Content for TR 33.824 Word version: 17.0.0

7.1 Conclusions on authentication framework for IAB-node 7.2 Conclusions on authentication framework for IAB-node (IAB-DU part setup) 7.3 Conclusions on F1 interface security

7 Conclusions p. 21

7.1 Conclusions on authentication framework for IAB-node p. 21

Solution #1.1 is recommended as baseline for normative work to support authentication and authorization of the IAB Node, when the IAB-UE functionality in the IAB Node performs IAB-UE setup procedure. The normative work on IAB-node IAB-UE security procedures refers to the appropriate clauses in TS 33.501 and TS 33.401 for the authentication, credential storage, NAS and AS security setup procedures.

7.2 Conclusions on authentication framework for IAB-node (IAB-DU part setup) p. 21

In order to establish IPsec ESP, authentication methods for IKEv2 are supported using both certificates and Pre-Shared Key (PSK).

Additionally, to support a flexible plug and play of IAB-node and IAB-donor without a pre-configuration of the PSK(s), dynamic PSK computation for IKEv2 PSK authentication may also be supported. When dynamic PSK is used, the IAB-node and the IAB-donor calculates the PSK (KIAB) as specified in solution 2.1 of the present document.

7.3 Conclusions on F1 interface security p. 22

7.3.1 Key Issue #3.1: F1 interface security for IAB p. 22

F1 interface security for the wireline link between CU and DU is specified in TS 33.501. In IAB, the F1 interface is realized over a single hop or multiple hop wireless link(s). Since F1 interface is a logical interface between two end-points (i.e., CU and DU), the security for the F1 interface should be defined independently of the underlying transport medium (e.g., wireline, wireless, or single hop or multiple hops). Therefore, it is recommended that the solution #3.1 is used as the basis for normative work for F1 interfaces between IAB node and IAB-donor.