Section: 5.9.3 Requirements for e2e core network interconnection security 5.9.3.1 General
Content: The present sub-clause contains requirements common to sub-clauses 5.9.2 and 5.9.3. A solution for e2e core network interconnection security shall satisfy the following requirements. The solution shall support application layer mechanisms for addition, deletion and modification of message elements by intermediate nodes except for specific message elements described in the present document. NOTE: Typical example for such a case is IPX providers modifying messages for routing purposes. The solution shall provide confidentiality and/or integrity end-to-end between source and destination network for specific message elements identified in the present document. For this requirement to be fulfilled, the SEPP – cf [2], clause 6.2.17 shall be present at the edge of the source and destination networks dedicated to handling e2e Core Network Interconnection Security. The confidentiality and/or integrity for the message elements is provided between two SEPPs of the source and destination PLMN–. The destination network shall be able to determine the authenticity of the source network that sent the specific message elements protected according to the preceding bullet. For this requirement to be fulfilled, it shall suffice that a SEPP in the destination network that is dedicated to handling e2e Core Network Interconnection Security can determine the authenticity of the source network. The solution should have minimal impact and additions to 3GPP-defined network elements. The solution should be using standard security protocols. The solution shall cover interfaces used for roaming purposes. The solution should take into account considerations on performance and overhead. The solution shall cover prevention of replay attacks. The solution shall cover algorithm negotiation and prevention of bidding down attacks. The solution should take into account operational aspects of key management.