Section: 9.9 Security mechanisms for non-SBA interfaces internal to the 5GC and between PLMNs
Content: Non-SBA interfaces internal to the 5G Core such as N4 and N9 can be used to transport signalling data as well as privacy sensitive material, such as user and subscription data, or other parameters, such as security keys. Therefore, these interfaces shall be confidentiality, integrity, and replay protected. Roaming interfaces between PLMNs except for N32, shall be confidentiality, integrity, and replay protected. Protection for the N32 interface is specified in clauses 13.1 and 13.2.. For the protection of the above mentioned non-SBA internal and roaming interfaces except N32, IPsec ESP and IKEv2 certificate-based authentication shall be supported as specified in sub-clauses 9.1.2 of the present document with confidentiality, integrity and replay protection. This security mechanism shall be used,, unless security is provided by other means, e.g. physical security. A SEG may be used to terminate the IPsec tunnels. QoS related aspects are further described in sub-clause 9.1.3 of the present document. NOTE: It is up to the operator choice to use cryptographic solutions or other mechanisms to protect internal non-SBA interfaces such as N4 and N9.