1、 ETSI TR 133 924 V14.0.0 (2017-04) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Identity management and 3GPP security interworking; Identity management and Generic Authentication Architecture (GAA) interworking (3GPP TR 33.924 v
2、ersion 14.0.0 Release 14) TECHNICAL REPORT ETSI ETSI TR 133 924 V14.0.0 (2017-04)13GPP TR 33.924 version 14.0.0 Release 14Reference RTR/TSGS-0333924ve00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 S
3、iret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print.
4、 The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Port
5、able Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/porta
6、l.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic
7、 or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommu
8、nications Standards Institute 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M lo
9、go is protected for the benefit of its Members GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TR 133 924 V14.0.0 (2017-04)23GPP TR 33.924 version 14.0.0 Release 14Intellectual Property Rights IPRs essential or potentially essential to the present document
10、 may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETS
11、I standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs
12、 not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical spec
13、ifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Mo
14、dal verbs terminology In the present document “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI d
15、eliverables except when used in direct citation. ETSI ETSI TR 133 924 V14.0.0 (2017-04)33GPP TR 33.924 version 14.0.0 Release 14Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions, symbols and abbrev
16、iations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 Interworking of OpenID and GAA 7g34.1 Introduction 7g34.2 Architectural Descriptions 7g34.2.1 Generic Bootstrapping Architecture . 7g34.2.2 OpenID Architecture. 9g34.3 NAF and OpenID-IdP Co-location . 10g34.4 Message Flow for Interworking Scen
17、ario 11g34.4.1 Message Flow for direct GBA Interworking Scenario 11g34.4.2 Message Flow for Split Terminal GBA Interworking Scenario . 13g34.4.2.1 General 13g34.4.2.2 Differentiating between Scenarios 14g34.4.2.3 Scenarios not using cryptographic binding . 14g34.4.2.4 Scenarios using cryptographic b
18、inding . 23g34.5 Mapping of Concepts . 33g34.5.1 Identifiers in OpenID and GBA 33g34.5.2 Asociation Session Concept 35g34.5.3 Assertions . 35g34.5.3.1 Positive Assertions 35g34.5.3.2 Negative Assertions 35g34.6 Use of GUSS and USS for OpenID 36g3Annex A (informative): Example for Charging via IdP 37
19、g3Annex B: Change history 40g3History 41g3ETSI ETSI TR 133 924 V14.0.0 (2017-04)43GPP TR 33.924 version 14.0.0 Release 14Foreword This Technical Report has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TS
20、G and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for inform
21、ation; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been in
22、corporated in the document. Introduction 3GPP SA3 outlined the interworking of the operator controlled GBA with the Liberty Alliance Identity Management. This was sufficient for the time of writing, but now new additional systems are deployed and used. If we want to enable interworking of operator c
23、entric identity management, then smooth interworking with those new systems need to be outlined. If this is not done, then a seamless interworking is not possible on global scale and it would be difficult to leverage the existing customer base and security level that operators have. ETSI ETSI TR 133
24、 924 V14.0.0 (2017-04)53GPP TR 33.924 version 14.0.0 Release 141 Scope The objective is to extend the current identity management as outlined in TS 33.220, TS 33.222, TS 29.109 and TR 33.980 with the latest developments on identity management outside of the 3GPP sphere. This will allow a better inte
25、gration and usage of identity management for services in 3GPP and seamless integration with existing services that are not standardized in 3GPP. This report outlines the interworking of GBA and OpenID. 2 References The following documents contain provisions which, through reference in this text, con
26、stitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the case of
27、a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 33.220: “Generic Authentication Architecture (GA
28、A); Generic Bootstrapping Architecture“. 3 3GPP TS 24.109: “Bootstrapping Interface (Ub) and Network Application Function Interface (Ua); Protocol Details“. 4 3GPP TR 33.980: “Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Service Framework (ID-WSF) and the Gene
29、ric Authentication Architecture (GAA)“. 5 3GPP TS 33.222: “Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)“. 6 3GPP TS 33.223: “Generic Bootstrapping Architecture (GBA) Push Function“. 7 3GPP T
30、S 29.109: “Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter Protocol; Stage 3“. 8 OpenID Foundation “OpenID Authentication 2.0“, http:/ 9 OpenID Foundation “OpenID Attribute Exchange 1.0“, http:/ 10 OpenID Foundation “OpenID Provider Authentication Policy Extensi
31、on 1.0“, http:/ 11 OASIS Reed, D.; McAlpin, D.: “Extensible Resource Identifier (XRI) Syntax v2.0“; http:/www.oasis-open.org/ 12 OpenID Foundation, http:/ 13 OpenID Site Directory, http:/ 14 3GPP TS 33.259: “Key Establishment between a UICC hosting device and a remote device“. 15 IETF RFC 4006, “Dia
32、meter Credit Control“, http:/tools.ietf.org/html/rfc4006 16 W3C, “HTML 4.01 Specification“, http:/www.w3.org/TR/html401/ 17 IETF RFC 2617 (1999): “HTTP Authentication: Basic and Digest Access Authentication“. 18 IETF RFC 3761 (2004): “The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegatio
33、n Discovery System (DDDS) Application (ENUM)“. ETSI ETSI TR 133 924 V14.0.0 (2017-04)63GPP TR 33.924 version 14.0.0 Release 143 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 1 and the following apply. A t
34、erm defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905 1. The GAA / GBA specific definitions are originated from 2 and the OpenID definitions are originated from 8. In case of conflict 2 and 8 take precedence. Attribute: An attribute is used i
35、n the OpenID Attribute Exchange service extension 9. This extension provides a mechanism for moving identity related information between sites. An attribute is associated with a Subject Identifier. An attribute has a type identifier and a value. An attribute type identifier is a URI. An attribute va
36、lue can be any kind of data. Bootstrapping Server Function (BSF): A Bootstrapping Server Function (BSF) is hosted in a network element under the control of an MNO. BSF, HSS/HLR, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping
37、 procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes. GBA User Security Settings: GUSS contains the BSF specific information element and the set of all application-specific USSs. Identifier: An Identifier in OpenID is either an “http“ or “https“ UR
38、L, or an XRI 11. OpenID 8 defines various kinds of identifiers depending on the context. Network Application Function (NAF): A NAF is hosted in a network element. GBA may be used between NAFs and UEs for authentication purposes, and for securing the communication path between the UE and the NAF. Ope
39、nID Provider (OP): An OpenID Provider (OP) is an OpenID Authentication Server on which a Relying Party relies for an assertion that the end user controls an Identifier. OpenID Provider driven identifier selection: OpenID Provider driven identifier selection is the ability for a user to enter the URL
40、 of their OpenID Provider into an OpenID field rather than their personal OpenID URL. This allows the web site (RP) to start the OpenID authentication flow and send the user over to the correct OpenID provider. The user can then authenticate to the OpenID provider, select a particular OpenID URL and
41、 persona if they have multiple, This will result in an actual user OpenID URL or an anonymous OpenID URL being returned to the RP. OP Endpoint URL: The URL which accepts OpenID Authentication protocol messages, obtained by performing discovery on the User-Supplied identifier. This value must be an a
42、bsolute HTTP or HTTPS URL. Relying Party (RP): A Relying Party is a web application that wants a proof that the end user controls an Identifier. User Supplied Identifier: An Identifier that was presented by the end user to the RP, or selected by the user at the OpenID Provider. During the initiation
43、 phase of the protocol, an end user may enter either their own Identifier or an OP Identifier. If an OP Identifier is used, the OP may then assist the end user in selecting an Identifier to share with the RP. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in TR 2
44、1.905 1 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905 1. AKA Authentication and Key Agreement Protocol AV Authentication Vector BSF Bootstrapping Server Function IdP Identity Provider GAA G
45、eneric Authentication Architecture GBA Generic Bootstrapping ArchitectureGPI GBA Push Information GUSS GBA User Security Settings HLR Home Location Register ETSI ETSI TR 133 924 V14.0.0 (2017-04)73GPP TR 33.924 version 14.0.0 Release 14HSS Home Subscriber Server ME Mobile Equipment MNO Mobile Networ
46、k Operator NAF Network Application Function OP OpenID Provider PAPE Provider Authentication Policy Extension RP Relying Party SLF Subscriber Locator Function SP Service Provider UE User Equipment USS User Security Settings 4 Interworking of OpenID and GAA 4.1 Introduction In this chapter we outline
47、how the Generic Authentication Architecture, in particular, the Generic Bootstrapping Architecture (GBA) as specified in 2 can be utilized by the OpenID protocol as specified by 8. The focus will lie on the impact to the network nodes of the Mobile Network Operator (MNO) and the service providers, t
48、he supported protocols and the message flows. The general setting for the GBA OpenID interworking is quite similar to the GBA Liberty Alliance Interworking as outlined in 4. The major difference is that OpenID as currently specified is more lightweight than the Liberty Alliance Web Service and Ident
49、ity Federation Framework and therefore many well-known service providers have chosen OpenID for their identity management solution. 4.2 Architectural Descriptions 4.2.1 Generic Bootstrapping Architecture In this section, we give a brief overview of the Generic Bootstrapping Architecture as described in TS 33.220 2. GBA enables automatic provisioning of shared keys between a User Equipment (UE) and an application server (
