Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.871 Word version: 12.0.0

1… 4…

4 Overview p. 9

4.1 WebRTC p. 9

4.1.1 General p. 9

4.1.2 WebRTC control plane p. 9

4.1.3 WebRTC user plane p. 9

4.2 WebRTC IMS Client access to IMS p. 11

4.2.1 Overview p. 11

4.2.2 Architecture p. 11

5 Assumptions, Risks and Security requirements p. 13

5.1 Assumptions p. 13

5.2 Risks p. 13

5.2.1 Impact of security breach at WWSF on arbitrary IMS subscribers p. 13

5.2.2 Lack of means to identify potentially compromised WWSF in the IMS core p. 13

5.2.3 Risks relating to the determination of IMS identities by the WWSF p. 13

5.2.4 Risks relating to assignment of IMS identities to WebRTC IMS Client from pool of IMS subscriptions held by WWSF p. 14

5.3 Potential security requirements p. 15

6 Solutions p. 17

6.1 Authentication and Authorization p. 17

6.1.1 Authentication of WebRTC IMS Client with IMS subscription re-using existing IMS authentication mechanisms p. 17

6.1.1.1 General p. 17

6.1.1.2 Use of SIP Digest credentials p. 17

6.1.1.3 Use of IMS AKA p. 19

6.1.2 Authentication of WebRTC IMS Client with IMS subscription using web credentials p. 20

6.1.2.1 General p. 20

6.1.2.2 Use of Trusted Node Authentication (TNA) p. 21

6.1.2.3 Example of web authentication using IMS AKA credentials p. 27

6.1.2.4 Use of direct authentication between WIC and eP-CSCF p. 28

6.1.2.5 Trusted Node Authentication using OAuth 2.0 Implicit Grant p. 29

6.1.3 Assignment of IMS identities to WebRTC IMS Client from pool of IMS subscriptions held by WWSF p. 32

6.1.3.1 General p. 32

6.1.3.2 Use of Trusted Node Authentication (TNA) p. 32

6.2 Enhancements to IMS media plane security p. 37

6.2.1 Media security for RTP p. 37

6.2.1.1 General p. 37

6.2.1.2 e2ae security for RTP using DTLS-SRTP p. 37

6.2.2 Media security for WebRTC Data Channels p. 39

6.2.2.1 General p. 39

6.2.2.2 e2ae security for WebRTC Data Channels p. 39

6.3 Other security aspects p. 41

6.3.1 Firewall traversal p. 41

7 Assessment of solutions p. 42

8 Conclusions and recommendations p. 42

A Secure usage of GBA with UE browser p. 43

B Profiling of DTLS-SRTP p. 47

C Linking IMS identities and web identities - Example security mechanisms p. 48

D Mapping OAuth 2.0 to IMS WebRTC p. 49

$ Change History p. 52