ETSI TR 133 980-2018 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) LTE Liberty Alliance and 3GPP security interworki.pdf

1、 ETSI TR 133 980 V15.0.0 (2018-07) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Liberty Alliance and 3GPP security interworking; Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Services Frame

2、work (ID-WSF) and Generic Authentication Architecture (GAA) (3GPP TR 33.980 version 15.0.0 Release 15) TECHNICAL REPORT ETSI ETSI TR 133 980 V15.0.0 (2018-07)13GPP TR 33.980 version 15.0.0 Release 15Reference RTR/TSGS-0333980vf00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sop

3、hia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The p

4、resent document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such ve

5、rsions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the

6、 current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification

7、No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the

8、foregoing restriction extend to reproduction in all media. ETSI 2018. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETSI registered for the benefit of its Members and of the 3GPP O

9、rganizational Partners. oneM2M logo is protected for the benefit of its Members. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TR 133 980 V15.0.0 (2018-07)23GPP TR 33.980 version 15.0.0 Release 15Intellectual Property Rights Essential patents IPRs essentia

10、l or potentially essential to normative deliverables may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentiall

11、y Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guar

12、antee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks and/or tradenames which are asserted and/or re

13、gistered by their owners. ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does not constitute an endorsement by ETSI of pro

14、ducts, services or organizations associated with those trademarks. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identi

15、ties. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “should“, “should not“, “may“, “ne

16、ed not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TR 133 980 V15.0.0 (2

17、018-07)33GPP TR 33.980 version 15.0.0 Release 15Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 5g3Introduction 5g31 Scope 6g32 References 6g33 Definitions, symbols and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 8g34 Interworking of Liberty

18、 Alliance ID-FF/ ID-WSF and Generic Authentication Architecture . 9g34.1 Introduction 9g34.2 Architectural Description Use of GBA within ID-FF / ID-WSF . 9g34.2.1 Architecture for collocation of NAF with Liberty Alliance Authentication Function 12g34.2.1.1 Collocation of IdP/NAF in Liberty Alliance

19、ID-FF (alternatively SAML v2.0) . 12g34.2.1.2 Collocation of AS/NAF in Liberty Alliance ID-WSF . 13g34.2.2 Architecture for collocation of BSF with Liberty Alliance authentication function . 15g34.2.2a Logical data model of the Liberty Alliance Authentication Function (IdP/AS) . 16g34.2.3 User Regis

20、tration to Interworking Service 16g34.2.3.1 Registration with Operator 17g34.2.3.2 Registration with IdP. 17g34.2.4 Provisioning of User Data for Interworking Service 17g34.2.4.1 Service based on standard user data 17g34.2.4.2 Service based on pre-provisioned interworking data 18g34.2.4.3 Service ba

21、sed on explicitly added interworking data 18g34.3 Co-hosting of NAF and IdP 18g34.3.1 Federation Concept in GBA 18g34.3.2 Session Concept at IdP . 19g34.3.2a Single-Logout Concept . 20g34.3.3 SSO scenario: ID-FF with transfer 20g34.3.3.1 HTTPS with conventional TLS . 20g34.3.3.2 HTTPS with PSK TLS 2

22、2g34.3.4 SSO scenario: ID-FF with artefact transfer . 23g34.3.5 SSO scenario: ID-WSF Authentication Service . 25g34.3.6 SSO scenario: SAML v2.0 with transfer . 27g34.3.6.1 HTTPS with TLS 27g34.3.6.2 HTTPS with PSK TLS 28g34.3.7 SSO scenario: SAML v2.0 with artefact transfer (resolution) 29g34.3a Co-

23、hosting of BSF and IdP 30g34.3a.1 General 30g34.3a.2 UE behaviour 31g34.3a.3 IdP/BSF behaviour 31g34.3a.4 Federation Concept in GBA with IdP/BSF collocation 31g34.3a.5 Session Concept at the IdP 32g34.3a.6 SSO scenario: ID-FF with transfer 32g34.4 Use of GUSS / USS in Support of ID-FF and ID-WSF . 3

24、4g34.4.1 GAA-LAP Interworking Service 35g34.4.2 GAA-LAP Interworking USS . 35g34.4.2a GUSS / USS when IdP/AS is collocated with BSF 35g34.5 Liberty Alliance Authentication Context and GBA . 35g3Annex A: Digest Authentication within SASL for Ua protocol between UE and AS/NAF . 36g3A.1 HTTPS deploymen

25、t 36g3ETSI ETSI TR 133 980 V15.0.0 (2018-07)43GPP TR 33.980 version 15.0.0 Release 15A.2 Digest challenge . 36g3A.3 Digest response 37g3A.4 Response auth . 37g3A.5 Subsequent authentication 37g3Annex Z: Change history 38g3History 40g3ETSI ETSI TR 133 980 V15.0.0 (2018-07)53GPP TR 33.980 version 15.0

26、.0 Release 15Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document,

27、it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y

28、 the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction 3GPP defined the Generic Authentication Architecture (GAA) independ

29、ent of the Liberty Alliance Identity Federation and Web Service Framework. Both systems were designed to be deployed independently of each other. The Liberty Alliance Identity Federation and Web Service Framework offers simplified sign-on and session management for complex web service business inter

30、action protocols. The GAA offers a mechanism to provide a shared secret and certificates to two communicating entities for mobile applications, based on GSM and UMTS authentication and key agreement protocols. ETSI ETSI TR 133 980 V15.0.0 (2018-07)63GPP TR 33.980 version 15.0.0 Release 151 Scope The

31、 present document provides guidelines on the interworking of the Generic Authentication Architecture (GAA) and the Liberty Alliance architecture. The document studies the details of possible interworking methods between the Security Assertion Markup Language v2.0, SAML v2.0 (or alternatively the Lib

32、erty Alliance Identity Federation Framework, ID-FF), the Identity Web Services Framework (ID-WSF) , the Security Assertion Markup Language (SAML) and a component of GAA called the Generic Bootstrapping Architecture (GBA). This document only applies if Liberty Alliance and GBA or SAML v2.0 and GBA ar

33、e used in combination. 2 References The following documents contain provisions, which, through reference in this text, constitute provisions of the present document. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a sp

34、ecific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the pres

35、ent document. 1 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic bootstrapping architecture“. 2 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“. 3 3GPP TS 3

36、3.221: “Generic Authentication Architecture (GAA); Support for subscriber certificates“. 4 3GPP TS 24.109: “Bootstrapping interface (Ub) and network application function interface (Ua); Protocol details“. 5 3GPP TS 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the

37、 Diameter protocol; Stage 3“. 6 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF Security Mechanisms“. 7 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Architecture Overview“. 8 Liberty Alliance Project, ID-WSF v2.0 “Liberty ID-WSF Authentication Service Specification and Single Sign-On

38、Service“. 9 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF SOAP Binding Specification“. 10 Liberty Alliance Project, ID-WSF v2.0: “Liberty ID-WSF Discovery Service Specification“. 11 Organization for the Advancement of Structured Information Standards (OASIS), SAML v2 Core “Assertions and Pr

39、otocols for the OASIS Security Assertion Markup Language (SAML) V2.0“. 12 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Bindings and Profiles Specification“. 13 Organization for the Advancement of Structured Information Standards (OASIS), “Profiles for the OASIS Security Assertion Markup Lang

40、uage (SAML) v2.0“. 14 Liberty Alliance Project, ID-WSF v1.2: “Security Mechanisms“. 15 Liberty Alliance Project Support Documents: “Authentication Context Specification“ v2.0. 16 Liberty Alliance Project, ID-WSF “Profiles for Liberty enabled User Agents and Devices“ v2.0. 17 IETF RFC 2222 (1997), “S

41、imple Authentication and Security Layer (SASL)“. ETSI ETSI TR 133 980 V15.0.0 (2018-07)73GPP TR 33.980 version 15.0.0 Release 1518 IETF RFC 2831 (2000), “Using Digest Authentication as a SASL Mechanism“. 19 IETF RFC 2617 (1999), “HTTP Authentication: Basic and Digest Access Authentication“. 20 Liber

42、ty Alliance Project Support Documents: “Liberty Reverse HTTP Binding for SOAP Specification“ v1.1. 21 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 22 IETF RFC 3546 (2003-06), “Transport Layer Security (TLS) Extensions“. 23 Liberty Alliance Project, ID-SIS: “Liberty Alliance ID-SIS 1.0 Speci

43、fications“. 24 IETF RFC 2246 (1999-01), “The TLS Protocol Version 1.0“. 25 IETF RFC 4279 (2005-12), “Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)“. 26 Liberty Alliance Project, ID-FF v1.2: “Liberty ID-FF Protocols and Schema Specification“. 27 Organization for the Advancement of St

44、ructured Information Standards (OASIS), “Authentication Contexts for the OASIS Security Assertion Markup Language (SAML) V2.0“. 28 Organization for the Advancement of Structured Information Standards (OASIS), SAML v2 Core “Conformance Requirements for the OASIS Security Assertion Markup Language (SA

45、ML) V2.0“. 29 3GPP TS 23.003: “Numbering, addressing and identification“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 21 and the following apply. Assertion (SAML assertion) is an XML-based data struct

46、ure defined by SAML v2.0 28. Assertions are collections of one or more statements made by a SAML authority (also known as an issuer), such as an authentication statement or attribute statement. As used in Liberty, assertions typically concern things such as: an act of authentication performed by the

47、 Principal, attribute information about a Principal, or an authorization permission applying to a Principal with respect to a specified resource. Attribute: A distinct, named characteristic of a Principal or other system entity. Bootstrapping Server Function (BSF): A BSF is hosted in a network eleme

48、nt under the control of an MNO. BSF, HSS, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes. Defederate (federation termina

49、tion): To eliminate the linkage between a Principals account at an identity provider and a service provider. Discovery Service (DS): An ID-WSF service facilitating the registration, and subsequent discovery of, ID-WSF service instances, as indexed by Principal identity 10. Federation: A is an act of establishing a relationship between two entities or an association compromising any number of service providers and identity providers. GBA Function: A is a function on the ME executing the bootstrapping procedure w