Content for TR 33.816 Word version: 10.0.0
10 Proposed Solutions p. 31
10.1 Solution 1 - IPsec for control and user plane p. 31
10.1.1 General p. 31
10.1.2 Security Procedures p. 31
10.1.3 UICC Aspects in RN scenarios p. 31
10.1.4 Enrolment procedures for RNs for backhaul link security p. 31
10.1.5 Analysis of Solution 1 p. 32
10.2 Solution 2 - IPsec for control and user plane with certificate and AKA authentication in IKE p. 32
10.2.1 General p. 32
10.2.2 Security Procedures p. 32
10.2.3 UICC Aspects in RN scenarios p. 32
10.2.4 Enrolment procedures for RNs for backhaul link security p. 32
10.2.5 Analysis of Solution 2 p. 33
10.3 Solution 3 - AKA credentials embedded in RN p. 33
10.3.1 General p. 33
10.3.2 Security Procedures p. 33
10.3.3 UICC Aspects in RN scenarios p. 33
10.3.4 Enrolment procedures for RNs for backhaul link security p. 33
10.3.5 Analysis of Solution 3 p. 34
10.4 Solution 4 - IPsec for control plane and secure channel between RN and USIM with AKA credentials stored in UICC p. 34
10.4.1 General p. 34
10.4.2 Security Procedures p. 34
10.4.3 UICC Binding Aspects in RN scenarios p. 36
10.4.4 Enrolment procedures for RNs p. 37
10.4.5 Secure management procedures for RNs p. 37
10.4.6 Certificate validation p. 37
10.4.7 Profiles of solution 4 p. 38
10.4.7.1 Solution profile 4A p. 38
10.4.7.1.1 General p. 38
10.4.7.1.2 Security Procedures p. 38
10.4.7.1.3 USIM Binding Aspects in RN scenarios p. 39
10.4.7.1.4 Enrolment procedures for RNs p. 39
10.4.7.1.5 Secure management procedures for RNs p. 39
10.4.7.1.6 Certificate validation p. 39
10.4.7.2 Solution profile 4B p. 40
10.4.8 Analysis of Solution 4 p. 42
10.5 Solution 5 - Enhanced AKA to include device authentication p. 45
10.5.1 General p. 45
10.5.2 Security Procedures p. 45
10.5.2.1 General p. 45
10.5.2.2 Enhanced AKA authentication p. 46
10.5.3 UICC Aspects in RN scenarios p. 50
10.5.4 Enrolment procedures for RNs for backhaul link security p. 50
10.5.5 Analysis of Solution 5 p. 51
10.5.5.1 How does solution 5 address the threats in clause 5? p. 51
10.5.5.2 How does solution 5 fulfil the requirements in clause 6? p. 52
10.5.5.3 How does solution 5 address the general Editor's notes and the residual threats in clause 8.1.2.1? p. 53
10.5.5.4 How does solution 5 address the general Editor's notes and the residual threats in clause 8.1.2.2? p. 54
10.5.5.5 Analysis of solution 5 not related to threats p. 54
10.6 Solution 6: AKA for Relay Node UE authentication and secure channel between RN and USIM p. 54
10.6.1 General p. 54
10.6.2 Security Procedures p. 55
10.6.3 UICC Aspects in RN scenarios p. 55
10.6.4 Enrolment procedures for RNs for backhaul link security p. 55
10.7 Solution 7: AKA for Relay Node UE authentication and IPSec protection p. 55
10.7.1 General p. 55
10.7.2 Security Procedures p. 56
10.7.3 UICC Aspects in RN scenarios p. 56
10.7.4 Pre-shared Key Enrolment procedures for RNs for backhaul link security p. 56
10.7.5 Analysis of Solution 7 p. 57
10.8 Solution 8 - Enhancing AKA to include device authentication via symmetric key in RN and HSS/MME p. 59
10.8.1 General p. 59
10.8.2 Security Procedures p. 59
10.8.2.1 General p. 59
10.8.2.2 Enhanced EPS-AKA using a relay-node device secret key p. 59
10.8.2.3 Improvement using enhanced authentication data p. 60
10.8.3 UICC Aspects in RN scenarios p. 62
10.8.4 Enrolment procedures for RNs for backhaul link security p. 63
10.8.5 Analysis of solution 8 p. 63
10.8.5.1 How does solution 8 address the threats in clause 5.3? p. 63
10.8.5.2 How does the solution 8 fulfil the requirements in clause 6.2? p. 64
10.8.5.3 How does the solution 8 address the general Editor's notes and the residual threats in clause 8.1.2.1.2? p. 65
10.8.5.4 How does solution 8 address the general Editor's notes and the residual threats in clause 8.1.2.2? p. 66
10.8.5.5 Analysis of solution 8 not related to threats p. 66
10.9 Solution 9 - IPsec or PDCP security for control plane and with key binding for AS security p. 66
10.9.1 General p. 66
10.9.2 Security Procedures p. 68
10.9.2.1 Start up procedure phase II: Attach for RN operation p. 68
10.9.2.2 Binding of RN platform authentication to the AS security context p. 69
10.9.2.2.1 Purpose of the binding p. 69
10.9.2.2.2 Binding KO and the keys from RN subscription authentication p. 69
10.9.2.2.3 Switching to the KO-bound AS security context p. 70
10.9.2.2.4 Establishment of KO p. 70
10.9.2.2.5 KeNB chaining, change of KO and change of IPsec SAs p. 70
10.9.2.3 Analysis of protection against identified threats p. 71
10.9.3 UICC Aspects in RN scenarios p. 72
10.9.4 Enrolment procedures for RNs for backhaul link security p. 72
10.10 Solution 10 - Secure channel between RN and USIM with a one-to-one mapping between RN and UICC p. 72
10.10.1 General p. 72
10.10.2 Security Procedures p. 72
10.10.3 UICC Aspects in RN scenarios p. 72
10.10.4 Enrolment procedures for RNs for backhaul link security p. 73
10.11 Solution 11 - Secure Channel between USIM and RN and AS integrity for S1 /X2; Variant with two USIMs p. 73
10.11.1 General p. 73
10.11.2 Security Procedures p. 73
10.11.3 USIM Binding Aspects in RN scenarios p. 75
10.11.4 Enrolment procedures for RNs p. 75
10.11.5 Secure management procedures for RNs p. 76
10.11.6 Certificate validation p. 76
10.11.7 Profiles of solution 11 p. 76
10.11.7.1 Solution profile 11A p. 76
10.11.7.1.1 General p. 76
10.11.7.1.2 Security Procedures p. 77
10.11.7.1.3 USIM Binding Aspects in RN scenarios p. 78
10.11.7.1.4 Enrolment procedures for RNs p. 78
10.11.7.1.5 Secure management procedures for RNs p. 78
10.11.7.1.6 Certificate validation p. 78
10.11.7.2 Solution profile 11B p. 78
10.11.8 Analysis of Solution 11 p. 82
10.12 Solution 12 - Secure Channel between USIM and RN and AS integrity for S1 /X2; Variant with modified KASME p. 86
11 Conclusions p. 93
$ Change history p. 94
