Content for TR 33.924 Word version: 17.0.0
0 Introduction
1 Scope
2 References
3 Definitions, symbols and abbreviations
3.1 Definitions
3.2 Abbreviations
...
...
0 Introduction p. 4
3GPP SA3 outlined the interworking of the operator controlled GBA with the Liberty Alliance Identity Management. This was sufficient for the time of writing, but now new additional systems are deployed and used. If we want to enable interworking of operator centric identity management, then smooth interworking with those new systems need to be outlined. If this is not done, then a seamless interworking is not possible on global scale and it would be difficult to leverage the existing customer base and security level that operators have.
1 Scope p. 5
The objective is to extend the current identity management as outlined in TS 33.220, TS 33.222, TS 29.109 and TR 33.980 with the latest developments on identity management outside of the 3GPP sphere. This will allow a better integration and usage of identity management for services in 3GPP and seamless integration with existing services that are not standardized in 3GPP. This report outlines the interworking of GBA and OpenID.
2 References p. 5
The following documents contain provisions which, through reference in this text, constitute provisions of the present document.
- References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific.
- For a specific reference, subsequent revisions do not apply.
- For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.
[1]
TR 21.905: "Vocabulary for 3GPP Specifications".
[2]
TS 33.220: "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture".
[3]
TS 24.109: "Bootstrapping Interface (Ub) and Network Application Function Interface (Ua); Protocol Details".
[4]
TR 33.980: "Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Service Framework (ID-WSF) and the Generic Authentication Architecture (GAA)".
[5]
TS 33.222: "Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Security (HTTPS)".
[6]
TS 33.223: "Generic Bootstrapping Architecture (GBA) Push Function".
[7]
TS 29.109: "Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter Protocol; Stage 3".
[8]
OpenID Foundation "OpenID Authentication 2.0", http://openid.net/ .
[9]
OpenID Foundation "OpenID Attribute Exchange 1.0", http://openid.net/ .
[10]
OpenID Foundation "OpenID Provider Authentication Policy Extension 1.0", http://openid.net/ .
[11]
OASIS Reed, D.; McAlpin, D.: "Extensible Resource Identifier (XRI) Syntax v2.0"; http://www.oasis-open.org/
[12]
OpenID Foundation, http://openid.net/foundation/
[13]
OpenID Site Directory, http://openiddirectory.com/
[14]
TS 33.259: "Key Establishment between a UICC hosting device and a remote device".
[15]
RFC 4006, "Diameter Credit Control", http://tools.ietf.org/html/rfc4006
[16]
W3C, "HTML 4.01 Specification"!, http://www.w3.org/TR/html401/
[17]
RFC 2617 (1999): "HTTP Authentication: Basic and Digest Access Authentication".
[18]
RFC 3761 (2004): "The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM)".
3 Definitions, symbols and abbreviations p. 6
3.1 Definitions p. 6
For the purposes of the present document, the terms and definitions given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905. The GAA / GBA specific definitions are originated from [2] and the OpenID definitions are originated from [8]. In case of conflict [2] and [8] take precedence.
Attribute:
An attribute is used in the OpenID Attribute Exchange service extension [9]. This extension provides a mechanism for moving identity related information between sites. An attribute is associated with a Subject Identifier. An attribute has a type identifier and a value. An attribute type identifier is a URI. An attribute value can be any kind of data.
Bootstrapping Server Function (BSF):
A Bootstrapping Server Function (BSF) is hosted in a network element under the control of an MNO. BSF, HSS/HLR, and UEs participate in GBA in which a shared secret is established between the network and a UE by running a bootstrapping procedure. The shared secret can be used between NAFs and UEs, for example, for authentication purposes.
GBA User Security Settings:
GUSS contains the BSF specific information element and the set of all application-specific USSs.
Identifier:
An Identifier in OpenID is either an "http" or "https" URL, or an XRI [11]. OpenID [8] defines various kinds of identifiers depending on the context.
Network Application Function (NAF):
A NAF is hosted in a network element. GBA may be used between NAFs and UEs for authentication purposes, and for securing the communication path between the UE and the NAF.
OpenID Provider (OP):
An OpenID Provider (OP) is an OpenID Authentication Server on which a Relying Party relies for an assertion that the end user controls an Identifier.
OpenID Provider driven identifier selection:
OpenID Provider driven identifier selection is the ability for a user to enter the URL of their OpenID Provider into an OpenID field rather than their personal OpenID URL. This allows the web site (RP) to start the OpenID authentication flow and send the user over to the correct OpenID provider. The user can then authenticate to the OpenID provider, select a particular OpenID URL and persona if they have multiple, This will result in an actual user OpenID URL or an anonymous OpenID URL being returned to the RP.
OP Endpoint URL:
The URL which accepts OpenID Authentication protocol messages, obtained by performing discovery on the User-Supplied identifier. This value must be an absolute HTTP or HTTPS URL.
Relying Party (RP):
A Relying Party is a web application that wants a proof that the end user controls an Identifier.
User Supplied Identifier:
An Identifier that was presented by the end user to the RP, or selected by the user at the OpenID Provider. During the initiation phase of the protocol, an end user may enter either their own Identifier or an OP Identifier. If an OP Identifier is used, the OP may then assist the end user in selecting an Identifier to share with the RP.
3.2 Abbreviations p. 6
For the purposes of the present document, the abbreviations given in TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905.
AKA
Authentication and Key Agreement Protocol
AV
Authentication Vector
BSF
Bootstrapping Server Function
IdP
Identity Provider
GAA
Generic Authentication Architecture
GBA
Generic Bootstrapping Architecture
GPI
GBA Push Information
GUSS
GBA User Security Settings
HLR
Home Location Register
HSS
Home Subscriber Server
ME
Mobile Equipment
MNO
Mobile Network Operator
NAF
Network Application Function
OP
OpenID Provider
PAPE
Provider Authentication Policy Extension
RP
Relying Party
SLF
Subscriber Locator Function
SP
Service Provider
UE
User Equipment
USS
User Security Settings
