Trust in Network-Based Key Management for End-to. End Security (UC 3.2) Summary: An encrypted and authenticated IoT Service can be provided for IoT devices through a 5G system although there is no way to share secret keys between endpoints. 5G network may provide a network- enabled key management service which can be used to achieve secure end-to-end service between an IoT device and an IoT backend service. The keys can be provided either for device-specific unicast or group- specific multicast communication. The key management service can be offered by the 5G operator or a third party. The IoT service can be located outside the 5G network, e.g. in the cloud or it can be inside the 5G system. The IoT backend service and the IoT devices should have 5G credentials. 5G should support lawful interception. Entities: MNO, VMNO, third-party service operator, legal authorities, subscribers. Trust: The IoT service providers and the owners of IoT devices need to trust the 5G operator. The 5G operator should trust the key management service provider and the operator should trust that lawful interception is not misused. The users and the IoT backend service provider should accept lawful interception.
