ETSI TS 183 020-2006 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN) Network Attachment Roaming in TISPAN NGN Network Accesses Int_1.pdf

1、 ETSI TS 183 020 V1.1.1 (2006-03)Technical Specification Telecommunications and Internet converged Services andProtocols for Advanced Networking (TISPAN);Network Attachment: Roaming in TISPAN NGN Network Accesses;Interface Protocol DefinitionETSI ETSI TS 183 020 V1.1.1 (2006-03) 2 Reference DTS/TISP

2、AN-03042-NGN-R1 Keywords access, interface, network, roaming ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Imp

3、ortant notice Individual copies of the present document can be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is t

4、he Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Inf

5、ormation on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No

6、part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2006. All rights reserved. DECTTM, PLUGTESTSTM and UMTSTM are Trade Marks of ETSI registered for the ben

7、efit of its Members. TIPHONTMand the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TS 183 020 V1.1.1 (2006-03) 3 Contents Intel

8、lectual Property Rights4 Foreword.4 1 Scope 5 2 References 5 3 Definitions and abbreviations.6 3.1 Definitions6 3.2 Abbreviations .6 4 NGN General Architecture.7 4.1 Overview of Interface e58 5 Protocols and profiles for Interface e5 .9 5.1 802.1X-based Authentication.9 5.2 Intermediaries.11 5.3 Req

9、uirements of the visited NGN network 11 5.4 Requirements of the home NGN network 12 5.5 Subscriber Profile Transfer.13 5.5.1 Privacy-Indicator AVP .14 Annex A (informative): Tracking of Standards-related Work.15 A.1 Items to be tracked .15 Annex B (informative): Bibliography .16 History 17 ETSI ETSI

10、 TS 183 020 V1.1.1 (2006-03) 4 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR

11、000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Po

12、licy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Te

13、chnical Specification (TS) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TS 183 020 V1.1.1 (2006-03) 5 1 Scope The present document describes the protocol specifications and profiles for the

14、interface between the UAAF in the visited NGN network (UAAF-proxy) and the UAAF in the home NGN network (UAAF-server). The specifications of this interface will be common for both xDSL and WLAN access networks, including possible other access network types as well. Specific differences, if any, will

15、 be called out. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For a specific ref

16、erence, subsequent revisions do not apply. For a non-specific reference, the latest version applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. 1 ETSI ES 282 001: “Telecommunications and Internet conve

17、rged Services and Protocols for Advanced Networking (TISPAN); NGN Functional Architecture Release 1“. 2 ETSI ES 282 004: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Functional Architecture; Network Attachment Sub-System (NASS)“. 3 ETSI TS 1

18、29 234: “Universal Mobile Telecommunications System (UMTS); 3GPP system to Wireless Local Area Network (WLAN) interworking; Stage 3 (3GPP TS 29.234 Release 6)“. 4 Wi-Fi Alliance: “WPA Deployment Guidelines for Public Access Wi-Fi Networks“. NOTE: http:/www.wi-fi.org/OpenSection/pdf/WPA_for_Public_Ac

19、cess_Final.pdf 5 IETF RFC 3748: “Extensible Authentication Protocol (EAP)“. 6 IETF RFC 2486bis: “The Network Access Identifier“. 7 ETSI TS 183 019: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Network Attachment; Network Access xDSL and WLAN Acc

20、ess Networks; Interface Protocol Definitions“. 8 IETF RFC 2865: “Remote Authentication Dial In User Service (RADIUS)“. 9 ETSI ES 283 034: “TISPAN; Network Attachment Sub-System (NASS); e4 interface based on the DIAMETER protocol“. 10 ETSI TS 183 017: “Telecommunications and Internet Converged Servic

21、es and Protocols for Advanced Networking (TISPAN); Resource and Admission Control: DIAMETER protocol for session based policy set-up information exchange between the Application Function (AF) and the Service Policy Decision Function (SPDF); Protocol specification“. 11 ETSI ES 283 035: “TISPAN; Netwo

22、rk Attachment Sub-System (NASS); e2 interface based on the DIAMETER protocol“. 12 IETF RFC 3539: “Authentication, Authorization and Accounting (AAA) Transport Profile“. 13 IETF RFC 4005: “Diameter Network Access Server Application“. 14 IETF RFC 4072: “Diameter Extensible Authentication Protocol (EAP

23、) Application“. ETSI ETSI TS 183 020 V1.1.1 (2006-03) 6 15 IETF RFC 3588: “Diameter Base Protocol“. 16 IETF RFC 4372: “Chargeable User Identity“. 17 IETF RFC 2866: “RADIUS Accounting“. 18 IETF RFC 3580: “IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines“. 19 IETF RFC 2

24、548: “Microsoft Vendor-specific RADIUS Attributes“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply: access network: collection of network entities and interfaces that provide the underlying IP transport connectivity

25、 between end user devices and NGN entities Attribute-Value Pair: see RFC 3588 15, it corresponds to an Information Element in a Diameter message functional entity: entity that comprises a specific set of functions at a given location. Functional entities are logical concepts, grouping of functional

26、entities are used to describe practical physical realizations Core Network: portion of the delivery system composed of networks, systems equipment and infrastructures, connecting the service providers to the access network user equipment: one or more devices allowing a user to access services delive

27、red by TISPAN NGN networks NOTE: This includes devices under user control commonly referred to as CPE, IAD, ATA, RGW, TE, etc., but not network controlled entities such as access gateways. visited NGN network: NGN network through which the User Equipment gains network connectivity NOTE: The NGN Netw

28、ork includes both the Access Network and the Core Network. The User Equipment does not have a service relationship with the business entity that operates this network. home NGN network: NGN network through which the User Equipment gains network connectivity NOTE: The NGN Network includes both the Ac

29、cess Network and the Core Network. The User Equipment has a service relationship with the business entity that operates this network. 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: 3GPP Third Generation Project Partnership AAA Authentication, Authoriza

30、tion and Accounting AAA-H AAA-Home AAA-V AAA-VisitedAMF Access Management Function AP Access Point ATA Analogue Terminal Adaptor AVP Attribute Value Pair CNG Customer Network Gateway EAP Extensible Authentication Protocol EAPOL EAP Over Lan GSMA Global System for Mobile communications Association IA

31、D Integrated Access Device IETF Internet Engineering Task Force ETSI ETSI TS 183 020 V1.1.1 (2006-03) 7 IP Internet Protocol NAI Network Access Identifier NASS Network Attachment SubSystem NGN Next Generation Network PEAP Protected EAP RGW Residential GateWay STA Station TE Terminal Equipment TLS Tr

32、ansport Layer Security TTLS Tunnelled TLS UAAF User Access Authorization Function UE User Equipment WLAN Wireless Local Area Network WPA Wi-Fi Protected Access xDSL Digital Subscriber Line4 NGN General Architecture ES 282 001 1 provides a description of the general network architecture of the NGN. T

33、he model is depicted in figure 1. UE Visited NGN Network Home NGN Network e1 e5 Figure 1: General NGN Network Model Interface e1 is an access-network-specific interface, and is dependant on the access technology being used (xDSL, WLAN, and so on). Interface e5 is a roaming interface, and is independ

34、ent of the access technology. Interface e5 is used to provide a consistent method for the visited NGN network to communicate with the home NGN network. ETSI ETSI TS 183 020 V1.1.1 (2006-03) 8 Figure 2 depicts the functional composition of the access network and the NGN core for the roaming scenario,

35、 where a UE obtains network access via a visited NGN network and authenticates back with the home NGN network. Details of this model may be found in ES 282 004 2. Home NGN Access Network UAAF Visited NGN Access Network PDBF CPE (CNG/TE) e5 ARF a4 Service control subsystems a3 a1 a2 e1 e2 e4 e3 Resou

36、rce and Admission Control Subsystem CLF NACF CNGCF AMF UAAF UE Visited NGN network Home NGN network Access Transport network e1 Figure 2: NASS mapped onto functional network roles - roaming scenario 4.1 Overview of Interface e5 The present document details the protocols and profiles for interface e5

37、. This interface is intended to be used between a UAAF-proxy and a UAAF-server, which may be in different distractive domains. This interface allows the UAAF-proxy to request the UAAF-server for user authentication and authorization, based on user profiles. It also allows the UAAF-proxy to forward a

38、ccounting data for the particular user session to the UAAF-server. The UAAF-proxy will forward access and authorization requests, as well as accounting messages, received over interface a3 from the AMF, to the UAAF-server over interface e5. Responses received back in return from the UAAF-server over

39、 interface e5 will be forwarded to the AMF over interface a3. A bilateral trust relationship will need to be setup between the UAAF-proxy and the UAAF-server in order to facilitate this exchange. The specifications for interface e5 will be similar to that of interface a3, between the AMF and the UAA

40、F in the visited network. This interface therefore supports AAA message exchange between the UAAF-proxy and the UAAF-server. RADIUS and Diameter are two possible options for carrier protocols on this interface, and detailed requirements are listed in the present document. Interface e5 supports both

41、authentication/authorization and accounting message exchange. The present document will be common for both xDSL and WLAN access networks, as well as for potential other types of access networks. Specific differences, if any, will be called out in the document. ETSI ETSI TS 183 020 V1.1.1 (2006-03) 9

42、 5 Protocols and profiles for Interface e5 5.1 802.1X-based Authentication Figure 4 depicts a typical protocol stack for 802.1X-based authentication. Further details may be found in Wi-Fi Alliance 4. The EAP messages are carried over EAPOL (EAP over LAN) frames between the UE and the AP and then re-

43、encapsulated in RADIUS or Diameter messages when sent from the AP to the home AAA Server (via zero or more AAA proxies). In figure 4, the UE (mobile station) acts as the 802.1X supplicant, the AP acts as the authenticator, and the RADIUS AAA server acts as the authentication server. For security rea

44、sons, RADIUS is sometimes also carried over IPsec (RFC 3162 (see Bibliograhy) describes use of RADIUS over IPv6-IPsec, and RFC 3580 18 also recommends use of IPsec to protect RADIUS). Diameter may also be used instead of or in addition to RADIUS. Figure 3: 802.1X/EAP Authentication Protocol Stack ET

45、SI ETSI TS 183 020 V1.1.1 (2006-03) 10Figure 5 depicts a typical 802.1X-based authentication scenario. The UE attempts to associate with an AP and is challenged to authenticate. At this point, the UE needs to indicate its user identity. There are usually two parts to this identity: the user name and

46、 the realm. Typically, these are combined into a Network Access Identifier (NAI) of the form userrealm. The realm part of the NAI is used to establish a connection with the appropriate AAA-H for that user. This presumes that the visited network recognizes that realm name. If this is not the case, th

47、en the visited network will signal an authentication failure back to the UE. The UE can then either try a different account (with a different realm) or can try to establish a new account on the visited network. If those alternatives also fail, the UE will be denied access or will be granted only lim

48、ited guest access. Figure 4: 802.1X-based authentication with RADIUS as AAA protocol To avoid revealing the true user identity to an entity other than the home service provider, especially across the WLAN radio link, the UE can use a generic user name like “anonymous“ or “user“ in the NAI given in t

49、he initial identity exchange. The realm part of the NAI is the only information the visited network needs to know at this point. If PEAP or TTLS are used to establish a secure tunnel between the STA and the AAA-H, then the protected identity exchange will not be visible to the visited network or to any eavesdroppers. The visited network will eventually need to obtain some identity value for charging and billing purposes if the authentication is successful. The home network can provide the identity that identifies the acc