5G Enhancements to Non-3GPP Access Security

Size: px

Start display at page:

Download "5G Enhancements to Non-3GPP Access Security"

Annabelle Cook
6 years ago
Views:

1 5G Enhancements to Non-3GPP Access Security Andreas Kunz 13 th June Lenovo 1

2 Outline Non-3GPP Access in 3GPP System Architecture New 5G Features for Non-3GPP Access NAS over Non-3GPP Access Authentication methods Protocol Enhancements Deployment options and new opportunities 2018 Lenovo 2

3 Non-3GPP Access in 3GPP Non-3GPP Access is mostly referred to IEEE types of WLAN Two different options based on trust relationship: Trusted Access: the UE connects to the core network via an access gateway (TNGF) TNGF = Trusted Non3GPP Gateway Function (it exposes the /N3 interfaces) Untrusted Access: The UE connects to the core network via an interworking function (N3IWF) For 5G Phase 1 (Release 15) only Untrusted Access is standardized Trusted Access part of Phase 2 study for Release 16 (SA2) NSSF UE NEF NRF PCF UDM AF Nnssf Nnef Nnrf Npcf Nudm Naf AUSF N1 Nausf NWu Y1 Namf AMF (R)AN N3IWF N3 Y2 Untrusted Non- 3GPP Access SMF Nsmf N4 UPF N6 HPLMN DN Non-3GPP Networks 2018 Lenovo 3

Since a UE is always connected, it cannot be paged on Untrusted Non-3GPP access 3GPP RAN (NR) Uu NWu N1 NAS Connection N3IWF AMF

4 New 5G Features for Non-3GPP Access: NAS Non Access Stratum (NAS) Signalling now possible via Non-3GPP Access A UE can register to the 5G Core Network with the normal registration procedure Simultaneous registrations over 3GPP and non-3gpp accesses are possible Since a UE is always connected, it cannot be paged on Untrusted Non-3GPP access 3GPP RAN (NR) Uu NWu N1 NAS Connection N3IWF AMF Same AMF, if both accesses belong to the same serving network => common 5G NAS security context N1 NAS Connection N3GPP Access 2018 Lenovo 4

5 New 5G Features for Non-3GPP Access: Authentication 5G offers different authentication methods: EAP-AKA' and 5G AKA Optional EAP-TLS for IoT/Private NW Uses a new transport method EAP-5G utilizing the "Expanded" EAP type and the existing 3GPP Vendor-Id Encapsulated within EAP- 5G/5G-NAS packets UE N3IWF AMF AUSF 1. UE connects to N3GPP access, selects N3IWF and obtains IP address 2. IKE_SA_INIT 3. IKE_AUTH Req (UE ID=random Nr, without AUTH) 4. IKE_AUTH Res (EAP-Req/5G-Start) 5. IKE_AUTH Req (EAP-Res/5G-NAS/AN-Para, NAS-PDU) 6a. AMF Selection 6b. Msg (Registration Request) 7. Authentication (EAP-AKA' or 5G AKA) 8. NAS SMC [EAP-Success]/NAS SMC Complete 10. IKE_AUTH Res (EAP Success) 11. IKE_AUTH (with Auth) Ipsec SA established 9. IniConSet Req (K N3IWF ) EAP-Success for EAP-5G EAP-Success in case of EAP-AKA 2018 Lenovo 5

6 New 5G Features for Non-3GPP Access: Protocols EAP-5G needs to support the following information elements: EAP-5G Type field EAP-Request/5G- Start message Two Attributes to indicate the AN Parameters and NAS PDU payload NAS EAP-5G IKEv2 IP Non- 3GPP UE EAP-5G Packets IP Non- Lower 3GPP layers Untrusted non-3gpp Access Network EAP-5G 2018 Lenovo 6 Nwu IKEv2 IP Lower layers N3IWF stack NAS stack AMF Control Plane before the signalling IPsec SA is established between UE and N3IWF Bits Octets Code Identifier Length Type = 254 (Expanded) Vendor-Id = (already assigned to 3GPP) Vendor-Type = 3 (EAP-5G, specified in 3GPP) Message-Id (5G-Start-Id of 1) Spare Extensions (optional) m Octets Code Identifier Length Type = 254 (Expanded) Vendor-Id = (already assigned to 3GPP) Vendor-Type = 3 (EAP-5G, specified in 3GPP) Message-Id (5G-NAS-Id of 2) Spare AN-parameter length AN-parameter NAS-PDU length NAS-PDU Extensions (optional) x 19+x 20+x 21+x n+x n+x+1 z+x

Deployment Options Additional EAP methods can be used for primary authentication for private networks or

ices in isolated deployment scenarios, i.e. roaming/interaction with public network is not considered

Non-3GPP Access) with 5G NAS support UE may not require a UICC for Non-3GPP only access and could use

that can be used to verify server certificates Current Study on the Wireless and Wireline Convergence

7 Deployment Options Additional EAP methods can be used for primary authentication for private networks or with IoT devices in isolated deployment scenarios, i.e. roaming/interaction with public network is not considered New business opportunities with 5GC private network deloyments: Minimum UE Requirement: WLAN (Untrusted Non-3GPP Access) with 5G NAS support UE may not require a UICC for Non-3GPP only access and could use EAP-TLS For EAP-TLS, the UE is required to be pre-configured with a UE certificate and also certificates that can be used to verify server certificates Current Study on the Wireless and Wireline Convergence for the 5G system architecture is ongoing and can be seen as another type of Non-3GPP access Public 5G Network with Non-3GPP Wireline Access Private 5G Network with untrusted Non- 3GPP Access 2018 Lenovo 7

What is network convergence and why do we need it?

What is network convergence and why do we need it? Maria Cuevas IEEE Broadband Multimedia Systems and Broadcasting 2018 7 th June 2018 Contents Types of convergence What is network convergence Benefits