Tech-invite3GPPspecsSIPRFCs
Overview21222324252627282931323334353637384‑5x

Content for  TS 33.501  Word version:  16.3.0

Top   Top   Up   Prev   Next
1…   4…   5…   6…   6.2…   6.3…   6.5…   6.8…   6.9…   6.10…   6.12…   6.14   6.15   6.16   7…   7A…   7B…   8…   9…   10…   11…   13…   13.3…   13.4…   14…   15…   A…   B…   C…   D…   G…   K…   O…

 

6.14  Steering of roaming security mechanismWord‑p. 99

6.14.1  General

This clause describes the security functions necessary to support steering of the UE in the VPLMN during registration procedure and also after registration as described in TS 23.122 Annex C. The security functions are described in the context of the functions supporting the control plane solution for steering of roaming in 5GS.
If the control plane solution for Steering of Roaming is supported by the HPLMN, the AUSF shall store the K AUSF after the completion of the primary authentication.
The content of Steering Information List as well as the conditions for sending it to the UE are described in TS 23.122 Annex C and are not repeated below. For example, the Steering Information List may include a list of preferred PLMN/access technology combinations or HPLMN indication that 'no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed and thus no list of preferred PLMN/access technology combinations is provided'.
Up

6.14.2  Security mechanisms

6.14.2.1  Procedure for steering of UE in VPLMN during registration

The security procedure for the case when the UE registers with VPLMN AMF is described below in figure 6.14.2.1-1:
[not reproduced yet]
Figure 6.14.2.1-1: Procedure for providing list of preferred PLMN/access technology combinations
Up
1) The UE initiates registration by sending Registration Request message to the VPLMN AMF.
2-3) The VPLMN AMF executes the registration procedure as defined in subclause 4.2.2.2.2 of TS 23.502. As part of the registration procedure, the VPLMN AMF executes primary authentication of the UE and then initiates the NAS SMC procedure, after the authentication is successful.
4-5) The VPLMN AMF invokes the Nudm_UECM_Registration message to the UDM and registers access with the UDM as per step 14a in subclause 4.2.2.2.2 of TS 23.502.
6) The VPLMN AMF invokes Nudm_SDM_Get service operation message to the UDM to get amongst other information the Access and Mobility Subscription data for the UE (see step 14b in subclause 4.2.2.2.2 of TS 23.502).
7) The UDM decides to send the Steering Information, and obtains the list as descirbed in TS 23.122.
8-9) The UDM shall invoke Nausf_SoRProtection service operation message to the AUSF to get SoR-MAC-IAUSF and CounterSoR as specified in subclause 14.1.3 of this document. If the HPLMN decided that the UE is to acknowledge the successful security check of the received Steering Information List, then the UDM shall set the corresponding indication in the SoR header (see TS 24.501) and include the ACK Indication in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-XMAC-IUE, as specified in subclause 14.1.3 of this document.
The details of the CounterSoR is specified in subclause 6.14.2.3 of this document. In case, the Steering Information List is not available or HPLMN determines that no steering of the UE is required, then the List indication valuein the SoR header shall be set to null and list shall not be included. The inclusion of list of preferred PLMN/access technology combinations (if provided) and the SoR header in the calculation of SoR-MAC-IAUSF allows the UE to verify that the Steering Information List received is not tampered with or removed by the VPLMN and if the UDM requested an acknowledgement. The expected SoR-XMAC-IUE allows the UDM to verify that the UE received the Steering Information List.
10) The UDM responds to the Nudm_SDM_Get service operation to the VPLMN AMF, which shall include the SoR header, Steering Information List, SoR-MAC-IAUSF and CounterSoR within the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-XMAC-IUE.
11) The VPLMN AMF shall include the Steering Information List, the SoR-MAC-IAUSF, CounterSoR and the SoR header to the UE in the Registration Accept message;
12) On receiving the Registration Accept message, if the USIM is configured with the indication that the UE shall receive the Steering Information List, then the UE shall calculate the SoR-MAC-IAUSF in the same way as the AUSF (as specified in Annex A.17) on the received Steering information, the CounterSoR and the SoR header and verifies whether it matches the SoR-MAC-IAUSF value received in the Registration Accept message. Based on the SoR-MAC-IAUSF verification outcome, the behaviour of the UE is specified in TS 23.122.
13) If the UDM has requested an acknowledgement from the UE and the UE verified that the Steering Information List has been provided by the HPLMN in step 11, then the UE shall send the Registration Complete message to the serving AMF. The UE shall generate the SoR-MAC-IUE as specified in Annex A.18 and includes the generated SoR-MAC-IUE in a transparent container in the Registration Complete message.
14) The AMF sends a Nudm_SDM_Info request message to the UDM. If a transparent container with the SoR-MAC-IUE was received in the Registration Complete message, the AMF shall include the transparent container in the Nudm_SDM_Info request message.
15) If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering Information List in step 10, then the UDM shall compare the received SoR-MAC-IUE with the expected SoR-XMAC-IUE that the UDM stored temporarily in step 10.
Up

6.14.2.2  Procedure for steering of UE in VPLMN after registrationWord‑p. 101
The security procedure for the steering of UE in VPLMN after registration is described below in figure 6.14.2.2-1:
[not reproduced yet]
Figure 6.14.2.2-1: Procedure for providing list of preferred PLMN/access technology combinations
Up
1) The UDM decides to notify the UE of the changes to the Steering Information List by the means of invoking Nudm_SDM_Notification service operation.
2-3) The UDM shall invoke Nausf_SoRProtection service operation message by including the SoR header and Steering Information List to the AUSF to get SoR-MAC-IAUSF and CounterSoR as specified in subclause 14.1.3 of this document. If the HPLMN decided that the UE is to acknowledge the successful security check of the received Steering Information List, then the UDM shall set the corresponding indication in the SoR header (see TS 24.501) and include the ACK Indication in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-XMAC-IUE, as specified in subclause 14.1.3 of this document.
The details of the CounterSoR is specified in subclause 6.14.2.3 of this document. The inclusion of Steering Information List and the acknowledge indication in the calculation of SoR-MAC-IAUSF allows the UE to verify that the Steering Information List received is not tampered with or removed by the VPLMN and if the UDM requested an acknowledgement. The inclusion of these information in the calculation of the expected SoR-XMAC-IUE allows the UDM to verify that the UE received the Steering Information.
4) The UDM shall invoke Nudm_SDM_Notification service operation, which contains the list of preferred PLMN/access technology combinations, SoR-MAC-IAUSF, CounterSoR within the Access and Mobility Subscription data and the SoR header. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-XMAC-IUE.
5) Upon receiving the Nudm_SDM_Notification message, the AMF shall send a DL NAS Transport message to the served UE. The AMF shall include in the DL NAS Transport message the transparent container received from the UDM.
6) On receiving the DL NAS Transport message, the UE shall calculate the SoR-MAC-IAUSF in the same way as the AUSF (as specified in Annex A.17) on the received Steering information, the CounterSoR and the SoR header and verifies whether it matches the SoR-MAC-IAUSF value received in the DL NAS Transport message.
7) If the UDM has requested an acknowledgement from the UE and the UE verified that the Steering Information List has been provided by the HPLMN, then the UE shall send the UL NAS Transport message to the serving AMF. The UE shall generate the SoR-MAC-IUE as specified in Annex A.18 and includes the generated SoR-MAC-IUE in a transparent container in the UL NAS Transport message.
8) The AMF shall send a Nudm_SDM_Info request message to the UDM. If a transparent container with the SoR-MAC-IUE was received in the UL NAS Transport message, the AMF shall include the transparent container in the Nudm_SDM_Info request message.
9) If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering Information List, then the UDM shall compare the received SoR-MAC-IUE with the expected SoR-XMAC-IUE that the UDM stored temporarily in step 4.
Up

6.14.2.3  SoR CounterWord‑p. 103
The AUSF and the UE shall associate a 16-bit counter, CounterSoR, with the key K AUSF.
The UE shall initialize the CounterSoR to 0x00 0x00 when the K AUSF is derived.
To generate the SoR-MAC-IAUSF, the AUSF shall use a counter, called a CounterSoR. The CounterSoR shall be incremented by the AUSF for every new computation of the SoR-MAC-IAUSF. The CounterSoR is used as freshness input into SoR-MAC-IAUSF and SoR-MAC-IUE derivations as described in the Annex A.17 and Annex A.18 respectively, to mitigate the replay attack. The AUSF shall send the value of the CounterSoR (used to generate the SoR-MAC-IAUSF) along with the SoR-MAC-IAUSF to the UE. The UE shall only accept CounterSoR value that is greater than stored CounterSoR value. The UE shall store the received CounterSoR, only if the verification of the received SoR-MAC-IAUSF is successful. The UE shall use the stored CounterSoR received from the HPLMN, when deriving the SoR-MAC-IUE for the SoR acknowledgement.
The AUSF and the UE shall maintain the CounterSoR for lifetime of the K AUSF.
The AUSF that supports the control plane solution for steering of roaming shall initialize the CounterSoR to 0x00 0x01 when the K AUSF is derived. The AUSF shall set the CounterSoR to 0x00 0x02 after the first calculated SoR-MAC-IAUSF, and monotonically increment it for each additional calculated SoR-MAC-IAUSF. The SoR Counter value of 0x00 0x00 shall not be used to calculate the SoR-MAC-IAUSF and SoR-MAC-IUE.
The AUSF shall suspend the SoR protection service for the UE, if the CounterSoR associated with the K AUSF of the UE, is about to wrap around. When a fresh K AUSF is generated for the UE, the CounterSoR at the AUSF is reset to 0x00 0x01 as defined above and the AUSF shall resume the SoR protection service for the UE.
Up


Up   Top   ToC