ETSI TS 133 310 V9.1.0 (2010-01) Technical Specification Universal Mobile Telecommunications System (UMTS); LTE; Network Domain Security (NDS); Authentication Framework (AF) (3GPP TS 33.310 version 9.1.0 Release 9) 3GPP TS 33.310 version 9.1.0 Release 9 1 ETSI TS 133 310 V9.1.0 (2010-01) Reference RTS/TSGS-0333310v910 Keywords LTE, SECURITY, UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http://portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. © European Telecommunications Standards Institute 2010. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE™ is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI 3GPP TS 33.310 version 9.1.0 Release 9 2 ETSI TS 133 310 V9.1.0 (2010-01) Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http://webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http://webapp.etsi.org/key/queryform.asp. ETSI 3GPP TS 33.310 version 9.1.0 Release 9 3 ETSI TS 133 310 V9.1.0 (2010-01) Contents Intellectual Property Rights ................................................................................................................................ 2 Foreword ............................................................................................................................................................. 2 Foreword ............................................................................................................................................................. 6 Introduction ........................................................................................................................................................ 6 1 Scope ........................................................................................................................................................ 7 2 References ................................................................................................................................................ 8 3 Definitions and abbreviations ................................................................................................................... 8 3.1 Definitions .......................................................................................................................................................... 8 3.2 Abbreviations ..................................................................................................................................................... 9 4 Introduction to Public Key Infrastructure (PKI) ...................................................................................... 9 4.1 Manual Cross-certification ................................................................................................................................. 9 4.2 Cross-certification with a Bridge CA ................................................................................................................. 9 5 Architecture and use cases of the NDS/AF ............................................................................................ 10 5.1 PKI architecture for NDS/AF ........................................................................................................................... 10 5.1.1 General architecture .................................................................................................................................... 10 5.1.1.1 NDS/IP case .......................................................................................................................................... 11 5.1.1.2 TLS case ................................................................................................................................................ 12 5.2 Use cases .......................................................................................................................................................... 13 5.2.1 Operator Registration: Creation of interconnect agreement ....................................................................... 13 5.2.2 Establishment of secure communications ................................................................................................... 14 5.2.2.1 NDS/IP case .......................................................................................................................................... 14 5.2.2.1.1 NDS/IP case for the Za interface ........................................................................................................... 14 5.2.2.1.2 NDS/IP case for the Zb-interface .......................................................................................................... 15 5.2.2.1 TLS case ................................................................................................................................................ 15 5.2.3 Operator deregistration: Termination of interconnect agreement ............................................................... 17 5.2.3a Interconnection CA registration .................................................................................................................. 17 5.2.3b Interconnection CA deregistration .............................................................................................................. 17 5.2.3c Interconnection CA certification creation ................................................................................................... 17 5.2.3d Interconnection CA certification revocation ............................................................................................... 17 5.2.3e Interconnection CA certification renewal ................................................................................................... 18 5.2.4 SEG/TLS CA registration ........................................................................................................................... 18 5.2.5 SEG/TLS CA deregistration ....................................................................................................................... 18 5.2.6 SEG/TLS CA certificate creation ............................................................................................................... 18 5.2.7 SEG/TLS CA certificate revocation ........................................................................................................... 18 5.2.8 SEG/TLS CA certificate renewal ................................................................................................................ 18 5.2.9 End entity registration ................................................................................................................................. 19 5.2.9.1 SEG registration .................................................................................................................................... 19 5.2.9.2 TLS client registration ........................................................................................................................... 19 5.2.9.3 TLS server registration .......................................................................................................................... 19 5.2.9.4 NE registration ...................................................................................................................................... 19 5.2.10 End entity deregistration ............................................................................................................................. 19 5.2.10.1 SEG deregistration ................................................................................................................................ 19 5.2.10.2 TLS client deregistration ....................................................................................................................... 19 5.2.10.3 TLS server deregistration ...................................................................................................................... 19 5.2.10.4 NE deregistration .................................................................................................................................. 20 5.2.11 End entity certificate creation ..................................................................................................................... 20 5.2.12 End entity certificate revocation ................................................................................................................. 20 5.2.13 End entity certificate renewal ..................................................................................................................... 20 5.2.14 NE CA deregistration.................................................................................................................................. 20 5.2.15 NE CA certification creation ...................................................................................................................... 20 5.2.16 NE CA certificate revocation ...................................................................................................................... 20 5.2.17 NE CA certificate renewal .......................................................................................................................... 20 ETSI 3GPP TS 33.310 version 9.1.0 Release 9 4 ETSI TS 133 310 V9.1.0 (2010-01) 6 Profiling .................................................................................................................................................. 21 6.1 Certificate profiles ............................................................................................................................................ 21 6.1.1 Common rules to all certificates ................................................................................................................. 21 6.1.2 Interconnection CA Certificate profile ....................................................................................................... 21 6.1.3 SEG Certificate profile ............................................................................................................................... 22 6.1.3a TLS entity certificate profile ....................................................................................................................... 22 6.1.3b NE Certificate profile.................................................................................................................................. 23 6.1.4 SEG CA certificate profile .......................................................................................................................... 23 6.1.4a TLS client/server CA certificate profile ...................................................................................................... 23 6.1.4b NE CA certificate profile ............................................................................................................................ 23 6.2 IKE negotiation and profiling ........................................................................................................................... 23 6.2.1 IKEv1 Phase 1 profile ................................................................................................................................. 23 6.2.1b IKEv2 profile .............................................................................................................................................. 24 6.2.2 Potential interoperability issues .................................................................................................................. 24 6.2a TLS profiling .................................................................................................................................................... 25 6.2a.1 TLS profile.................................................................................................................................................. 25 6.2a.2 Potential interoperability issues .................................................................................................................. 25 6.3 Path validation .................................................................................................................................................. 25 6.3.1 Path validation profiling ............................................................................................................................. 25 7 Detailed description of architecture and mechanisms ............................................................................ 25 7.1 Repositories ...................................................................................................................................................... 25 7.2 Life cycle management .................................................................................................................................... 28 7.3 Cross-certification ............................................................................................................................................ 29 7.4 Revoking a SEG/TLS CA cross-certificate ...................................................................................................... 29 7.5 Establishing secure connections between NDS/IP end entities using IKE on the Za interface ........................ 29 7.5a Establishing secure connections using TLS ..................................................................................................... 30 7.5b Establishing secure connections between NDS/IP entities on the Zb interface ................................................ 30 7.6 CRL management ............................................................................................................................................. 30 8 Backward compatibility for NDS/IP NE's and SEGs ............................................................................. 31 Annex A (normative): Critical and non critical Certificate Extensions .......................................... 32 Annex B (informative): Decision for the simple trust model .............................................................. 33 B.1 Introduction ............................................................................................................................................ 33 B.2 Requirements for trust model in NDS/AF .............................................................................................. 33 B.3 Cross-certification approaches ............................................................................................................... 33 B.3.1 Manual Cross-certification ............................................................................................................................... 33 B.3.2 Cross-certification with a Bridge CA ............................................................................................................... 34 B.4 Issues with the Bridge CA approach ...................................................................................................... 34 B.4.1 Need for nameConstraint support in certificates or strong legal bindings and auditing ................................... 34 B.4.2 Preventing name collisions ............................................................................................................................... 35 B.4.3 Two redundant steps required for establishing trust ......................................................................................... 35 B.4.4 Long certificate chains connected with IKE implementation issues ................................................................ 35 B.4.5 Lack of existing relevant Bridge CA experiences ............................................................................................ 36 B.5 Feasibility of the direct cross-certification approach ............................................................................. 36 B.5.1 Benefits of direct cross-certification................................................................................................................. 36 B.5.2 Memory and processing power requirements ................................................................................................... 37 B.5.3 Shortcomings .................................................................................................................................................... 37 B.5.4 Possible evolution path to a Bridge CA............................................................................................................ 37 Annex C (informative): Decision for the CRL repository access protocol for SEGs ....................... 38 Annex D (informative): Decision for storing the cross-certificates in CR ......................................... 39 Annex E (normative): TLS protocol profile ...................................................................................... 40 Annex F (informative): Manual handling of TLS certificates............................................................ 41 ETSI 3GPP TS 33.310 version 9.1.0 Release 9 5 ETSI TS 133 310 V9.1.0 (2010-01) F.1 TLS certificate enrolment ....................................................................................................................... 41 F.2 TLS Certificate revocation ..................................................................................................................... 41 Annex G (informative): Change history ....................................................................................................... 42 History .............................................................................................................................................................. 43 ETSI 3GPP TS 33.310 version 9.1.0 Release 9 6 ETSI TS 133 310 V9.1.0 (2010-01) Foreword This Technical Specification has been produced by the 3rd Generation Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction For 3GPP systems there is a need for truly scalable entity Authentication Framework (AF) since an increasing number of network elements and interfaces are covered by security mechanisms. This specification provides a highly scalable entity authentication framework for 3GPP network nodes. This framework is developed in the context of the Network Domain Security work item, which effectively limits the scope to the control plane entities of the core network. Thus, the Authentication Framework will provide entity authentication for the nodes that are using NDS/IP. Feasible trust models (i.e. how CAs are organized) and their effects are provided. Additionally, requirements are presented for the used protocols and certificate profiles, to make it possible for operator IPsec and PKI implementations to interoperate. ETSI 3GPP TS 33.310 version 9.1.0 Release 9 7 ETSI TS 133 310 V9.1.0 (2010-01) 1 Scope The scope of this Technical Specification is limited to authentication of network elements, which are using NDS/IP or TLS. In the case of NDS/IP this specification includes both the authentication of Security Gateways (SEG) at the corresponding Za-interfaces and the authentication between NEs and between NEs and SEGs at the Zb-interface. Authentication of end entities (i.e. NEs and SEGs) in the intra-operator domain is considered an internal issue for operators. This is quite much in line with [1] which states that only Za is mandatory and that the security domain operator can decide if the Zb-interface is deployed or not, as the Zb-interface is optional for implementation. Validity of certificates may be restricted to the operator's domain in case of Zb interface or in case of Za-interface between two security domains of the same operator. NOTE: In case two SEGs interconnect separate network regions under a single administrative authority (e.g. owned by the same mobile operator) then the Za-interface is not subject to interconnect agreements, but the decision on applying Za-interface is left to operators. The NDS architecture for IP-based protocols is illustrated in figure 1. Security Domain A Security Domain B NE NE A-1 B-1 Zb Zb Za Zb SEG SEG Zb A B Zb Zb NE NE A-2 B-2 IKE "connection" ESP tunnel Figure 1: NDS architecture for IP-based protocols [1] In the case of TLS this Specification concentrates on authentication of TLS entities across inter-operator links. For example, TLS is specified for inter-operator communications between IMS and non-IMS networks TS 33.203 [9] and on the Zn' interface in GBA TS 33.220 [10]. Authentication of TLS entities across intra-operator links is considered an internal issue for operators. However, NDS/AF can easily be adapted to the intra-operator use case since it is just a simplification of the inter-operator case when all TLS NEs and the PKI infrastructure belong to the same operator. Validity of certificates may be restricted to the operator's domain. An Annex contains information on the manual handling of TLS certificates in case automatic enrolment and revocation according to NDS/AF for TLS is not implemented. ETSI 3GPP TS 33.310 version 9.1.0 Release 9 8 ETSI TS 133 310 V9.1.0 (2010-01) 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. • References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. • For a specific reference, subsequent revisions do not apply. • For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. [1] 3GPP TS 33.210: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Network domain security; IP network layer security". [2] IETF RFC 2986: "PKCS#10 Certification Request Syntax Specification Version 1.7". [3] Void. [4] IETF RFC 4210: "Internet X.509 Public Key Infrastructure Certificate Management Protocol". [5] IETF RFC 2252: "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions". [6] IETF RFC 1981: "Path MTU Discovery for IP version 6". [7] "PKI basics – A Technical Perspective", November 2002, http://www.pkiforum.org/pdfs/PKI_Basics-A_technical_perspective.pdf [8] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". [9] 3GPP TS 33.203: "Access security for IP-based services". [10] 3GPP TS 33.220: "Generic Authentication Architecture: Generic Bootstrapping Architecture". [11] IETF RFC 2246: "The TLS Protocol Version 1.0". [12] IETF RFC 2560 (1999): "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP". [13] Void. [14] IETF RFC 5280: "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". [15] IETF RFC 4945: "The Internet IP Security PKI Profile of IKEv1/ISAKMP, IKEv2, and PKIX". 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the definitions given in TR 21.905 [8] and the following definitions apply: Interconnection CA: The CA that issues cross-certificates on behalf of a particular operator to the SEG CAs of other domains with which the operator"s SEGs have interconnection. Interconnect Agreement: In the context of this specification an interconnect agreement is an agreement by two operators to establish secure communications. This may be for the purpose of protecting various forms of communications between the operators, e.g. GPRS roaming, MMS interconnect, WLAN roaming and IMS interconnect. Local CR: Repository that contains cross-certificates. ETSI 3GPP TS 33.310 version 9.1.0 Release 9 9 ETSI TS 133 310 V9.1.0 (2010-01) Local CRL: Repository that contains cross-certificate revocations. PSK: Pre-Shared Key. Method of authentication used by IKE between SEG in NDS/IP [1]. Public CRL: Repository that contains revocations of SEG and CA certificates and can be accessed by other operators. SEG CA: The CA that issues end entity certificates to SEGs within a particular operator"s domain. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in TR 21.905 [8] and the following abbreviations apply: AF Authentication Framework CA Certification Authority CR Certificate Repository CRL Certificate Revocation List GBA Generic Bootstrapping Architecture IMS IP Multimedia Subsystem NDS Network Domain Security PKI Public Key Infrastructure PSK Pre-Shared Key SEG Security Gateway VPN Virtual Private Network Za Interface between SEGs belonging to different networks/security domains (a Za interface may be an intra or an inter operator interface). Zb Interface between SEGs and NEs and interface between NEs within the same network/security domain 4 Introduction to Public Key Infrastructure (PKI) PKI Forum's "PKI basics – A Technical Perspective" [7] provides a concise vendor neutral introduction to the PKI technology. Thus only two cross-certification aspects are described in this introduction section. Cross-certification is a process that establishes a trust relationship between two authorities. When an authority A is cross-certified with authority B, the authority A has chosen to trust certificates issued by the authority B. Cross- certification process enables the users under both authorities to trust the other authority's certificates. Trust in this context equals being able to authenticate. 4.1 Manual Cross-certification Mutual cross-certifications are established directly between the authorities. This approach is often called manual cross- certification. In manual cross-certification the authority makes decisions about trust locally. When an authority A chooses to trust an authority B, the authority A signs the certificate of the authority B and distributes the new certificate (B's certificate signed by A) locally. The disadvantage of this approach is that it often results in scenarios where there needs to be a lot of certificates available for the entities doing the trust decisions: There needs to be a certificate signed by the local authority for each security domain the local authority wishes to trust. However, all the certificates can be configured locally and are locally signed, so the management of them is often flexible. 4.2 Cross-certification with a Bridge CA The bridge CA is a concept that reduces the amount of certificates that needs to be configured for the entity that does the certificate checking. The name "bridge" is descriptive; when two authorities are mutually cross-certified with the bridge, the authorities do not need to know about each other. Authorities can still trust each other because the trust in this model is transitive (A trusts bridge, bridge trusts B, thus A trusts B and vice versa). The bridge CA acts like a bridge between the authorities. However, the two authorities shall also trust that the bridge does the right thing for them. ETSI