Tech-invite  3GPPspace  IETFspace
◀  ▶  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x

Content for  TR 33.700-22  Word version:  19.2.0

Top   Top   None   None   None
1…  
1 Scope  2 References  3 Definitions of terms, symbols and abbreviations 

 

1  Scope  p. 10

The present document investigates the security and privacy impacts of the CAPIF procedures and covers the following:
  • Resource owner authorization management.
  • CAPIF interconnection security.
  • Authorizing API invoker on one UE accessing resources related to another UE.
  • Nested API invocation.
  • Authentication and authorization of multiple API invokers.
  • Onboarding aspects.

2  References  p. 10

The following documents contain provisions which, through reference in this text, constitute provisions of the present document.
  • References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific.
  • For a specific reference, subsequent revisions do not apply.
  • For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.
[1]
TR 21.905: "Vocabulary for 3GPP Specifications".
[2]
TS 23.222: "Common API Framework for 3GPP Northbound APIs".
[3]
TR 23.700-22: "Study on CAPIF Phase 3".
[4]
TS 33.122: "Security aspects of Common API Framework (CAPIF) for 3GPP northbound APIs".
[5]
RFC 8693:  "OAuth 2.0 Token Exchange".
[6]
TS 33.310: "Network Domain Security (NDS); Authentication Framework (AF)".
[7]
TS 33.210: "Network Domain Security (NDS); IP network layer security".
[8]
TS 33.220: "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA)".
[9]
TS 33.535: "Authentication and Key Management for Applications (AKMA)based on 3GPP credentials in the 5G System (5GS)".
[10]
RFC 6749:  "The OAuth 2.0 Authorization Framework".
[11]
OpenID Connect Client-Initiated Backchannel Authentication Flow 1.0.
[12]
RFC 7515:  "JSON Web Signature (JWS)".
[13]
TR 23.700-95: "Study on application enablement aspects for subscriber-aware northbound API access".
[14]
TS 33.501: "Security architecture and procedures for 5G System".
[15]
RFC 7519:"  JSON Web Token (JWT)".
Up

3  Definitions of terms, symbols and abbreviations  p. 11

3.1  Terms  p. 11

For the purposes of the present document, the terms given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905.
Resource owner authorization:
The permission by the resource owner to allow the API invoker to access the resource owner's resource via the northbound API.

3.2  Symbols  p. 11

Void.

3.3  Abbreviations  p. 11

For the purposes of the present document, the abbreviations given in TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905.
AZF
AuthoriZation Function
CCF
CAPIF Core Function
MAC
Message Authentication Code
ROF
Resource Owner Function
ROMF
Resource Owner Management Function

Up   Top