Tech-invite  3GPPspace  IETFspace
◀  ▶  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x
Top   in Index   Prev   Next

TS 33.320
Security of Home Node B (HNB) / Home evolved Node B (HeNB)

3GPP‑Page   ETSI‑search   fToC↓   Partial Content →
V19.0.0 (PDF)  2025/09  43 p.
V18.0.0  2024/03  43 p.
V17.0.0  2022/03  43 p.
V16.0.0  2020/06  43 p.
V15.0.0  2018/06  42 p.
V14.0.0  2016/12  43 p.
V13.0.0  2016/01  43 p.
V12.1.0  2014/09  43 p.
V11.6.0  2012/06  43 p.
V10.5.0  2012/06  37 p.
V9.7.0  2012/12  36 p.
Rapporteur:
Mr. Wong, Marcus
Huawei Tech.(UK) Co.. Ltd

full Table of Contents for  TS 33.320  Word version:  19.0.0

each clause number in 'red' refers to the equivalent title in the Partial Content
Here   Top
1Scope  p. 6
2References  p. 6
3Definitions and abbreviations  p. 7
3.1Definitions  p. 7
3.2Abbreviations  p. 7
4Overview of Security Architecture and Requirements  p. 8
4.1System architecture of H(e)NB  p. 8
4.2Network Elements  p. 9
4.2.1H(e)NB  p. 9
4.2.2Security Gateway (SeGW)  p. 9
4.2.3H(e)NB Management System (H(e)MS)  p. 10
4.2.4UE  p. 10
4.2.5H(e)NB Gateway (H(e)NB-GW) and MME  p. 10
4.2.6AAA Server and HSS  p. 10
4.2.7Void  p. …
4.2.8Local Gateway (L-GW) |R10|  p. 10
4.3Interfaces (Reference Points)  p. 10
4.3.1Backhaul Link  p. 10
4.3.2H(e)MS Interface  p. 10
4.3.3Interface between SeGW and AAA Server, AAA Server and HSS  p. 10
4.3.4Interface between H(e)NBs |R11|  p. 11
4.4Security Requirements and Principles  p. 11
4.4.1Operation  p. 11
4.4.2Requirements on H(e)NB  p. 11
4.4.3Requirements on SeGW  p. 12
4.4.4Requirements on H(e)MS  p. 12
4.4.5Requirements on Backhaul Link  p. 13
4.4.6Requirements on H(e)MS Link  p. 13
4.4.7Requirements on Local Gateway (L-GW) |R10|  p. 13
4.4.8Requirements on the Direct Link between H(e)NBs |R11|  p. 14
4.4.9Requirements on Verification of H(e)NB Identity and Operating Access Mode |R11|  p. 14
5Security Features  p. 15
5.1Secure Storage and Execution  p. 15
5.1.1Hosting Party Module  p. 15
5.1.2Trusted Environment (TrE)  p. 15
5.1.2.1General  p. 15
5.2Device Mutual Authentication  p. 15
5.3Hosting Party Mutual Authentication  p. 16
5.4Other security features  p. 16
6Security Procedures in H(e)NB  p. 18
6.1Device Integrity Check  p. 18
6.1.1Device Integrity Check Procedure  p. 18
6.1.2Protection of Trusted Reference Value(s)  p. 18
6.2Void  p. …
6.3Measures for Clock Protection  p. 18
6.3.1Clock Synchronization Security Mechanisms for H(e)NB  p. 18
7Security Procedures between H(e)NB and SeGW  p. 19
7.1Device Validation  p. 19
7.2Device Authentication  p. 19
7.2.1General  p. 19
7.2.2SeGW and Device Mutual Authentication Procedure  p. 20
7.2.3H(e)NB/IKEv2 Processing Requirements for SeGW Certificates  p. 21
7.2.4SeGW/IKEv2 Processing Requirements for H(e)NB Certificates  p. 21
7.2.5Security Profiles  p. 22
7.2.5.1Profile for IKEv2  p. 22
7.2.5.2IKEv2 Certificate Profile  p. 22
7.2.5.2.1IKEv2 Entity Certificates  p. 22
7.2.5.2.2IKEv2 CA Certificates  p. 22
7.3Hosting Party Authentication  p. 23
7.4IPsec Tunnel Establishment  p. 23
7.5Device Authorization  p. 23
8Security Aspects of H(e)NB Management  p. 25
8.1Location Verification  p. 25
8.1.1General  p. 25
8.1.2IP Address provided by H(e)NB  p. 25
8.1.3IP Address and/or access line location identifier provided by broadband access provider  p. 25
8.1.4Surrounding macro-cell information provided by H(e)NB  p. 25
8.1.5GNSS information provided by H(e)NB  p. 25
8.1.6Requirements  p. 26
8.2Access Control Mechanisms for H(e)NB  p. 26
8.2.1Non-CSG Method  p. 26
8.2.2CSG Method  p. 26
8.3Protection of H(e)MS traffic between H(e)MS and H(e)NB  p. 26
8.3.1Connection to H(e)MS accessible on MNO Intranet  p. 26
8.3.2Connection to H(e)MS accessible on public Internet  p. 27
8.3.2.1General  p. 27
8.3.2.2Device Validation  p. 28
8.3.3TLS certificate profile  p. 28
8.3.3.1TLS entity certificates  p. 28
8.3.3.2TLS CA certificates  p. 29
8.3.4TR-069 protocol profile  p. 29
8.4Protection of SW Download  p. 29
8.5Enrolment of H(e)NB to an Operator PKI |R11|  p. 30
8.5.1General  p. 30
8.5.2Enrolment Procedure  p. 30
8.5.3Certificate Validation  p. 30
9Security Aspects of Emergency Call Handling  p. 31
10Security Aspects for Mobility  p. 32
10.1Inbound mobility  p. 32
10.2Outbound mobility  p. 32
11Security Procedures for Direct Interfaces between Base Stations |R11|  p. 33
11.1General  p. 33
11.2Direct Link between two H(e)NBs  p. 33
AAuthentication Call-flows  p. 34
A.1Device Authentication Call-flow Example  p. 34
A.2Combined Device and HP Authentication Call-flow Example  p. 35
BLocation Verification Examples  p. 38
B.1Example of Location verification based on IP address and line identifier in NASS  p. 38
B.2Example process of location verification when the verifying node receive different types of location information  p. 38
$Change History  p. 40

Up   Top