Tech-invite  3GPPspace  IETFspace
21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x
Top   in Index   Prev   Next

TR 33.739
Study on Security enhancement of support for
Edge Computing
Phase 2

3GPP‑Page  
V18.1.0 (Wzip)  2023/12  … p.
Rapporteur:
Dr. Zhang, Bo
HUAWEI TECHNOLOGIES Co. Ltd.

full Table of Contents for  TR 33.739  Word version:  18.0.0

Here   Top
1 Scope  2 References  3 Definitions of terms, symbols and abbreviations  4 Overview of Edge Computing - Phase 2  5 Key issues  6 Proposed solutions  7 Conclusions  $ Change history 

 

1  Scope  p. 9

The present document studies the security aspects related to the new features and procedures resulting from the continuation of the work on Edge Computing support in 5G Systems, i.e. 5G System Enhancements for Edge Computing in TR 23.700-48, and enhanced architecture for enabling Edge Applications in TR 23.700-98. The study bases on the work done in the TS 33.558 and TR 33.839.
Up

2  References  p. 9

3  Definitions of terms, symbols and abbreviations  p. 10

3.1  Terms  p. 10

3.2  Symbols  p. 10

3.3  Abbreviations  p. 10

4  Overview of Edge Computing - Phase 2  p. 10

5  Key issues  p. 10

5.1  General  p. 10

5.2  Key issues related with 5G System Enhancements for Edge Computing  p. 10

5.2.1  Key issue #1.1: How to authorize PDU session to support local traffic routing to access an EHE in the VPLMN  p. 10

5.2.1.1  Key issue details  p. 10

5.2.1.2  Threats  p. 11

5.2.1.3  Potential security requirements  p. 11

5.2.2  Key issue #1.2: Security of EAS discovery procedure via V-EASDF in VPLMN  p. 11

5.2.2.1  Key issue details  p. 11

5.2.2.2  Threats  p. 11

5.2.2.3  Potential security requirements  p. 11

5.3  Key issues related with enhanced architecture for enabling Edge Applications  p. 11

5.3.1  Key Issue #2.1: Authentication and authorization of the EEC/UE by the ECS/EES  p. 11

5.3.1.1  Key issue details  p. 11

5.3.1.2  Security threats  p. 12

5.3.1.3  Potential security requirements  p. 12

5.3.2  Key issue #2.2: Authentication mechanism selection between EEC and ECS/EES  p. 12

5.3.2.1  Key issue details  p. 12

5.3.2.2  Security threats  p. 12

5.3.2.3  Potential security requirement  p. 12

5.3.3  Key issue #2.3: Authentication and Authorization between V-ECS and H-ECS  p. 13

5.3.3.1  Key issue details  p. 13

5.3.3.2  Threats  p. 13

5.3.3.3  Potential security requirements  p. 13

5.3.4  Key issue #2.4: Transport security for the EDGE10 interface  p. 13

5.3.4.1  Key issue details  p. 13

5.3.4.2  Threats  p. 13

5.3.4.3  Potential security requirements  p. 13

5.3.5  Key issue #2.5: Authentication and Authorization between AC and EEC  p. 13

5.3.5.1  Key issue details  p. 13

5.3.5.2  Threats  p. 14

5.3.5.3  Potential security requirements  p. 14

5.3.6  Key issue #2.6: New KI on authorization between EESes  p. 14

5.3.6.1  Key issue details  p. 14

5.3.6.2  Threats  p. 14

5.3.6.3  Potential security requirements  p. 14

5.3.7  Key issue #2.7: EEC provided information verification  p. 15

5.3.7.1  Key issue details  p. 15

5.3.7.2  Threats  p. 15

5.3.7.3  Potential security requirements  p. 15

6  Proposed solutions  p. 15

6.0  Mapping of Solutions to Key Issues  p. 15

6.1  Solution #1: Authentication and authorization between EEC hosted in the roaming UE and ECS  p. 17

6.1.1  Solution overview  p. 17

6.1.2  Solution details  p. 17

6.1.3  Solution evaluation  p. 18

6.2  Solution #2: Authentication and authorization between EEC hosted in the roaming UE and EES  p. 18

6.2.1  Solution overview  p. 18

6.2.2  Solution details  p. 19

6.2.3  Solution evaluation  p. 20

6.3  Solution #3: Authentication mechanism selection between EEC and ECS  p. 21

6.3.1  Solution overview  p. 21

6.3.2  Solution details  p. 21

6.3.2.1  ECS configuration  p. 21

6.3.3  Solution evaluation  p. 22

6.4  Solution #4: Authentication mechanism selection between EEC and EES  p. 22

6.4.1  Solution overview  p. 22

6.4.2  Solution details  p. 22

6.4.2.1  EES profile  p. 23

6.4.3  Solution evaluation  p. 23

6.5  Solution #5: 5GC-based authentication mechanism selection between EEC and ECS/EES  p. 23

6.5.1  Solution overview  p. 23

6.5.2  Solution details  p. 24

6.5.3  Solution evaluation  p. 25

6.6  Solution #6: ECS/EES authentication method information provisioning  p. 25

6.6.1  Solution overview  p. 25

6.6.2  Solution details  p. 25

6.6.3  Solution evaluation  p. 25

6.7  Solution #7: Negotiation procedure for the Authentication and Authorization  p. 26

6.7.1  Solution overview  p. 26

6.7.2  Solution details  p. 26

6.7.3  Solution evaluation  p. 27

6.8  Solution #8: Authentication mechanisms selected by ECS/EES  p. 27

6.8.1  Solution overview  p. 27

6.8.2  Solution details  p. 27

6.8.2.1  Authentication between EEC and ECS  p. 27

6.8.2.2  Authentication between EEC and EES  p. 27

6.8.3  Solution evaluation  p. 27

6.9  Solution #9: Authentication mechanism selection procedure between EEC and ECS  p. 27

6.9.1  Solution overview  p. 27

6.9.2  Solution details  p. 28

6.9.3  Solution evaluation  p. 28

6.10  Solution #10: Authentication mechanism selection procedure between EEC and EES  p. 28

6.10.1  Solution overview  p. 28

6.10.2  Solution details  p. 28

6.10.3  Solution evaluation  p. 29

6.11  Solution #11: Authentication mechanism selection procedure among EEC, ECS, and EES  p. 29

6.11.1  Solution overview  p. 29

6.11.2  Solution details  p. 29

6.11.3  Solution evaluation  p. 30

6.12  Solution #12: Authorization for PDU session supporting local traffic routing to access an EHE in the VPLMN  p. 31

6.12.1  Introduction  p. 31

6.12.2  Solution details  p. 31

6.12.3  Solution evaluation  p. 31

6.13  Solution #13: A solution for authentication of EEC/UE and GPSI verification by EES/ECS  p. 31

6.13.1  Solution overview  p. 31

6.13.2  Solution details  p. 31

6.13.3  Solution evaluation  p. 33

6.14  Solution #14: A solution for authentication of UE and GPSI verification by EES/ECS  p. 33

6.14.1  Solution overview  p. 33

6.14.2  Solution details  p. 33

6.14.3  Solution evaluation  p. 34

6.15  Solution #15: Authentication algorithm selection procedure between EEC and ECS  p. 34

6.15.1  Solution overview  p. 34

6.15.2  Solution details  p. 34

6.15.3  Solution evaluation  p. 36

6.16  Solution #16: Authentication algorithm selection procedure between EEC and EES  p. 36

6.16.1  Solution overview  p. 36

6.16.2  Solution details  p. 36

6.16.3  Solution evaluation  p. 37

6.17  Solution #17: Using existing AKMA/GBA negotiation mechanism  p. 38

6.17.1  Solution overview  p. 38

6.17.2  Solution details  p. 38

6.17.2.1  Shared key based EEC/UE authentication and certificate based ECS/EES authentication  p. 38

6.17.2.2  Shared key based mutual authentication  p. 38

6.17.2.2.1  Shared key based mutual authentication in TLS 1.2  p. 38
6.17.2.2.2  Shared key based mutual authentication in TLS 1.3  p. 39

6.17.2.3  Handling EEC authentication negotiation failure  p. 39

6.17.2.4  GPSI verification  p. 39

6.17.3  Solution evaluation  p. 39

6.18  Solution #18: Authentication and Authorization between V-ECS and H-ECS  p. 40

6.18.1  Solution overview  p. 40

6.18.2  Solution details  p. 40

6.19  Solution #19: Authorization of V-ECS in roaming scenario  p. 40

6.19.1  Solution overview  p. 40

6.19.2  Solution details  p. 40

6.19.3  Solution evaluation  p. 41

6.20  Solution #20: Transport security for the EDGE10 interface  p. 41

6.20.1  Solution overview  p. 41

6.20.2  Solution details  p. 41

6.20.3  Solution evaluation  p. 42

6.21  Solution #21: Using local policy on authorization between EESes  p. 42

6.21.1  Solution overview  p. 42

6.21.2  Solution details  p. 42

6.21.3  Solution evaluation  p. 42

6.23  Solution #23: EAS discovery procedure protection  p. 43

6.23.1  Solution overview  p. 43

6.23.2  Solution details  p. 43

6.23.3  Solution evaluation  p. 43

6.24  Solution #24: Public key signature based ECS/EES authentication  p. 44

6.24.1  Solution overview  p. 44

6.24.2  Solution details  p. 44

6.24.3  Solution evaluation  p. 44

6.25  Solution #25: Utilizing Token-Based Solutions for EEC authentication  p. 44

6.25.1  Solution overview  p. 44

6.25.2  Solution details  p. 45

6.25.3  Solution evaluation  p. 45

6.26  Solution #26: Using authorization token on authorization between EESes  p. 45

6.26.1  Solution overview  p. 45

6.26.2  Solution details - Target EES Decided ACR  p. 45

6.26.3  Solution details: Source EAS decided ACR  p. 47

6.26.4  Solution details: S-EES executed ACR  p. 48

6.26.5  Solution evaluation  p. 50

6.27  Solution #27: Token-based solution for authorization between EESes  p. 50

6.27.1  Solution overview  p. 50

6.27.2  Solution details  p. 50

6.27.3  Solution evaluation  p. 51

6.28  Solution #28: Usage of randomly generated ticket to verify EEC provided IP address  p. 51

6.28.1  Solution overview  p. 51

6.28.2  Solution details  p. 51

6.28.3  Solution evaluation  p. 52

6.29  Solution #29: Authorizing the Service Consumer when Resolving an IP Address to a UE ID  p. 53

6.29.1  Solution overview  p. 53

6.29.2  Solution details  p. 53

6.29.3  Solution evaluation  p. 53

6.30  Solution #30: Usage of existing public IP address to verify EEC provided IP address  p. 56

6.30.1  Solution overview  p. 56

6.30.2  Solution details  p. 56

6.30.3  Solution evaluation  p. 57

6.31  Solution #31: AKMA/GBA based verification of EEC provided IP address  p. 58

6.31.1  Solution overview  p. 58

6.31.2  Solution details  p. 58

6.31.3  Solution evaluation  p. 59

6.32  Solution #32: KDF based verification of EEC provided IP address  p. 59

6.32.1  Solution overview  p. 59

6.32.2  Solution details  p. 59

6.32.3  Solution evaluation  p. 59

6.33  Solution #33: Verification of EEC provided IP address  p. 60

6.33.1  Solution overview  p. 60

6.33.2  Solution details  p. 60

6.33.3  Solution evaluation  p. 60

6.34  Solution #34: Verification of EEC provided IP address using access token  p. 61

6.34.1  Solution overview  p. 61

6.34.2  Solution details  p. 61

6.34.3  Solution evaluation  p. 61

7  Conclusions  p. 62

7.1  Conclusions for Key Issue #2.4  p. 62

7.2  Conclusions for Key Issue #2.3  p. 62

7.3  Conclusions for Key Issue #2.5  p. 62

7.4  Conclusions for Key Issue #1.1  p. 62

7.5  Conclusions for Key Issue #2.1  p. 62

7.6  Conclusions for Key Issue#2.2  p. 62

7.7  Conclusions for Key Issue #2.6  p. 63

7.8  Conclusions for Key Issue #1.2  p. 63

7.9  Conclusions for Key Issue #2.7  p. 63

$  Change history  p. 64

Up   Top