name: IKEv2
full_form: Internet Key Exchange version 2
context: The E1 interface connects the gNB-CU-CP to the gNB-CU-UP. It is only used for the transport of signalling data. In order to protect the traffic on the E1 interface, IPsec ESP and IKEv2 certificates-based authentication shall be supported as specified in sub-clause 9.1.2 of the present document with confidentiality, integrity and replay protection. In addition to IPsec, DTLS shall be supported as specified in RFC 6083 [58] to provide mutual authentication, integrity protection, replay protection and confidentiality protection. Security profiles for DTLS implementation and usage shall follow the TLS profile given in clause 6.2 of TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3] and the certificate profile given in clause 6.1.3a of TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5]. The identities in the end entity certificates shall be used for authentication and policy checks. Mutual authentication shall be supported over the E1interface between the gNB-CU-CP and the gNB-CU-UP using DTLS and/or IKEv2. IPsec is mandatory to support on the gNB-CU-UP and the gNB-CU-CP. Observe that on both the gNB-CU-CP and the gNB-CU-UP sides, a SEG may be used to terminate the IPsec tunnel. NOTE 1: The use of transport layer security, via DTLS, does not rule out the use of network layer protection according to NDS/IP as specified in TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3]. In fact, IPsec has the advantage of providing topology hiding. NOTE 2: The use of cryptographic solutions to protect E1 is an operator's decision. In case the gNB has been placed in a physically secured environment then the 'secure environment' includes other nodes and links beside the gNB.
description: Internet Key Exchange version 2 (IKEv2) is a protocol used for setting up, maintaining, and tearing down IPsec VPNs. In the context of the E1 interface connecting the gNB-CU-CP to the gNB-CU-UP, IKEv2 certificates-based authentication is utilized in conjunction with IPsec ESP to ensure confidentiality, integrity, and replay protection of signalling data. This aligns with 3GPP's specifications for secure network operations.
explanation: IKEv2 is classified as a Protocol because it defines the rules and procedures for establishing and managing secure connections between network elements, specifically in this case, for protecting traffic on the E1 interface.
section_title: 9.8.3 Security mechanisms for the E1 interface
biotag_Context: O,B-Interface,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Interface,O,B-Protocol,B-Protocol,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Specification,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Specification,O,B-Technology,I-Technology,I-Technology,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Specification,O,B-Technology,I-Technology,I-Technology,O,O,B-Technology,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Network Function,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,B-Specification,O,B-Technology,I-Technology,I-Technology,O,B-Protocol,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Interface,O,O,O,O,O,O,O,B-Network Function,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O
biotag_Description: B-Protocol,I-Protocol,I-Protocol,I-Protocol,I-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Interface,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,B-Protocol,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O