Section: 5.3.4 Requirements for the gNB setup and configuration
Content: Setting up and configuring gNBs by O&M systems shall be authenticated and authorized by gNB so that attackers shall not be able to modify the gNB settings and software configurations via local or remote access. - The certificate enrolment mechanism specified in TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5] for base station should be supported for gNBs. The decision on whether to use the enrolment mechanism is left to operators. - Communication between the O&M systems and the gNB shall be confidentiality, integrity and replay protected from unauthorized parties. The security associations between the gNB and an entity in the 5G Core or in an O&M domain trusted by the operator shall be supported. These security association establishments shall be mutually authenticated. The security associations shall be realized according to TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3] and TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5]. - The gNB shall be able to ensure that software/data change attempts are authorized. - The gNB shall use authorized data/software. - Sensitive parts of the boot-up process shall be executed with the help of the secure environment. - Confidentiality of software transfer towards the gNB shall be ensured. - Integrity protection of software transfer towards the gNB shall be ensured. - The gNB software update shall be verified before its installation (cf. sub-clause 4.2.3.3.5 of TS 33.117[ Catalogue of general security assurance requirements ]  [24]).