Content for TR 33.847 Word version: 17.1.0
6 Solutions p. 29
6.0 Mapping of Solutions to Key Issues p. 29
6.1 Solution #1: Solution for key management in 5G Proximity Services relay communication p. 30
6.2 Solution #2: Secure data transfer between UE and 5GDDNMF p. 33
6.3 Solution #3: Reuse LTE security mechanism for 5G ProSe open discovery p. 34
6.4 Solution #4: Reuse LTE security mechanism for 5G ProSe restricted discovery p. 37
6.5 Solution #5: Protection of the PC3 interface using AKMA and TLS p. 44
6.6 Solution #6: Key management for UE-to-Network Relays and Remote UE's p. 46
6.7 Solution #7: Security establishment of one-to-one PC5 communication p. 50
6.8 Solution #8: Confidential protection against UE-to-UE relay using asymmetric cryptography p. 52
6.8.1 Introduction p. 52
6.8.2 Solution details p. 52
6.8.2.1 Procedure p. 52
6.8.3 Evaluation p. 53
6.9 Solution #9: Key management in discovery procedure p. 53
6.10 Solution #10: Authorization and security with UE-to-Network relay using Remote UE network primary authentication p. 54
6.10.1 Introduction p. 54
6.10.2 Solution details p. 54
6.10.2.1 Connection with UE-to-Network relay using Remote UE network primary authentication via the UE-to-Network relay p. 54
6.10.2.2 Connection with UE-to-Network relay using the 5G native security context of the Remote UE p. 56
6.10.2.3 Key hierarchy, key derivation, and distribution p. 59
6.10.2.4 Remote UE authorization revocation/re-authentication p. 61
6.10.3 Evaluation p. 61
6.11 Solution #11: Protection of the PC3 interface using GBA p. 62
6.12 Solution #12: Privacy handling for Layer-3 UE-to-UE Relay based on IP routing p. 62
6.13 Solution #13: Secondary Authentication for a Layer 3 Remote UE p. 65
6.13.1 Introduction p. 65
6.13.2 Solution details p. 66
6.13.2.1 Secondary Authentication after PC5 link setup p. 66
6.13.2.2 Secondary Authentication before PC5 link setup p. 68
6.13.3 Evaluation p. 70
6.14 Solution #14: A security solution for UE-to-Network Relay based on Layer 2 Relay p. 70
6.15 Solution #15: Key management in UE-to-Network Relay based on primary authentication p. 72
6.15.1 Introduction p. 72
6.15.2 Solution details p. 72
6.15.2.1 Procedure p. 72
6.15.2.2 Derivation of P-TID p. 74
6.15.3 Solution Evaluation p. 75
6.16 Solution #16: Security establishment procedures between two UEs in the UE-to-UE relay scenario p. 75
6.17 Solution #17: Solution on securely creating destination Layer-2 ID in groupcast communication p. 76
6.18 Solution #18: Authorization and PC5 link setup for UE-to-Network relay p. 77
6.19 Solution #19: End-to-end security for the L3 UE-to-Network relay p. 80
6.19.1 Introduction p. 80
6.19.2 Solution details p. 80
6.19.2.1 Procedure p. 80
6.19.2.2 Protocol Stack p. 81
6.19.3 Evaluation p. 82
6.20 Solution #20: PC5 link setup for UE-to-UE relay p. 82
6.21 Solution #21: 5G PKMF for key management in PC5 communication p. 83
6.22 Solution #22: Representation of identities during broadcast p. 90
6.23 Solution #23: Initial key with validity time p. 94
6.23.1 Introduction p. 94
6.23.2 Solution details p. 94
6.23.2.1 Overview p. 94
6.23.2.2 Procedures p. 94
6.23.3 Evaluation p. 96
6.24 Solution #24: NSSAA for Remote UE with L3 UE-to-Network relay p. 97
6.24.1 Introduction p. 97
6.24.2 Solution details p. 97
6.24.2.1 PC5 link establishment with L3 UE-to-Network relay to use an S-NSSAI subject to NSSAA p. 97
6.24.2.2 NSSAA of Remote UE connecting via L3 UE-to-Network relay p. 100
6.24.2.3 AAA-S triggered Authorization Revocation to use S-NSSAI for Remote UE p. 101
6.24.2.4 AAA-S triggered Authorization Revocation to use S-NSSAI for Relay UE p. 102
6.24.3 Evaluation p. 103
6.25 Solution #25: Secondary authentication of Remote UE with L3 UE-to-Network relay p. 104
6.25.1 Introduction p. 104
6.25.2 Solution details p. 104
6.25.2.1 PC5 link establishment with L3 UE-to-Network relay to use a PDU Session subject to secondary A&A p. 104
6.25.2.2 PDU Session secondary A&A of Remote UE via L3 UE-to-Network relay p. 106
6.25.2.3 DN-AAA triggered PDU Session Authorization Revocation for Remote UE p. 107
6.25.2.4 DN-AAA triggered PDU Session Re-Authentication/Authorization for Remote UE p. 108
6.25.3 Evaluation p. 109
6.26 Solution #26: Protecting PDU session-related parameters for L2 relay with existing mechanism p. 109
6.27 Solution #27: Mitigating the conflict between security policies using match report procedures p. 110
6.27.1 Introduction p. 110
6.27.2 Solution details p. 110
6.27.2.0 General p. 110
6.27.2.1 Open discovery scenario p. 110
6.27.2.2 Restricted discovery scenario p. 112
6.27.3 Evaluation p. 113
6.28 Solution #28: Mitigating the conflict between security policies using restricted discovery procedures on network side p. 113
6.29 Solution #29: Security flow for Layer-3 UE-to-Network Relay p. 115
6.30 Solution #30: UE-to-Network Relay security based on primary authentication p. 118
6.31 Solution #31: Use of authorization tokens in UE-to-UE relay p. 121
6.32 Solution #32: Mitigating privacy issues of user info IDs, relay service codes and PDU parameters for L3 UE-to-NW relays p. 124
6.33 Solution #33: Security establishment of one-to-one PC5 communication rekeying p. 131
6.34 Solution #34: Authorization of the remote UE in L3 U2N relay p. 132
6.35 Solution #35: Discovery procedures for UE-to-network relays p. 133
6.35.1 Introduction p. 133
6.35.2 Solution details p. 133
6.35.2.1 Commercial applications are dependent on the VPLMNs p. 133
6.35.2.2 Commercial applications are dependent on the HPLMNs of the relays p. 135
6.35.3 Evaluation p. 136
6.36 Solution #36: UE-to-Network Relay security based on AKMA p. 136
6.37 Solution #37: Keying procedures for Group Member and Relay discovery: public safety case p. 138
6.37.1 Introduction p. 138
6.37.2 Solution details p. 139
6.38 Solution #38: Mitigating the conflict between security policies using restricted discovery procedures on network side p. 141
6.39 Solution #39: Key management in UE-to-Network Relay based on shared key generated during primary authentication p. 143
6.40 Solution #40: Protection with Security Policies for PC5 Direct Communication p. 146
6.40.1 Introduction p. 146
6.40.2 Solution details p. 146
6.40.2.1 Security policy configuration and provisioning p. 146
6.40.2.2 Security policy negotiation and enforcement p. 147
6.40.3 Evaluation p. 147
6.41 Solution #41: Security protection for 5G ProSe indirect network communication p. 147
6.41.1 Introduction p. 147
6.41.2 Solution details p. 148
6.41.2.1 Framework of security protection for 5G ProSe indirect network communication p. 148
6.41.2.2 Secure provisioning of UP security policies for 5G ProSe indirect network communication p. 148
6.41.2.3 Enforcement of UP security policies for 5G ProSe indirect network communication p. 149
6.41.3 Evaluation p. 150
6.42 Solution #42: Privacy enhancements during PC5 link setup for UE-to-Network relay p. 150
6.42.1 Introduction p. 150
6.42.2 Solution details p. 151
6.42.2.1 General p. 151
6.42.2.2 Protection of PRUK ID and RSC over the PC5 interface p. 151
6.42.2.3 Calculation of message-specific confidentiality keystream p. 151
6.42.3 Evaluation p. 152
6.43 Solution #43: Improved LTE security mechanism for 5G ProSe restricted discovery to ensure source authentication in out of coverage use cases p. 152
6.43.1 Introduction p. 152
6.43.2 Solution details p. 152
6.43.2.3 Applicability to restricted discovery mode B p. 155
6.43.2.4 Applicability to relay and group discovery p. 155
6.43.3 Evaluation p. 155
6.44 Solution #44: PC5 anchor key generation via GBA Push p. 156
7 Conclusions p. 159
7.1 Key Issue #1: Discovery message protection p. 159
7.2 Key Issue #2: Keys in ProSe discovery scenario p. 159
7.3 Key Issue #3: Security of UE-to-Network Relay p. 159
7.4 Key issue #4: Authorization in the UE-to-Network relay scenario p. 161
7.5 Key Issue #5: Privacy protection over the UE-to-Network Relay p. 161
7.6 Key Issue #6: Integrity and confidentiality of information over the UE-to-UE Relay p. 161
7.7 Key issue #7: Authorization in the UE-to-UE relay scenario p. 162
7.8 Key Issue #8: Privacy of information over the UE-to-UE Relay p. 162
7.9 Key Issue #9: Key management in 5G Proximity Services for UE-to-Network relay communication p. 162
7.10 Key Issue #10: Key issue on secure data transfer between UE and 5GDDNMF p. 162
7.11 Key Issue #11: UE identity protection during ProSe discovery p. 162
7.12 Key Issue #12: Security of one-to-one communication over PC5 p. 163
7.13 Key Issue #13: Security and privacy of groupcast communication p. 163
7.14 Key Issue #14: security for support of Non-IP traffic p. 163
7.15 Key Issue #15: privacy of ProSe entities while supporting Non-IP traffic p. 163
7.16 Key Issue #16: Privacy protection of PDU session-related parameters for relaying p. 164
7.17 Key Issue #17: Supporting security policy handling for PC5 connection of 5G ProSe services p. 164
$ Change history p. 165
