on Cyber-attack detection p. 13

5.6.1 Key Issue Details p. 13

5.6.2 Security Threats p. 13

5.6.3 Potential Security Requirements p. 13

6 Solutions p. 13

6.0 Mapping Solutions to Key Issues p. 14

6.1 Solution #1: Authorization of AI/ML model retrieving p. 14

6.1.1 Introduction p. 14

6.1.2 Solution details p. 14

6.1.2.1 Authorization of AI/ML model retrieving from NWDAF p. 14

6.1.2.2 Authorization of AI/ML model retrieving from ADRF p. 14

6.1.3 Evaluation p. 15

6.2 Solution #2: Authorization and Authentication of ML model transfer p. 15

6.2.1 Introduction p. 15

6.2.2 Solution Details p. 15

6.2.3 Evaluation p. 17

6.3 Solution #3: AI/ML model authorization and retrieval p. 17

6.3.1 Introduction p. 17

6.3.2 Solution details p. 17

6.3.3 Evaluation p. 19

6.4 Solution #4: AI/ML model storage and sharing security p. 20

6.4.1 Introduction p. 20

6.4.2 Solution details p. 20

6.4.3 Evaluation p. 23

6.5 Void

6.6 Solution #6: Anomalous NF behaviour detection by NWDAF p. 23

6.6.1 Introduction p. 23

6.6.2 Solution details p. 24

6.6.2.1 General p. 24

6.6.2.2 Collection of security related log data of NFs via NFs EventExposure APIs p. 24

6.6.2.3 Collection of security related log data of NFs via OAM p. 25

6.6.3 Evaluation p. 28

6.7 Solution #7: Secured and authorized AI/ML model transfer and retrieval p. 29

6.7.1 Introduction p. 29

6.7.2 Solution details p. 29

6.7.3 Evaluation p. 31

6.8 Solution #8: Protection of data and analytics exchange in roaming case p. 32

6.8.1 Introduction p. 32

6.8.2 Solution details p. 32

6.8.3 Evaluation p. 34

6.9 Solution #9: Anomalous NF behaviour event related data collection and anomalous NF detection p. 34

6.9.1 Introduction p. 34

6.9.2 Solution details p. 34

6.9.3 Evaluation p. 37

6.10 Solution #10: Authorization of AI/ML model sharing between different vendors and usage of one-time URLs p. 37

6.10.1 Introduction p. 37

6.10.2 Solution details p. 38

6.10.3 Evaluation p. 40

6.11 Solution #11: Secured and authorized AI/ML model sharing between different vendors p. 40

6.11.1 Introduction p. 40

6.11.2 Solution details p. 40

6.11.3 Evaluation p. 43

6.12 Solution #12: Secured and authorized AI/ML model sharing between different vendors p. 43

6.12.1 Introduction p. 43

6.12.2 Solution details p. 43

6.12.3 Evaluation p. 45

6.13 Solution #13: Support authorization of AI/ML model sharing By NWDAF containing MTLF p. 45

6.13.1 Introduction p. 45

6.13.2 Solution details p. 46

6.13.3 Evaluation p. 48

6.14 Solution #14: Protection of data and analytics exchange in roaming case using Secure Multi-party Computation p. 48

6.14.1 Introduction p. 48

6.14.2 Solution details p. 48

6.14.2.1 Data Privacy Computing Function DPCF p. 48

6.14.2.2 Data collection protection architecture based on Secure Multi-party Computation p. 49

6.14.3 Evaluation p. 50

6.15 Solution #15: Authorization of selection of participant NWDAF instances in the FL group p. 50

6.15.1 Introduction p. 50

6.15.2 Solution details p. 50

6.15.3 Evaluation p. 51

6.16 Solution #16: FL GROUP AUTHORIZATION OF NWDAF(S) IN 5GC p. 51

6.16.1 Introduction p. 51

6.16.2 Solution details p. 51

6.16.3 Evaluation p. 53

6.17 Solution #17: Authorization of FL Server and FL Client in FL group p. 54

6.17.1 Introduction p. 54

6.17.2 Solution details p. 54

6.17.3 Evaluation p. 56

6.18 Solution #18: Solution for authorization in FL p. 56

6.18.1 Introduction p. 56

6.18.2 Solution details p. 56

6.18.3 Evaluation p. 58

6.19 Solution #19: Access control for user plane data p. 58

6.19.1 Introduction p. 58

6.19.2 Solution details p. 58

6.19.3 Evaluation p. 60

6.20 Solution #20: Cyber attack detection using an analytics function p. 60

6.20.1 Introduction p. 60

6.20.2 Solution details p. 60

6.20.3 Evaluation p. 63

6.21 Solution #21: Authorization of data and analytics exchange in roaming case p. 63

6.21.1 Introduction p. 63

6.21.2 Solution details p. 64

6.21.3 Evaluation p. 65

7 Conclusions p. 65

7.1 Conclusion on Key Issue #1 "Protection of data and analytics exchange in roaming case" p. 65

7.2 Conclusion on Key Issue #2 "Authorization of selection of participant NWDAF instances in the Federated Learning group" p. 65

7.3 Conclusion on Key Issue #3 "Security for AI/ML model storage and sharing" p. 66

7.4 Conclusion on Key Issue #4 " Anomalous NF behaviour detection by NWDAF " p. 66

7.5 Conclusion on Key Issue #5 "Security for NWDAF-assisted application detection" p. 66

7.6 Conclusion on Key Issue #6 "Key issues on Cyber-attack detection" p. 67

$ Change history p. 68