TR 33.845
Study on storage and transport of 5G Core (5GC) security parameters
for Authentication Credential Repository Processing Function (ARPF) authentication

3GPP‑Page fToC_↓ Partial Content _→

V17.0.0 (Wzip) 2021/06 33 p.

Rapporteur:: Mr. Evans, Tim P.
VODAFONE Group Plc

full Table of Contents for TR 33.845 Word version: 17.0.0

each clause number in 'red' refers to the equivalent title in the Partial Content

Introduction p. 7

Scope p. 8

References p. 8

Definitions of terms, symbols and abbreviations p. 9

3.1	Terms p. 9
3.2	Symbols p. 9
3.3	Abbreviations p. 9

Security assumptions relating to communication security in 5G p. 9

4.1

Overview p. 9

4.2

Models for ARPF and UDR setup p. 10

4.2.1	Model #A: Security parameters stored only in the ARPF p. 10
4.2.2	Model #B: Security parameters stored only in the UDR p. 10
4.2.3	Model #C: Security parameters stored both in the ARPF and the UDR p. 10

4.3

Primary Authentication p. 10

4.4

Secondary Authentication p. 10

4.5

Privacy p. 11

Parameters relevant to securing 5G communication p. 11

5.1	Overview p. 11
5.2	Milenage AKA authentication p. 12
5.3	TUAK AKA authentication p. 13
5.4	EAP methods for authentication p. 13
5.5	Proprietary authentication algorithms p. 13
5.6	AMF related parameters p. 13
5.7	Counter related parameters p. 13

Key Issues p. 14

6.1

Key Issue #1: Separation of authentication subscription data from subscription data p. 14

6.1.1	Key issue details p. 14
6.1.2	Security threats p. 14
6.1.3	Potential security requirements p. 14

6.2

Key Issue #2: protection of long-term key during storage in UDR p. 14

6.2.1	Key issue details p. 14
6.2.2	Security threats p. 14
6.2.3	Potential security requirements p. 15

6.3

Key Issue #3: protection of long-term key during transfer out of UDR p. 15

6.3.1	Key issue details p. 15
6.3.2	Security threats p. 15
6.3.3	Potential security requirements p. 15

6.4

Key Issue #4: protection of Milenage OPc value during storage in UDR p. 15

6.4.1	Key issue details p. 15
6.4.2	Security threats p. 15
6.4.3	Potential security requirements p. 15

6.5

Key Issue #5: protection of Milenage OPc value during transfer out of UDR p. 16

6.5.1	Key issue details p. 16
6.5.2	Security threats p. 16
6.5.3	Potential security requirements p. 16

6.6

Key Issue #6: protection of Milenage OP value during storage in UDR p. 16

6.6.1	Key issue details p. 16
6.6.2	Security threats p. 16
6.6.3	Potential security requirements p. 16

6.7

Key Issue #7: protection of Milenage OP value during transfer out of UDR p. 17

6.7.1	Key issue details p. 17
6.7.2	Security threats p. 17
6.7.3	Potential security requirements p. 17

6.8

Key Issue #8: protection of sequence number SQNHE during storage in UDR p. 17

6.8.1	Key issue details p. 17
6.8.2	Security threats p. 17
6.8.3	Potential security requirements p. 17

6.9

Key Issue #9: protection of sequence number SQNHE during transfer out of UDR p. 17

6.9.1	Key issue details p. 17
6.9.2	Security threats p. 18
6.9.3	Potential security requirements p. 18

6.10

Key Issue #10: protection of TUAK TOPc value during storage in UDR p. 18

6.10.1	Key issue details p. 18
6.10.2	Security threats p. 18
6.10.3	Potential security requirements p. 18

6.11

Key Issue #11: protection of TUAK TOPc value during transfer out of UDR p. 18

6.11.1	Key issue details p. 18
6.11.2	Security threats p. 18
6.11.3	Potential security requirements p. 19

Solutions p. 19

7.1

Solution #1: Authorization and Isolation of Authentication Data using existing techniques. p. 19

7.1.1	Introduction p. 19
7.1.2	Solution details p. 19
7.1.3	Evaluation p. 19

7.2

Solution #2: Protection of LTK during storage in UDR. p. 20

7.2.1	Introduction p. 20
7.2.2	Solution details p. 20
7.2.3	Evaluation p. 20

7.3

Solution #3: Protection of LTK over Nudr p. 21

7.3.1	Introduction p. 21
7.3.2	Solution details p. 21
7.3.3	Evaluation p. 21

7.4

Solution #4: Encrypted storage of the long-term key in the UDR p. 21

7.4.1	Introduction p. 21
7.4.2	Solution details p. 22
7.4.3	Evaluation p. 22

7.5

Solution #5: Encrypted transfer of the long-term key between UDR and UDM/ARPF p. 22

7.5.1	Introduction p. 22
7.5.2	Solution details p. 22
7.5.3	Evaluation p. 22

7.6

Solution #6: Storage of the LTK in the UDR p. 23

7.6.1	Introduction p. 23
7.6.2	Solution details p. 23
7.6.3	Evaluation p. 23

7.7

Solution #7: Transfer of the LTK out of the UDR p. 23

7.7.1	Introduction p. 23
7.7.2	Solution details p. 24
7.7.3	Evaluation p. 24

7.8

Solution #8: Encrypted transfer of Milenage OPc value between UDR and UDM/ARPF p. 24

7.8.1	Introduction p. 24
7.8.2	Solution details p. 24
7.8.3	Evaluation p. 24

7.9

Solution #9: Encrypted transfer of Milenage OP value between UDR and UDM/ARPF p. 25

7.9.1	Introduction p. 25
7.9.2	Solution details p. 25
7.9.3	Evaluation p. 25

7.10

Solution #10: Encrypted storage of Milenage OPc value in the UDR p. 25

7.10.1	Introduction p. 25
7.10.2	Solution details p. 26
7.10.3	Evaluation p. 26

7.11

Solution #11: Encrypted storage of Milenage OP value in the UDR p. 26

7.11.1	Introduction p. 26
7.11.2	Solution details p. 26
7.11.3	Evaluation p. 26

7.12

Solution #12: Access control for protection of SQNHE during storage in UDR p. 27

7.12.1	Introduction p. 27
7.12.2	Solution details p. 27
7.12.3	Evaluation p. 27

7.13

Solution #13: Encrypted storage of TUAK TOPc value in the UDR p. 27

7.13.1	Introduction p. 27
7.13.2	Solution details p. 27
7.13.3	Evaluation p. 28

7.14

Solution #14: OAuth 2.0 secured transfer of SQNHE out of UDR p. 28

7.14.1	Introduction p. 28
7.14.2	Solution details p. 28
7.14.3	Evaluation p. 28

7.15

Solution #15: Encrypted transfer of TUAK TOPc value between UDR and UDM/ARPF p. 28

7.15.1	Introduction p. 28
7.15.2	Solution details p. 29
7.15.3	Evaluation p. 29

Conclusions p. 29

Models for ARPF deployment p. 30

A.1	General p. 30
A.2	ARPF deployment options in 3GPP TS 33.501 [2] and TS 23.501 [10] p. 30
A.3	ARPF deployment options in UDICOM p. 31

Change history p. 34

TR 33.845 Study on storage and transport of 5G Core (5GC) security parameters for Authentication Credential Repository Processing Function (ARPF) authentication

full Table of Contents for TR 33.845 Word version: 17.0.0

TR 33.845
Study on storage and transport of 5G Core (5GC) security parameters
for Authentication Credential Repository Processing Function (ARPF) authentication