Content for TR 33.855 Word version: 16.1.0
6 Solutions
7 Conclusions
B Options for integrity protection on the N32 interface
C Deployment options for the UP gateway
$ Change history
6 Solutions Word‑p. 32
6.1 Solution #1: Authorization of NF service access Word‑p. 32
6.1.1 Introduction Word‑p. 32
6.1.2 Solution details Word‑p. 33
6.1.2.1 Service authorization procedure for non-roaming scenarios Word‑p. 33
6.1.2.2 Authorization of NF service access for roaming scenario Word‑p. 34
6.1.3 Evaluation Word‑p. 34
6.2 Solution #2: Application layer protection based on JSON Object Signing and Encryption (JOSE) Word‑p. 34
6.2.1 General Word‑p. 34
6.2.2 Application layer protection based on JOSE Word‑p. 35
6.2.2.1 JSON based IEs that require protection (WHAT) Word‑p. 35
6.2.2.2 Integrity and Confidentiality protection schemes (HOW) Word‑p. 35
6.2.2.2.1 Integrity protection based on JSON patch Word‑p. 35
6.2.2.2.2 Authorization of modifications based on JSON patch Word‑p. 38
6.2.2.2.3 Authentication of intermediaries Word‑p. 39
6.2.2.2.4 Rewriting of HTTP message into JSON-object Word‑p. 39
6.2.2.3 Void
6.2.3 Evaluation Word‑p. 39
6.3 Solution #3: NF service registration process Word‑p. 40
6.4 Solution #4: Authorization of NF service access Word‑p. 40
6.4.1 Introduction Word‑p. 40
6.4.2 Solution details Word‑p. 41
6.4.2.1 Authorization of NF service access in the same PLMN Word‑p. 41
6.4.2.2 Authorization of NF service access in different PLMNs Word‑p. 43
6.4.3 Evaluation Word‑p. 44
6.5 Solution #5: Using mediation services with end-to-end encryption Word‑p. 44
6.5.1 Generic Word‑p. 44
6.5.2 End-to-end encryption using HTTPS or TLS Word‑p. 44
6.5.3 End-to-end security using JOSE Word‑p. 45
6.5.4 Migration paths after accepting this solution Word‑p. 47
6.5.5 Possible deployments Word‑p. 47
6.5.6 Evaluation Word‑p. 47
6.6 Solution #6: Policies for protection on the N32 interface Word‑p. 48
6.7 Solution #7: Signaling based provisioning of message protection policy in partner SEPPs Word‑p. 49
6.8 Solution #8: Inter PLMN routing and TLS: Solution Options Word‑p. 50
6.8.1 Introduction Word‑p. 50
6.8.3 TLS tunnel or VPN from NF to SEPP Word‑p. 50
6.8.4 Using local SEPP FQDN in request URI Word‑p. 50
6.8.5 Mapped FQDN in request URI Word‑p. 51
6.8.6 Evaluation Word‑p. 52
6.9 Solution #9: N32 message anti-spoofing within the SEPP Word‑p. 52
6.10 Solution #10: Mitigation against fraudulent registration attack between SEPPs Word‑p. 52
6.11 Solution #11: Security policy provisioning for SEPP Word‑p. 53
6.12 Solution #12: End-to-end data protection in hop-by-hop network communication links Word‑p. 53
6.12.1 Introduction Word‑p. 53
6.12.2 Integrity protection with non-repudiation and traceability of changes Word‑p. 54
6.12.3 Integrity protection with non-repudiation, traceability of changes, and authorization Word‑p. 54
6.12.4 Confidentiality protection with authorization Word‑p. 55
6.13 Solution #13: Content and structure of protection policies Word‑p. 55
6.13.1 Introduction Word‑p. 55
6.13.2 Data-type encryption policy Word‑p. 56
6.13.3 NF API data-type placement mapping Word‑p. 56
6.13.4 Modification policy Word‑p. 56
6.13.5 Evaluation Word‑p. 57
6.14 Solution #14: Provisioning and negotiation of protection policies Word‑p. 57
6.14.1 Introduction Word‑p. 57
6.14.2 Provisioning of the policies in the SEPP Word‑p. 57
6.14.3 Negotiation of protection policies Word‑p. 57
6.14.4 Evaluation Word‑p. 57
6.15 Solution #15: Service access authorization in the delegated "Subscribe-Notify" interaction scenarios Word‑p. 58
6.16 Solution #16: OAuth 2.0 based authorization for Indirect communication without Delegated Discovery (Model C) Word‑p. 61
6.17 Solution #17: Protection of SeCoP interfaces Word‑p. 61
6.18 Solution #18: Support NDS/IP on the inter-PLMN N9 interface Word‑p. 62
6.19 Solution #19: Service access authorization based on NF Set in non-roaming scenario Word‑p. 63
6.19.1 Introduction Word‑p. 63
6.19.2 Solution details Word‑p. 63
6.19.2.0 General Word‑p. 63
6.19.2.1 Service access authorization for NF producers within a NF set (Model B) Word‑p. 63
6.19.2.2 Service access authorization based on NF Set by verifying the token on the service producer (Model C) Word‑p. 65
6.19.3 Evaluation Word‑p. 65
6.20 Solution #20: UP Gateway function on the inter-PLMN N9 interface Word‑p. 66
6.20.1 Introduction Word‑p. 66
6.20.2 Solution details Word‑p. 66
6.20.2.1 Interface between SEPP-U and Core Network control plane entity Word‑p. 66
6.20.2.2 Interface between UPFs and SEPP-U Word‑p. 67
6.20.3 Evaluation Word‑p. 67
6.21 Solution #21: OAuth 2.0 based authorization for Indirect communication with Delegated Discovery (Model D) Word‑p. 68
6.21.1 Introduction Word‑p. 68
6.21.2 Solution details Word‑p. 69
6.21.2.1 SeCoP obtaining access token on behalf of the NF consumer Word‑p. 69
6.21.2.2 SeCoP authorizing NF consumer based on token verification Word‑p. 70
6.21.2.4 SeCoP includes access token in the Service Response message Word‑p. 70
6.21.3 Evaluation Word‑p. 70
6.22 Solution #22: Authentication and authorization between Network Functions for Indirect Communication models Word‑p. 71
6.23 Solution #23: Token-based authorization for Scenario D using stateless SeCoP Word‑p. 71
6.23.1 Introduction Word‑p. 71
6.23.2 Solution Description Word‑p. 72
6.23.2.1 General Word‑p. 72
6.23.2.2 Assumptions on authentication and interface protection Word‑p. 72
6.23.2.3 Authorization and service invocation procedure Word‑p. 72
6.23.2.4 Trust model Word‑p. 73
6.23.3 Solution Evaluation Word‑p. 73
6.24 Solution #24: Token-based authorization for Scenario C using stateless SeCoP Word‑p. 73
6.24.1 Introduction Word‑p. 73
6.24.2 Solution Description Word‑p. 74
6.24.2.1 General Word‑p. 74
6.24.2.2 Assumptions on authentication and interface protection Word‑p. 74
6.24.2.3 Authorization and service invocation procedure Word‑p. 74
6.24.2.4 Trust model Word‑p. 75
6.24.3 Solution Evaluation Word‑p. 75
6.25 Solution #25: NF service consumer verification during service access authorization in the direct communication scenario Word‑p. 75
6.25.1 Introduction Word‑p. 75
6.25.2 Solution details for the non-roaming scenario Word‑p. 75
6.25.2.0 General Word‑p. 75
6.25.2.1 Access token generation with the certificate of the NF service consumer Word‑p. 76
6.25.2.2 NF service Producer authenticates NF consumer Word‑p. 77
6.25.3 Solution details for the roaming scenario Word‑p. 77
6.25.4 Evaluation Word‑p. 78
6.26 Solution #26: OAuth 2.0 based resource level authorization of NF service consumers Word‑p. 79
6.26.1 Introduction Word‑p. 79
6.26.2 Solution Description Word‑p. 79
6.26.3 Solution Evaluation Word‑p. 80
6.27 Solution #27: Policy based authorization for Indirect communication between Network functions Word‑p. 80
6.27.1 Introduction Word‑p. 80
6.27.2 Solution Description Word‑p. 81
6.27.2.1 Policy files Word‑p. 81
6.27.2.2 Procedure Word‑p. 81
6.27.3 Solution Evaluation Word‑p. 82
6.28 Solution #28: Authorization between Network Functions in Scenario D Word‑p. 82
6.29 Solution #29: Telescopic FQDN for the SeCoP Word‑p. 82
6.29.1 Introduction Word‑p. 82
6.29.2 Solution Description Word‑p. 82
6.29.3 Solution Evaluation Word‑p. 82
6.30 Solution #30: Token-based authorization for NF Sets / NF Service Sets by existing methods Word‑p. 83
6.30.1 Introduction Word‑p. 83
6.30.2 Solution Description Word‑p. 83
6.30.3 Solution Evaluation Word‑p. 83
6.31 Solution #31: Service access authorization based on of a NF Set in roaming scenario Word‑p. 83
6.31.1 Introduction Word‑p. 83
6.31.2 Solution details Word‑p. 83
6.31.2.0 General Word‑p. 83
6.31.2.1 Service access authorization for NF producers within a NF set (Model C) Word‑p. 84
6.31.3 Solution Evaluation Word‑p. 84
6.32 Solution #32: OAuth 2.0 based resource level authorization of NF service consumers Word‑p. 85
6.32.1 Introduction Word‑p. 85
6.32.2 Solution Description Word‑p. 85
6.32.2.0 General Word‑p. 85
6.32.2.1 NF OAuth 2.0 client (NF service consumer) registration with the OAuth 2.0 authorization server (NRF) Word‑p. 85
6.32.2.2 NF OAuth 2.0 resource server (NF service producer) registration with the OAuth 2.0 authorization server (NRF) Word‑p. 86
6.32.2.3 NF Access token request before service access Word‑p. 86
6.32.2.4 NF Service access request based on token verification Word‑p. 88
6.32.3 Solution Evaluation Word‑p. 89
6.33 Solution #33: NF service consumer verification during service access authorization in indirect communication scenario Word‑p. 89
6.33.1 Introduction Word‑p. 89
6.33.2 Solution Description Word‑p. 89
6.33.2.1 General Word‑p. 89
6.33.2.2 Solution details for the scenario C Word‑p. 89
6.33.2.2.0 General Word‑p. 89
6.33.2.2.1 Access token generation with the certificate of the NF service consumer Word‑p. 90
6.33.2.2.2 SeCoP authenticates NF consumer Word‑p. 91
6.33.2.3 Solution details for the scenario D Word‑p. 91
6.33.2.3.0 General Word‑p. 91
6.33.2.3.1 Access token generation with the certificate of the NF service consumer Word‑p. 92
6.33.2.3.2 SeCoP authenticates NF consumer Word‑p. 93
6.33.2.4 Solution details for the roaming scenario Word‑p. 93
6.33.3 Evaluation Word‑p. 94
6.34 Solution #34: Security of indirect communication in roaming scenarios Word‑p. 94
6.34.1 Introduction Word‑p. 94
6.34.2 Solution Description Word‑p. 94
6.34.3 Solution Evaluation Word‑p. 95
6.35 Solution #35: Service access authorization in the non-delegated "Subscribe-Notify" interaction scenarios Word‑p. 95
7 Conclusions Word‑p. 97
7.1 Conclusion on KI #20 Word‑p. 97
7.2 Conclusions on Key Issue #21: Secure message transport via the SeCoP Word‑p. 97
7.3 Conclusions on Key issue #22: Authorization of NF service access in indirect communication Word‑p. 97
7.4 Conclusion on KI #23 Word‑p. 97
7.5 Conclusion on KI #24 Word‑p. 98
7.6 Conclusions on Key issue #25: Indirect communication in roaming scenarios Word‑p. 98
7.7 Conclusion on KI #26 Word‑p. 98
7.8 Conclusion on KI #27 Word‑p. 98
7.9 Conclusion on KI #29 Word‑p. 98
A Void
B Options for integrity protection on the N32 interface Word‑p. 100
C Deployment options for the UP gateway Word‑p. 101
C.1 Deployment option 1: UP Gateway per slice Word‑p. 101
C.2 Deployment option 2: UP Gateway as shared appliance Word‑p. 101
$ Change history Word‑p. 103
