ETSI TS 133 141-2016 Universal Mobile Telecommunications System (UMTS) LTE Presence service Security (V13 0 0 3GPP TS 33 141 version 13 0 0 Release 13)《通用移动通信系统(UMTS) 长期演进技术(LTE) 在.pdf

1、 ETSI TS 1Universal Mobile TelPr(3GPP TS 33.1TECHNICAL SPECIFICATION133 141 V13.0.0 (2016elecommunications System (LTE; Presence service; Security .141 version 13.0.0 Release 1316-01) (UMTS); 13) ETSI ETSI TS 133 141 V13.0.0 (2016-01)13GPP TS 33.141 version 13.0.0 Release 13Reference RTS/TSGS-033314

2、1vd00 Keywords LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present do

3、cument can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In

4、case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the doc

5、ument may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.ets

6、i.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified wit

7、hout the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its M

8、embers. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 133 141 V13.0.0 (2016-01)23GPP TS 33.141 version 13.0.0 Release 13Intellect

9、ual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (

10、IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has be

11、en carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3

12、rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMT

13、S, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI

14、 Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 141 V13.0.0 (2016-01)33GPP TS 33.141 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal

15、 verbs terminology 2g3Foreword . 5g3Introduction 5g31 Scope 6g32 References 6g33 Definitions and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 7g34 Security architecture . 8g34.1 Overview of the security architecture . 8g34.2 The Ut reference point 8g35 Security features . 9g35.1 Secure

16、Access to the Presence Server over the Ut reference point . 9g35.1.1 Authentication of the subscriber and the presence server . 9g35.1.2 Confidentiality protection . 9g35.1.3 Integrity protection . 9g35.1.4 Authentication Proxy 9g36 Security Mechanisms for the Ut reference point 10g36.1 Authenticati

17、on and key agreement . 10g36.1.1 Authentication of the subscriber . 10g36.1.2 Authentication of the AP/Presence Server 10g36.1.3 Management of public user identities . 10g36.1.4 Authentication failures 10g36.2 Confidentiality protection . 11g36.3 Integrity protection . 11g37 Security parameters agre

18、ement 11g37.1 Set-up of Security parameters 11g37.2 Error cases 11g3Annex A: Void 12g3Annex B (informative): Void 13g3Annex C (normative): Requirements specific to 3GPP2 Access . 14g3C.1 General . 14g3C.2 Authentication of the subscriber . 14g3C.3 Authentication of the Presence Server . 14g3C.4 Mana

19、gement of public user identities 14g3C.5 Authentication failures . 14g3C.6 Set-up of Security parameters 15g3C.7 Error cases 15g3Annex D (normative): GPRS-IMS-Bundled Authentication for Ut interface security 16g3ETSI ETSI TS 133 141 V13.0.0 (2016-01)43GPP TS 33.141 version 13.0.0 Release 13Annex E (

20、informative): Change history . 18g3History 19g3ETSI ETSI TS 133 141 V13.0.0 (2016-01)53GPP TS 33.141 version 13.0.0 Release 13Foreword This Technical Specification has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work w

21、ithin the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TS

22、G for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes

23、have been incorporated in the document. Introduction This technical specification gives an overview of the security architecture and defines the security features and security mechanisms for the presence services. Presence services enable the dissemination of presence information of a user to other

24、users or services. A presence entity or presentity comprises the user, user“s devices, services and service components. It is the intention that this platform will enable new services like e.g. enhancement to chat, multimedia messaging, cinema ticket information, the score of a football game and so

25、on. A user has the possibility to control if her or his information is made available to other users or services. This control is possible to achieve with high granularity e.g. explicitly define which user or users and services have access to presence information. A presentity is a uniquely identifi

26、able entity with the capability to provide the presence information and it has only one principal associated with it. Hence a principal is distinct from all other principals and can be e.g. a human, organisation, program or even a collection thereof. One example of such a relation is when the presen

27、tity is a terminal and the principal of the terminal is the subscriber. However, the presence service is based on Public Identities, and consequently it is possible to have several terminals related to the same presentity. A watcher is also a uniquely identifiable entity but with the aim to fetch or

28、 request information about a presentity. There are access rules that set the rules for how presence information gets available to watchers. Presence information consists of a number of elements or presence tuples as defined in TS 23.141 3 ETSI ETSI TS 133 141 V13.0.0 (2016-01)63GPP TS 33.141 version

29、 13.0.0 Release 131 Scope The present document is the Stage 2 specification for the security requirements, security architecture, security features and security mechanisms for the Presence Service, which includes the elements necessary to realise the requirements in TS 22.141 2 and TS 23.141 3. As f

30、ar as SIP-based procedures are concerned, this specification refers to TS 33.203 4. The main content of this specification is the security for the Ut reference point, which is HTTPbased, as applied in presence services. The present document includes information applicable to network operators, servi

31、ce providers and manufacturers. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For

32、a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the pr

33、esent document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 22.141: “Presence service; Stage 1“. 3 3GPP TS 23.141: “Presence service; Architecture and functional description“. 4 3GPP TS 33.203: “3G Security; Access security for IP-based services“. 5 Void 6 Void 7 3GPP TS 23.002

34、: “Network architecture“. 8 Void 9 Void 10 3GPP TS 33.210: “3G Security; Network Domain Security; IP network layer security“. 11 3GPP TS 33.220: “Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture“. 12 Void 13 Void. 14 Void 15 3GPP TR 33.919: “Generic Authentication Archit

35、ecture (GAA); System description“. 16 Void 17 Void 18 Void 19 3GPP TS 33.222: “ Generic Authentication Architecture (GAA); Access to network application functions using secure hypertext transfer protocol (HTTPS)“. ETSI ETSI TS 133 141 V13.0.0 (2016-01)73GPP TS 33.141 version 13.0.0 Release 1320 Void

36、. 21 3GPP2 S.S0109-A v1.0: “Generic bootstrapping architecture“ 22 3GPP2 S.S0114-A v1.0: “Security mechanisms using GBA“ 23 3GPP TS 29.329: “Sh interface based on the Diameter protocol; Protocol details“ 24 3GPP TS 24.109: “Bootstrapping interface (Ub) and network application function interface (Ua)

37、; Protocol details 25 3GPP TS 23.003: “Numbering, addressing and identification“. 26 3GPP TS 29.328: “IP Multimedia (IM) Subsystem Sh interface; Signalling flows and message contents“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and d

38、efinitions apply. Confidentiality: The property that information is not made available or disclosed to unauthorised individuals, entities or processes. Data integrity: The property that data has not been altered in an unauthorised manner. Data origin authentication: The corroboration that the source

39、 of data received is as claimed. Entity authentication: The provision of assurance of the claimed identity of an entity. 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply, TR 21.905 1 contains additional applicable abbreviations: AKA Authentication and key

40、 agreement AP Authentication Proxy APN Access Point Name AS Application ServerBSF Bootstrapping Server Function CSCF Call Session Control Function ESP Encapsulating Security Payload GBA Generic Bootstrapping ArchitectureGGSN Gateway GPRS Support Node GIBA GPRS-IMS-Bundled Authentication HTTP HyperTe

41、xt Transfer Protocol HTTPS HTTP over TLS IM IP MultimediaIMPI IM Private Identity IMPU IM Public Identity IMS IP Multimedia Core Network Subsystem IP Internet Protocol IPsec IP SecurityISIM IM Services Identity Module NAF Network Application Function NDS/IP Network Domain Security for IP based Proto

42、cols P-CSCF Proxy Call Session Control Function PDP Packet Data Protocol SEG Security GatewayETSI ETSI TS 133 141 V13.0.0 (2016-01)83GPP TS 33.141 version 13.0.0 Release 13SIP Session Initiation Protocol TLS Transport Layer Security 4 Security architecture 4.1 Overview of the security architecture A

43、n IMS operator using the CSCFs as Watcher Presence proxies and Presentity Presence proxies may offer the Presence services on top of the IMS network, see TS 22.141 2. The access security for IMS is specified in TS 33.203 4 ensuring that SIP signalling is integrity protected and that IMS subscribers

44、are authenticated through the use of IMS AKA. The security termination point from the UE towards the network is in the P-CSCF utilising IPsec ESP. A watcher may send a SIP SUBSCRIBE over IMS towards the network, to subscribe or to fetch presence information, i.e., the Presence Service supports SIP-b

45、ased communications for publishing presence information. The presence information is provided by the Presence Server to the Watcher Application using SIP NOTIFY along the dialogue setup by SUBSCRIBE. This traffic is protected in a hop-by-hop fashion as specified in TS 33.210 10 with the access secur

46、ity provided in TS 33.203 4. The Presence Server is responsible for managing presence information on behalf of the presence entity and it resides in the presentitys home network. Furthermore, the Presence Server provides a subscription authorization policy that is used to determine which watchers ar

47、e allowed to subscribe to certain presence information. Prior to accepting the subscription requests from watchers, the presence server attempts to verify the identities of the watchers. Optionally, depending on the implementation, the Presence Server may authenticate an anonymous watcher depending

48、on the Subscription Authorization Policy. A Presence List Server is responsible of storing grouped lists of watched presentities and enables a Watcher Application to subscribe to the presence of multiple presentities using a single SIP SUBSCRIBE transaction. The Presence List Server also stores and

49、enables management of filters in the presence list, see figure 1. Watcher applicationPx = CxP-CSCF S-CSCFI-CSCFS-CSCFPresence ServerPresentity Presence ProxyHSSPw = ISCPw =MwWatcher Presence ProxyPw = GmApplication Server(Presence List)ISCWatcher applicationPw = ISCFigure 1: The Location of the Presence Server and the Presence List Server from an IMS point of view 4.2 The Ut reference point A Presence User Agent shall be able to manage the data on the Presence Server and the Presence List Server ove