ETSI TR 133 924-2018 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) LTE Identity management and 3GPP security interwo.pdf

1、 ETSI TR 133 924 V15.0.0 (2018-07) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Identity management and 3GPP security interworking; Identity management and Generic Authentication Architecture (GAA) interworking (3GPP TR 33.924 v

2、ersion 15.0.0 Release 15) TECHNICAL REPORT ETSI ETSI TR 133 924 V15.0.0 (2018-07)13GPP TR 33.924 version 15.0.0 Release 15Reference RTR/TSGS-0333924vf00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 S

3、iret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print.

4、 The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Port

5、able Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/porta

6、l.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic

7、 or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All rig

8、hts reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Membe

9、rs. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TR 133 924 V15.0.0 (2018-07)23GPP TR 33.924 version 15.0.0 Release 15Intellectual Property Rights Essential patents IPRs essential or potentially essential to normative deliverables may have been declared t

10、o ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is av

11、ailable from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI S

12、R 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners. ETSI claims no ownership of these except for any wh

13、ich are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks. Foreword T

14、his Technical Report (TR) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ET

15、SI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as desc

16、ribed in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TR 133 924 V15.0.0 (2018-07)33GPP TR 33.924 version 15.0.0 Release 15Contents Intellectual Propert

17、y Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions, symbols and abbreviations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 Interworking of OpenID and GAA 7g34.1 Introduction 7g34.2 Architectural Descriptions 7g34.2.1 Generi

18、c Bootstrapping Architecture . 7g34.2.2 OpenID Architecture. 8g34.3 NAF and OpenID-IdP Co-location . 10g34.4 Message Flow for Interworking Scenario 11g34.4.1 Message Flow for direct GBA Interworking Scenario 11g34.4.2 Message Flow for Split Terminal GBA Interworking Scenario . 13g34.4.2.1 General 13

19、g34.4.2.2 Differentiating between Scenarios 14g34.4.2.3 Scenarios not using cryptographic binding . 14g34.4.2.4 Scenarios using cryptographic binding . 23g34.5 Mapping of Concepts . 33g34.5.1 Identifiers in OpenID and GBA 33g34.5.2 Asociation Session Concept 35g34.5.3 Assertions . 35g34.5.3.1 Positi

20、ve Assertions 35g34.5.3.2 Negative Assertions 35g34.6 Use of GUSS and USS for OpenID 35g3Annex A (informative): Example for Charging via IdP 37g3Annex B: Change history 40g3History 41g3ETSI ETSI TR 133 924 V15.0.0 (2018-07)43GPP TR 33.924 version 15.0.0 Release 15Foreword This Technical Report has b

21、een produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identif

22、ying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes

23、of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction 3GPP SA3 outlined the interworking of the operator controlled GBA with the Liberty Alliance Identity Management. Thi

24、s was sufficient for the time of writing, but now new additional systems are deployed and used. If we want to enable interworking of operator centric identity management, then smooth interworking with those new systems need to be outlined. If this is not done, then a seamless interworking is not pos

25、sible on global scale and it would be difficult to leverage the existing customer base and security level that operators have. ETSI ETSI TR 133 924 V15.0.0 (2018-07)53GPP TR 33.924 version 15.0.0 Release 151 Scope The objective is to extend the current identity management as outlined in TS 33.220, T

26、S 33.222, TS 29.109 and TR 33.980 with the latest developments on identity management outside of the 3GPP sphere. This will allow a better integration and usage of identity management for services in 3GPP and seamless integration with existing services that are not standardized in 3GPP. This report

27、outlines the interworking of GBA and OpenID. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-s

28、pecific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Rele

29、ase as the present document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture“. 3 3GPP TS 24.109: “Bootstrapping Interface (Ub) and Network Application Function Interface (Ua); Protocol Details“.

30、4 3GPP TR 33.980: “Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Service Framework (ID-WSF) and the Generic Authentication Architecture (GAA)“. 5 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext

31、 Transfer Protocol over Transport Layer Security (HTTPS)“. 6 3GPP TS 33.223: “Generic Bootstrapping Architecture (GBA) Push Function“. 7 3GPP TS 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter Protocol; Stage 3“. 8 OpenID Foundation “OpenID Authenticati

32、on 2.0“, http:/ 9 OpenID Foundation “OpenID Attribute Exchange 1.0“, http:/ 10 OpenID Foundation “OpenID Provider Authentication Policy Extension 1.0“, http:/ 11 OASIS Reed, D.; McAlpin, D.: “Extensible Resource Identifier (XRI) Syntax v2.0“; http:/www.oasis-open.org/ 12 OpenID Foundation, http:/ 13

33、 OpenID Site Directory, http:/ 14 3GPP TS 33.259: “Key Establishment between a UICC hosting device and a remote device“. 15 IETF RFC 4006, “Diameter Credit Control“, http:/tools.ietf.org/html/rfc4006 16 W3C, “HTML 4.01 Specification“, http:/www.w3.org/TR/html401/ 17 IETF RFC 2617 (1999): “HTTP Authe

34、ntication: Basic and Digest Access Authentication“. 18 IETF RFC 3761 (2004): “The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM)“. ETSI ETSI TR 133 924 V15.0.0 (2018-07)63GPP TR 33.924 version 15.0.0 Release 153 Definitions, symbols and abbr

35、eviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 1 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905 1. The GAA / GBA specific definitions are ori

36、ginated from 2 and the OpenID definitions are originated from 8. In case of conflict 2 and 8 take precedence. Attribute: An attribute is used in the OpenID Attribute Exchange service extension 9. This extension provides a mechanism for moving identity related information between sites. An attribute

37、is associated with a Subject Identifier. An attribute has a type identifier and a value. An attribute type identifier is a URI. An attribute value can be any kind of data. Bootstrapping Server Function (BSF): A Bootstrapping Server Function (BSF) is hosted in a network element under the control of a

38、n MNO. BSF, HSS/HLR, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes. GBA User Security Settings: GUSS contains the BSF s

39、pecific information element and the set of all application-specific USSs. Identifier: An Identifier in OpenID is either an “http“ or “https“ URL, or an XRI 11. OpenID 8 defines various kinds of identifiers depending on the context. Network Application Function (NAF): A NAF is hosted in a network ele

40、ment. GBA may be used between NAFs and UEs for authentication purposes, and for securing the communication path between the UE and the NAF. OpenID Provider (OP): An OpenID Provider (OP) is an OpenID Authentication Server on which a Relying Party relies for an assertion that the end user controls an

41、Identifier. OpenID Provider driven identifier selection: OpenID Provider driven identifier selection is the ability for a user to enter the URL of their OpenID Provider into an OpenID field rather than their personal OpenID URL. This allows the web site (RP) to start the OpenID authentication flow a

42、nd send the user over to the correct OpenID provider. The user can then authenticate to the OpenID provider, select a particular OpenID URL and persona if they have multiple, This will result in an actual user OpenID URL or an anonymous OpenID URL being returned to the RP. OP Endpoint URL: The URL w

43、hich accepts OpenID Authentication protocol messages, obtained by performing discovery on the User-Supplied identifier. This value must be an absolute HTTP or HTTPS URL. Relying Party (RP): A Relying Party is a web application that wants a proof that the end user controls an Identifier. User Supplie

44、d Identifier: An Identifier that was presented by the end user to the RP, or selected by the user at the OpenID Provider. During the initiation phase of the protocol, an end user may enter either their own Identifier or an OP Identifier. If an OP Identifier is used, the OP may then assist the end us

45、er in selecting an Identifier to share with the RP. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in TR 21.905 1 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR

46、 21.905 1. AKA Authentication and Key Agreement Protocol AV Authentication Vector BSF Bootstrapping Server Function IdP Identity Provider GAA Generic Authentication Architecture GBA Generic Bootstrapping ArchitectureGPI GBA Push Information GUSS GBA User Security Settings HLR Home Location Register

47、HSS Home Subscriber Server ETSI ETSI TR 133 924 V15.0.0 (2018-07)73GPP TR 33.924 version 15.0.0 Release 15ME Mobile Equipment MNO Mobile Network Operator NAF Network Application Function OP OpenID Provider PAPE Provider Authentication Policy Extension RP Relying Party SLF Subscriber Locator Function

48、 SP Service Provider UE User Equipment USS User Security Settings 4 Interworking of OpenID and GAA 4.1 Introduction In this chapter we outline how the Generic Authentication Architecture, in particular, the Generic Bootstrapping Architecture (GBA) as specified in 2 can be utilized by the OpenID prot

49、ocol as specified by 8. The focus will lie on the impact to the network nodes of the Mobile Network Operator (MNO) and the service providers, the supported protocols and the message flows. The general setting for the GBA OpenID interworking is quite similar to the GBA Liberty Alliance Interworking as outlined in 4. The major difference is that OpenID as currently specified is more lightweight than the Liberty Alliance Web S