欢迎来到麦多课文档分享! | 帮助中心 海量文档,免费浏览,给你所需,享你所想!
麦多课文档分享
全部分类
  • 标准规范>
  • 教学课件>
  • 考试资料>
  • 办公文档>
  • 学术论文>
  • 行业资料>
  • 易语言源码>
  • ImageVerifierCode 换一换
    首页 麦多课文档分享 > 资源分类 > PDF文档下载
    分享到微信 分享到微博 分享到QQ空间

    ETSI TS 133 221-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) LTE Generic Authentication Architecture (GAA) Support f.pdf

    • 资源ID:743444       资源大小:183.17KB        全文页数:27页
    • 资源格式: PDF        下载积分:10000积分
    快捷下载 游客一键下载
    账号登录下载
    微信登录下载
    二维码
    微信扫一扫登录
    下载资源需要10000积分(如需开发票,请勿充值!)
    邮箱/手机:
    温馨提示:
    如需开发票,请勿充值!快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。
    如需开发票,请勿充值!如填写123,账号就是123,密码也是123。
    支付方式: 支付宝扫码支付    微信扫码支付   
    验证码:   换一换

    加入VIP,交流精品资源
     
    账号:
    密码:
    验证码:   换一换
      忘记密码?
        
    友情提示
    2、PDF文件下载后,可能会被浏览器默认打开,此种情况可以点击浏览器菜单,保存网页到桌面,就可以正常下载了。
    3、本站不支持迅雷下载,请使用电脑自带的IE浏览器,或者360浏览器、谷歌浏览器下载即可。
    4、本站资源下载后的文档和图纸-无水印,预览文档经过压缩,下载后原文更清晰。
    5、试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。

    ETSI TS 133 221-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) LTE Generic Authentication Architecture (GAA) Support f.pdf

    1、 ETSI TS 1Digital cellular telecoUniversal Mobile TelGeneric AutheSupport fo(3GPP TS 33.2TECHNICAL SPECIFICATION133 221 V13.0.0 (2016communications system (Phaelecommunications System (LTE; hentication Architecture (GAAt for subscriber certificates .221 version 13.0.0 Release 1316-01) hase 2+); (UMT

    2、S); A); 13) ETSI ETSI TS 133 221 V13.0.0 (2016-01)13GPP TS 33.221 version 13.0.0 Release 13Reference RTS/TSGS-0333221vd00 Keywords GSM,LTE,SECURITY,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF

    3、742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic

    4、and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) vers

    5、ion kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp

    6、If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying an

    7、d microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All r

    8、ights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered an

    9、d owned by the GSM Association. ETSI ETSI TS 133 221 V13.0.0 (2016-01)23GPP TS 33.221 version 13.0.0 Release 13Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is p

    10、ublicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the E

    11、TSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be,

    12、or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. Thes

    13、e should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“

    14、, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 22

    15、1 V13.0.0 (2016-01)33GPP TS 33.221 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 5g31 Scope 6g32 References 6g33 Definitions and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 7g34 Support for Subscriber Certificates

    16、8g34.1 Introduction 8g34.2 Reference model . 8g34.3 Network elements . 9g34.3.1 PKI Portal . 9g34.3.2 Bootstrapping Server Function . 9g34.3.3 User Equipment 9g34.4 Requirements and principles for issuing subscriber certificates . 9g34.4.1 Usage of Bootstrapping 9g34.4.2 Access independence 9g34.4.3

    17、 Roaming and service network support 9g34.4.4 Home operator control 10g34.4.5 Charging principles. 10g34.4.6 Subscriber Certificate Profile 10g34.4.7 Service Discovery . 10g34.4.8 Requirements on reference point Ua . 11g34.5 Certificate issuing architecture . 11g34.5.1 Reference point Ua . 11g34.5.1

    18、.1 General description . 11g34.5.1.2 Functionality and protocols . 12g34.5.1.2.1 PKCS#10 with HTTP Digest Authentication 12g34.5.1.2.2 Key Generation 12g34.6 Certificate issuing procedure 13g34.6.1 Certificate issuing . 13g34.6.2 CA Certificate delivery . 15g34.7 Functionality in presence of pre-cer

    19、tified key pair or pre-shared keys. 16g34.7.1 Presence of pre-certified key pair . 16g34.7.2 Presence of symmetric pre-shared key 17g3Annex A (informative): Key pair storage . 18g3A.1 Introduction 18g3A.2 Key pair storage use-cases . 18g3A.2.1 Key pair storage on the ME 18g3A.2.2 Key pair storage on

    20、 the UICC 18g3A.3 Threats associated with the key pair . 18g3A.3.1 Key pair generation 18g3A.3.2 Unauthorized usage of the private key . 18g3A.3.3 Portability . 19g3A.3.4 Environment . 19g3A.3.5 Threat to the required properties for digital signatures. 19g3A.4 Security risk analysis related to key p

    21、air storage . 20g3ETSI ETSI TS 133 221 V13.0.0 (2016-01)43GPP TS 33.221 version 13.0.0 Release 13A.4.1 Subscriber certificate use-cases 20g3A.4.1.1 Secure services 20g3A.4.1.2 Secure connectivity . 20g3A.4.2 Security risk analysis in some scenarios . 20g3A.4.2.1 Scenarios involving subscribers perso

    22、nal data . 21g3A.4.2.1.1 Self-service management 21g3A.4.2.1.2 Security Risk Analysis in this scenario . 21g3A.4.2.2 Scenarios involving payment and agreement between operator and service provider 22g3A.4.2.2.1 Notifications through cellular network scenario . 22g3A.4.2.2.2 Small to medium payment t

    23、hrough cellular operator scenario 22g3A.4.2.2.3 Security Risk Analysis in these scenarios . 23g3A.4.3 Summary of risk analysis . 24g3Annex B (informative): Change history . 25g3History 26g3ETSI ETSI TS 133 221 V13.0.0 (2016-01)53GPP TS 33.221 version 13.0.0 Release 13Foreword This Technical Specific

    24、ation has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with

    25、 an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for a

    26、ll changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. ETSI ETSI TS 133 221 V13.0.0 (2016-01)63GPP TS 33.221 version 13.0.0 Release 131 Scope The present document describes

    27、subscriber certificate distribution by means of generic bootstrapping architecture (GBA) TS 33.220 11. Subscriber certificates support services whose provision the mobile operator assists, as well as services that are offered by the mobile operator. The scope of this specification presents signallin

    28、g procedures for support of issuing certificates to subscribers and the standard format of certificates and digital signatures. It is not intended to duplicate existing standards being developed by other groups on these topics, and will reference these where appropriate. 2 References The following d

    29、ocuments contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subsequent revisions do not apply. For

    30、 a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 IETF RFC 2986 : “ PKCS#10 Certification Re

    31、quest Syntax Standard“ Version 1.7 (2000). 2 IETF RFC 2510: “Internet X.509 Public Key Infrastructure Certificate Management Protocols“. 3 IETF RFC 2511: “Internet X.509 Certificate Request Message Format“. 4 IETF RFC 2527: “Internet X.509 Public Key Infrastructure Certificate Policy and Certificati

    32、on Practices Framework“. 5 Void. 6 IETF RFC 3280: “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile“. 7 OMA Security: “Certificate and CRL Profiles“, version 1.1 (2004). 8 OMA Security: “Wireless Identity Module; Part: Security, version 1.2 (2005). 9

    33、 OMA Security: “Wireless Application Profile; Public Key Infrastructure Definition“, version 1.2 (2005). 10 ITU-T Recommendation X.509 (1997) | ISO/IEC 9594-8:1997: “Information Technology - Open Systems Interconnection - The Directory: Authentication Framework“. 11 3GPP TS 33.220: “3rd Generation P

    34、artnership Project; Technical Specification Group Services and System Aspects; Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture“. 12 Void 13 Void. 14 OMA: “Crypto Object for the ECMAScript Mobile Profile“, version 1.1 (2005). 15 IETF RFC 3546: “Transport Layer Security (

    35、TLS) Extensions“. 16 Void. ETSI ETSI TS 133 221 V13.0.0 (2016-01)73GPP TS 33.221 version 13.0.0 Release 1317 IETF RFC 3039: “Internet X.509 Public Key Infrastructure Qualified Certificates Profile“. 18 ETSI TS 101 862: “Qualified certificate profile“. 19 OMA: “Provisioning Content Version 1.1“ (2005

    36、). 20 3GPP TS 24.109: “Bootstrapping interface (Ub) and Network application function interface (Ua); Protocol details“. 21 Void 22 IETF RFC 2797: “Certificate Management Messages over CMS“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms

    37、and definitions apply. Subscriber certificate: a certificate issued to a subscriber. It contains the subscribers own public key and possibly other information such as the subscribers identity in some form. CA certificate: A Certificate Authority signs all certificates that it issues with its private

    38、 key. The corresponding Certificate Authority public key is itself contained within a certificate, called a CA Certificate. 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: AK Anonymity Key AKA Authentication and Key Agreement B-TID Bootstrapping Transac

    39、tion Identifier blob Binary Large Object BSF Bootstrapping Server Function CA Certificate Authority CMC Certificate Management Messages over CMS CMP Certificate Management Protocols CMS Cryptographic Message Syntax GAA Generic Authentication Architecture GBA Generic Bootstrapping ArchitectureHSS Hom

    40、e Subscriber System IK Integrity Key MNO Mobile Network Operator NAF Network Application Function PKCS Public-Key Cryptography Standards PKI Public Key Infrastructure UE User Equipment ETSI ETSI TS 133 221 V13.0.0 (2016-01)83GPP TS 33.221 version 13.0.0 Release 134 Support for Subscriber Certificate

    41、s 4.1 Introduction Digital signatures can be used, for instance, to secure mobile commerce, service authorization and accounting. But digital signature by itself is not enough; there is need of a global support for authorization and charging. This TS specifies a global and secure authorization and c

    42、harging infrastructure of mobile networks to support a local architecture for digital signatures. Subscriber certificates, issued using the mechanisms described in this TS, provide a migration path towards global Public Key Infrastructure (PKI). A local architecture for digital signatures can be dep

    43、loyed incrementally; one operator can choose to deploy independently of the others. On the other hand, the existence of subscribers and service providers that use digital signatures makes it easier to build a global PKI. 3GPP systems shall issue subscriber certificates in order to authorize and acco

    44、unt for service usage both in home and in visited networks. This requires specification of: 1. procedures to issue temporary or long-term certificates to subscribers; 2. standard format of certificates and digital signatures, e.g. re-using OMA wireless PKI specifications. The mechanism shall allow a

    45、 cost efficient implementation of the security support of the UE. It will also enable a users anonymity towards the service provider, whilst the user who invokes the service, can be identified by the network. Open Mobile Alliance offers an alternative solution for certificate enrolment (c.f. subclau

    46、se 4.5) Subscriber certificates support services whose provision the mobile operator assists, as well as services that the mobile operator provides. There is no need to standardize those services in this TS. Also, the communication between service provider and the operator (in the role of certificat

    47、e issuer) need not be standardized in this TS. 4.2 Reference model Figure 1 shows a simple network model of the entities involved in the certificate issuing, and the reference points used between the network entities. Figure 1: Simple network model for certificate issuing UE PKI Portal (NAF) BSF Ub

    48、Ua Zn ETSI ETSI TS 133 221 V13.0.0 (2016-01)93GPP TS 33.221 version 13.0.0 Release 134.3 Network elements 4.3.1 PKI Portal A PKI Portal shall issue a certificate for UE and deliver an operator CA certificate. In both cases, requests and responses are protected by shared key material that has been pr

    49、eviously established between UE and a BSF. In PKI terms, the PKI portal is a Registration Authority (RA) who authenticates the certification request based on cellular subscription. PKI Portal may also function as a Certification Authority (CA) who issues certificates. However, this task may also be done in an existing PKI infrastructure towards which the PKI Portal would function as a RA only, and the CA would be in the PKI infrastructure. 4.3.2 Bootstrapping Server Function The bootstrapping server function (BSF) shall


    注意事项

    本文(ETSI TS 133 221-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) LTE Generic Authentication Architecture (GAA) Support f.pdf)为本站会员(arrownail386)主动上传,麦多课文档分享仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文档分享(点击联系客服),我们立即给予删除!




    关于我们 - 网站声明 - 网站地图 - 资源地图 - 友情链接 - 网站客服 - 联系我们

    copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
    备案/许可证编号:苏ICP备17064731号-1 

    收起
    展开