ETSI TS 133 141-2018 Universal Mobile Telecommunications System (UMTS) LTE Presence service Security (V15 0 0 3GPP TS 33 141 version 15 0 0 Release 15).pdf

1、 ETSI TS 133 141 V15.0.0 (2018-07) Universal Mobile Telecommunications System (UMTS); LTE; Presence service; Security (3GPP TS 33.141 version 15.0.0 Release 15) TECHNICAL SPECIFICATION ETSI ETSI TS 133 141 V15.0.0 (2018-07)13GPP TS 33.141 version 15.0.0 Release 15Reference RTS/TSGS-0333141vf00 Keywo

2、rds LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can

3、be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

4、 existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may b

5、e subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi

6、.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified with

7、out the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETS

8、I registered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 133 141 V15.0.0 (2018-07)23GPP TS 33.141 version 15.0.0 Release 1

9、5Intellectual Property Rights Essential patents IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “

10、Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation,

11、including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may incl

12、ude trademarks and/or tradenames which are asserted and/or registered by their owners. ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the prese

13、nt document does not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications o

14、r reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs te

15、rminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed

16、 in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 141 V15.0.0 (2018-07)33GPP TS 33.141 version 15.0.0 Release 15Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions and abbre

17、viations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 Security architecture . 7g34.1 Overview of the security architecture . 7g34.2 The Ut reference point 7g35 Security features . 8g35.1 Secure Access to the Presence Server over the Ut reference point . 8g35.1.1 Authentication of the subscriber

18、and the presence server . 8g35.1.2 Confidentiality protection . 8g35.1.3 Integrity protection . 8g35.1.4 Authentication Proxy 8g36 Security Mechanisms for the Ut reference point 9g36.1 Authentication and key agreement . 9g36.1.1 Authentication of the subscriber . 9g36.1.2 Authentication of the AP/Pr

19、esence Server 9g36.1.3 Management of public user identities . 9g36.1.4 Authentication failures 9g36.2 Confidentiality protection . 9g36.3 Integrity protection . 10g37 Security parameters agreement 10g37.1 Set-up of Security parameters 10g37.2 Error cases 10g3Annex A: Void 11g3Annex B (informative):

20、Void . 12g3Annex C (normative): Requirements specific to 3GPP2 Access 13g3C.1 General . 13g3C.2 Authentication of the subscriber . 13g3C.3 Authentication of the Presence Server . 13g3C.4 Management of public user identities 13g3C.5 Authentication failures . 13g3C.6 Set-up of Security parameters 13g3

21、C.7 Error cases 14g3Annex D (normative): GPRS-IMS-Bundled Authentication for Ut interface security 15g3Annex E (informative): Change history . 17g3History 18 ETSI ETSI TS 133 141 V15.0.0 (2018-07)43GPP TS 33.141 version 15.0.0 Release 15Foreword This Technical Specification has been produced by the

22、3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of relea

23、se date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. t

24、echnical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction This technical specification gives an overview of the security architecture and defines the security features and security mechanisms fo

25、r the presence services. Presence services enable the dissemination of presence information of a user to other users or services. A presence entity or presentity comprises the user, users devices, services and service components. It is the intention that this platform will enable new services like e

26、.g. enhancement to chat, multimedia messaging, cinema ticket information, the score of a football game and so on. A user has the possibility to control if her or his information is made available to other users or services. This control is possible to achieve with high granularity e.g. explicitly de

27、fine which user or users and services have access to presence information. A presentity is a uniquely identifiable entity with the capability to provide the presence information and it has only one principal associated with it. Hence a principal is distinct from all other principals and can be e.g.

28、a human, organisation, program or even a collection thereof. One example of such a relation is when the presentity is a terminal and the principal of the terminal is the subscriber. However, the presence service is based on Public Identities, and consequently it is possible to have several terminals

29、 related to the same presentity. A watcher is also a uniquely identifiable entity but with the aim to fetch or request information about a presentity. There are access rules that set the rules for how presence information gets available to watchers. Presence information consists of a number of eleme

30、nts or presence tuples as defined in TS 23.141 3 ETSI ETSI TS 133 141 V15.0.0 (2018-07)53GPP TS 33.141 version 15.0.0 Release 151 Scope The present document is the Stage 2 specification for the security requirements, security architecture, security features and security mechanisms for the Presence S

31、ervice, which includes the elements necessary to realise the requirements in TS 22.141 2 and TS 23.141 3. As far as SIP-based procedures are concerned, this specification refers to TS 33.203 4. The main content of this specification is the security for the Ut reference point, which is HTTPbased, as

32、applied in presence services. The present document includes information applicable to network operators, service providers and manufacturers. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. - References are

33、 either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM docume

34、nt), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 22.141: “Presence service; Stage 1“. 3 3GPP TS 23.141: “Presence service; Architecture and functional

35、description“. 4 3GPP TS 33.203: “3G Security; Access security for IP-based services“. 5 Void 6 Void 7 3GPP TS 23.002: “Network architecture“. 8 Void 9 Void 10 3GPP TS 33.210: “3G Security; Network Domain Security; IP network layer security“. 11 3GPP TS 33.220: “Generic Authentication Architecture (G

36、AA); Generic Bootstrapping Architecture“. 12 Void 13 Void. 14 Void 15 3GPP TR 33.919: “Generic Authentication Architecture (GAA); System description“. 16 Void 17 Void 18 Void 19 3GPP TS 33.222: “ Generic Authentication Architecture (GAA); Access to network application functions using secure hypertex

37、t transfer protocol (HTTPS)“. 20 Void. ETSI ETSI TS 133 141 V15.0.0 (2018-07)63GPP TS 33.141 version 15.0.0 Release 1521 3GPP2 S.S0109-A v1.0: “Generic bootstrapping architecture“ 22 3GPP2 S.S0114-A v1.0: “Security mechanisms using GBA“ 23 3GPP TS 29.329: “Sh interface based on the Diameter protocol

38、; Protocol details“ 24 3GPP TS 24.109: “Bootstrapping interface (Ub) and network application function interface (Ua); Protocol details 25 3GPP TS 23.003: “Numbering, addressing and identification“. 26 3GPP TS 29.328: “IP Multimedia (IM) Subsystem Sh interface; Signalling flows and message contents“.

39、 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply. Confidentiality: The property that information is not made available or disclosed to unauthorised individuals, entities or processes. Data integrity: The property tha

40、t data has not been altered in an unauthorised manner. Data origin authentication: The corroboration that the source of data received is as claimed. Entity authentication: The provision of assurance of the claimed identity of an entity. 3.2 Abbreviations For the purposes of the present document, the

41、 following abbreviations apply, TR 21.905 1 contains additional applicable abbreviations: AKA Authentication and key agreement AP Authentication Proxy APN Access Point Name AS Application ServerBSF Bootstrapping Server Function CSCF Call Session Control Function ESP Encapsulating Security Payload GB

42、A Generic Bootstrapping ArchitectureGGSN Gateway GPRS Support Node GIBA GPRS-IMS-Bundled Authentication HTTP HyperText Transfer Protocol HTTPS HTTP over TLS IM IP MultimediaIMPI IM Private Identity IMPU IM Public Identity IMS IP Multimedia Core Network Subsystem IP Internet Protocol IPsec IP Securit

43、yISIM IM Services Identity Module NAF Network Application Function NDS/IP Network Domain Security for IP based Protocols P-CSCF Proxy Call Session Control Function PDP Packet Data Protocol SEG Security GatewaySIP Session Initiation Protocol TLS Transport Layer Security ETSI ETSI TS 133 141 V15.0.0 (

44、2018-07)73GPP TS 33.141 version 15.0.0 Release 154 Security architecture 4.1 Overview of the security architecture An IMS operator using the CSCFs as Watcher Presence proxies and Presentity Presence proxies may offer the Presence services on top of the IMS network, see TS 22.141 2. The access securi

45、ty for IMS is specified in TS 33.203 4 ensuring that SIP signalling is integrity protected and that IMS subscribers are authenticated through the use of IMS AKA. The security termination point from the UE towards the network is in the P-CSCF utilising IPsec ESP. A watcher may send a SIP SUBSCRIBE ov

46、er IMS towards the network, to subscribe or to fetch presence information, i.e., the Presence Service supports SIP-based communications for publishing presence information. The presence information is provided by the Presence Server to the Watcher Application using SIP NOTIFY along the dialogue setu

47、p by SUBSCRIBE. This traffic is protected in a hop-by-hop fashion as specified in TS 33.210 10 with the access security provided in TS 33.203 4. The Presence Server is responsible for managing presence information on behalf of the presence entity and it resides in the presentitys home network. Furth

48、ermore, the Presence Server provides a subscription authorization policy that is used to determine which watchers are allowed to subscribe to certain presence information. Prior to accepting the subscription requests from watchers, the presence server attempts to verify the identities of the watcher

49、s. Optionally, depending on the implementation, the Presence Server may authenticate an anonymous watcher depending on the Subscription Authorization Policy. A Presence List Server is responsible of storing grouped lists of watched presentities and enables a Watcher Application to subscribe to the presence of multiple presentities using a single SIP SUBSCRIBE transaction. The Presence List Server also stores and enables management of filters in the presence list, see figure 1. Watcher applicationPx = CxP-