CBOR Object Signing and Encryption

Description

COSE (CBOR Object Signing and Encryption) is a security framework defined by the IETF in RFC 8152, which provides a compact binary representation for digital signatures, message authentication codes (MACs), and encryption using the Concise Binary Object Representation (CBOR). In 3GPP, COSE is adopted as a key security mechanism for protecting application-layer messages in constrained devices and networks, particularly in the context of IoT and mission-critical services. The 3GPP specifications 33.703 and 33.938 define its usage for securing the interfaces between the UE and application servers, as well as for protecting the integrity and confidentiality of data in 5G systems.

The architecture of COSE revolves around a set of cryptographic structures: COSE_Sign, COSE_Sign1, COSE_Mac, COSE_Mac0, COSE_Encrypt, and COSE_Encrypt0. These structures encapsulate the payload, protected headers (which are cryptographically bound), unprotected headers, and the cryptographic parameters. COSE supports a wide range of algorithms, including ECDSA, EdDSA, AES-GCM, and ChaCha20-Poly1305, making it flexible for different security requirements. The binary encoding of CBOR ensures minimal overhead, which is crucial for low-power and bandwidth-constrained devices typical in massive IoT deployments.

In 3GPP networks, COSE is used in several contexts. For example, in the 5G Service-Based Architecture (SBA), COSE can secure the communication between network functions (NFs) and the Unified Data Management (UDM) or between the UE and the Application Function (AF). It is also employed in the authentication and authorization of UEs for edge computing services, where the UE needs to prove its identity to a local edge enabler. The 3GPP Security Assurance Specifications (SCAS) leverage COSE for testing and validation of security features.

One of the key advantages of COSE is its ability to provide end-to-end security at the application layer, independent of the underlying transport security (e.g., TLS or IPsec). This is particularly important in multi-vendor and multi-domain environments where trust boundaries are not aligned with network segments. COSE also supports key management through the use of COSE Key structures, which can be distributed via the 3GPP Generic Bootstrapping Architecture (GBA) or other mechanisms.

The introduction of COSE in 3GPP Release 19 reflects the growing need for lightweight, interoperable security solutions in 5G-Advanced and 6G networks. As networks evolve towards supporting massive numbers of IoT devices, the efficiency and flexibility of COSE will be essential to ensure secure and scalable deployments. Its adoption in 3GPP also aligns with the broader industry trend towards using CBOR and COSE in other standards such as Web of Things (WoT) and FIDO2.

Purpose & Motivation

COSE was created to address the need for a compact, efficient, and interoperable security format for constrained devices and networks. Traditional security protocols like JSON Web Signature (JWS) and JSON Web Encryption (JWE) are text-based and incur significant overhead, making them unsuitable for IoT devices with limited processing power, memory, and bandwidth. COSE solves this by using CBOR, a binary format that is more compact and easier to parse on constrained devices.

In the context of 3GPP, the motivation for adopting COSE was to provide a standardized security mechanism that can be used across different 5G and beyond services, including massive IoT, ultra-reliable low-latency communications (URLLC), and edge computing. Previous approaches often relied on proprietary or transport-layer security, which lacked end-to-end protection and interoperability. COSE enables application-layer security that is independent of the transport network, ensuring that data remains protected even when it traverses multiple domains or untrusted networks.

Furthermore, COSE supports a wide range of cryptographic algorithms and key management options, making it adaptable to various regulatory and operational requirements. Its inclusion in 3GPP Release 19 and beyond signifies a commitment to secure and efficient communication for the next generation of mobile networks, where billions of devices will need to authenticate and exchange data securely.