Content for  TS 33.163  Word version:  17.0.0

The EMSDP Session Request command shall be used by the UE to trigger a new BEST session from the HSE. This message shall include an identification of the UE, an indication of its BEST support Optionally, the EMSDP Session Request command may include information on the end enterprise service that this data is a part of. The UE may also include a 'BEST confidential service requested' indication in the EMSDP Session Request command to indicate the UE is requesting a 'BEST user plane confidential service'. For UEs not supporting 5G authentication, if the UE is requesting a 'BEST user plane confidential service' then the Serving network information shall be present, else this information is optional. For UEs supporting 5G authentication, the Serving network information shall be present. This message may be sent after a PDP context has been setup. The cmd options for the EMSDP session request command are as follows:

IMSI TLV: This is a TLV that contains the IMSI as follows:

SUCI TLV: This is a TLV that contains the 5G SUCI as follows:

The SUCI TLV shall be used if SUCI is supported by the UE, otherwise the IMSI TLV shall be used. BEST configuration TLV: This is a TLV that contains the BEST configuration details for the UE as follows:

Where:

• BEST release supported by the UE - an indicator the release of the BEST solution that the UE has been designed to. If no release is indicated this means that the BEST service is not supported.
  • Value: This shall be a 4 bit field where "0000" = Rel.14 , "0001" = Release 15, "0010" = Release 16, "0011" = Release 17 and " 0100 " to "1111" are RFU,
• BEST counter schemes supported by the UE - a flag for each supported scheme. At least one scheme must be supported and indicated.
  • Value: '1' - Optimised EMSDP counter scheme.
• BEST protocols supported for control plane messages - a flag for each BEST control plane protocol that is supported by the UE. At least one scheme must be supported and indicated.
  • Value: '1' - EMSDP.
• BEST protocols supported for user plane messages - a flag for each BEST control plane protocol that is supported by the UE. At least one scheme must be supported and indicated.
  • Value: '1' - EMSDP.
  • This flag is set to '0' if only the BEST Key agreement service is used
• User data push to UE Supported - a flag to indicate whether the UE supports user data pushed to the UE without a request for user data from the UE.
  • Values:
    '1' = User data push to UE supported,
    '0' = User data push to UE not supported.
• BEST encryption algorithms supported by the UE - a flag for each supported algorithm: GEA4, GEA5, UEA1, UEA2, EEA0, 128-EEA1, 128-EEA2, 128-EEA3, 128-NEA1, 128-NEA2 and 128-NEA3. EEA0 shall always be supported and means no encryption.
  • Values:
    '1' = Algorithm supported,
    '0' = Algorithm not supported.
• BEST integrity algorithms supported by the UE - a flag for each supported algorithm: GIA4, GIA5, UIA1, UIA2, 128-EIA1, 128-EIA2, 128-EIA3, 128-NIA1, 128-NIA2 and 128-NIA3.
  • Values:
    '1' = Algorithm supported,
    '0' = Algorithm not supported.
• BEST Key agreement mechanisms supported by the UE: a flag for each supported key agreement method: EPS authentication, 5G authentication, GBA, 5G GBA, AKMA and proprietary key agreement.
  • Values:
    '1' = Algorithm supported,
    '0' = Algorithm not supported.
• BEST confidential service requested - an indication from the UE that it would like the BEST user plane data to be confidentiality protected.
  • Values:
    '1' = BEST confidential service requested,
    '0' = BEST confidential service not requested.

Enterprise Setup Information Element TLV: This is a TLV element that contains information from the UE that is used by the HSE to setup the HSE to enterprise connection as follows:

Serving network TLV: This is a TLV that contains information on the serving network.

Response: If the HSE agrees to setup the session, it shall respond with an EMSDP Session Start command. If the HSE does not agree to setup a BEST session, it may respond with a EMSDP Message Reject command. This command may include the reason that the request has been rejected.

The EMSDP Session Start command is used by the HSE to setup a new BEST session. This message shall contain information on the BEST service setup, key agreement details, a hash of the information sent by the UE in the prior EMSDP Session Request command and optionally, the HSE identity. On receipt of this command the UE shall:

• If no indication is given, perform a UTMS security context authentication with the USIM using the RAND and AUTN combination from the Key Agreement TLV. If the USIM returns IK and CK values, the UE uses these keys and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5. If the USIM determines re-synchronisation is required and returns an AUTS then the UE sends a EMSDP Message Reject command containing the AUTS to the HSE.
• If indicated, perform an EPS security context authentication with the USIM using the RAND and AUTN combination from the Key Agreement TLV. If the USIM returns IK and CK values, the UE uses these keys to derive KASME and subsequently use KASME and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5. If the USIM determines re-synchronisation is required and returns an AUTS then the UE sends a EMSDP Message Reject command containing the AUTS to the HSE.
• If indicated, perform a 5G security context authentication with the USIM using the RAND and AUTN combination from the Key Agreement TLV. If the USIM returns IK and CK values, the UE uses these keys to derive KHSE (depending on the authentication method selected) and subsequently use KHSE and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5. The derivation of KHSE is described in clause 5.1.0a. If the USIM determines re-synchronisation is required and returns an AUTS then the UE sends a EMSDP Message Reject command containing the AUTS to the HSE.
• If indicated, perform a GBA based authentication. After establishing the agreed key (see clause 5.1.1), the UE uses this key and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5.
• If indicated, perform a 5G GBA based authentication. After establishing the agreed key (see clause 5.1.1), the UE uses this key and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5.
• If indicated, perform a AKMA based authentication. After establishing the agreed key (see clause 5.1.1), the UE uses this key and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5.
• If indicated, perform a proprietry based authentication. After establishing the agreed key (see clause 5.1.1), the UE uses this key and the HSE identity supplied (if the HSE Identity TLV is present) to generate the session keys for the EMSDP messages as detailed in clause 5.
• Verify that the UE supports the BEST service indicated in the BEST Service configuration TLV.
• Verify the received message format, the CP COUNTER value and the message MAC value.
• Verify that the MAC supplied in the MAC TLV matches the MAC that would be produced for the previous EMSDP Session Request message if the BEST configuration in the BEST Service configuration TLV had been applied using the integrity key calculated from the Key agreement TLV.

The EMSDP Session Start command has the following cmd options:

BEST Service configuration TLV: The BEST Service configuration TLV sets the BEST service parameters to be used in this session as follows:

• BEST Service Activated - a bit flag that when set instructs the UE to use the BEST service and when clear instructs the UE not to use the BEST service,
• BEST signalling plane protocol identifier - 1 octet that is used to determine the BEST signalling protocol to be used from the following list (only one shall be indicated): 01 = type 01 signalling plane EMSDP message. All other values are reserved for future use.
• BEST user plane protocol identifier - 1 octet that is used to determine the BEST signalling protocol to be used from the following list (only one shall be indicated): 01 = type 01 user plane EMSDP message. All other values are reserved for future use.
• BEST encryption algorithm to be used - 1 octet that is used to define which of the following algorithms to use for encryption: GEA0, GEA4, GEA5, UEA0, UEA1, UEA2, EEA0, 128-EEA1, 128-EEA2, 128-EEA3, 128-NEA1, 128-NEA2, and 128-NEA3. Only one algorithm from this list shall be indicated. If the Visited network indicated that BEST encryption is restricted, then the HSE shall indicate EEA0.
• BEST integrity algorithm to be used - 1 octet that is used to define which one of the following algorithms to use for integrity: GIA4, GIA5, UIA1, UIA2, 128-EIA1, 128-EIA2, 128-EIA3, 128-NIA1, 128-NIA2, and 128-NIA3. Only one algorithm from this list shall be indicated.
• Local BEST configuration management allowed - a flag to indicate that the software connected to the UE is allowed to manage the BEST service.
• UE triggered key refresh supported - The HSE indicating to the UE whether key refresh requests will be ignored or responded.
• New Session Required - 1 bit that indicates if a new session is required. If this bit is set to 0 then the details agreed for the last session can be used and a new session is not required to be setup.
• Use EAS UP keys - If set to 0 it indicates that the UE should not derive the UE-to-EAS keys. If set to 1 it means that the UE shall derive UE-to-EAS keys to be used in a UE-to-EAS BEST secure session.
• EMSDP MAC length - 2 bits that indicates how many octets in the EMSDP data packet the integrity checksum (MAC) will be on, as follows: "00"=4 octets, "01"=8 octets, "10"=12 octets and "11"= 16 octets. This value shall not be set to a size that is greater than MAC size produced by the chosen algorithm.
• Size of EMSDP Data Length - 4 bits that indicate how many octets are used for the EMSDP Data Length. "0000" is reserved for future use.
• Authentication method - 1 bit that indicates which authentication method was selected by the UDM.
  • Values: '0' = 5G AKA was selected,
    '1' = EAP-AKA' was selected.
• BEST Key Agreement Method - 6 bits that indicate which one of the key agreement methods to use, the bit set indicates the relevant method from the following methods: EPS authentication, 5G authentication, GBA, 5G GBA, AKMA and proprietary key agreement. At most one of the BEST Key Agreement Method values shall be set to 1 and the BEST Key Argeement Method set shall be one of the supported BEST Key Agreement Methods indicated in the preceeding Sesssion Request.

Any remaining bits are reserved for future use and are set to "0..0". Key agreement TLV:

If the 'Length of the Key agreement' is set to 1 then this means use current keyset agreed for this KEY ID. In this case the RAND IE and AUTN IE shall not be present. If BEST key agreement - EPS authentication required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then RAND IE and AUTN IE shall be present in the Key Agreement TLV. In this case, B-TID, A-KID, and Pre-Agreed Key Identifier shall not be present in the Key Agreement TLV. If BEST key agreement - 5G authentication required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then RAND IE and AUTN IE shall be present in the Key Agreement TLV. In this case, B-TID, A-KID, and Pre-Agreed Key Identifier shall not be present in the Key Agreement TLV. If BEST key agreement - GBA required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then B-TID shall be present in the Key Agreement TLV set to a value that identifies the key generated by the GBA key agreement used for this purpose. In this case, RAND IE, AUTN IE, A-KID, and Pre-Agreed Key Identifier shall not be present in the Key Agreement TLV. If BEST key agreement - 5G GBA required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then B-TID shall be present in the Key Agreement TLV set to a value that identifies the key generated by the 5G GBA key agreement used for this purpose. In this case, RAND IE, AUTN IE, A-KID, and Pre-Agreed Key Identifier shall not be present in the Key Agreement TLV. If BEST key agreement - AKMA required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then A-KID shall be present in the Key Agreement TLV set to a value that identifies the key generated by the AKMA key agreement used for this purpose. In this case, RAND IE, AUTN IE, B-TID, and Pre-Agreed Key Identifier shall not be present in the Key Agreement TLV. If BEST key agreement - Proprietary Key agreement required is indicated in the BEST HSE configuration TLV and if the Length is not set to 1 then Pre-Agreed Key Identifier shall be present in the Key Agreement TLV set to a value that identifies the Proprietary key to be used. In this case, RAND IE, AUTN IE, B-TID, and A-KID shall not be present in the Key Agreement TLV. The Additional information are as follows:

EMSDP Session Request MAC TLV: The EMSDP session request MAC TLV shall be present if the previous command was an EMSDP session request message. Its contents are as follows:

HSE Identity TLV: this contains a 4 octet numeric identifier for the HSE. This should be unique to the HSE being used within the home network. It is formatted as follows:

The EAS Container TLV: this contains a 4 octet numeric identifier for the Enterprise Key ID.

Response: If the Confirmation message required flag in the Key agreement TLV is set and the message verifies, then the UE shall send an EMSDP start session confirmation message. If the Confirmation message required flag in the Key agreement TLV is set and the message verifies, then the UE may send an EMSDP start session confirmation message. If the message does not verify, then the UE shall respond with a Request Rejected command. This command may include the reason that the request has been rejected. If the USIM returns a AUTS as a result of the authentication, the UE shall respond with a Request Rejected command with the reason "Authentication ReSync required" and including the AUTS.

The EMSDP Session Start conformation message is sent by the UE to confirm a previous EMSDP Session Start command. This message is optional for the UE to send unless the "Confirmation message required" flag is set in the EMSDP start Session Start command in which case this message shall be sent. This command has the following cmd options:

AUTHENTICATION RESPONSE TLV: This TLV contains the authentication response for a successful authentication as follows:

If the response is associated with an EPS key agreement from the HSE then RES shall be present. If the response is associated with a 5G key agreement from the HSE then XRES shall be present. If the response is associated with a Proprietary key agreement from the HSE then Proprietary Key agreement response may be present. Where: Key Information is coded:

The EMSDP Session Terminate Request may be sent by either the UE or the HSE to terminate an existing EMSDP session. The sending party shall close their session on sending this command and the receiving party shall close the session upon reception of this command. All future BEST User Plane messages and BEST control plane messages for the session indicated in the session ID shall be either refused or ignored. This command has no cmd options.

The EMSDP Manage Keys request command shall be sent by the UE to request the HSE to negotiate new key material. If the BEST session requested includes cyphering then the UE shall send a Serving Network TLV (as defined in clause 6.2.6.1.1).

The EMSDP Manage Keys command is used by the HSE to agree new keys,replace a key and delete existing keys. When the HSE indicates "Add new key" and the key ID indicated in the Key Agreement TLV is not currently used in the UE, then the UE shall use the information in the Key Agreement TLV to create a new key that can be used in this EMSDP session. If the Key ID is already in use then the UE shall send a EMSDP Message Reject command. When the HSE indicates "Update key" and the Key ID in the Key Agreement TLV is the same as the Key ID in the in the Key Management TLV, then the UE shall delete the key indicated in the Key Management TLV and then create a new key use the information in the Key Agreement TLV that can be used in this EMSDP session. If the Key ID of the key to be deleted is no longer valid then the UE shall silently ignore this request. When the HSE indicates " Update key" and the Key ID in the Key Agreement TLV is different to the Key ID in the in the Key Management TLV, then the UE shall create a new key using the information in the Key Agreement TLV that can be used in this EMSDP session. The key indicated in the Key Management TLV shall be deleted when the UE receives the first EMSDP message using the new key ID. If the Key ID of the key to be created is already in use then the UE shall send a EMSDP Message Reject command. If the Key ID of the key to be deleted is no longer valid then the UE shall silently ignore this request. When the HSE indicates "delete key" then the UE shall delete the key indicated in the Key Management TLV. If the Key ID of the key to be deleted is no longer valid then the UE shall silently ignore this request. The EMSDP Manage Keys command has the following cmd options:

Key management TLV:

Where: Key Management Information is coded:

b8 and b7: Action to be performed b6 to b4: RFU (set to 0) b3 to b1: Key ID Key agreement TLV: As detailed in clause 6.2.6.1.2.

The EMSDP Message Reject command may be used by either the UE or the HSE to reject messages, data or control plane. The EMSDP Message Reject command has the following cmd options:

Where: Rejection details TLV:

Rejection reason: