Section: 9.2 Security mechanisms for the N2 interface
Content: N2 is the reference point between the AMF and the 5G-AN. It is used, among other things, to carry NAS signalling traffic between the UE and the AMF over 3GPP and non-3GPP accesses. The transport of control plane data over N2 shall be integrity, confidentiality and replay-protected. In order to protect the N2 reference point, it is required to implement IPsec ESP and IKEv2 certificates-based authentication as specified in sub-clause 9.1.2 of the present document. IPsec is mandatory to implement on the gNB and the ng-eNB. On the core network side, a SEG may be used to terminate the IPsec tunnel. In addition to IPsec, DTLS shall be supported as specified in RFC 6083 [58] to provide mutual authentication, integrity protection, replay protection and confidentiality protection. Security profiles for DTLS implementation and usage shall follow the TLS profile given in clause 6.2 of TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3] and the certificate profile given in clause 6.1.3a of TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5]. The identities in the end entity certificates shall be used for authentication and policy checks. Mutual authentication shall be supported over the N2 interface between the AMF and the 5G-AN using DTLS and/or IKEv2. NOTE 1: The use of transport layer security, via DTLS, does not rule out the use of network layer protection according to NDS/IP as specified in TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3]. In fact, IPsec has the advantage of providing topology hiding. NOTE 2: The use of cryptographic solutions to protect N2 is an operator's decision. In case the NG-RAN node (gNB or ng-eNB) has been placed in a physically secured environment then the 'secure environment' includes other nodes and links beside the NG-RAN node.