Question: In a 3GPP SAE scenario, for ANDSF push messages, if no existing PSK TLS connection is available, what security mechanism MUST be used between the UE and the ANDSF server for mutual authentication?
Option 1: Certificate-based TLS with mutual authentication using public keys.
Option 2: Pre-Shared Key (PSK) TLS with Generic Bootstrapping Architecture (GBA) pull-based shared key mutual authentication.
Option 3: PSK TLS with GBA push-based shared key mutual authentication between the UE and the ANDSF server.
Option 4: Basic Authentication over an unsecured connection.
Explanation: According to specified security requirements for non-3GPP accesses, when no PSK TLS connection is available for ANDSF push messages, the UE and ANDSF server must utilize PSK TLS with GBA push-based shared key mutual authentication, ensuring secure communication by authenticating both parties using a shared secret derived from the Generic Bootstrapping Architecture's push function.