Study on enhanced security aspects of the 5G Service Based Architecture (SBA)
The present document studies enhanced security aspects of the 5G Service Based Architecture. It will analyse potential threats, study necessary security enhancements, and document decisions of solutions to be adopted or not adopted after evaluating the risks versus the complexity.
In particular, the following topics are addressed:
- Need and mechanism of enabling end to end authentication in roaming case if no cross-certification between operators is enabled;
- Need and mechanism of enabling NF Service Consumer authentication of NRF and the NF Service Producer;
- Need for addressing potential security impact of different deployment scenarios including the several SCPs;
- Verification of URI in subscription/notification;
- Dynamic authorization between SCPs or NF and SCP;
- End-to-End Critical HTTP headers/body parts integrity protection;
- Access token usage in NF Sets;
- Authorization mechanism determination;
- Security of NRF service management;
- Inter-Slice access authorization;
- N32 roaming security considerations for deployment scenarios including roaming hub and hosted SEPP.