TR 33.804
Single Sign On (SSO) Application Security
for Common IMS based on SIP Digest

3GPP‑Page fToC_↓ Partial Content _→

V12.0.0 (Wzip) 2013/06 47 p.

V11.2.0 2013/06 47 p.

Rapporteur:: Dr. Holtmanns, Silke
Nokia Networks Oy

full Table of Contents for TR 33.804 Word version: 12.0.0

each clause number in 'red' refers to the equivalent title in the Partial Content

Introduction p. 4

Scope p. 5

References p. 5

Definitions, symbols and abbreviations p. 6

3.1	Definitions p. 6
3.2	Abbreviations p. 6

Description of SSO feature p. 6

System architecture and assumptions p. 7

5.1

Overview of Existing Systems p. 7

5.1.1	Use of SIP Digest in Common IMS p. 7
5.1.2	Uses of GBA p. 7

5.2

High-level architecture for SSO to applications for Common IMS based on SIP Digest p. 11

5.3

Support for the Ut reference point p. 12

5.4

Interworking with Liberty Alliance p. 13

5.5

Interworking with OpenId p. 14

Security requirements p. 16

Solutions p. 17

7.1

General p. 17

7.2

Solution 1 - SIP Digest based GBA solution p. 17

7.2.1	Solution 1 - Architecture for SIP Digest based GBA (GBA_Digest) p. 17
7.2.2	SIP Digest based GBA (GBA_Digest) bootstrapping procedure and its use p. 19
7.2.3	Interworking of SIP digest based GBA with other SSO systems p. 22
7.2.4	Evaluation p. 22

7.3

Solution 2 - SIP Digest based Authentication and Lightweight Security (SDALS) solution p. 25

7.3.1

Architecture and Interworking for SDALS p. 25

7.3.1.1

Solution 2 - High-level architecture p. 25

7.3.1.2

Interworking of SDALS (solution 2) with other SSO systems p. 26

7.3.1.2.1	Background p. 26
7.3.1.2.2	Co-hosting AS and OP p. 26
7.3.1.2.3	Co-hosting AS and IdP (Liberty Alliance) p. 27
7.3.1.2.4	Co-hosting IdP (SSO Server) and OP p. 28

7.3.2

Message Flows for Solution 2 SDALS p. 29

7.3.2.1	Basic message flow p. 29
7.3.2.2	Message Flow with IdP (SSO Server) and OP co-hosting p. 32
7.3.2.3	Message Flow with AS and OP co-hosting p. 34
7.3.2.4	Solution 2 (SDALS) - Improvements with RP authentication for IdP (SSO Server) and OP co-hosting case p. 37

7.3.3

Solution 2 SDLAS - evaluation p. 42

7.4

The Use of protocol binding for SIP Digest over TLS to prevent MitM attacks p. 42

Use of the key derivation function p. 45

A.1	Derivation of passwd and Ks p. 45
A.2	NAF specific key derivation in GBA_Digest p. 45

Change history p. 47

TR 33.804 Single Sign On (SSO) Application Security for Common IMS based on SIP Digest

full Table of Contents for TR 33.804 Word version: 12.0.0

TR 33.804
Single Sign On (SSO) Application Security
for Common IMS based on SIP Digest