Tech-invite  3GPPspace  IETFspace
21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x

Content for  TS 33.503  Word version:  19.0.0

Top   Top   Up   Prev   Next
1…   4…   5…   6…   6.1.3.2…   6.1.3.2.2.2   6.1.3.2.3   6.1.3.3…   6.1.3.4…   6.1.3.5…   6.2…   6.3…   6.3.3.2…   6.3.3.3…   6.3.4…   6.3.8…   6.4…   7…   A… 
6.1.3.5 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery  6.1.3.5.1 General  6.1.3.5.2 Security requirements for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery  6.1.3.5.3 Security flows for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery  6.1.3.5.3.1 Security of 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery for IP PDU type  6.1.3.5.3.1.1 Relay discovery among 5G ProSe UE-to-UE Relays  6.1.3.5.3.1.2 Relay discovery between a 5G ProSe End UE and 5G ProSe UE-to-UE Relay  6.1.3.5.3.2 Security procedure for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of non-IP PDU type 
...

 

6.1.3.5  5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery |R19|  p. 35

6.1.3.5.1  General  p. 35
This clause describes the security requirements and the procedures for 5G ProSe Layer-3 multi-hop UE-to-UE Relay Discovery defined in TS 23.304, including the Layer-3 multi-hop UE-to-UE Relay discovery for IP PDU type and non-IP PDU type.
6.1.3.5.2  Security requirements for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery  p. 35
5G ProSe Layer-3 multi-hop UE-to-UE Relay discovery addresses the following security requirements:
  • The 5G System shall provide a means for confidentiality protection, integrity protection and replay protection of discovery messages for Layer-3 multi-hop UE-to-UE Relay discovery.
  • The 5G System shall provide a means to mitigate trackability and linkability attacks on UEs in Layer-3 multi-hop discovery.
  • The 5G System shall provide a means to securely provision the security materials for Layer-3 multi-hop UE-to-UE Relay discovery.
Up
6.1.3.5.3  Security flows for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery  p. 35
Two types of 5G ProSe Layer-3 Multi-hop UE-to-UE Relay discovery are supported as specified in TS 23.304, i.e., discovery for IP PDU type and discovery for non-IP PDU type (i.e., Ethernet or Unstructured), depends on the RSC for the discovery. Both Model A and Model B discovery are supported by the 5G ProSe Layer-3 Multi-hop UE-to-UE discovery.
6.1.3.5.3.1  Security of 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery for IP PDU type  p. 35
The 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of IP PDU type consists of two types of relay discovery: one for Relay discovery among 5G ProSe UE-to-UE Relays and the other one for Relay discovery between an 5G ProSe End UE and 5G ProSe UE-to-UE Relay as specified in clause 6.3.2.6.2 of TS 23.304. The discovery of the target 5G ProSe End UEs are performed via DNS queries after establishing a secure PC5 link with the 5G ProSe Multi-hop UE-to-UE Relay(s).
Up
6.1.3.5.3.1.1  Relay discovery among 5G ProSe UE-to-UE Relays  p. 35
For the provisioning of discovery security materials and discovery message protection based on the discovery security materials associated with an RSC for multi-hop UE-to-UE Relay, the security procedures for 5G ProSe UE-to-Network Relay discovery with Model A and Model B as specified in clause 6.1.3.2.2 are reused with the following change:
  • One 5G ProSe UE-to-UE Relay plays the role of a 5G ProSe Remote UE and the other 5G ProSe UE-to-UE Relay plays the role of a 5G ProSe UE-to-Network Relay.
Up
6.1.3.5.3.1.2  Relay discovery between a 5G ProSe End UE and 5G ProSe UE-to-UE Relay  p. 35
For the provisioning of discovery security materials and discovery message protection based on the discovery security materials associated with an RSC for multi-hop UE-to-UE Relay, the security procedures for 5G ProSe UE-to-Network Relay discovery with Model A and Model B as specified in clause 6.1.3.2.2 are reused with the following change:
  • A 5G ProSe End UE plays the role of a 5G ProSe Remote UE and a 5G ProSe UE-to-UE Relay plays the role of a 5G ProSe UE-to-Network Relay.
Up
6.1.3.5.3.2  Security procedure for 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of non-IP PDU type  p. 36
Both Model A and Model B discovery are supported by the security procedures of 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of non-IP PDU type.
For Model A discovery in 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of non-IP PDU type, the UE-to-UE Relay has discovered End UEs in proximity and obtains the Direct Discovery Set(s) from End UE(s) in proximity per RSC as specified in TS 23.304 (e.g. via a previous 5G ProSe UE-to-UE Relay Discovery or via secure PC5 connection between 5G ProSe U2U Relay and 5G ProSe End UE). As per TS 23.304, for each received Direct Discovery Set, the UE-to-UE Relay also gets paths information, hop count and optionally maximum number of hops. Similar to the security principle of UE-to-UE Relay discovery as specified in clause 6.1.3.3, the Direct Discovery Set is End-to-End protected between End UEs, while other parameters in the discovery message are hop-by-hop protected between UE-to-UE Relay and End UE:
Step 1a.
To provide End-to-End protection of the Direct Discovery Set, the existing discovery security material provisioning procedure as specified in clause 6.1.3.2.2.1 is reused to provision the discovery security materials to the End UEs. The security materials are associated with 5G ProSe Direct Discovery service for Restricted 5G ProSe Direct Discovery.
Step 1b.
To offer hop-by-hop protection of discovery messages, the existing discovery security material provisioning procedure as specified in clause 6.1.3.2.2.1 is reused to provision the discovery security materials to the End UEs and the UE-to-UE Relays. The security materials are associated RSC for the UE-to-UE Relay Discovery. The monitoring End UE plays the role of Remote UE while the UE-to-UE plays the role of UE-to-Network Relay.
Step 2.
The announcing End UE protects the Direct Discovery Set, using the security materials as specified in clause 6.1.3.2.3. The protects the Direct Discovery Set is sent to UE-to-UE Relay using either by a previous UE-to-UE Relay Discovery procedure or via secure PC5 connection between to the UE-to-UE Relay.
Step 3.
Before announcing the Announcement message, the UE-to-UE Relay prepares the message including the protected Direct Discovery Set(s), and other discovery parameters as specified in TS 23.304, and protects the Announcement message using the discovery security materials in step 1b as specified in clause 6.1.3.2.3. The UE-to-UE relay needs to check the validity timer(s) associated with the protected Direct Discovery Set(s) as specified in clause 6.1.3.3.3, only valid protected Direct Discovery Set(s) are included in the Announcement message.
Step 4.
On receiving the Announcement message from the UE-to-UE Relay, the monitoring End UE uses the discovery security material received in step 1b to process the message as specified in clause 6.1.3.2.3. If the verification is successful, the monitoring End UE processs the Direct Discovery Set(s) in the message using the discovery security materials in step 1a as specified in clause 6.1.3.2.3.
For Model B discovery in 5G ProSe Layer-3 Multi-hop UE-to-UE Relay Discovery of non-IP PDU type,
  • The 5G ProSe End UE and 5G ProSe UE-to-UE Relay are provisioned with the discovery security materials associated with an RSC from the 5G PKMF/5G DDNMF in their own HPLMN, reusing the procedures specified in clause 6.1.3.2.
  • The 5G ProSe End UE and 5G ProSe UE-to-UE Relay use the mechanisms as specified in clause 6.1.3.3 to protect the discovery messages.
Up

Up   Top   ToC