GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual...
Transcript of GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual...
![Page 1: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/1.jpg)
GAA/GBA: a new Architecturefor single sign-on
2nd ETSI Security Workshop: Future Security16-17 January 2007 Sophia- Antipolis (France)
ACELERAR PARA SER MÁS LÍDERES
Wednesday, 17th January 2007
Telefónica Spain
![Page 2: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/2.jpg)
1Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA
04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 3: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/3.jpg)
2Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 4: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/4.jpg)
3Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
01 GAA (Generic Authentication Architecture )
NE
GBA
AP
Certificates
HSS
UE
GAA
![Page 5: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/5.jpg)
4Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
01 GAA Protocols
GAA System Description TR 33.919
GAAHTTPS
TS33.222
GAA GBA TS 33.220
HTTP Digest AKARFC 3310
IMS Cx Diameter message definitionsTS 29.229
Diameter RFC 3588SCTP
IP
GAA Zh and ZnTS 29.109
Zh Zn
GAA Ub & UaTS 24.109
HTTPTCP
GAASSCTS
33.221UbUa
HTTP DigestRFC 2617 *
Interfaces andspecifications
* The GAA supports potentially many protocols on Ua Interface (eg. HTTP digest)
![Page 6: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/6.jpg)
5Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
01 Basic Authentication Mechanism
GBA (Generic Bootstrapping Architecture) Mechanism of application independent based on 3GPP AKAShared key between client and ASEg.: HTTP Digest, IKE …
SSC (Support for Subscriber Certificates) Authentication based on public-private key and certificatesA PKI infrastructure is neededEg: PGP, HTTP over TLS
Access to AS by HTTPS User authentication based on HTTP over TLSPossible with GBA and SSC
![Page 7: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/7.jpg)
6Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 8: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/8.jpg)
7Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
02 General Description Example: Buy contents in a content provider with secure commercial transactions
1. Get certificate for authenticating with content provider (first time)2. Authentication is done
Steps1. Authentication for a secure context establishment based on shared key (GBA)2. Use the secure context to get certificates from PKI (SSC)3. Use of certificates with third parties (SSC)
GAA (GenericAuthenticationArchitecture)
User Content provider
![Page 9: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/9.jpg)
8Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Entities
1. UE - BSF (Ub) : Negotiation of session shared key Ks (GBA)2. UE – Portal PKI (Ua): Process for getting certificates for user and CA (SSC)3. UE – AS (Ua) : User uses his/her certificate with third parties based on PKI (SSC)
02
UE
PKI Portal BSF AS (Service provider)
HSS
Zh
Ub
Zn
UaUa
![Page 10: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/10.jpg)
9Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
02 Bootstrapping
UE NAF PKIUa
Needed Ks generation. Bootstrapping starts
BSF HSS
Checks AUTN andgenerates RES
Check challege. Ks=Ck||Ik
ZhUb
2- 401 Unauthorized
3- HTTP Request4- Get AV
5- 401 Unauthorized (challenge)
6- Challenge response
7- 200 OK
1- HTTP request inicial
A security association between UE and PKI is created (confidentiality, integrity...)
![Page 11: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/11.jpg)
10Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
02 User’s Certificate
UE PKIUa
Generates Ks_NAF from Ks and B_TID
BSFUb
Zn
Authenticates and generates certificate
Verify values of Authentication-Info header. If success, certificates is
accepted
8- Challenge response9- Gets Ks_NAF
10- 200 OK
![Page 12: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/12.jpg)
11Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
02 CA’s certificate
UE PKIUa
If UE has no keys, they are generated by bootstraping process
Authenticates and generates certificate. Access to BSF for
getting info needed
UE receives the response, checks values and if success acepts
certificate
12- 401 Unauthorized
13- Response challenge
11- Request CA’s certificate
14- 200 OK
![Page 13: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/13.jpg)
12Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
02 Access to the service providerUser has user’s certificate with public key signed with CA’s private keyUser has CA’s certificate with CA’s public key User has the following security services
AuthenticationIntegrityConfidentialityNo repudiation
![Page 14: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/14.jpg)
13Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 15: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/15.jpg)
14Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
03 GBA Architecture
UE
HSS
BSF
Ua Ub
Zh Zn'
NAF
Zn-Proxy
Zn
Visited network Home network Untrusted network
Zn-Proxy (Diameter Proxy)Proxy between visited NAF and
local BSCreates a secure connection and
checks if there is communications between NAF and BSF
Security level ≥ highest NAF’ssecurity level
If BSF and NAF are in different networks, Zn and Zn’ shall be protected by TLS
BSF (Bootstrapping Server Function)Controlled by local operatorIn charge of establishing shared
key with UE using AKANAF (Network Application Function)
Similar to an AS in IMSHSS (Home Subscriber Server)
![Page 16: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/16.jpg)
15Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
03 GBA Operations
UE
HSS
BSF
UaUb
Zh Zn
NAF
Mutual authentication UE and BSF based on AKA
After this sessions keys are agreed
Ks
Ks
B_TID
B_TID
BSF access to HSS in order toget info for GBA process
GUUS (GBA User SecuritySettings)
GUUS
After bootstrapping between UE and BSF, UE and NAF may use some authentication protocol based on key sessions previously generated
Ks_NAF key generated by Ks will be used for secure connections
Ks_NAF
Ks_NAF
![Page 17: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/17.jpg)
16Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
GBA Push extensionEarly stage of developmentNo needed that UE contacts BSF to start bootstrapping.All bootstrapping process goes through NAF‘Up’ defined to transmit Push information from BSF to UE
03
UE
HSS
BSF
UaUp
Zh Zn
NAFSLF
Dz
¿GAA?¿GAA?
Arq. ServiciosArq. Servicios
![Page 18: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/18.jpg)
17Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
03 2G GBA extensionProblem:
MILLIONS of users still with SIM cards!Security in 2G lower than in 3G
ObjectiveEnables GAA services for 2G users ⇒ adapt GAA elements for using with 2G GBA
Main changesBootstrapping remain without significant changesParameter and algorithms adaptation in order to use with 2G GBA
![Page 19: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/19.jpg)
18Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 20: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/20.jpg)
19Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
04 Characteristics
Based on public/private key mechanisms and digital certificatesPKI infrastructure is needed More security than shared keyUser gets certificates from CA and access to AS with themWorks in roamingHome operator controls subscriber's certificates emission based on GUSS (GBA User Security Settings)Uses X.509 certificates
![Page 21: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/21.jpg)
20Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
04 SSC Architecture
PKI acts as a CA and RARequest and responses to/from
PKI shall be protected (Uainterface) with shared key
previously generated between UE and BSF
BSF provides the authentication info needed by PKI
This info is in USS (User Security Settings) stored in HSS
UE
PKI Portal (NAF)
BSF
Ub
Ua
Zn
Ks
Ks
Ks_NAFUE shall be able to generate pairs of public/private keys, to store the
private key and to protect the private key
![Page 22: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/22.jpg)
21Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 23: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/23.jpg)
22Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
05 Access to AS by HTTPSAuthentication between UE and AS using HTTPS
Without Authentication ProxyAS authenticates directly the UE using GAA mechanisms
Authentication Proxy (NAF≡AP)Authorization and authentication delegated to APAP authenticates the UE and resend the UE’s identity to ASAP can use any GAA mechanism for UE authentication
AP
Presence
Messaging
Conferencing
Other services
UE
Ua (HTTP)
Ut (HTTP)
Zb/Za(HTTP)
![Page 24: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/24.jpg)
23Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
Agenda
01 GAA
02 EXAMPLE OF GAA APPLICATION
03 GBA04 SSC
05 HTTPS
06 CONCLUSIONS
![Page 25: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/25.jpg)
24Telefónica SpainLuis Angel Galindo
ACELERAR PARA
SER MÁS LÍDERES
06 CONCLUSIONSGAA
Created in order to ensure an security environment in accessing to services in AS from a mobile handset3GPP standards are based in PKI and symmetric technologiesTwo main mechanism:
Shared key: GBA.Asymmetric key and digital certificates: SSC.
GBA SSC
Advantages Medium security High security
DisadvantagesLess security that asymmetric key
systems
Higher computational load
A PKI infrastructure is needed to generate
certificates
![Page 26: GAA/GBA: a new Architecture for single sign-on€¦ · HSS BSF NAF Ub Ua Zh Zn Mutual authentication UE and BSF based on AKA After this sessions keys are agreed Ks Ks B_TID B_TID](https://reader034.fdocuments.us/reader034/viewer/2022042409/5f2597df0f745b669d1aa267/html5/thumbnails/26.jpg)