The AMF supports the following encryption and integrity protection algorithms to enable encryption and integrity protection on the N1/N2 interface:

• NEA0/NIA0

• 128-NEA1/128-NIA1

• 128-NEA2/128-NIA2

This section describes how this feature works.

The UE Security Capability IE, received from the UE in Registration Request, is used by the network to indicate which security algorithms are supported by the UE for NAS security. The AMF creates a new security context for the UE and does the negotiation of encryption and integrity protection algorithms. These algorithms are configurable along with the priority of negotiation. The AMF compares the algorithms supported by the UE with configuration priority and selects the algorithms to be used for encryption and integrity protection. When integrity protection is disabled, ciphering is also auto-disabled.

In addition, the NasSubscriber database is a new database that stores the UE security context for both the AMF application and the protocol layer to access. The AMF application stores the derived keys and negotiated algorithms in the NasSubscriber database before sending the security mode command to the UE. The AMF protocol encodes the packets received from the AMF application and initiates the encryption and integrity protection based on the negotiated algorithm and the downlink Nas count.

The AMF extracts the security header from the packets to verify integrity protection in the uplink path. After verification, the AMF protocol deciphers the packets before sending it to the AMF application.

This section describes how to configure AMF Ciphering Algorithm.

This feature is configured under the amf-global configuration.

The supi-policy is configured per subscriber or for a group of subscribers. It’s done by associating the supi/supi-prefix with the supi policy. The operator policy name is configured under supi-policy and the call-control profile is configured under operator policy. Under call-control policy, authentication timer, retry, and security algorithms are configured.

To configure this feature, use the following configuration.

config 
  amf-global 
   call-control-policy call_control_policy_name 
      timers t3560 
       value time_value 
       retry retry_value 
      exit 
      security-algo security_algo_priority 
       ciphering-algo  [5G-EA0 | 128-5G-EA1 | 128-5G-EA2] 
       integity-prot-algo [5G-IA0 | 128-5G-IA1 | 128-5G-IA2] 
      exit 
   operator-policy operator_policy_name 
      ccp-name ccp_name 
   exit 
   supi-policy supi_policy_name 
     operator-policy-name operator_policy_name 
     end 

NOTES:

• call-control-policy call_control_policy_name —Specify the call control policy name.

• security-algosecurity_algo_priority —Specify the priority of security algorithms. Its values are 1, 2, 3.

• ciphering-algo [5G-EA0 | 128-5G-EA1 | 128-5G-EA2] —Specify the Ciphering algorithm to use.

• integity-prot-algo [5G-IA0 | 128-5G-IA1 | 128-5G-IA2] —Specify the Integrity protocol algorithm to use.

• operator-policy operator_policy_name —Specify the operator policy name.

• supi-policy supi_policy_name —Specify the SUPI policy name. SUPI policy name is the number which represents PLMN ID.

  Example: amf-global supi-policy 223556 operator-policy-name local

This section describes operations, administration, and maintenance support for this feature.