Section: 9.3 Security requirements and procedures on N3
Content: N3 is the reference point between the 5G-AN and UPF. It is used to carry user plane data from the UE to the UPF. The transport of user data over N3 shall be integrity, confidentiality and replay-protected. In order to protect the traffic on the N3 reference point, it is required to implement IPsec ESP and IKEv2 certificate-based authentication as specified in sub-clause 9.1.2 of the present document with confidentiality, integrity and replay protection. IPsec is mandatory to implement on the gNB and the ng-eNB. On the core network side, a SEG may be used to terminate the IPsec tunnel. NOTE: The use of cryptographic solutions to protect N3 is an operator's decision. In case the NG-RAN node (gNB or ng-eNB) has been placed in a physically secured environment then the 'secure environment' includes other nodes and links beside the NG-RAN node. QoS related aspects are further described in sub-clause 9.1.3 of the present document.