Content for TS 33.328 Word version: 18.1.0
4 IMS media plane security overview
5 IMS media plane security features
6 Security mechanisms
7 Security association set-up procedures for media protection
4 IMS media plane security overview p. 12
4.1 Introduction p. 12
4.2 IMS media plane security architecture p. 15
4.2.1 General p. 15
4.2.2 E2ae security p. 15
4.2.3 E2e security using SDES p. 16
4.2.4 E2e security using KMS p. 16
4.2.5 E2DCe security p. 17
4.2.6 E2e security for IMS Data Channels p. 18
5 IMS media plane security features p. 18
5.1 General p. 18
5.2 Media integrity protection p. 19
5.3 Media confidentiality protection p. 19
5.4 Authentication and authorization p. 19
5.4.1 Authentication and authorization for e2ae protection p. 19
5.4.2 Authentication and authorization for e2e protection using SDES p. 20
5.4.3 Authentication and authorization for e2e protection using KMS p. 20
5.4.4 Authentication and authorization for e2DCe protection p. 21
5.4.5 Authentication and authorization for e2e protection using DTLS p. 21
5.5 Security properties of key management, distribution and derivation p. 21
5.5.1 General security properties for protection using SDES p. 21
5.5.2 Additional security properties for e2ae protection using SDES p. 22
5.5.3 Security properties for e2e protection using KMS p. 22
5.5.4 Security properties for e2ae protection using TLS/DTLS p. 22
5.5.5 Security properties for e2ae protection using DTLS-SRTP p. 23
5.5.6 Security properties for e2DCe protection using DTLS p. 23
6 Security mechanisms p. 23
6.1 Media security mechanisms p. 23
6.1.1 Media security mechanisms for real-time traffic p. 23
6.1.2 Media security mechanisms for session based messaging (MSRP) p. 23
6.1.3 Media security mechanisms for IMS data channels p. 24
6.2 Key management mechanisms for media protection p. 24
6.2.1 Key management mechanisms for e2ae protection p. 24
6.2.1.1 Endpoints for e2ae protection p. 24
6.2.1.2 Key management protocol for e2ae protection p. 24
6.2.1.3 Functional extension of the Iq interface for e2ae protection p. 25
6.2.2 Key management mechanisms for e2e protection using SDES p. 25
6.2.3 Key management mechanisms for e2e protection using KMS p. 26
6.2.3.1 General p. 26
6.2.3.2 KMS user and user group identities p. 26
6.2.3.3 IMS UE local policies p. 27
6.2.3.4 Ticket data p. 27
6.2.3.4.1 Ticket format p. 27
6.2.3.4.2 Allocation of ticket subtype and version for ticket type 2 p. 27
6.2.3.5 Authentication of public identities in REQUEST_INIT and RESOLVE_INIT p. 27
6.2.3.6 Authentication of terminating user identity p. 27
6.2.3.7 Reusable tickets p. 28
6.2.3.8 Signalling between KMSs p. 28
6.2.4 Key management mechanisms for e2DCe protection p. 28
7 Security association set-up procedures for media protection p. 29
7.1 IMS UE registration procedures p. 29
7.1.1 Indication of support for e2ae security for RTP based media p. 29
7.1.2 Indication of support for e2ae security for MSRP p. 30
7.1.3 Indication of support for e2DCe security for IMS data channel p. 30
7.2 IMS UE originating procedures p. 30
7.2.1 IMS UE originating procedures for e2ae p. 30
7.2.2 IMS UE originating procedures for e2e using SDES p. 33
7.2.3 IMS UE originating procedures for e2e using KMS p. 35
7.2.4 IMS UE originating procedures for e2DCe p. 36
7.2.5 IMS UE originating procedures for e2e using TLS/DTLS certificate / fingerprint p. 38
7.3 UE terminating procedures p. 40
7.3.1 UE terminating procedures for e2ae p. 40
7.3.2 IMS UE terminating procedures for e2e using SDES p. 43
7.3.3 IMS UE terminating procedures for e2e using KMS p. 44
7.3.4 UE terminating procedures for e2DCe p. 46
7.3.5 IMS UE terminating procedures for e2e using TLS/DTLS certificate / fingerprint p. 47
7.4 Session update procedures p. 47
7.5 Handling of emergency calls p. 48
