ETSI TR 133 918-2007 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) Generic Authentication Architecture (GAA) Early implemer.pdf

1、 ETSI TR 133 918 V7.0.0 (2007-06)Technical Report Digital cellular telecommunications system (Phase 2+);Universal Mobile Telecommunications System (UMTS);Generic Authentication Architecture (GAA);Early implementation of Hypertext Transfer Protocol over Transport Layer Security (HTTPS) connection bet

2、ween a Universal Integrated Circuit Card (UICC) and a Network Application Function (NAF) (3GPP TR 33.918 version 7.0.0 Release 7)GLOBAL SYSTEM FOR MOBILE COMMUNICATIONSRETSI ETSI TR 133 918 V7.0.0 (2007-06) 1 3GPP TR 33.918 version 7.0.0 Release 7 Reference DTR/TSGS-0333918v700 Keywords GSM, SECURIT

3、Y, UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present docume

4、nt can be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute

5、, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI

6、 documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by writte

7、n permission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2007. All rights reserved. DECTTM, PLUGTESTSTM and UMTSTM are Trade Marks of ETSI registered for the benefit of its Members. TIPHONTMand the TIPHON logo are

8、Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TR 133 918 V7.0.0 (2007-06) 2 3GPP TR 33.918 version 7.0.0 Release 7 Intellectual Property Rights

9、 IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, o

10、r potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been ca

11、rried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generatio

12、n Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and

13、ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. ETSI ETSI TR 133 918 V7.0.0 (2007-06) 3 3GPP TR 33.918 version 7.0.0 Release 7 Contents Intellectual Property Rights2 Foreword.2 Foreword.4 Introduction 4 1 Scope 5 2 References 5 3 Definitions, symbols and abbreviations .5

14、3.1 Definitions5 3.2 Abbreviations .5 4 Requirements6 5 Security architecture.6 6 Authentication schemes6 6.1 Reference model.6 6.2 GBA functions split in the UE6 6.3 General requirements and principles 6 6.3.1 Requirements on the UE .7 6.3.1.1 Requirements on the ME.7 6.3.1.2 Requirements on the UI

15、CC .7 6.3.2 Requirements on the NAF 7 6.4 Shared key-based UICC authentication with certificate-based NAF authentication 7 6.5 Shared key-based mutual authentication between UICC and NAF7 6.6 Certificate based mutual authentication between UICC and Application Server.8 Annex A: Bearer Independent Pr

16、otocol overview.9 A.1 Architecture9 A.2 BIP usage9 Annex B: Change history 11 History 12 ETSI ETSI TR 133 918 V7.0.0 (2007-06) 4 3GPP TR 33.918 version 7.0.0 Release 7 Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present docume

17、nt are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x

18、 the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incre

19、mented when editorial only changes have been incorporated in the document. Introduction TS 33.222 3 describes how the access over HTTP can be secured using TLS in the Generic Authentication Architecture. An application residing on a UICC may advantageously use such a mechanism to secure its communic

20、ation with a Network Application Function (NAF). Due to time constraint, this scenario was not fully covered in release 6. The “HTTPS connection between a UICC and a NAF“ functionality is a candidate for early implementation since all required mechanisms are available in release 7 specifications. ET

21、SI ETSI TR 133 918 V7.0.0 (2007-06) 5 3GPP TR 33.918 version 7.0.0 Release 7 1 Scope The present document gives guidance on how to perform an early implementation of HTTPS connections between a UICC-based application and a Network Application Function in the Generic Authentication Architecture (GAA)

22、. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subseque

23、nt revisions do not apply. For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 21.9

24、05: “3G Vocabulary“. 2 3GPP TS 31.111: “USIM Application Toolkit (USAT)“, Release 6. 3 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“, release 6. 4 3GPP TS 24.109: “Bootstrap

25、ping interface (Ub) and network application function interface (Ua); Protocol details“, release 6. 5 3GPP TS 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter protocol; Stage 3“, release 6. 6 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Gen

26、eric Bootstrapping Architecture“, release 6. 7 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“, release 7. 3 Definitions, symbols and abbreviations 3.1 Definitions For the pur

27、poses of the present document, the terms and definitions given in TS 33.222 3 and TR 21.905 1 apply. 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: BIP Bearer Independent Protocol HTTP Hypertext Transfer Protocol HTTPS HTTP over TLS ME Mobile Equipment

28、 NAF Operator-controlled Network Application Function functionality TLS Transport Layer Security ETSI ETSI TR 133 918 V7.0.0 (2007-06) 6 3GPP TR 33.918 version 7.0.0 Release 7 UE User Equipment 4 Requirements The new requirements and procedures that enable the termination of HTTPS connections in the

29、 UICC have been defined in the following Change Requests: - CR022 to TS 33.222 3: “Usage of Ks_int_NAF for HTTPS connection between a UICC and a NAF“ - CR062 to TS 33.220 6: “Introduction of key selection mechanism“ - CR020 (rev 1) to TS 24.109 4: “Ks_int_NAF usage“ - CR019 (rev 1) to TS 29.109 5: “

30、Key indication in USS“ These new requirements and procedures have been introduced in the corresponding release 7 specifications. The early implementation should fulfill all the requirements and procedures specified for “Access to network application function using HTTPS“ in the aforementioned Change

31、 Requests and in TS 33.222 3, TS 24.109 4 and TS 29.109 5. The early implementation of HTTPS connection between a UICC and a NAF should provide the same security level as the solution defined in TS 33.222 7 for UICC-based application. 5 Security architecture The overall security architecture conform

32、s to the architecture defined in TS 33.220 6. 6 Authentication schemes 6.1 Reference model The reference model conforms to the model specified in TS 33.222 3. 6.2 GBA functions split in the UE The GBA security association between a UICC-based application and a NAF can be established as follows: - Th

33、e ME executes the bootstrapping procedure with the BSF (i.e. supporting the Ub reference point). This ME function can be initiated by the UICC as described in section 6.3.1.1. - The UICC, which hosts the HTTPS client, runs the bootstrapping usage procedure with a NAF (i.e. supporting the Ua referenc

34、e point). 6.3 General requirements and principles The general requirements and principles are provided in TS 33.222 3 and CR022 to TS 33.222 3. This section identifies the UE functionalities that have to be supported in order to enable the implementation of an HTTPS client in a UICC. ETSI ETSI TR 13

35、3 918 V7.0.0 (2007-06) 7 3GPP TR 33.918 version 7.0.0 Release 7 6.3.1 Requirements on the UE 6.3.1.1 Requirements on the ME In order to enable HTTPS connections between a UICC and a NAF, the ME shall support BIP commands (only class “e“) and the “Toolkit-initiated GBA“ command as specified in TS 31.

36、111 2. A ME that is compliant with TS 33.222 3 doesnt require any upgrade to enable the termination of HTTPS connections in the UICC, if the aforementioned functionalities are implemented. When the “Toolkit-initiated GBA“ command is supported by the ME, the UICC can request the ME to perform a GBA b

37、ootstrapping procedure (as defined in TS 31.111 2). As a result, the UE and the BSF will share a new bootstrapping key Ks. The BIP commands allow the UICC to establish a data channel through the ME with a NAF. Then the UICC can run a bootstrapping usage procedure, which is required for the establish

38、ment of an HTTPS tunnel. 6.3.1.2 Requirements on the UICC In order to enable HTTPS connections between a UICC and a NAF, the network access application on the UICC shall be the USIM to enable the usage of the BIP commands and the “Toolkit-initiated GBA“ command as specified in TS 31.111 2. The UICC-

39、based application shall implement a HTTPS client, as defined in TS 33.222 3 and CR022 to TS 33.222 3. The UICC-based mechanisms in charge of the HTTPS connection shall be located on a USIM Toolkit Application on the UICC. 6.3.2 Requirements on the NAF In order to enable HTTPS connections between a U

40、ICC and a NAF, the NAF shall support: - GBA_U and - the requirements, the procedures and the key decision mechanism defined in TS 33.222 3, TS 24.109 4, TS 29.109 5, CR022 to TS 33.222 3, CR062 to TS 33.220 6, CR020 (rev 1) to TS 24.109 4 and CR019 (rev 1) to TS 29.109 5. 6.4 Shared key-based UICC a

41、uthentication with certificate-based NAF authentication The authentication and tunnel establishment mechanisms are described in TS 33.222 3, TS 24.109 4, TS 29.109 5, CR022 to TS 33.222 3, CR062 to TS 33.220 6, CR020 (rev 1) to TS 24.109 4 and CR019 (rev 1) to TS 29.109 5. Compared to release 6, the

42、 only additional procedures that should be supported are described in the aforementioned Change Requests. 6.5 Shared key-based mutual authentication between UICC and NAF The authentication and tunnel establishment mechanisms are described in TS 33.222 3, TS 24.109 4, TS 29.109 5, CR022 to TS 33.222

43、3, CR062 to TS 33.220 6, CR020 (rev 1) to TS 24.109 4 and CR019 (rev 1) to TS 29.109 5. Compared to release 6, the only additional procedures that should be supported are described in the aforementioned Change Requests. ETSI ETSI TR 133 918 V7.0.0 (2007-06) 8 3GPP TR 33.918 version 7.0.0 Release 7 6

44、.6 Certificate based mutual authentication between UICC and Application Server The authentication and tunnel establishment mechanisms are described in TS 33.222 3, TS 24.109 4 and TS 29.109 5. ETSI ETSI TR 133 918 V7.0.0 (2007-06) 9 3GPP TR 33.918 version 7.0.0 Release 7 Annex A: Bearer Independent

45、Protocol overview This annex provides an overview of the Bearer Independent Protocol (BIP) usage to establish the HTTPS connection between a UICC and a NAF. A.1 Architecture Application UICC HTTP TLS BIP BIP Application TCP/IP TCP/IP HTTP TLS ME NAF A.2 BIP usage BIP open channel (TCP/IP protocol) S

46、end (Data) OK (channel number) Data sent in TCP/IP packets Data received in TCP/IP packets BIP commands TCP/IP protocol ME NAF UICC ETSI ETSI TR 133 918 V7.0.0 (2007-06) 103GPP TR 33.918 version 7.0.0 Release 7 When the UICC opens a BIP channel with the NAF as described in TS 31.111 2 then an active

47、 TCP/IP connection is established between the UICC and the NAF. This channel is further used to exchange HTTPS and HTTP packets. ETSI ETSI TR 133 918 V7.0.0 (2007-06) 113GPP TR 33.918 version 7.0.0 Release 7 Annex B: Change history Change history Date TSG # TSG Doc. CR Rev Cat Subject/Comment Old Ne

48、w WI 05/09/2005 - - - Created at SA3 #40 0.0.0 0.1.0 UICNAFSec 21/09/2005 SP-29 SP-050574 - - - Presented for information at SA #29 0.1.0 1.0.0 UICNAFSec 19/11/2005 SP-30 Raised to version 2.0.0 for presentation to SA #30 for approval 1.0.0 2.0.0 UICNAFSec 2005-12 SP-30 SP-050770 Approved at SA #30 2.0.0 7.0.0 UICNAFSec ETSI ETSI TR 133 918 V7.0.0 (2007-06) 123GPP TR 33.918 version 7.0.0 Release 7 History Document history V7.0.0 June 2007 Publication