Tech-invite  3GPPspace  IETFspace
◀  ▶  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x
Top   in Index   Prev   Next

TR 33.700-22
Study on Security aspects of Common API Framework (CAPIF) Phase 3

3GPP‑Page   fToC↓   Partial Content →
V19.2.0 (Wzip)  2025/09  … p.
Rapporteur:
Mr. Rathod, Niraj
Ericsson LM

full Table of Contents for  TR 33.700-22  Word version:  19.2.0

each clause number in 'red' refers to the equivalent title in the Partial Content
Here   Top
1Scope  p. 10
2References  p. 10
3Definitions of terms, symbols and abbreviations  p. 11
3.1Terms  p. 11
3.2Symbols  p. 11
3.3Abbreviations  p. 11
4High-level architectures  p. 11
4.0Introduction  p. 11
4.1High-level architecture for RNAA  p. 12
4.2High-level architecture for CAPIF interconnection  p. 12
5Key issues  p. 14
5.1Key Issue #1: Security of resource owner authorization management and CAPIF-8 reference point  p. 14
5.1.0Introduction  p. 14
5.1.1Key Issue #1.1: CAPIF-8 reference point  p. 14
5.1.1.1Key issue details  p. 14
5.1.1.2Security threats  p. 14
5.1.1.3Potential Security Requirement  p. 14
5.1.2Key Issue #1.2: Resource owner authorization management  p. 14
5.1.2.1Key issue details  p. 14
5.1.2.2Security threats  p. 15
5.1.2.3Potential security requirement  p. 15
5.1.3Key Issue #1.3: Finer granular authorization  p. 15
5.1.3.1Key issue details  p. 15
5.1.3.2Security threats  p. 15
5.1.3.3Potential Security Requirement  p. 15
5.2Key issue #2: CAPIF interconnection security  p. 15
5.2.1Key issue details  p. 15
5.2.2Security threats  p. 16
5.2.3Potential security requirements  p. 16
5.3Key Issue #3: Authorizing API invoker on one UE accessing resources related to another UE  p. 16
5.3.1Key issue details  p. 16
5.3.2Security threats  p. 17
5.3.3Potential security requirements  p. 17
5.4Key issue #4: Nested API invocation  p. 17
5.4.1Key issue details  p. 17
5.4.2Security threats  p. 17
5.4.3Potential security requirements  p. 17
5.5Key Issue KI#5: Authenticating multiple API invokers of the same Resource Owner  p. 18
5.5.1Key Issue details  p. 18
5.5.2Security threats  p. 18
5.5.3Security requirements  p. 18
5.6Key Issue KI#6: Onboarding security issues  p. 18
5.6.1Key issue details  p. 18
5.6.2Threats  p. 18
5.6.3Potential requirements  p. 18
6Proposed solutions  p. 19
6.0Mapping of solutions to key issues  p. 19
6.1Solution #1: Security protection mechanism for CAPIF-8 reference point  p. 20
6.1.1Introduction  p. 20
6.1.2Solution details  p. 20
6.1.3Evaluation  p. 20
6.2Solution #2: CAPIF-8 reference point security  p. 20
6.2.1Introduction  p. 20
6.2.2Solution details  p. 21
6.2.2.1Mutual authentication  p. 21
6.2.2.2Protection of messages between ROF -AZF/CCF  p. 21
6.2.3Evaluation  p. 21
6.3Solution #3: Security procedures for CAPIF-8 reference points  p. 21
6.3.1Introduction  p. 21
6.3.2Solution details  p. 21
6.3.3Evaluation  p. 22
6.4Solution #4: resource owner authorized revocation  p. 22
6.4.1Introduction  p. 22
6.4.2Solution details  p. 22
6.4.2.1Authorization procedure  p. 22
6.4.2.2Revocation procedure  p. 22
6.4.3Evaluation  p. 23
6.5Solution #5: Security of resource owner authorization management and CAPIF-8  p. 23
6.5.1Introduction  p. 23
6.5.2Solution details  p. 23
6.5.3Evaluation  p. 25
6.6Solution #6: Security procedures for resource owner authorization management  p. 25
6.6.1Introduction  p. 25
6.6.2Solution details  p. 25
6.6.2.1Security procedure for obtaining resource owner authorization  p. 25
6.6.2.2Security procedure for authorizing the API invoker in RNAA  p. 26
6.6.2.3Security procedure for revoking resource owner authorization  p. 27
6.6.3Evaluation  p. 27
6.7Solution #7: RO permission/ management  p. 27
6.7.1Introduction  p. 27
6.7.2Solution details  p. 28
6.7.2.0General  p. 28
6.7.2.1Notifications for permissions / wakeup  p. 28
6.7.3Evaluation  p. 30
6.8Solution #8: Resource owner triggered revocation procedure  p. 30
6.8.1Introduction  p. 30
6.8.2Solution details  p. 30
6.8.3Evaluation  p. 31
6.9Solution #9: Resource owner authentication and authorization mechanism  p. 32
6.9.1Introduction  p. 32
6.9.2Solution details  p. 32
6.9.3Evaluation  p. 33
6.10Solution #10: resource-level and/or API-level authorization and revocation  p. 33
6.10.1Introduction  p. 33
6.10.2Solution details  p. 33
6.10.2.1Service operation/resource level authorization  p. 33
6.10.2.2Service operation/resource level revocation  p. 34
6.10.3Evaluation  p. 34
6.11Solution #11: Client initiated backchannel authorization (CIBA)  p. 34
6.11.1Introduction  p. 34
6.11.2Solution details  p. 34
6.11.3Evaluation  p. 35
6.12Solution #12: Security method retrieval in CAPIF interconnect  p. 35
6.12.1Introduction  p. 35
6.12.2Solution details  p. 36
6.12.2.1Summary  p. 36
6.12.2.2Information flow  p. 36
6.12.3Evaluation  p. 37
6.13Solution #13: Requesting security information from another CCF in order to authenticate using TLS-PSK in CAPIF interconnect  p. 37
6.13.1Introduction  p. 37
6.13.2Solution details  p. 37
6.13.2.1Summary  p. 37
6.13.2.2Information flow  p. 38
6.13.3Evaluation  p. 39
6.14Solution #14: Authentication aspect in CAPIF interconnect when API invoker has not included CCF information  p. 39
6.14.1Introduction  p. 39
6.14.2Solution details  p. 39
6.14.2.1Summary  p. 39
6.14.2.2Information flow  p. 40
6.14.3Evaluation  p. 40
6.15Solution #15: Authorization token request handling in CAPIF interconnect  p. 41
6.15.1Introduction  p. 41
6.15.2Solution details  p. 41
6.15.2.1Summary  p. 41
6.15.2.2Information flow  p. 42
6.15.3Evaluation  p. 43
6.16Solution #16: Mapping an API invoker authorization request to the correct CCF in CAPIF interconnect  p. 44
6.16.1Introduction  p. 44
6.16.2Solution details  p. 44
6.16.2.1Introduction  p. 44
6.16.2.2Summary  p. 45
6.16.2.3Information flow  p. 45
6.16.3Evaluation  p. 45
6.17Solution #17: Security procedures for CAPIF interconnection  p. 46
6.17.1Introduction  p. 46
6.17.2Solution details  p. 46
6.17.2.1Security procedure for API invoker authentication and authorization using Method 3 in CAPIF interconnection  p. 46
6.17.2.2Security procedure for API invoker offboarding in CAPIF interconnection  p. 48
6.17.3Evaluation  p. 48
6.18Solution #18: API invoker authentication mechanism in CAPIF interconnection scenarios  p. 49
6.18.1Introduction  p. 49
6.18.2Solution details  p. 49
6.18.2.1TLS-PSK based authentication mechanism for CCF interconnection scenarios  p. 49
6.18.2.2TLS-PKI based authentication mechanism for CCF interconnection scenarios  p. 50
6.18.3Evaluation  p. 50
6.19Solution #19: API invoker authorization mechanism in CAPIF interconnection scenarios  p. 51
6.19.1Introduction  p. 51
6.19.2Solution details  p. 51
6.19.3Evaluation  p. 53
6.20Solution #20: Security method negotiation mechanism in CAPIF interconnection scenarios  p. 53
6.20.1Introduction  p. 53
6.20.2Solution details  p. 53
6.20.3Evaluation  p. 54
6.21Solution #21: Solution for CAPIF interconnection security  p. 55
6.21.1Introduction  p. 55
6.21.2Solution details  p. 55
6.21.2.1General  p. 55
6.21.2.2Security Method negotiation  p. 55
6.21.2.3Authentication and Authorization  p. 57
6.21.3Evaluation  p. 60
6.22Solution #22: CAPIF interconnection  p. 60
6.22.1Introduction  p. 60
6.22.2Solution details  p. 61
6.22.3Evaluation  p. 62
6.23Solution #23: Security protection mechanism for CAPIF-6 and CAPIF-6e reference points  p. 62
6.23.1Introduction  p. 62
6.23.2Solution details  p. 62
6.23.3Evaluation  p. 62
6.24Solution #24: Security procedure for CAPIF interconnection  p. 62
6.24.1Introduction  p. 62
6.24.2Solution details  p. 63
6.24.2.1Security method negotiation in CAPIF interconnection  p. 63
6.24.2.2Authentication and authorization  p. 64
6.24.2.2.1Authentication and authorization with security method TLS-PSK or PKI  p. 64
6.24.2.2.2Authentication and authorization with security method TLS with OAuth token  p. 65
6.24.3Evaluation  p. 67
6.25Solution #25: Backend based solution for UE-deployed API invoker accessing resources not owned by that UE  p. 67
6.25.1Introduction  p. 67
6.25.2Solution details  p. 67
6.25.3Evaluation  p. 69
6.26Solution #26: Nested API invocation  p. 69
6.26.1Introduction  p. 69
6.26.2Solution details  p. 69
6.26.3Evaluation  p. 70
6.27Solution #27: Authorization for nested API invocation  p. 71
6.27.1Introduction  p. 71
6.27.2Solution details  p. 71
6.27.2.0General  p. 71
6.27.2.1Access token claims  p. 73
6.27.3Evaluation  p. 73
6.28Solution #28: Authenticating multiple API invokers of the same RO  p. 73
6.28.1Introduction  p. 73
6.28.2Solution Details  p. 73
6.28.3Evaluation  p. 75
6.29Solution #29: Enhancing authorization through finer level access token granularity.  p. 75
6.29.1Introduction  p. 75
6.29.2Solution details  p. 75
6.29.2.1Summary  p. 75
6.29.2.2Information flow  p. 76
6.29.3Evaluation  p. 77
6.30Solution #30: Authentication of the origin API invoker in nested API invocation  p. 77
6.30.1Introduction  p. 77
6.30.2Solution Details  p. 77
6.30.3Evaluation  p. 78
6.31Solution#31: Authorization mechanism for nested API invocation  p. 79
6.31.1Introduction  p. 79
6.31.2Solution details  p. 79
6.31.3Evaluation  p. 80
6.32Solution #32: Validation of correct GPSI in API invoker information  p. 81
6.32.1Introduction  p. 81
6.32.2Solution Details  p. 81
6.32.3Evaluation  p. 81
6.33Solution #33: Onboarding of API Invoker residing in UE  p. 81
6.33.1Introduction  p. 81
6.33.2Solution details  p. 82
6.33.3Evaluation  p. 82
6.34Solution #34: UE-deployed API invoker accessing resources not owned by that UE  p. 83
6.34.1Introduction  p. 83
6.34.2Solution details  p. 83
6.34.2.1Obtaining resource owner authorization and authorization revocation information  p. 83
6.34.2.2UE-deployed API invoker accessing resources not owned by that UE  p. 84
6.34.3Solution evaluation  p. 85
6.35Solution #35: Onboarding of UE-hosted API invoker  p. 86
6.35.1Introduction  p. 86
6.35.2Solution details  p. 86
6.35.3Solution evaluation  p. 87
6.36Solution #36: Reusing existing mechanism to enable cross-UE authorization  p. 87
6.36.1Introduction  p. 87
6.36.2Solution details  p. 87
6.36.3Evaluation  p. 87
6.37Solution #37: Enabling mTLS between ROF and CCF using AKMA  p. 88
6.37.1Introduction  p. 88
6.37.2Solution details  p. 88
6.37.3Evaluation  p. 90
6.38Solution #38: Renewal of onboarding  p. 90
6.38.1Introduction  p. 90
6.38.2Solution details  p. 90
6.38.3Evaluation  p. 92
6.39Solution #39: ROF certificate generation  p. 93
6.39.1Introduction  p. 93
6.39.2Solution details  p. 93
6.39.3Evaluation  p. 94
7Conclusions  p. 94
7.1-  p. 94
7.1.1Conclusions for KI#1.1 CAPIF-8 reference point  p. 94
7.1.2Conclusions for KI#1.2 Resource owner authorization management  p. 95
7.1.2.0Introduction  p. 95
7.1.2.1Authentication and authorization of the end points and security of transferred authorization data  p. 95
7.1.2.2Resource owner authorization data  p. 95
7.1.2.3Revocation  p. 95
7.1.3Conclusions for KI#1.3 Finer granular authorization  p. 95
7.2Conclusion for KI #2: CAPIF interconnection security  p. 95
7.2.0General  p. 95
7.2.1Conclusion for CAPIF 6/6e security  p. 95
7.2.2Conclusion for security method negotiation  p. 96
7.2.3Conclusion for API invoker authentication and authorization mechanism  p. 96
7.3Conclusion for KI #3: Authorizing API invoker on one UE accessing resources related to another UE  p. 96
7.4Conclusion for KI #4: Nested API Invocation  p. 96
7.5Conclusion for KI #5: Authenticating multiple API invokers of the same Resource Owner  p. 97
7.6Conclusion for KI #6: Onboarding security issues  p. 97
$Change history  p. 98

Up   Top