摘自3GPP 5G Security的

5G最重要的增强是：

The most important 5G security enhancements are：

access agnostic primary authentication with home control（这一个没看懂什么意思）归属控制对不可知接入的主身份验证
security key establishment and management安全秘钥的建立与管理
security for mobility 移动安全
service based architecture security SBA
inter-network security
privacy and security for services provided over 5G with secondary authentication

在这里插入图片描述

在这里插入图片描述

The long term secret key (K) provisioned in the USIM and the 5G core network acts as the primary source of security context in the same way as in of an 4G system. Different to LTE, in 5G there are 2 types of authentication, primary authentication that all devices have to perform for accesing the mobile network services, and secondary authentication to an external data network (DN), if so desired by the external data network
在usim和5g核心网络中提供的长期密钥（k）与在4g系统中一样，充当安全上下文的主要来源。与lLTE不同，5g中有两种类型的认证，即所有设备访问移动网络服务时必须执行的主认证和外部数据网络（dn）的辅助认证（如果外部数据网络需要的话）。

在这里插入图片描述

K_AUSF:

The K_AUSF is derived by ME and ARPF from CK and IK during 5G Authentication and Key Agreement (AKA).
If the 3GPP credential K is used for authentic ation over a radio access technology supporting the extensible authentication protocol EAP, K_AUSFis derived by ME and AUSF according to the EAP AKA’ specification.

K_SEAF:

From K_AUSF, the AUSF and ME derive the anchor key K_SEAFthat is then used to derive the K_AMF by ME and SEAF.

K_AMF and K’_AMF:

K_AMF is derived by ME and SEAF from K_SEAF
The K’_AMF is a key that can be derived by ME and AMF from previous K_AMF when the UE moves from one AMF to another during inter-AMF mobility

K_NASint and K_NASenc:

The integrity and confidentiality keys, K_NASint and K_NASenc respectively, are derived by ME and AMF from KAMF for the NAS signalling protection.

K_gNB:

The K_gNBis derived by ME and AMF from K_AMF.
The K_gNBis also derived by ME and source gNB using a intermediary key, K*_gNB, during mobility that can lead to, what is known as, horizontal or vertical key derivation.

K_UPint、 K_UPenc、 K_RRCint and K_RRCenc:

The integrity and confidentiality keys for AS, i.e. UP (K_UPint and K_UPenc) and RRC (K_RRCint and K_RRCenc), are derived by ME and gNB from K_gNB.
UP integrity protection is another enhancement in 5G that is valuable for the expected Internet of Things (IoT) services.

NH:

The intermediate key NH is derived by ME and AMF to provide forward secrecy during handover.

Up to 4G, the home network had to trust the visited network through which the authentication took place.

The UE constructs the SUCI from

the protection scheme identifier,
the home network public key identifier,
the home network identifier and
the protection scheme-output that represents the output of a public key protection scheme.

在这里插入图片描述

4G与5G的互通安全

来源：https://blog.csdn.net/qq_37160773/article/details/102678897

标签