ETSI TS 124 482-2018 LTE Mission Critical Services (MCS) identity management Protocol specification (V15 0 0 3GPP TS 24 482 version 15 0 0 Release 15).pdf

1、 ETSI TS 124 482 V15.0.0 (2018-06) LTE; Mission Critical Services (MCS) identity management; Protocol specification (3GPP TS 24.482 version 15.0.0 Release 15) TECHNICAL SPECIFICATION ETSI ETSI TS 124 482 V15.0.0 (2018-06)13GPP TS 24.482 version 15.0.0 Release 15Reference RTS/TSGC-0124482vf00 Keyword

2、s LTE ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded fr

3、om: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or per

4、ceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to rev

5、ision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/Comm

6、iteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written

7、authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETSI registered for

8、 the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 124 482 V15.0.0 (2018-06)23GPP TS 24.482 version 15.0.0 Release 15Intellectual Pr

9、operty Rights Essential patents IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Pro

10、perty Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR se

11、arches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks a

12、nd/or tradenames which are asserted and/or registered by their owners. ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

13、 not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using

14、their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the

15、 present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliver

16、ables except when used in direct citation. ETSI ETSI TS 124 482 V15.0.0 (2018-06)33GPP TS 24.482 version 15.0.0 Release 15Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 6g33.1 Definitions 6g

17、33.2 Abbreviations . 6g34 General . 7g34.1 Identity management 7g35 Entities 8g35.1 Identity management client 8g35.2 Identity management server . 8g35.3 MC service client 8g35.4 HTTP proxy 8g36 Authentication procedures 8g36.1 General . 8g36.2 Identity management client procedures 8g36.2.1 User aut

18、hentication . 8g36.2.2 Token exchange procedure . 10g36.2.3 Token request to a partner system IdM server 10g36.3 Identity management server procedures . 11g36.3.1 User authentication . 11g36.3.2 Token exchange procedure . 12g36.3.3 Token request from an IdM client to a partner system . 12g37 Inter/i

19、ntra domain interface security 12g3Annex A (normative): HTTP entities . 13g3A.1 Scope 13g3A.2 Procedures 13g3A.2.1 HTTP client 13g3A.2.1.1 General 13g3A.2.1.2 HTTP client in UE 13g3A.2.1.3 HTTP client in network entity 14g3A.2.2 HTTP proxy 14g3A.2.2.1 General 14g3A.2.2.2 HTTP request method from HTT

20、P client in UE . 14g3A.2.2.3 HTTP request method from HTTP client in network entity within trust domain . 15g3A.2.3 HTTP server . 15g3Annex B (informative): Change history . 16g3History 17g3ETSI ETSI TS 124 482 V15.0.0 (2018-06)43GPP TS 24.482 version 15.0.0 Release 15Foreword This Technical Specifi

21、cation has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG wit

22、h an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for

23、all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. ETSI ETSI TS 124 482 V15.0.0 (2018-06)53GPP TS 24.482 version 15.0.0 Release 151 Scope This document specifies the id

24、entity management and authentication protocols needed to support Mission Critical Services (MCSs). Identity management applies only to on-network operation. MCSs are services that require preferential handling compared to normal telecommunication services, e.g. in support of police or fire brigade.

25、MCSs can be used for public safety applications and also for general commercial applications (e.g., utility companies and railways). This document is applicable to User Equipment (UE) supporting the identity management client functionality, and to application servers supporting the identity manageme

26、nt server functionality. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a s

27、pecific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the pre

28、sent document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 Void. 3 3GPP TS 22.179: “Mission Critical Push To Talk (MCPTT) over LTE“. 4 IETF RFC 2616: “Hypertext Transfer Protocol - HTTP/1.1“. 5 IETF RFC 6749: “The OAuth 2.0 Authorization Framework“. 6 “OpenID Connect Core 1.0 incorpora

29、ting errata set 1“. 7 W3C.REC-html401-19991224: “HTML 4.01 Specification“. 8 3GPP TS 23.379: “Functional architecture and information flows to support mission critical communication services“. 9 Void. 10 IETF RFC 2818: “HTTP Over TLS“. 11 3GPP TS 24.483: “Mission Critical Services (MCS) Management O

30、bject (MO)“. 12 3GPP TS 24.379: “Mission Critical Push To Talk (MCPTT) call control Protocol specification“. 13 3GPP TS 23.228: “IP Multimedia Subsystem (IMS); Stage 2“. 14 IETF RFC 6750: “The OAuth 2.0 Authorization Framework: Bearer Token Usage“. 15 3GPP TS 24.109: “Bootstrapping interface (Ub) an

31、d network application function interface (Ua); Protocol details“. 16 3GPP TS 23.280: “Common functional architecture to support mission critical services; Stage 2“. 17 3GPP TS 33.180: “Security of the Mission Critical Service“. 18 draft-ietf-oauth-token-exchange-11: “OAuth 2.0 Token Exchange“. ETSI

32、ETSI TS 124 482 V15.0.0 (2018-06)63GPP TS 24.482 version 15.0.0 Release 15Editors Note: The above document cannot be formally referenced until it is published as an RFC. 19 IETF RFC 7523: “JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants“. 20 IETF RFC 7159: “

33、The JavaScript Object Notation (JSON) Data Interchange Format“. 21 3GPP TS 24.281: “Mission Critical Video (MCVideo) signalling control; Protocol specification“. 22 3GPP TS 23.282: “Mission Critical Data (MCData) signalling control; Protocol specification“. 3 Definitions and abbreviations 3.1 Defini

34、tions For the purposes of the present document, the terms and definitions given in 3GPP TR 21.905 1 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in 3GPP TR 21.905 1. IdM client id: The client_id as specified in 3GPP TS

35、 33.179 2 which is used to identify the IdM client to the IdM server. Authorisation endpoint: An identity management server protocol endpoint used by the identity management client to obtain an authorisation grant, as specified in IETF RFC 6749 5. Token endpoint: An identity management server protoc

36、ol endpoint used by the identity management client to exchange an authorisation grant for an access token, as specified in IETF RFC 6749 5. MC UE: A UE that is used to host one or more MC service clients. For the purposes of the present document, the following terms and definitions given in 3GPP TS

37、22.179 3 apply: MCPTT UE For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.379 8 apply: MCPTT group ID MCPTT ID For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.228 13 apply: Public service identity For

38、the purposes of the present document, the following terms and definitions given in 3GPP TS 23.280 16 apply: MC service MC service client MC service group MC service ID MC service user MC user 3.2 Abbreviations For the purposes of the present document, the abbreviations given in 3GPP TR 21.905 1 and

39、the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in 3GPP TR 21.905 1. HTTP Hypertext Transfer Protocol IdM Identity Management LTE Long Term Evolution MCData Mission Critical Data MC ID Mission Critical User I

40、dentity MCPTT Mission Critical Push To Talk ETSI ETSI TS 124 482 V15.0.0 (2018-06)73GPP TS 24.482 version 15.0.0 Release 15MCVideo Mission Critical Video OIDC OpenID Connect TLS Transport Layer Security UE User Equipment 4 General 4.1 Identity management The Identity Management functional model for

41、MC services is shown in figure 4.1-1 below and consists of the identity management server located in the common services core and the identity management client located in the MC UE. The IdM server and the IdM client in the MC UE establish the foundation for MC services user authentication and user

42、authorisation. Figure 4.1-1: Functional model for MC services identity management The CSC-1 reference point, between the IdM client in the UE and the Identity Management server, provides the interface for user authentication. CSC-1 supports OpenID Connect Core 1.0 6 and IETF RFC 6749 5. The OpenID C

43、onnect profile for MC services is implemented as described in 3GPP TS 33.180 17. The MC services user authentication, the MC services user authorisation, the OpenID Connect Core 1.0 6 and the OpenID Connect profile described in 3GPP TS 33.180 17 for MC services forms the basis of the MC services ide

44、ntity management architecture. Subclause 6.2.1 and subclause 6.3.1 describes the procedures for the MC services user authentication. OIDC is flexible with respect to the user authentication mechanism used. As 3GPP TS 33.180 17 has indicated that username and password authentication is mandatory to s

45、upport, that mechanism is included in subclause 6.2.1 and subclause 6.3.1, although other mechanisms are possible. When the MC services user is authenticated, the procedure will provide an id token, an access token and a refresh token, which are all described in 3GPP TS 33.180 17. The access token i

46、s scoped to the services the MC services user is authorised for, e.g., group management services, key management services and MC services. The access token will be utilized for MCPTT service authorisation, MCData service authorisation and MCVideo service authorisation as documented in 3GPP TS 24.379

47、 12, 3GPP TS 24.282 22 and 3GPP TS 24.281 21 respectively. After an MC service user has obtained an access token from their home IdM server, they can acquire a security token from their home IdM server by means of the procedures of subclause 6.2.2, subclause 6.3.2. The security token can be used to

48、acquire an access token from the IdM server of a partner system to allow access to resources in the partner systems domain by means of the procedures of subclause 6.2.3 and subclause 6.3.3. ETSI ETSI TS 124 482 V15.0.0 (2018-06)83GPP TS 24.482 version 15.0.0 Release 155 Entities 5.1 Identity managem

49、ent client The identity management client acts as the application user agent for MC ID transactions. It interacts with the identity management server. The identity management client: - shall support identity management registration to the identity management server; - shall support the MC services user authentication framework as specified in 3GPP TS 33.180 17; - shall support a username and password method of authentication as specified in 3GPP TS 33.180 17; and - may support addition