ETSI TR 133 980-2017 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) LTE Liberty Alliance and 3GPP security interworki.pdf

1、 ETSI TR 133 980 V14.0.0 (2017-04) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Liberty Alliance and 3GPP security interworking; Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Services Frame

2、work (ID-WSF) and Generic Authentication Architecture (GAA) (3GPP TR 33.980 version 14.0.0 Release 14) TECHNICAL REPORT ETSI ETSI TR 133 980 V14.0.0 (2017-04)13GPP TR 33.980 version 14.0.0 Release 14Reference RTR/TSGS-0333980ve00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sop

3、hia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The p

4、resent document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such ve

5、rsions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the

6、 current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification

7、No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the

8、foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for

9、the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TR 133 980 V14.0.0 (2017-04)23GPP TR 33.980 version 14.0.0 Release 14Intellectual Pr

10、operty Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs);

11、 Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been car

12、ried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generation

13、 Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and E

14、TSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for t

15、he expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TR 133 980 V14.0.0 (2017-04)33GPP TR 33.980 version 14.0.0 Release 14Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 5g

16、3Introduction 5g31 Scope 6g32 References 6g33 Definitions, symbols and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 8g34 Interworking of Liberty Alliance ID-FF/ ID-WSF and Generic Authentication Architecture . 9g34.1 Introduction 9g34.2 Architectural Description Use of GBA within ID-FF

17、/ ID-WSF . 9g34.2.1 Architecture for collocation of NAF with Liberty Alliance Authentication Function 12g34.2.1.1 Collocation of IdP/NAF in Liberty Alliance ID-FF (alternatively SAML v2.0) . 12g34.2.1.2 Collocation of AS/NAF in Liberty Alliance ID-WSF . 13g34.2.2 Architecture for collocation of BSF

18、with Liberty Alliance authentication function . 15g34.2.2a Logical data model of the Liberty Alliance Authentication Function (IdP/AS) . 16g34.2.3 User Registration to Interworking Service 16g34.2.3.1 Registration with Operator 17g34.2.3.2 Registration with IdP. 17g34.2.4 Provisioning of User Data f

19、or Interworking Service 17g34.2.4.1 Service based on standard user data 18g34.2.4.2 Service based on pre-provisioned interworking data 18g34.2.4.3 Service based on explicitly added interworking data 18g34.3 Co-hosting of NAF and IdP 18g34.3.1 Federation Concept in GBA 19g34.3.2 Session Concept at Id

20、P . 19g34.3.2a Single-Logout Concept . 20g34.3.3 SSO scenario: ID-FF with transfer 20g34.3.3.1 HTTPS with conventional TLS . 20g34.3.3.2 HTTPS with PSK TLS 22g34.3.4 SSO scenario: ID-FF with artefact transfer . 23g34.3.5 SSO scenario: ID-WSF Authentication Service . 25g34.3.6 SSO scenario: SAML v2.0

21、 with transfer . 27g34.3.6.1 HTTPS with TLS 27g34.3.6.2 HTTPS with PSK TLS 28g34.3.7 SSO scenario: SAML v2.0 with artefact transfer (resolution) 29g34.3a Co-hosting of BSF and IdP 30g34.3a.1 General . 30g34.3a.2 UE behaviour 31g34.3a.3 IdP/BSF behaviour 31g34.3a.4 Federation Concept in GBA with IdP/

22、BSF collocation 31g34.3a.5 Session Concept at the IdP 32g34.3a.6 SSO scenario: ID-FF with transfer 32g34.4 Use of GUSS / USS in Support of ID-FF and ID-WSF . 34g34.4.1 GAA-LAP Interworking Service 35g34.4.2 GAA-LAP Interworking USS . 35g34.4.2a GUSS / USS when IdP/AS is collocated with BSF 35g34.5 L

23、iberty Alliance Authentication Context and GBA . 35g3Annex A: Digest Authentication within SASL for Ua protocol between UE and AS/NAF . 37g3A.1 HTTPS deployment 37g3ETSI ETSI TR 133 980 V14.0.0 (2017-04)43GPP TR 33.980 version 14.0.0 Release 14A.2 Digest challenge . 37g3A.3 Digest response 38g3A.4 R

24、esponse auth . 38g3A.5 Subsequent authentication 38g3Annex Z: Change history 39g3History 41g3ETSI ETSI TR 133 980 V14.0.0 (2017-04)53GPP TR 33.980 version 14.0.0 Release 14Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present do

25、cument are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z wher

26、e: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is i

27、ncremented when editorial only changes have been incorporated in the document. Introduction 3GPP defined the Generic Authentication Architecture (GAA) independent of the Liberty Alliance Identity Federation and Web Service Framework. Both systems were designed to be deployed independently of each ot

28、her. The Liberty Alliance Identity Federation and Web Service Framework offers simplified sign-on and session management for complex web service business interaction protocols. The GAA offers a mechanism to provide a shared secret and certificates to two communicating entities for mobile application

29、s, based on GSM and UMTS authentication and key agreement protocols. ETSI ETSI TR 133 980 V14.0.0 (2017-04)63GPP TR 33.980 version 14.0.0 Release 141 Scope The present document provides guidelines on the interworking of the Generic Authentication Architecture (GAA) and the Liberty Alliance architect

30、ure. The document studies the details of possible interworking methods between the Security Assertion Markup Language v2.0, SAML v2.0 (or alternatively the Liberty Alliance Identity Federation Framework, ID-FF), the Identity Web Services Framework (ID-WSF) , the Security Assertion Markup Language (S

31、AML) and a component of GAA called the Generic Bootstrapping Architecture (GBA). This document only applies if Liberty Alliance and GBA or SAML v2.0 and GBA are used in combination. 2 References The following documents contain provisions, which, through reference in this text, constitute provisions

32、of the present document. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference t

33、o a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic bootstrapping architecture“. 2 3GPP TS 33.222: “Generic A

34、uthentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“. 3 3GPP TS 33.221: “Generic Authentication Architecture (GAA); Support for subscriber certificates“. 4 3GPP TS 24.109: “Bootstrapping interface (Ub) and

35、network application function interface (Ua); Protocol details“. 5 3GPP TS 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter protocol; Stage 3“. 6 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF Security Mechanisms“. 7 Liberty Alliance Project, ID-F

36、F v1.2: “Liberty ID-FF Architecture Overview“. 8 Liberty Alliance Project, ID-WSF v2.0 “Liberty ID-WSF Authentication Service Specification and Single Sign-On Service“. 9 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF SOAP Binding Specification“. 10 Liberty Alliance Project, ID-WSF v2.0: “Li

37、berty ID-WSF Discovery Service Specification“. 11 Organization for the Advancement of Structured Information Standards (OASIS), SAML v2 Core “Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0“. 12 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Bindings and P

38、rofiles Specification“. 13 Organization for the Advancement of Structured Information Standards (OASIS), “Profiles for the OASIS Security Assertion Markup Language (SAML) v2.0“. 14 Liberty Alliance Project, ID-WSF v1.2: “Security Mechanisms“. 15 Liberty Alliance Project Support Documents: “Authentic

39、ation Context Specification“ v2.0. 16 Liberty Alliance Project, ID-WSF “Profiles for Liberty enabled User Agents and Devices“ v2.0. ETSI ETSI TR 133 980 V14.0.0 (2017-04)73GPP TR 33.980 version 14.0.0 Release 1417 IETF RFC 2222 (1997), “Simple Authentication and Security Layer (SASL)“. 18 IETF RFC 2

40、831 (2000), “Using Digest Authentication as a SASL Mechanism“. 19 IETF RFC 2617 (1999), “HTTP Authentication: Basic and Digest Access Authentication“. 20 Liberty Alliance Project Support Documents: “Liberty Reverse HTTP Binding for SOAP Specification“ v1.1. 21 3GPP TR 21.905: “Vocabulary for 3GPP Sp

41、ecifications“. 22 IETF RFC 3546 (2003-06), “Transport Layer Security (TLS) Extensions“. 23 Liberty Alliance Project, ID-SIS: “Liberty Alliance ID-SIS 1.0 Specifications“. 24 IETF RFC 2246 (1999-01), “The TLS Protocol Version 1.0“. 25 IETF RFC 4279 (2005-12), “Pre-Shared Key Ciphersuites for Transpor

42、t Layer Security (TLS)“. 26 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Protocols and Schema Specification“. 27 Organization for the Advancement of Structured Information Standards (OASIS), “Authentication Contexts for the OASIS Security Assertion Markup Language (SAML) V2.0“. 28 Organizati

43、on for the Advancement of Structured Information Standards (OASIS), SAML v2 Core “Conformance Requirements for the OASIS Security Assertion Markup Language (SAML) V2.0“. 29 3GPP TS 23.003: “Numbering, addressing and identification“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the pu

44、rposes of the present document, the terms and definitions given in TR 21.905 21 and the following apply. Assertion (SAML assertion) is an XML-based data structure defined by SAML v2.0 28. Assertions are collections of one or more statements made by a SAML authority (also known as an issuer), such as

45、 an authentication statement or attribute statement. As used in Liberty, assertions typically concern things such as: an act of authentication performed by the Principal, attribute information about a Principal, or an authorization permission applying to a Principal with respect to a specified resou

46、rce. Attribute: A distinct, named characteristic of a Principal or other system entity. Bootstrapping Server Function (BSF): A BSF is hosted in a network element under the control of an MNO. BSF, HSS, and UEs participate in GBA in which a shared secret is established between the network and a UE by

47、running a bootstrapping procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes. Defederate (federation termination): To eliminate the linkage between a Principals account at an identity provider and a service provider. Discovery Service (DS): An ID-WS

48、F service facilitating the registration, and subsequent discovery of, ID-WSF service instances, as indexed by Principal identity 10. Federation: A is an act of establishing a relationship between two entities or an association compromising any number of service providers and identity providers. GBA

49、Function: A is a function on the ME executing the bootstrapping procedure with BSF (i.e. supporting the Ub reference point) and providing Ua applications with a security association to run bootstrapping usage procedure. The GBA function is called by a Ua application when the Ua application wants to use the bootstrapped security association. Identity Provider (IdP): A Liberty-enabled system entity that manages identity information on behalf of Principals and provides assertions of Principal authentication to ot