Content for TR 33.839 Word version: 17.1.0
6 Proposed solutions Word‑p. 20
6.0 Mapping of Solutions to Key Issues Word‑p. 20
6.1 Solution #1: DNS request protection Word‑p. 21
6.1.1 Introduction Word‑p. 21
6.1.2 Solution details Word‑p. 21
6.1.3 Solution Evaluation Word‑p. 21
6.2 Solution #2: Authentication between EEC and ECS based on primary authentication Word‑p. 22
6.2.1 Introduction Word‑p. 22
6.2.2 Solution details Word‑p. 22
6.2.2.1 Procedure Word‑p. 22
6.2.2.2 Derivation of Kedge and Kedge ID Word‑p. 23
6.2.2.3 Generation of MACEEC Word‑p. 23
6.2.3 Solution Evaluation Word‑p. 23
6.3 Solution #3: Authentication/Authorization framework for Edge Enabler Client and Servers Word‑p. 24
6.3.1 Introduction Word‑p. 24
6.3.2 Solution details Word‑p. 24
6.3.3 Solution evaluation Word‑p. 26
6.4 Solution #4: Authentication/Authorization framework for Edge Enabler Client and Servers Word‑p. 26
6.4.1 Introduction Word‑p. 26
6.4.2 Solution details Word‑p. 27
6.4.3 Solution evaluation Word‑p. 28
6.5 Solution #5: Authentication and Authorization between the Edge Enabler Client and the Edge Enabler Server Word‑p. 29
6.5.1 Introduction Word‑p. 29
6.5.2 Solution details Word‑p. 29
6.5.3 Solution evaluation Word‑p. 30
6.6 Solution #6: Authentication and Authorization between the Edge Enabler Client and the Edge Enabler Server Word‑p. 30
6.6.1 Introduction Word‑p. 30
6.6.2 Solution details Word‑p. 31
6.6.3 Solution evaluation Word‑p. 32
6.7 Solution #7: Authentication and Authorization with the Edge Data Network Word‑p. 32
6.7.1 Solution overview Word‑p. 32
6.7.3 Solution evaluation Word‑p. 35
6.8 Solution #8: Authentication between EEC and EES Word‑p. 36
6.8.1 Solution overview Word‑p. 36
6.8.2 Solution details Word‑p. 36
6.8.3 Solution evaluation Word‑p. 37
6.9 Solution #9: Authentication and authorization between EEC and ECS based on AKMA Word‑p. 37
6.9.1 Introduction Word‑p. 37
6.9.2 Solution details Word‑p. 38
6.9.3 Solution Evaluation Word‑p. 39
6.10 Solution #10: Authentication and Authorization between the Edge Enabler Client and the Edge Configuration Server Word‑p. 39
6.10.1 Introduction Word‑p. 39
6.10.2 Solution details Word‑p. 40
6.10.3 Solution Evaluation Word‑p. 40
6.11 Solution #11: Authentication between EEC and ECS Word‑p. 40
6.11.1 Solution overview Word‑p. 40
6.11.2 Solution details Word‑p. 41
6.11.3 Solution evaluation Word‑p. 42
6.12 Solution #12: Onboarding and authentication/authorization framework for Edge Enabler Server and Edge Configuration Server Word‑p. 42
6.12.1 Introduction Word‑p. 42
6.12.2 Solution details Word‑p. 43
6.12.3 Solution evaluation Word‑p. 44
6.13 Solution #13: Transport security for EDGE-1-9 interfaces Word‑p. 44
6.13.1 Introduction Word‑p. 44
6.13.2 Solution details Word‑p. 44
13.2.0 General Word‑p. 44
6.13.3 Solution Evaluation Word‑p. 45
6.14 Solution #14: Protection of Network Information Provisioning to Local AF directly Word‑p. 45
6.14.1 Solution overview Word‑p. 45
6.14.2 Solution details Word‑p. 46
6.14.3 Solution evaluation Word‑p. 46
6.15 Solution #15: Network capability re-exposure via Edge Enabler Server Word‑p. 47
6.15.1 Introduction Word‑p. 47
6.15.2 Solution details Word‑p. 47
6.15.3 Solution Evaluation Word‑p. 47
6.16 Solution #16: EEC authentication and authorization framework with ECS and EES Word‑p. 48
6.16.1 Introduction Word‑p. 48
6.16.2 Solution details Word‑p. 48
6.16.3 Solution Evaluation Word‑p. 49
6.17 Solution #17: EEC/EES/ECS authentication and transport protection with TLS Word‑p. 50
6.17.1 Solution overview Word‑p. 50
6.17.2 Solution details Word‑p. 50
6.17.2.1 Authentication and transport protection for the EDGE-1, EDGE-3, EDGE-4, EDGE-6 and EDGE-9 interfaces Word‑p. 50
6.17.2.2 Authentication of the GPSI in EEC-EES/ECS communication Word‑p. 51
6.17.3 Solution evaluation Word‑p. 52
6.18 Solution #18: Authentication and Authorization Framework for EDGE-4 interfaces using Primary authentication and proxy interface Word‑p. 53
6.18.1 Introduction Word‑p. 53
6.18.2 Solution details Word‑p. 54
6.18.3 Solution Evaluation Word‑p. 55
6.19 Solution #19: Authentication/authorization between UE and Edge Data Network based on the secondary authentication Word‑p. 55
6.19.1 Introduction Word‑p. 55
6.19.2 Solution details Word‑p. 55
6.19.3 Solution Evaluation Word‑p. 56
6.20 Solution #20: Authentication and authorization in EES capability exposure based on CAPIF Word‑p. 56
6.20.1 Introduction Word‑p. 56
6.20.2 Solution details Word‑p. 56
6.20.3 Solution Evaluation Word‑p. 57
6.21 Solution #21: security for the interface between the SMF and LDNSR Word‑p. 57
6.21.1 Solution overview Word‑p. 57
6.21.2 Solution details Word‑p. 57
6.21.3 Solution evaluation Word‑p. 58
6.22 Solution #22: Authorization during Edge Data Network change Word‑p. 58
6.22.1 Introduction Word‑p. 58
6.22.2 Solution details Word‑p. 58
6.22.3 Solution Evaluation Word‑p. 60
6.23 Solution #23: Authentication and Authorization between EEC and ECS/EES Word‑p. 60
6.23.1 Solution overview Word‑p. 60
6.23.2 Solution details Word‑p. 60
6.23.3 Solution evaluation Word‑p. 60
6.24 Solution #24: Using TLS with AKMA to protect edge interfaces Word‑p. 61
6.24.1 Solution overview Word‑p. 61
6.24.2 Solution details Word‑p. 61
6.24.2.1 General Word‑p. 61
6.24.2.2 Shared key-based UE authentication with certificate-based AF authentication Word‑p. 61
6.24.2.2.1 General Word‑p. 61
6.24.1.2.2 Procedures Word‑p. 61
6.24.2.3 Shared key-based mutual authentication between UE and AF Word‑p. 62
6.24.2.3.1 General Word‑p. 62
6.24.2.3.2 Procedures Word‑p. 62
6.24.3 Solution evaluation Word‑p. 62
6.25 Solution #25: Practical authorization during Edge Data Network change Word‑p. 62
6.25.1 Introduction Word‑p. 62
6.25.2 Solution details Word‑p. 63
6.25.3 Solution Evaluation Word‑p. 64
6.26 Solution #26: GBA-based solution for EEC authentication and authorization framework with ECS and EES Word‑p. 64
6.26.1 Introduction Word‑p. 64
6.26.2 Solution details Word‑p. 64
6.26.3 Solution Evaluation Word‑p. 66
6.27 Solution #27: Using TLS with Edge Security Service to protect edge interfaces Word‑p. 67
6.27.1 Solution overview Word‑p. 67
6.27.2 Solution details Word‑p. 68
6.27.3 Solution evaluation Word‑p. 70
6.28 Solution #28: Authentication between EEC and ECS based on AKMA Word‑p. 70
6.28.1 Introduction Word‑p. 70
6.28.2 Solution details Word‑p. 70
6.28.2.1 Procedure Word‑p. 70
6.28.2.2 Derivation of Kedge and Kedge ID Word‑p. 71
6.28.2.3 Generation of MACEEC Word‑p. 72
6.28.3 Solution Evaluation Word‑p. 72
6.29 Solution #29: Using TLS with GBA to protect edge interfaces Word‑p. 72
6.29.1 Solution overview Word‑p. 72
6.29.2 Solution details Word‑p. 72
6.29.2.1 General Word‑p. 72
6.29.2.2 Shared key-based UE authentication with certificate-based AF authentication Word‑p. 72
6.29.2.2.1 General Word‑p. 72
6.29.2.3 Shared key-based mutual authentication between UE and AF Word‑p. 72
6.29.2.3.1 General Word‑p. 72
6.29.3 Solution evaluation Word‑p. 73
6.30 Solution #30: An AKMA-based solution for authentication and interface protection between EEC and EES/ECS Word‑p. 73
6.30.1 Solution overview Word‑p. 73
6.30.2 Solution details Word‑p. 73
6.30.3 Solution evaluation Word‑p. 74
6.31 Solution #31: Enhancing TLS with GBA for usage with Edge Word‑p. 75
6.31.1 Solution overview Word‑p. 75
6.31.2 Solution details Word‑p. 75
6.31.3 Solution evaluation Word‑p. 75
7 Conclusions Word‑p. 75
7.1 Conclusions for Key Issue #1 Word‑p. 75
7.2 Conclusions for Key Issue #2 Word‑p. 76
7.3 Conclusions for Key Issue #3 Word‑p. 76
7.4 Conclusions for Key Issue #4 Word‑p. 76
7.5 Conclusions for Key Issue #5 Word‑p. 76
7.6 Conclusions for Key Issue #6 Word‑p. 76
7.7 Conclusions for Key Issue #7 Word‑p. 77
7.8 Conclusions for Key Issue #8 Word‑p. 77
7.9 Conclusions for Key Issue #9 Word‑p. 77
7.10 Conclusions for Key Issue #10 Word‑p. 77
$ Change history Word‑p. 78
