Question: In a trusted non-3GPP access, how is integrity protection and/or confidentiality protection of user plane traffic achieved over the S2c tunnel between the UE (User Equipment) and the PDN GW (Packet Data Network Gateway)?
Option 1: Through inherent security features of the S2c tunnel protocol itself.
Option 2: By implementing TLS (Transport Layer Security) for end-to-end encryption.
Option 3: By creating a pair of IPsec child SAs (Security Associations) as specified in RFC 4877, utilizing IKEv2 and IPsec ESP in tunnel mode.
Option 4: Through regular encryption key updates negotiated directly between the UE and PDN GW without additional protocols.
Explanation: This is the correct answer because, according to the provided context, integrity protection and/or confidentiality protection over the S2c tunnel in a trusted non-3GPP access are specifically achieved through the creation of IPsec child Security Associations (SAs), following the specifications outlined in RFC 4877. This method involves using IKEv2 for key exchange and IPsec ESP in tunnel mode for encrypting and authenticating the traffic, ensuring secure communication between the UE and the PDN GW.