ETSI TR 133 924-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) LTE Identity management and 3GPP security interworking .pdf

1、 ETSI TR 1Digital cellular telecoUniversal Mobile TelIdentity managemenIdentiGeneric Authenticatio(3GPP TR 33.9TECHNICAL REPORT 133 924 V13.0.0 (2016communications system (Phaelecommunications System (LTE; ent and 3GPP security interwontity management and ation Architecture (GAA) interw.924 version

2、13.0.0 Release 1316-01) hase 2+); (UMTS); rking; er orking 13) ETSI ETSI TR 133 924 V13.0.0 (2016-01)13GPP TR 33.924 version 13.0.0 Release 13Reference RTR/TSGS-0333924vd00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax:

3、 +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versi

4、ons and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is t

5、he print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is avail

6、able at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means,

7、electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European

8、 Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners.

9、 GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TR 133 924 V13.0.0 (2016-01)23GPP TR 33.924 version 13.0.0 Release 13Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The informati

10、on pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI

11、 Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the upd

12、ates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identit

13、ies, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document

14、“shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when

15、used in direct citation. ETSI ETSI TR 133 924 V13.0.0 (2016-01)33GPP TR 33.924 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions, symbols and abbreviations . 6g33.1 Definit

16、ions 6g33.2 Abbreviations . 6g34 Interworking of OpenID and GAA 7g34.1 Introduction 7g34.2 Architectural Descriptions 7g34.2.1 Generic Bootstrapping Architecture . 7g34.2.2 OpenID Architecture. 9g34.3 NAF and OpenID-IdP Co-location . 10g34.4 Message Flow for Interworking Scenario 11g34.4.1 Message F

17、low for direct GBA Interworking Scenario 11g34.4.2 Message Flow for Split Terminal GBA Interworking Scenario . 13g34.4.2.1 General 13g34.4.2.2 Differentiating between Scenarios 14g34.4.2.3 Scenarios not using cryptographic binding . 14g34.4.2.4 Scenarios using cryptographic binding . 23g34.5 Mapping

18、 of Concepts . 33g34.5.1 Identifiers in OpenID and GBA 33g34.5.2 Asociation Session Concept 35g34.5.3 Assertions . 35g34.5.3.1 Positive Assertions 35g34.5.3.2 Negative Assertions 35g34.6 Use of GUSS and USS for OpenID 36g3Annex A (informative): Example for Charging via IdP 37g3Annex B: Change histor

19、y 40g3History 41g3ETSI ETSI TR 133 924 V13.0.0 (2016-01)43GPP TR 33.924 version 13.0.0 Release 13Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change followi

20、ng formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TS

21、G for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the docume

22、nt. Introduction 3GPP SA3 outlined the interworking of the operator controlled GBA with the Liberty Alliance Identity Management. This was sufficient for the time of writing, but now new additional systems are deployed and used. If we want to enable interworking of operator centric identity manageme

23、nt, then smooth interworking with those new systems need to be outlined. If this is not done, then a seamless interworking is not possible on global scale and it would be difficult to leverage the existing customer base and security level that operators have. ETSI ETSI TR 133 924 V13.0.0 (2016-01)53

24、GPP TR 33.924 version 13.0.0 Release 131 Scope The objective is to extend the current identity management as outlined in TS 33.220, TS 33.222, TS 29.109 and TR 33.980 with the latest developments on identity management outside of the 3GPP sphere. This will allow a better integration and usage of ide

25、ntity management for services in 3GPP and seamless integration with existing services that are not standardized in 3GPP. This report outlines the interworking of GBA and OpenID. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of th

26、e present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP do

27、cument (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic Bootstrappin

28、g Architecture“. 3 3GPP TS 24.109: “Bootstrapping Interface (Ub) and Network Application Function Interface (Ua); Protocol Details“. 4 3GPP TR 33.980: “Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Service Framework (ID-WSF) and the Generic Authentication Archi

29、tecture (GAA)“. 5 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“. 6 3GPP TS 33.223: “Generic Bootstrapping Architecture (GBA) Push Function“. 7 3GPP TS 29.109: “Generic Authe

30、ntication Architecture (GAA); Zh and Zn Interfaces based on the Diameter Protocol; Stage 3“. 8 OpenID Foundation “OpenID Authentication 2.0“, http:/ 9 OpenID Foundation “OpenID Attribute Exchange 1.0“, http:/ 10 OpenID Foundation “OpenID Provider Authentication Policy Extension 1.0“, http:/ 11 OASIS

31、 Reed, D.; McAlpin, D.: “Extensible Resource Identifier (XRI) Syntax v2.0“; http:/www.oasis-open.org/ 12 OpenID Foundation, http:/ 13 OpenID Site Directory, http:/ 14 3GPP TS 33.259: “Key Establishment between a UICC hosting device and a remote device“. 15 IETF RFC 4006, “Diameter Credit Control“, h

32、ttp:/tools.ietf.org/html/rfc4006 16 W3C, “HTML 4.01 Specification“, http:/www.w3.org/TR/html401/ 17 IETF RFC 2617 (1999): “HTTP Authentication: Basic and Digest Access Authentication“. ETSI ETSI TR 133 924 V13.0.0 (2016-01)63GPP TR 33.924 version 13.0.0 Release 1318 IETF RFC 3761 (2004): “The E.164

33、to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM)“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 1 and the following apply. A term defined in the prese

34、nt document takes precedence over the definition of the same term, if any, in TR 21.905 1. The GAA / GBA specific definitions are originated from 2 and the OpenID definitions are originated from 8. In case of conflict 2 and 8 take precedence. Attribute: An attribute is used in the OpenID Attribute E

35、xchange service extension 9. This extension provides a mechanism for moving identity related information between sites. An attribute is associated with a Subject Identifier. An attribute has a type identifier and a value. An attribute type identifier is a URI. An attribute value can be any kind of d

36、ata. Bootstrapping Server Function (BSF): A Bootstrapping Server Function (BSF) is hosted in a network element under the control of an MNO. BSF, HSS/HLR, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping procedure. The shared s

37、ecret can be used between NAFs and UEs, for example, for authentication purposes. GBA User Security Settings: GUSS contains the BSF specific information element and the set of all application-specific USSs. Identifier: An Identifier in OpenID is either an “http“ or “https“ URL, or an XRI 11. OpenID

38、8 defines various kinds of identifiers depending on the context. Network Application Function (NAF): A NAF is hosted in a network element. GBA may be used between NAFs and UEs for authentication purposes, and for securing the communication path between the UE and the NAF. OpenID Provider (OP): An Op

39、enID Provider (OP) is an OpenID Authentication Server on which a Relying Party relies for an assertion that the end user controls an Identifier. OpenID Provider driven identifier selection: OpenID Provider driven identifier selection is the ability for a user to enter the URL of their OpenID Provide

40、r into an OpenID field rather than their personal OpenID URL. This allows the web site (RP) to start the OpenID authentication flow and send the user over to the correct OpenID provider. The user can then authenticate to the OpenID provider, select a particular OpenID URL and persona if they have mu

41、ltiple, This will result in an actual user OpenID URL or an anonymous OpenID URL being returned to the RP. OP Endpoint URL: The URL which accepts OpenID Authentication protocol messages, obtained by performing discovery on the User-Supplied identifier. This value must be an absolute HTTP or HTTPS UR

42、L. Relying Party (RP): A Relying Party is a web application that wants a proof that the end user controls an Identifier. User Supplied Identifier: An Identifier that was presented by the end user to the RP, or selected by the user at the OpenID Provider. During the initiation phase of the protocol,

43、an end user may enter either their own Identifier or an OP Identifier. If an OP Identifier is used, the OP may then assist the end user in selecting an Identifier to share with the RP. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in TR 21.905 1 and the followin

44、g apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905 1. AKA Authentication and Key Agreement Protocol AV Authentication Vector BSF Bootstrapping Server Function IdP Identity Provider GAA Generic Authentication Ar

45、chitecture ETSI ETSI TR 133 924 V13.0.0 (2016-01)73GPP TR 33.924 version 13.0.0 Release 13GBA Generic Bootstrapping Architecture GPI GBA Push Information GUSS GBA User Security Settings HLR Home Location Register HSS Home Subscriber Server ME Mobile Equipment MNO Mobile Network Operator NAF Network

46、Application Function OP OpenID Provider PAPE Provider Authentication Policy Extension RP Relying Party SLF Subscriber Locator Function SP Service Provider UE User Equipment USS User Security Settings 4 Interworking of OpenID and GAA 4.1 Introduction In this chapter we outline how the Generic Authent

47、ication Architecture, in particular, the Generic Bootstrapping Architecture (GBA) as specified in 2 can be utilized by the OpenID protocol as specified by 8. The focus will lie on the impact to the network nodes of the Mobile Network Operator (MNO) and the service providers, the supported protocols

48、and the message flows. The general setting for the GBA OpenID interworking is quite similar to the GBA Liberty Alliance Interworking as outlined in 4. The major difference is that OpenID as currently specified is more lightweight than the Liberty Alliance Web Service and Identity Federation Framewor

49、k and therefore many well-known service providers have chosen OpenID for their identity management solution. 4.2 Architectural Descriptions 4.2.1 Generic Bootstrapping Architecture In this section, we give a brief overview of the Generic Bootstrapping Architecture as described in TS 33.220 2. GBA enables automatic provisioning of shared keys between a User Equipment (UE) and an application server (Network Application Fun