ETSI TR 133 980-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) LTE Liberty Alliance and 3GPP security interworking Int.pdf

1、 ETSI TR 1Digital cellular telecoUniversal Mobile TelLiberty Alliance aInterworking of Liberty A(ID-FF), Identity WebGeneric Authe(3GPP TR 33.9TECHNICAL REPORT 133 980 V13.0.0 (2016communications system (Phaelecommunications System (LTE; e and 3GPP security interworky lliance Identity Federation eb

2、Services Framework (ID-WShentication Architecture (GAA.980 version 13.0.0 Release 1316-01) hase 2+); (UMTS); rking; n Framework F) and AA) 13) ETSI ETSI TR 133 980 V13.0.0 (2016-01)13GPP TR 33.980 version 13.0.0 Release 13Reference RTR/TSGS-0333980vd00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route d

3、es Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org

4、/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in c

5、ontents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of sta

6、tus. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright

7、Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyr

8、ight and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI re

9、gistered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TR 133 980 V13.0.0 (2016-01)23GPP TR 33.980 version 13.0.0 Release 13Intellectual Property Rights IPRs essential or potentially

10、 essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs

11、notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given

12、 as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present do

13、cument may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/web

14、app.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of prov

15、isions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TR 133 980 V13.0.0 (2016-01)33GPP TR 33.980 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 5g3Introduction 5g31 Sc

16、ope 6g32 References 6g33 Definitions, symbols and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 8g34 Interworking of Liberty Alliance ID-FF/ ID-WSF and Generic Authentication Architecture . 9g34.1 Introduction 9g34.2 Architectural Description Use of GBA within ID-FF / ID-WSF . 9g34.2.1 A

17、rchitecture for collocation of NAF with Liberty Alliance Authentication Function 12g34.2.1.1 Collocation of IdP/NAF in Liberty Alliance ID-FF (alternatively SAML v2.0) . 12g34.2.1.2 Collocation of AS/NAF in Liberty Alliance ID-WSF . 13g34.2.2 Architecture for collocation of BSF with Liberty Alliance

18、 authentication function . 15g34.2.2a Logical data model of the Liberty Alliance Authentication Function (IdP/AS) . 16g34.2.3 User Registration to Interworking Service 16g34.2.3.1 Registration with Operator 17g34.2.3.2 Registration with IdP. 17g34.2.4 Provisioning of User Data for Interworking Servi

19、ce 17g34.2.4.1 Service based on standard user data 18g34.2.4.2 Service based on pre-provisioned interworking data 18g34.2.4.3 Service based on explicitly added interworking data 18g34.3 Co-hosting of NAF and IdP 18g34.3.1 Federation Concept in GBA 19g34.3.2 Session Concept at IdP . 19g34.3.2a Single

20、-Logout Concept . 20g34.3.3 SSO scenario: ID-FF with transfer 20g34.3.3.1 HTTPS with conventional TLS . 20g34.3.3.2 HTTPS with PSK TLS 22g34.3.4 SSO scenario: ID-FF with artefact transfer . 23g34.3.5 SSO scenario: ID-WSF Authentication Service . 25g34.3.6 SSO scenario: SAML v2.0 with transfer . 27g3

21、4.3.6.1 HTTPS with TLS 27g34.3.6.2 HTTPS with PSK TLS 28g34.3.7 SSO scenario: SAML v2.0 with artefact transfer (resolution) 29g34.3a Co-hosting of BSF and IdP 30g34.3a.1 General 30g34.3a.2 UE behaviour 31g34.3a.3 IdP/BSF behaviour 31g34.3a.4 Federation Concept in GBA with IdP/BSF collocation 31g34.3

22、a.5 Session Concept at the IdP 32g34.3a.6 SSO scenario: ID-FF with transfer 32g34.4 Use of GUSS / USS in Support of ID-FF and ID-WSF . 34g34.4.1 GAA-LAP Interworking Service 35g34.4.2 GAA-LAP Interworking USS . 35g34.4.2a GUSS / USS when IdP/AS is collocated with BSF 35g34.5 Liberty Alliance Authent

23、ication Context and GBA . 35g3Annex A: Digest Authentication within SASL for Ua protocol between UE and AS/NAF . 37g3ETSI ETSI TR 133 980 V13.0.0 (2016-01)43GPP TR 33.980 version 13.0.0 Release 13A.1 HTTPS deployment 37g3A.2 Digest challenge . 37g3A.3 Digest response 38g3A.4 Response auth . 38g3A.5

24、Subsequent authentication 38g3Annex Z: Change history 39g3History 41g3ETSI ETSI TR 133 980 V13.0.0 (2016-01)53GPP TR 33.980 version 13.0.0 Release 13Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to c

25、ontinuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1

26、 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editori

27、al only changes have been incorporated in the document. Introduction 3GPP defined the Generic Authentication Architecture (GAA) independent of the Liberty Alliance Identity Federation and Web Service Framework. Both systems were designed to be deployed independently of each other. The Liberty Allian

28、ce Identity Federation and Web Service Framework offers simplified sign-on and session management for complex web service business interaction protocols. The GAA offers a mechanism to provide a shared secret and certificates to two communicating entities for mobile applications, based on GSM and UMT

29、S authentication and key agreement protocols. ETSI ETSI TR 133 980 V13.0.0 (2016-01)63GPP TR 33.980 version 13.0.0 Release 131 Scope The present document provides guidelines on the interworking of the Generic Authentication Architecture (GAA) and the Liberty Alliance architecture. The document studi

30、es the details of possible interworking methods between the Security Assertion Markup Language v2.0, SAML v2.0 (or alternatively the Liberty Alliance Identity Federation Framework, ID-FF), the Identity Web Services Framework (ID-WSF) , the Security Assertion Markup Language (SAML) and a component of

31、 GAA called the Generic Bootstrapping Architecture (GBA). This document only applies if Liberty Alliance and GBA or SAML v2.0 and GBA are used in combination. 2 References The following documents contain provisions, which, through reference in this text, constitute provisions of the present document

32、. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (incl

33、uding a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic bootstrapping architecture“. 2 3GPP TS 33.222: “Generic Authentication Architect

34、ure (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“. 3 3GPP TS 33.221: “Generic Authentication Architecture (GAA); Support for subscriber certificates“. 4 3GPP TS 24.109: “Bootstrapping interface (Ub) and network application fun

35、ction interface (Ua); Protocol details“. 5 3GPP TS 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter protocol; Stage 3“. 6 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF Security Mechanisms“. 7 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF

36、Architecture Overview“. 8 Liberty Alliance Project, ID-WSF v2.0 “Liberty ID-WSF Authentication Service Specification and Single Sign-On Service“. 9 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF SOAP Binding Specification“. 10 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF Discovery

37、Service Specification“. 11 Organization for the Advancement of Structured Information Standards (OASIS), SAML v2 Core “Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0“. 12 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Bindings and Profiles Specification“.

38、 13 Organization for the Advancement of Structured Information Standards (OASIS), “Profiles for the OASIS Security Assertion Markup Language (SAML) v2.0“. 14 Liberty Alliance Project, ID-WSF v1.2: “Security Mechanisms“. 15 Liberty Alliance Project Support Documents: “Authentication Context Specifica

39、tion“ v2.0. 16 Liberty Alliance Project, ID-WSF “Profiles for Liberty enabled User Agents and Devices“ v2.0. ETSI ETSI TR 133 980 V13.0.0 (2016-01)73GPP TR 33.980 version 13.0.0 Release 1317 IETF RFC 2222 (1997), “Simple Authentication and Security Layer (SASL)“. 18 IETF RFC 2831 (2000), “Using Dige

40、st Authentication as a SASL Mechanism“. 19 IETF RFC 2617 (1999), “HTTP Authentication: Basic and Digest Access Authentication“. 20 Liberty Alliance Project Support Documents: “Liberty Reverse HTTP Binding for SOAP Specification“ v1.1. 21 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 22 IETF

41、RFC 3546 (2003-06), “Transport Layer Security (TLS) Extensions“. 23 Liberty Alliance Project, ID-SIS: “Liberty Alliance ID-SIS 1.0 Specifications“. 24 IETF RFC 2246 (1999-01), “The TLS Protocol Version 1.0“. 25 IETF RFC 4279 (2005-12), “Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)“

42、. 26 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Protocols and Schema Specification“. 27 Organization for the Advancement of Structured Information Standards (OASIS), “Authentication Contexts for the OASIS Security Assertion Markup Language (SAML) V2.0“. 28 Organization for the Advancement

43、of Structured Information Standards (OASIS), SAML v2 Core “Conformance Requirements for the OASIS Security Assertion Markup Language (SAML) V2.0“. 29 3GPP TS 23.003: “Numbering, addressing and identification“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present d

44、ocument, the terms and definitions given in TR 21.905 21 and the following apply. Assertion (SAML assertion) is an XML-based data structure defined by SAML v2.0 28. Assertions are collections of one or more statements made by a SAML authority (also known as an issuer), such as an authentication stat

45、ement or attribute statement. As used in Liberty, assertions typically concern things such as: an act of authentication performed by the Principal, attribute information about a Principal, or an authorization permission applying to a Principal with respect to a specified resource. Attribute: A disti

46、nct, named characteristic of a Principal or other system entity. Bootstrapping Server Function (BSF): A BSF is hosted in a network element under the control of an MNO. BSF, HSS, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping

47、 procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes. Defederate (federation termination): To eliminate the linkage between a Principal“s account at an identity provider and a service provider. Discovery Service (DS): An ID-WSF service facilitating

48、 the registration, and subsequent discovery of, ID-WSF service instances, as indexed by Principal identity 10. Federation: A is an act of establishing a relationship between two entities or an association compromising any number of service providers and identity providers. GBA Function: A is a funct

49、ion on the ME executing the bootstrapping procedure with BSF (i.e. supporting the Ub reference point) and providing Ua applications with a security association to run bootstrapping usage procedure. The GBA function is called by a Ua application when the Ua application wants to use the bootstrapped security association. Identity Provider (IdP): A Liberty-enabled system entity that manages identity information on behalf of Principals and provides assertions of Principal authentication to other providers e.g. othe