Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 29.828 Word version: 12.1.0

1… 2…

2 References p. 8

3 Definitions and abbreviations p. 11

3.1 Definitions p. 11

3.2 Abbreviations p. 12

4 Key issues and Design considerations for Extended IMS media plane security features p. 13

4.1 Media security for Session based messaging (MSRP) p. 13

4.1.1 General design considerations p. 13

4.1.2 Assumptions and limitations for MSRP support p. 15

4.1.3 Scenarios in scope p. 16

4.1.4 MSRP-agnostic vs. MSRP-aware mode p. 19

4.2 Media security for conferencing (BFCP) p. 20

4.2.1 General design considerations p. 20

4.2.2 Assumptions and limitations for BFCP support p. 20

4.2.3 Scenarios in scope p. 21

4.2.4 BFCP-agnostic vs. BFCP-aware mode p. 21

4.3 TLS procedures p. 22

4.3.1 Introduction - Media/transport security sessions at Mb p. 22

4.3.2 H.248 bearer type indication "TLS" p. 22

4.3.3 TLS security session establishment p. 23

4.3.3.1 TLS client/server role assignment p. 23

4.3.3.1.1 General p. 23

4.3.3.1.2 Application agnostic TLS-over-TCP p. 23

4.3.3.1.3 Application aware scenario "MSRP-over-TLS-over-TCP" p. 23

4.3.3.1.4 Application aware scenario "BFCP-over-TLS-over-TCP" p. 24

4.3.3.2 Start of TLS security session establishment p. 24

4.3.4 TLS security session release p. 24

4.3.4.1 TLS-to-TCP relations p. 24

4.3.4.2 MGW: stimuli for TLS security session release p. 25

4.3.5 TLS protocol profile p. 25

4.3.5.1 Configuration p. 25

4.3.5.2 TLS protocol profile awareness at MGC level p. 25

4.4 TCP procedures p. 25

4.4.1 H.248 bearer type indication "TCP" p. 25

4.4.2 TCP connection establishment p. 25

4.4.2.1 TCP client/server role assignment p. 25

4.4.2.1.1 SIP level negotiation of TCP server and client role by MGC p. 25

4.4.2.1.2 H.248 control of TCP connection establishment at MGC by MGW p. 30

4.4.2.2 Start of TCP connection establishment p. 32

4.4.2.3 L3/L4 level NAT traversal support p. 32

4.4.3 TCP connection release p. 33

4.4.3.1 TLS-to-TCP relations p. 33

4.4.3.2 MGW: stimuli for TCP connection release p. 33

4.4.4 TCP Interworking in the MGW p. 34

4.5 MGC information baseline for gateway control decisions p. 35

4.6 Media security for T.38 fax over UDPTL/UDP transport p. 35

4.6.1 General design considerations p. 35

4.6.2 Assumptions and limitations for T.38 fax support p. 36

4.6.2.1 T.38 transport p. 36

4.6.2.2 Establishment directions of SIP session and DTLS session p. 36

4.6.2.3 Framework for e2ae security p. 36

4.6.3 Scenarios in scope p. 36

4.6.4 Consideration of application awareness of IMS-AGW p. 37

5 IMS-ALG/ IMS-AGW interface (Iq) p. 38

5.1 Requirements p. 38

5.1.1 End-to-access edge security for TCP-based media using TLS p. 38

5.1.1.1 General requirements p. 38

5.1.1.2 Specific requirements for session based messaging (MSRP) p. 38

5.1.1.2.1 General p. 38

5.1.1.2.2 Certificate fingerprints based solution for TLS and key management p. 38

5.1.1.2.3 Mutual authentication and authorization of TLS endpoints p. 38

5.1.1.2.4 Functional extension of the Iq interface for e2ae protection for MSRP p. 38

5.1.1.2.5 Specific MSRP based media e2ae protection requirements for IMS-ALG p. 40

5.1.1.3 Specific requirements for conferencing (BFCP) p. 40

5.1.1.3.1 General p. 40

5.1.1.3.2 Security for conferencing based on SIP signalling security p. 40

5.1.1.3.3 Specific BFCP based media e2ae protection requirements for IMS-ALG. p. 41

5.1.2 End-to-end security for TCP-based media using TLS p. 41

5.1.2.1 General requirements p. 41

5.1.2.2 Specific requirements for session based messaging (MSRP) p. 41

5.1.2.3 Specific requirements for conferencing (BFCP) p. 42

5.1.3 End-to-access edge security for UDP-based media using DTLS p. 42

5.1.3.1 General requirements p. 42

5.1.3.2 Specific requirements for T.38 fax over UDPTL/UDP transport p. 42

5.1.4 MSRP handling p. 43

5.1.4.1 General p. 43

5.1.4.2 IMS-ALG procedures to support IETF RFC 6714 with application agnostic MSRP handling by the IMS-AGW p. 44

5.1.4.3 IMS-ALG procedures to support IETF draft-ietf-simple-msrp-sessmatch with application agnostic MSRP handling by the IMS-AGW p. 44

5.1.4.4 IMS-ALG procedures for application aware MSRP interworking by the IMS-AGW p. 44

5.1.4.5 Application-aware MSRP interworking at the IMS-AGW p. 45

5.2 Procedures p. 45

5.2.1 End-to-access edge security for TCP-based media using TLS p. 45

5.2.1.1 Generic procedures p. 45

5.2.1.2 Specific procedures for session based messaging (MSRP) p. 45

5.2.1.2.1 Indicating support of e2ae security during registration. p. 45

5.2.1.2.2 IMS UE originating procedures for e2ae p. 46

5.2.1.2.2.1 Incoming TCP bearer establishment triggers an outgoing TCP bearer establishment. p. 46

5.2.1.2.2.2 IMS-ALG requests sending an outgoing TCP bearer establishment. p. 49

5.2.1.2.3 IMS UE terminating procedures for e2ae p. 51

5.2.1.2.3.1 Incoming TCP bearer establishment triggers an outgoing TCP bearer establishment. p. 51

5.2.1.2.3.2 IMS-ALG requests sending an outgoing TCP bearer establishment. p. 54

5.2.1.3 Specific procedures for conferencing (BFCP) p. 56

5.2.1.3.1 Indicating support of e2ae security during registration. p. 56

5.2.1.3.2 IMS UE originating procedures for e2ae p. 56

5.2.1.3.3 IMS UE terminating procedures for e2ae p. 59

5.2.2 End-to-end security for TCP-based media using TLS p. 62

5.2.2.1 Generic procedures p. 62

5.2.2.2 Specific procedures for session based messaging (MSRP) p. 62

5.2.2.3 Specific procedures for conferencing (BFCP) p. 62

5.2.3 End-to-access edge security for UDP-based media using DTLS p. 62

5.2.3.1 Generic procedures p. 62

5.2.3.1.1 Context model p. 62

5.2.3.2 Specific procedures for T.38 fax over UDPTL/UDP transport p. 62

5.2.3.2.1 Indicating support of e2ae security during registration p. 62

5.2.3.2.2 IMS UE originating procedures for e2ae p. 63

5.2.3.2.3 IMS UE terminating procedures for e2ae p. 65

6 IBCF/ TrGW interface (Ix) p. 67

6.1 Requirements p. 67

6.1.1 End-to-end security for TCP-based media using TLS p. 67

6.1.1.1 General requirements p. 67

6.1.1.2 Specific requirements for session based messaging (MSRP) p. 67

6.1.1.3 Specific requirements for conferencing (BFCP) p. 67

6.2 Procedures p. 67

6.2.1 End-to-end security for TCP-based media using TLS p. 67

6.2.1.1 Generic procedures p. 67

6.2.1.2 Specific procedures for session based messaging (MSRP) p. 67

6.2.1.3 Specific procedures for conferencing (BFCP) p. 67

7 MRFC/ MRFP interface (Mp) p. 68

7.1 Requirements p. 68

7.1.1 End-to-end security for TCP-based media using TLS p. 68

7.1.1.1 General requirements p. 68

7.1.1.2 Specific requirements for session based messaging (MSRP) p. 69

7.1.1.3 Specific requirements for conferencing (BFCP) p. 70

7.2 Procedures p. 70

7.2.1 End-to-end security for TCP-based media using TLS p. 70

7.2.1.1 Generic procedures p. 70

7.2.1.1.1 Ad-hoc Conferences p. 70

7.2.1.2 Specific procedures for session based messaging (MSRP) p. 70

7.2.1.2.1 General p. 70

7.2.1.2.2 IMS UE originating procedures ("dial-in" scenario) for e2e p. 71

7.2.1.2.3 IMS UE terminating procedures ("dial-out" scenario) for e2e p. 74

7.2.1.3 Specific procedures for conferencing (BFCP) p. 76

7.2.1.3.1 IMS UE originating procedures ("dial-in" scenario) for e2e p. 76

7.2.1.3.2 IMS UE terminating procedures ("dial-out" scenario) for e2e p. 78

8 3GPP- ITU-T H.248 requirements gap analysis p. 81

8.1 Relevant ITU-T Recommendations p. 81

8.1.1 Capabilities related to TCP bearer support p. 81

8.1.2 Capabilities related to NAT-T support p. 81

8.1.3 Capabilities related to media security support p. 81

8.1.4 Capabilities related to support of MGW autonomous behaviour p. 81

8.2 Scope of ITU-T "(D)TLS transport security" p. 81

8.3 Status gap analysis p. 81

9 Conclusions and recommendations p. 82

A Impacts on existing specifications p. 83

B Release 12 requirements and procedures for extended media security p. 84

C Interworking between sessmatch and CEMA p. 97

C.1 Scope p. 97

C.2 MSRP Interworking Function p. 97

C.3 Procedures for SBC without User Plane MSRP B2BUA p. 100

D Preventing TLS establishment collision without a TLS B2BUA p. 101

E Example end-to-end network scenario p. 102

E.1 Scope p. 102

E.2 Aspect of IP realms p. 102

E.3 Aspect of TCP bearer connection establishment p. 104

E.4 Aspects of TCP flow control p. 107

E.4.1 Overview p. 107

E.4.2 TCP flow control during establishment phase p. 107

E.4.2.1 Without early application data p. 107

E.4.2.2 With early application data p. 107

E.4.3 TCP flow control during active data transfer phase p. 107

F Example traffic flow (communication establishment phase) p. 108

F.1 Scope p. 108

F.2 TCP bearer connection establishment (example) p. 108

F.3 TLS security session establishment (example) p. 110

$ Change history p. 111