6.15 UE parameters update via UDM control plane procedure security mechanism

33.5013GPPRelease 18Security architecture and procedures for 5G SystemTS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

6.15.1 General

This clause describes the security functions necessary to update the UE parameters using the UDM control plane procedure specified in TS 23.502 [8]. The security functions are described in the context of the functions supporting the delivery of UE Parameters Update Data from the UDM to the UE after the UE has successfully registered to the 5G network.

If the control plane procedure for UE parameters update is supported by the UDM, the AUSF shall store the latest K_AUSF after the completion of the latest primary authentication.

The content of UE Parameters Update Data and the conditions for sending it to the UE as well as how it is handled at the UE are specified in TS 24.501 [35].

NOTE : The home network relies on the serving network to deliver the UE parameters update.

6.15.2 Security mechanisms

6.15.2.1 Procedure for UE Parameters Update

The UDM may decide to perform UE parameters update anytime after the UE has been successfully authenticated and registered to the 5G system. The security procedure for the UE parameters update is described below in figure 6.15.2.1-1:

Figure 6.15.2.1-1: Procedure for UE Parameters Update

1) The UDM decides to perform the UE Parameters Update (UPU) using the control plane procedure while the UE is registered to the 5G system. If the final consumer of any of the UE parameters to be updated (e.g., the updated Routing ID Data) is the USIM, the UDM shall protect these parameters using a secured packet mechanism (see 3GPP TS 31.115 [65]) to update the parameters stored on the USIM. The UDM shall then prepare the UE Parameters Update Data (UPU Data) by including the parameters protected by the secured packet, if any, as well as any UE parameters for which final consumer is the ME (see TS 24.501 [35]).

2-3) The UDM shall invoke Nausf_UPUProtection service operation message by including the UPU Data to the AUSF to get UPU-MAC-I_AUSF and Counter_UPU as specified in sub-clause 14.1.4 of this document. The UDM shall select the AUSF that holds the latest K_AUSF of the UE.

If the UDM decided that the UE is to acknowledge the successful security check of the received UE Parameters Update Data, then the UDM shall set the corresponding indication in the UE Parameters Update Data (see TS 24.501 [35]) and include the ACK Indication in the Nausf_UPUProtection service operation message to signal that it also needs the expected UPU-XMAC-I_UE, as specified in sub-clause 14.1.4 of this document.

The details of the CounterUPU is specified in sub-clause 6.15.2.2 of this document. The inclusion of UE Parameters Update Data in the calculation of UPU-MAC-IAUSF allows the UE to verify that it has not been tampered by any intermediary. The expected UPU-XMAC-I_UE allows the UDM to verify that the UE received the UE Parameters Update Data correctly.

4) The UDM shall invoke Nudm_SDM_Notification service operation, which includes the UPU transparent container if the AMF supports UPU transparent container, or includes individual IEs comprising the UE Parameters Update Data, UPU-MAC-I_AUSF, Counter_UPUwithin the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected UPU-XMAC-I_UE.

5) Upon receiving the Nudm_SDM_Notification message, the AMF shall send a DL NAS Transport message to the served UE. The AMF shall include in the DL NAS Transport message the transparent container if received from the UDM in step 4. Otherwise, if the UDM provided individual IEs in step 4, then the AMF shall construct a UPU transparent container.

6) On receiving the DL NAS Transport message, the UE shall calculate the UPU-MAC-I_AUSF in the same way as the AUSF (as specified in Annex A.19) on the received UE Parameters Update Data and the Counter_UPU and verify whether it matches the UPU-MAC-I_AUSF value received within the UPU transparent container in the DL NAS Transport message. If the verification of UPU-MAC-I_AUSF is successful and the UPU Data contains any parameters that is protected by secured packet (see 3GPP TS 31.115 [65]), the ME shall forward the secured packet to the USIM using procedures in 3GPP TS 31.111 [66]. If the verification of UPU-MAC-I_AUSF is successful and the UPU Data contains any parameters that is not protected by secure packet, the ME shall update its stored parameters with the received parameters in UDM Updata Data.

7) If the UDM has requested an acknowledgement from the UE and the UE has successfully verified and updated the UE Parameters Update Data provided by the UDM, then the UE shall send the UL NAS Transport message to the serving AMF. The UE shall generate the UPU-MAC-I_UEas specified in Annex A.20 and include the generated UPU-MAC-I_UEin a transparent container in the UL NAS Transport message.

8) If a transparent container with the UPU-MAC-I_UE was received in the UL NAS Transport message, the AMF shall send a Nudm_SDM_Info request message with the transparent container to the UDM.

9) If the UDM indicated that the UE is to acknowledge the successful security check of the received UE Parameters Update Data, then the UDM shall compare the received UPU-MAC-I_UE with the expected UPU-XMAC-I_UE that the UDM stored temporarily in step 4.

6.15.2.2 UE Parameters Update Counter

The AUSF and the UE shall associate a 16-bit counter, Counter_UPU, with the key K_AUSF.

The UE shall initialize the Counter_UPU to 0x00 0x00 when the newly derived K_AUSF is stored (see clause 6.2.2.2). The UE shall store the UPU counter . If the USIM supports both 5G parameters storage and 5G parameters extended storage, then Counter_UPU shall be stored in the USIM. Otherwise, Counter_UPU shall be stored in the non-volatile memory of the ME.

To generate the UPU-MAC-I_AUSF, the AUSF shall use the Counter_UPU. The Counter_UPU shall be incremented by the AUSF for every new computation of the UPU-MAC-I_AUSF. The Counter_UPU is used as freshness input into UPU-MAC-I_AUSF and UPU-MAC-I_UE derivations as described in the Annex A.19 and Annex A.20 respectively, to mitigate the replay attack. The AUSF shall send the value of the Counter_UPU (used to generate the UPU-MAC-I_AUSF) along with the UPU-MAC-I_AUSF to the UE. The UE shall only accept Counter_UPU value that is greater than stored Counter_UPU value. The UE shall update the stored Counter_UPU with the received Counter_UPU,onlyif the verification of the received UPU-MAC-I_AUSF is successful. The UE shall use the Counter_UPU received from the UDM, when deriving the UPU-MAC-I_UE for the UE Parameters Upadate Data acknowledgement.

The AUSF and the UE shall maintain the Counter_UPU for lifetime of the K_AUSF.

The AUSF that supports the UE parameters update using control plane procedure shall initialize the Counter_UPU to 0x00 0x01 when the newly derived K_AUSF is stored (see clause 6.2.2.1). The AUSF shall set the Counter_UPU to 0x00 0x02 after the first calculated UPU-MAC-I_AUSF, and monotonically increment it for each additional calculated UPU-MAC-I_AUSF. The UPU Counter value of 0x00 0x00 shall not be used to calculate the UPU-MAC-I_AUSFand UPU-MAC-I_UE.

The AUSF shall suspend the UE Parameters Update protection service for the UE, if the Counter_UPU associated with the K_AUSF of the UE, is about to wrap around. When a fresh K_AUSF is generated for the UE, the Counter_UPU at the AUSF is reset to 0x00 0x01 as defined above and the AUSF shall resume theUE Parameters Update protection service for the UE.