Transport Layer Security

In Release 15, the TLS function was newly introduced or explicitly mandated for securing specific interfaces and procedures, including the authorization and authentication between Network Functions and the NRF, as well as for providing application layer security on the N32 interface. The release also introduced security mechanisms for non-Service-Based Architecture interfaces in the 5G Core and clarified security protections for API invoker onboarding and offboarding within the CAPIF framework. Furthermore, it defined security procedures for the update of UE parameters via UDM control plane procedures, ensuring these exchanges are protected.

• Security requirements for API invoker onboarding and offboarding TS 33.122CR0005
• Clarifications to: Protection at the network or transport layer, Authorization and authentication between network functions and the NRF TS 33.501CR0147
• Clarifications to security requirements and features (clause 5) TS 33.501CR0161
• Security Negotiation for RRC INACTIVE TS 33.501CR0183
• Security Mechanism for Steering of Roaming TS 33.501CR0214
• CR-slice-management-security TS 33.501CR0290

+ 59 more changes

In Release 16, the TLS function was extended to support new security procedures for the CAPIF-3e/4e/5e and CAPIF-7/7e reference points, and its usage was explicitly profiled for the CAPIF framework. Furthermore, TLS was mandated for securing the connection between a Network Function and the SEPP, specifically based on a custom HTTP header, and its application was defined for new service contexts including security for 5GLAN services and for the Inter-PLMN User Plane Security (IPUPS) Function.

• Exchange IPX security information lists TS 29.573CR0020
• Transport Harmonization (align 33.108 to 33.128) TS 33.108CR0418
• Security Requirements for CAPIF-3e/4e/5e reference points TS 33.122CR0019
• Security aspects of CAPIF-7/7e reference points TS 33.122CR0022
• Security procedures for CAPIF-7/7e reference points TS 33.122CR0024
• Security procedures for CAPIF-3e/4e/5e reference points TS 33.122CR0025

+ 33 more changes

In Release 17, the TLS function was enhanced with new profiles and capabilities, specifically adding support for TLS 1.3 using keys derived from the Authentication and Key Management for Applications (AKMA) framework and for Generic Bootstrapping Architecture (GBA)-based shared secrets with Pre-Shared Key (PSK) authentication. Furthermore, support for end-to-end application encryption (e2ae) was extended to non-WebRTC sessions using Datagram Transport Layer Security for Secure Real-time Transport Protocol (DTLS-SRTP). These updates also included alignment with the security working group's (SA3) supported TLS profiles.

• Communication security context when using functional alias TS 23.280CR0257
• Alignment with SA3 supported TLS profiles TS 23.333CR0144
• Alignment with SA3 supported TLS profiles TS 23.334CR0176
• Support of e2ae security using DTLS-SRTP for non WebRTC sessions TS 23.334CR0178
• Adding profiles of TLS to use AKMA keys TS 24.109CR0070
• GBA-based shared secret with PSK authentication in TLS 1.3 TS 24.109CR0071

+ 38 more changes

In Release 18, TLS enhancements focused on securing new interfaces and procedures, specifically introducing TLS security for the N32-f interface and detailing its handling for roaming scenarios like the V-EASDF discovery procedure. The release also added security for network automation enablers and updated negotiation procedures for security profiles and capabilities.

• Support the negotiation of security profiles TS 29.573CR0174
• Security for resource owner aware northbound access to APIs TS 33.122CR0036
• Security aspects of NG RTC TS 33.328CR0071
• Security aspects of MSGin5G Service in rel-18 TS 33.501CR1565
• Security aspects of enhanced support of Non-Public Networks phase 2 TS 33.501CR1671
• Security of EAS discovery procedure via V-EASDF in roaming Scenario TS 33.501CR1741

+ 26 more changes

In Release 19, the TLS function saw new security procedures and requirements introduced for several specific interfaces and services. These included enhanced security for the CAPIF-6, CAPIF-6e, and CAPIF-8 reference points, as well as for the MSGin5G service and IMS capability exposure. Furthermore, new security aspects were defined for Core Network Enhanced Support for AIML and for N6 delay measurements.

• [AMD_PRO-MED] Security procedures for metrics reporting at M3 TS 26.512CR0100
• Security requirements and procedures for CAPIF-8 reference point TS 33.122CR0078
• RNAA and Interconnect aspects in function security model TS 33.122CR0080
• CAPIF Security requirements on CAPIF-6 and -6e reference points TS 33.122CR0081
• Security procedures for CAPIF interconnection TS 33.122CR0107
• Extra IAB information in stage 2 related to Downlink NAS transport and to UE CONTEXT MODIFICATION REQUEST TS 33.127CR0255

+ 25 more changes

In Release 20, the new TLS-related feature introduced a procedure for making specific security parameters visible to RIs (Registration Intervals). This enhancement explicitly addressed the visibility of security attributes and cipher keys, which are defined as codes used with a security algorithm to encode and decode data, within the framework of transport layer security operations.

• Procedure to making some security parameters visible to RIs TS 33.501CR2191