Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

TR 33.893
Study on Security aspects of Ranging-based services and Sidelink Positioning

V18.0.1 (Wzip) 2023/06 97 p.

Rapporteur:: Ms. Lu, Wei
Xiaomi Technology

full Table of Contents for TR 33.893 Word version: 18.0.1

1 Scope p. 9

The present document investigates the security and privacy aspects of Ranging based services and sidelink positioning in 5G system. The study is based on the architectural and functional requirements on Ranging based services and sidelink positioning services, so as to ensure that the proposed solutions address the security and privacy implications on the architecture enhancements studied in TR 23.700-86. Specifically, it covers the following:

The identified security and privacy issues, threats, and potential requirements for Ranging based services and sidelink positioning.
The gap analysis in security and privacy issues between Ranging based services and ProSe/V2X applications.
The potential solutions addressing the security and privacy issues specific to Ranging based services and sidelink positioning.

2 References p. 9

3 Definitions of terms, symbols and abbreviations p. 10

3.1 Terms p. 10

3.2 Symbols p. 10

3.3 Abbreviations p. 10

4 Architecture assumptions p. 10

4.1 Reference architecture p. 10

4.2 Reference points p. 11

5 Key issues p. 11

5.1 Key issue #1: Privacy protection for Ranging/SL Positioning services p. 11

5.1.1 Key issue details p. 11

5.1.2 Security threats p. 12

5.1.3 Potential security requirements p. 12

5.2 Key Issue #2: Authorization for Ranging/Sidelink Positioning Service p. 12

5.2.1 Key issue details p. 12

5.2.2 Security threats p. 13

5.2.3 Potential security requirements p. 13

5.3 Key issue #3: Protection of discovery procedure p. 13

5.3.1 Key issue details p. 13

5.3.2 Security threats p. 13

5.3.3 Potential security requirements p. 14

5.4 Key issue #4: Protection of unicast direct communication p. 14

5.4.1 Key issue details p. 14

5.4.2 Security threats p. 14

5.4.3 Potential security requirements p. 15

5.5 Key issue #5: Protection of groupcast/broadcast p. 15

5.5.1 Key issue details p. 15

5.5.2 Security threats p. 15

5.5.3 Potential security requirements p. 15

6 Solutions p. 16

6.0 Mapping of solutions to key issues p. 16

6.1 Solution #1: Privacy protection for UEs in Ranging p. 17

6.1.1 Introduction p. 17

6.1.2 Solution details p. 17

6.1.3 Evaluation p. 18

6.2 Solution #2: Authorization of 5GC NF for Ranging/SL positioning service exposure p. 18

6.2.1 Introduction p. 18

6.2.2 Solution details p. 18

6.2.3 Evaluation p. 20

6.3 Solution #3: Authorization of Application Server for Ranging/SL positioning service exposure p. 20

6.3.1 Introduction p. 20

6.3.2 Solution details p. 20

6.3.3 Evaluation p. 22

6.4 Solution #4: Subscription-based authorization of the role of the UE during discovery p. 23

6.4.1 Introduction p. 23

6.4.2 Solution details p. 23

6.4.3 Evaluation p. 27

6.5 Solution #5: Use of authorization tokens at PC5 security establishment p. 28

6.5.1 Introduction p. 28

6.5.2 Solution details p. 28

6.5.2.1 Token based authorization for scenario of SL positioning services p. 28

6.5.2.1.1 Security for network assisted Sidelink Positioning with full network coverage p. 28

6.5.2.1.2 Security for network assisted Sidelink Positioning with partial network coverage p. 29

6.5.2.2 Token based authorization for scenario of Ranging services p. 30

6.5.2.2.1 Security for Ranging procedure between Reference UE and Target UE p. 30

6.5.2.2.2 Security for Ranging procedure between Reference UE/Target UE and Assistant UE p. 31

6.5.3 Evaluation p. 33

6.6 Solution #6: Protection of direct communication for Sidelink Positioning service p. 33

6.6.1 Introduction p. 33

6.6.2 Solution details p. 33

6.6.3 Evaluation p. 35

6.7 Solution #7: Security policy based protection for Ranging/SL positioning service operation p. 35

6.7.1 Introduction p. 35

6.7.2 Solution details p. 36

6.7.3 Evaluation p. 36

6.8 Solution #8: Security policy based protection for ranging result sent to SL Positioning Client UE p. 37

6.8.1 Introduction p. 37

6.8.2 Solution details p. 37

6.8.2.1 Security policy configuration for ranging result sent via PC5 p. 37

6.8.2.2 Security policy configuration for ranging result sent via 5GC p. 38

6.8.3 Evaluation p. 38

6.9 Solution #9: Ranging/SL Positioning discovery and link establishment procedure for V2X capable UEs p. 39

6.9.1 Introduction p. 39

6.9.2 Solution details p. 40

6.9.2.1 Security for direct discovery and communication for V2X capable UEs p. 40

6.9.2.2 Security for Assistant UE discovery and communication for V2X capable UEs p. 42

6.9.3 Evaluation p. 44

6.10 Solution #10: Use of authorization tokens after PC5 security establishment p. 44

6.10.1 Introduction p. 44

6.10.2 Solution details p. 45

6.10.3 Evaluation p. 46

6.11 Solution #11: Client UE authorization for service exposure through sidelink p. 46

6.11.1 Introduction p. 46

6.11.2 Solution details p. 46

6.11.2.1 Authorization of SL Positioning Client UE during direct link establishment p. 46

6.11.2.2 Authorization of SL Positioning Client UE after direct link establishment p. 48

6.11.2.3 Authorization of SL Positioning Client UE during direct discovery p. 49

6.11.3 Evaluation p. 51

6.12 Solution #12: Ranging/SL Positioning discovery security for 5G ProSe capable UEs p. 52

6.12.1 Introduction p. 52

6.12.2 Solution details p. 52

6.12.3 Evaluation p. 52

6.13 Solution #13: Security of Ranging unicast communication p. 52

6.13.1 Introduction p. 52

6.13.2 Solution details p. 52

6.13.3 Evaluation p. 53

6.14 Solution #14: Direct communication security for Ranging-based services p. 53

6.14.1 Introduction p. 53

6.14.2 Solution details p. 53

6.14.3 Evaluation p. 53

6.15 Solution #15: Protection of information over group communication for Ranging/SL Positioning service p. 54

6.15.1 Introduction p. 54

6.15.2 Solution details p. 55

6.15.2.1 Security flows p. 55

6.15.2.2 Protection of messages between UEs p. 56

6.15.2.2.1 Message processing in the sending UE p. 56

6.15.2.2.2 Protected message processing in the receiving UE p. 57

6.15.3 Evaluation p. 57

6.16 Solution #16: Privacy protection of Located UE during its discovery and selection p. 57

6.16.1 Introduction p. 57

6.16.2 Solution details p. 57

6.16.3 Evaluation p. 60

6.17 Solution #17: Client UE authorization for service exposure through 5GC network p. 60

6.17.1 Introduction p. 60

6.17.2 Solution details p. 61

6.17.3 Evaluation p. 62

6.18 Solution #18: Client UE authorization by 5GC for service exposure through PC5 p. 62

6.18.1 Introduction p. 62

6.18.2 Solution details p. 63

6.18.2.0 General p. 63

6.18.2.1 Authorization of SL Positioning Client UE during direct link establishment p. 63

6.18.2.2 Authorization of SL Positioning Client UE during Ranging/SL positioning procedure p. 64

6.18.3 Evaluation p. 65

6.19 Solution #19: Protecting Ranging/SL Positioning discovery out of network coverage p. 66

6.19.1 Introduction p. 66

6.19.2 Solution details p. 67

6.19.3 Evaluation p. 69

6.20 Solution #20: Secure groupcast/broadcast of SL positioning data p. 69

6.20.1 Introduction p. 69

6.20.2 Solution details p. 69

6.20.3 Evaluation p. 70

6.21 Solution #21: Security of ranging/SL positioning groupcast communication p. 70

6.21.1 Introduction p. 70

6.21.2 Solution details p. 70

6.21.3 Evaluation p. 71

6.22 Solution #22: Protection of broadcast Sidelink Positioning data in coverage scenario p. 71

6.22.1 Introduction p. 71

6.22.2 Solution details p. 71

6.22.3 Evaluation p. 73

6.23 Solution #23: Provisioning groupcast/broadcast protection key out of coverage p. 73

6.23.1 Introduction p. 73

6.23.2 Solution details p. 73

6.23.3 Evaluation p. 76

6.24 Solution #24: Protecting groupcast/broadcast messages p. 76

6.24.1 Introduction p. 76

6.24.2 Solution details p. 77

6.24.2.1 Protecting groupcast message p. 77

6.24.2.1.1 Groupcast security key hierarchy p. 77

6.24.2.1.2 Groupcast security p. 77

6.24.2.2 Protecting broadcast message p. 78

6.24.2.2.1 Broadcast security key hierarchy p. 78

6.24.2.2.2 Broadcast security p. 78

6.24.3 Evaluation p. 79

6.25 Solution #25: Protection for groupcast of SLPP signalling p. 79

6.25.1 Introduction p. 79

6.25.2 Solution details p. 79

6.25.2.1 General p. 79

6.25.2.2 Key provisioning for SLPP signalling groupcast p. 80

6.25.2.3 SLPP signaling protection and verification p. 81

6.25.3 Evaluation p. 82

6.26 Solution #26: Protection of SLPP broadcast based on central key management function p. 82

6.26.1 Introduction p. 82

6.26.2 Solution details p. 82

6.26.2.1 General p. 82

6.26.2.2 Key provisioning via the PCF p. 83

6.26.2.3 Key provisioning via the LMF p. 84

6.26.3 Evaluation p. 86

6.27 Solution #27: Protection of broadcast communication p. 86

6.27.1 Introduction p. 86

6.27.2 Solution details p. 87

6.27.3 Solution Evaluation p. 89

6.28 Solution #28: Protection of broadcast communication p. 89

6.28.1 Introduction p. 89

6.28.2 Solution details p. 89

6.28.3 Evaluation p. 91

6.29 Solution #29: Discovery security material and SL session root key provisioning for Ranging/SL positioning UE discovery p. 92

6.29.1 Introduction p. 92

6.29.2 Solution details p. 92

6.29.3 Evaluation p. 94

7 Conclusions p. 94

7.1 Conclusions on Key Issue #1 p. 94

7.2 Conclusions on Key Issue #2 p. 95

7.3 Conclusions on Key Issue #3 p. 95

7.4 Conclusions on Key Issue #4 p. 95

$ Change history p. 97