User Plane Authentication and Authorization for Session Management

Description

UUAA-SM (User Plane Authentication and Authorization for Session Management) is a security procedure introduced in 3GPP Release 19 as part of the broader User Plane Authentication and Authorization (UUAA) framework. It is specified in 3GPP TS 23.256 and TS 33.256. The procedure is executed during the establishment of a PDU session in 5G networks or during the establishment of a PDN connection in EPS (Evolved Packet System) when interworking with 5G. Its primary role is to authenticate and authorize the user plane connection before it is fully established, ensuring that the user equipment (UE) is permitted to access the requested data network and that the session is not hijacked or misused.

Architecturally, UUAA-SM involves interactions between the UE, the Session Management Function (SMF) in 5G core or the Serving GPRS Support Node (SGSN)/Mobility Management Entity (MME) in EPS, and the User Plane Function (UPF) or Packet Data Network Gateway (PGW). The procedure leverages authentication credentials and authorization policies that may be stored in the Unified Data Management (UDM) or Authentication Server Function (AUSF). During PDU session establishment, the SMF triggers UUAA-SM after receiving the session establishment request from the UE. The SMF then initiates an authentication exchange with the UE, potentially using the Extensible Authentication Protocol (EAP) framework, and verifies the UE's authorization to access the requested Data Network Name (DNN) or network slice. Upon successful authentication and authorization, the SMF proceeds with the session establishment, selecting an appropriate UPF and configuring the user plane.

The procedure is designed to be flexible and can be integrated with existing 5G security mechanisms such as primary authentication and secondary authentication. UUAA-SM can be used in scenarios where additional user plane authentication is required, for example, for private networks, industrial IoT, or when accessing external data networks that demand their own authentication. It supports both EAP-based methods and non-EAP methods, depending on the deployment. The authentication and authorization information may be provided by the UE, the network, or an external data network authentication, authorization, and accounting (AAA) server.

Key components involved in UUAA-SM include the UE, which must support the UUAA procedures; the SMF, which orchestrates the procedure; the UPF, which may enforce user plane policies; and the UDM/AUSF, which provide authentication vectors and subscription data. The procedure also interacts with the Policy Control Function (PCF) for authorization policies. The signaling for UUAA-SM is carried over the N1 interface between the UE and the SMF (via the AMF) and over the N4 interface between the SMF and UPF for user plane setup. In EPS, similar interactions occur over the S11 and S5/S8 interfaces.

UUAA-SM enhances the security of user plane sessions by ensuring that the UE is authenticated and authorized before any user data can be transmitted. This is particularly important in 5G networks where diverse services and network slices may have different security requirements. By performing authentication and authorization during session establishment, UUAA-SM prevents unauthorized access and mitigates risks such as session hijacking, spoofing, and unauthorized data access. It complements other security features like integrity protection and ciphering of user plane data, providing a comprehensive security framework for session management.

Purpose & Motivation

UUAA-SM was created to address the growing need for enhanced security in user plane session establishment, particularly in 5G networks where diverse services and network slices require differentiated security treatment. Prior to Rel-19, user plane authentication was limited to secondary authentication for specific data networks, but there was no standardized procedure to authenticate and authorize the user plane connection itself during PDU session establishment. This gap could be exploited by attackers to establish unauthorized sessions or to access sensitive data networks without proper credentials.

The introduction of UUAA-SM provides a standardized mechanism to perform authentication and authorization of the user plane connection, ensuring that only legitimate and authorized UEs can establish user plane connectivity. It solves the problem of unauthorized session establishment and provides a foundation for secure access to external data networks, private networks, and network slices. By integrating with existing authentication frameworks such as EAP, UUAA-SM enables operators to leverage existing AAA infrastructure and to enforce fine-grained authorization policies based on subscription data and network policies.

Historically, user plane security relied primarily on encryption and integrity protection, but authentication of the user plane connection was not always performed. UUAA-SM fills this gap by adding an authentication and authorization step during session establishment, similar to how primary authentication secures the control plane. This is especially relevant for 5G-Advanced and future networks where trust boundaries are more dynamic and where network slicing and edge computing introduce new security challenges. UUAA-SM thus represents a significant step forward in securing user plane sessions in a standardized and interoperable manner.