| 7.0 | Mapping solutions to key issues p. 14
|
| 7.1 | Solution #1: Secure N4 interface with Security Gateway p. 14
| 7.1.1 | Introduction p. 14
|
| 7.1.2 | Solution details p. 15
| 7.1.2.0 | System architecture p. 15
|
| 7.1.2.1 | Topology information hiding p. 15
|
| 7.1.2.2 | Signalling inspection and message filtration p. 15
|
| 7.1.2.3 | Security between the dedicated UPF and the Security Gateway p. 16
| 7.1.2.3.0 | General p. 16
|
| 7.1.2.3.1 | Authentication p. 16
|
| 7.1.2.3.2 | Transport protection between the dedicated UPF and the Security Gateway p. 16
|
|
| 7.1.2.4 | Access control p. 16
|
|
| 7.1.3 | Evaluation p. 17
|
|
| 7.2 | Solution #2: CIWF for N4 interface p. 17
| 7.2.1 | Introduction p. 17
|
| 7.2.2 | Solution details p. 17
| 7.2.2.1 | General p. 17
|
| 7.2.2.2 | Procedure for CIWF deployed only in the PLMN operational domain p. 18
|
| 7.2.2.3 | Procedure for CIWF deployed in the PLMN and PNI-NPN operational domain p. 19
|
| 7.2.2.4 | Procedure for CIWF deployed only in the PNI-NPN operational domain p. 20
|
|
| 7.2.3 | Evaluation p. 21
|
|
| 7.3 | Solution #3: A perimeter security gateway for N4 and SBI interface. p. 21
| 7.3.1 | Introduction p. 21
|
| 7.3.2 | Solution details p. 22
| 7.3.2.0 | General p. 22
|
| 7.3.2.1 | Authentication and Authorization between HNSPP and NFs p. 23
|
| 7.3.2.2 | Authentication and Authorization between HNSPPs p. 23
|
| 7.3.2.3 | Authentication between NFs and Authorization of NF service access p. 23
|
|
| 7.3.3 | Evaluation p. 23
|
|
| 7.4 | Solution #4: Security protection to avoid UE information disclosure p. 24
|
| 7.5 | Solution #5: Secure SBA interface with Security Gateway p. 25
| 7.5.1 | Introduction p. 25
|
| 7.5.2 | Solution details p. 26
| 7.5.2.0 | General p. 26
|
| 7.5.2.1 | Topology information hiding p. 26
|
| 7.5.2.2 | Signalling inspection and message filtration p. 27
|
| 7.5.2.3 | Security between the NF in customer premise and the Security Gateway p. 27
|
| 7.5.2.4 | Security between the Security Gateway and the NF in PLMN p. 28
|
| 7.5.2.5 | Access control p. 28
|
|
| 7.5.3 | Evaluation p. 28
|
|
| 7.6 | Solution #6: CIWF as a gateway for SBA interface p. 28
| 7.6.1 | Introduction p. 28
|
| 7.6.2 | Solution details p. 29
| 7.6.2.1 | General p. 29
|
| 7.6.2.2 | Procedure for CIWF deployed only in the PLMN operational domain p. 30
|
| 7.6.2.3 | Procedure for CIWF deployed in the PLMN and PNI-NPN operational domain p. 32
|
| 7.6.2.4 | Procedure for CIWF deployed only in the PNI-NPN operational domain p. 34
|
|
| 7.6.3 | Evaluation p. 36
|
|
| 7.7 | Solution #7: CIWF as a delegate for SBA interface p. 36
| 7.7.1 | Introduction p. 36
|
| 7.7.2 | Solution details p. 36
| 7.7.2.1 | General p. 36
|
| 7.7.2.2 | Procedure for CIWF deployed only in the PLMN operational domain p. 38
|
| 7.7.2.3 | Procedure for CIWF deployed in the PLMN and PNI-NPN operational domain p. 39
|
| 7.7.2.4 | Procedure for CIWF deployed only in the PNI-NPN operational domain p. 41
|
|
| 7.7.3 | Evaluation p. 42
|
|
| 7.8 | Solution #8: NRF based service and information exchange restriction p. 43
| 7.8.1 | Introduction p. 43
|
| 7.8.2 | Solution details p. 43
| 7.8.2.1 | NF Service Producer registration with NRF p. 43
|
| 7.8.2.2 | NF Service Consumer obtaining access token p. 43
|
| 7.8.2.3 | NF Service Consumer requesting service access with an access token p. 44
|
|
| 7.8.3 | Evaluation p. 45
|
|
| 7.9 | Solution #9: DNS Security in PLMN hosting NPN scenario p. 46
|
| 7.10 | Solution #10: SCP based topology hiding and message handling p. 47
|
| 7.11 | Solution #11: SUPI privacy protection in hosted NPN p. 49
|
| 7.12 | Solution #12: Secure sensitive data with secure environment p. 51
|
| 7.13 | Solution #13: Extended SEG to support topology hiding and message inspection p. 52
|
| 7.14 | Solution #14: Extended SCP p. 53
|
| 7.15 | Solution #15: SUPI privacy protection based on AMF register with UDM p. 57
|
| 7.16 | Solution #16: Use a new PLMNNPN UE ID to resolve the SUPI privacy issue p. 58
|
| 7.17 | Solution #17: SUPI privacy protection p. 60
|
| 7.18 | Solution #18: Enforcing policy checks for NF Consumer in PNI-NPN p. 62
| 7.18.1 | Introduction p. 62
|
| 7.18.2 | Solution details p. 62
| 7.18.2.1 | Determining the domain of the NF Consumer p. 62
|
| 7.18.2.2 | Enforcing security checks p. 62
|
| 7.18.2.3 | Policy checks to be enforced p. 64
|
|
| 7.18.3 | Evaluation p. 64
|
|
| 7.19 | Solution #19: Re-use of existing SMF/UPF/SEG functionality p. 64
|
| 7.20 | Solution #20: SEAF in PLMN operational domain for SUPI privacy protection p. 65
|
