Content for TR 33.880 Word version: 15.1.0
7 Potential security solutions p. 40
7.1 General p. 40
7.2 Cross-service security solutions p. 40
7.2.1 Solution #1.1 : KMS Discovery and redirection p. 40
7.2.1.1 Overview p. 40
7.2.1.2 Motivating security requirements p. 40
7.2.1.3 Solution description p. 41
7.2.1.3.1 Overview of KMS Redirect Response (KRR) p. 41
7.2.1.3.2 Use of KRRs p. 42
7.2.1.3.2.1 Content of KRRs p. 42
7.2.1.3.2.2 KRR creation procedure by a receiver p. 42
7.2.1.3.2.3 KRR creation procedure by a MCX server or signalling proxy p. 43
7.2.1.3.2.4 Processing a KRR at a MCX server or signalling proxy p. 43
7.2.1.3.2.5 KMS Selection at the initiator p. 44
7.2.1.3.3 Security procedures for KMS Redirection Response p. 45
7.2.1.3.4 Security Procedures for reporting external security domain use p. 47
7.2.1.3.5 Policy around use of external security domains p. 47
7.2.1.4 Evaluation against requirements p. 47
7.2.2 Solution #1.2 : Distribution of key material to protect signalling between the MCX Server and the MCX client p. 48
7.2.2.1 Overview p. 48
7.2.2.2 Motivating security requirements p. 48
7.2.2.3 Solution description p. 48
7.2.2.3.1 Introduction p. 48
7.2.2.3.2 CSK Upload to MCX Server p. 49
7.2.2.3.3 Key download from MCX Server p. 49
7.2.2.3.4 Security procedures for key download p. 49
7.2.2.3.5 Key download procedures p. 51
7.2.2.4 Evaluation against requirements p. 51
7.2.3 Solution #1.3 : Adding KMS security domain details to configuration data p. 52
7.2.3.1 Overview p. 52
7.2.3.2 Motivating security requirements p. 52
7.2.3.3 Solution description p. 52
7.2.3.3.1 Provisioning security parameters to support external security domains p. 52
7.2.3.3.2 Identification of External Security Domains p. 53
7.2.3.3.3 Use of Multiple Security Domains p. 54
7.2.3.4 Evaluation against requirements p. 54
7.2.4 Solution #1.4 : Encryption of entire XML signalling content p. 54
7.2.4.1 Overview p. 54
7.2.4.2 Motivating security requirements p. 55
7.2.4.3 Solution description p. 55
7.2.4.4 Evaluation against requirements p. 55
7.2.5 Solution #1.5 : Signalling Proxy p. 55
7.2.5.1 Overview p. 55
7.2.5.2 Motivating security requirements p. 56
7.2.5.3 Solution description p. 56
7.2.5.3.1 Overview p. 56
7.2.5.3.2 Location of a Signalling Proxy p. 57
7.2.5.3.2.1 Overview p. 57
7.2.5.3.2.2 Deployment with an untrusted SIP Core p. 57
7.2.5.3.2.3 Deployment with a trusted SIP Core p. 58
7.2.5.3.3 Functions of a signalling proxy p. 59
7.2.5.3.3.1 Overview p. 59
7.2.5.3.3.2 Identifier modification (topology hiding) p. 59
7.2.5.3.3.3 Resilience against signalling storm p. 59
7.2.5.3.3.4 Client connection to a CS Proxy p. 59
7.2.5.3.3.5 CSK key download from a CS Proxy p. 59
7.2.5.3.3.6 MuSiK and MSCCK key download from a CS Proxy p. 60
7.2.5.3.3.7 Signalling protection by the IS Proxy p. 60
7.2.5.3.3.8 Creation of KMS Redirect Responses (KRRs) p. 60
7.2.5.3.3.9 Policy enforcement p. 60
7.2.5.4 Evaluation against requirements p. 60
7.2.6 Solution #1.6 : Authentication of a sensitive signalling request (EAR) p. 60
7.2.6.1 Overview p. 60
7.2.6.2 Motivating security requirements p. 61
7.2.6.3 Solution description p. 61
7.2.6.3.1 Overview p. 61
7.2.6.3.2 Contents of an EAR p. 61
7.2.6.3.3 EAR Signatures p. 61
7.2.6.3.4 Relationship with MCData SDS p. 62
7.2.6.3.5 EAR Encryption p. 62
7.2.6.4 Evaluation against requirements p. 62
7.2.7 Solution #1.7 : EAR authorisation p. 62
7.2.7.1 Overview p. 62
7.2.7.2 Motivating security requirements p. 62
7.2.7.3 Solution description p. 63
7.2.7.3.1 Overview p. 63
7.2.7.3.2 Conveying authorisation p. 64
7.2.7.3.3 Adding authorisation to an EAR p. 65
7.2.7.3.3a Gaining authorisation p. 65
7.2.7.3.4 Bit fields for authorisation p. 66
7.2.7.3.4.1 General p. 66
7.2.7.3.4.2 Role authorisations p. 66
7.2.7.3.4.3 Authorisations for privileged signalling p. 67
7.2.7.3.4.4 Authorisations for off-network signalling p. 68
7.2.7.3.5 Example MC Service IDs with authorisation p. 68
7.3 Security solutions for the Common Functional Architecture (MC_ARCH) p. 69
7.4 Security solutions to enhance push-to-talk (eMCPTT) p. 69
7.4.1 Solution #3.1 : New bearer specific key for MBMS subchannel control message protection p. 69
7.4.1.1 Overview p. 69
7.4.1.2 Motivating security requirements p. 69
7.4.1.3 Solution description p. 69
7.4.1.4 Evaluation against requirements p. 71
7.4.2 Solution #3.2 : MKFC based protection for MBMS subchannel control messages p. 71
7.4.2.1 Overview p. 71
7.4.2.2 Motivating security requirements p. 71
7.4.2.3 Solution description p. 71
7.4.2.4 Evaluation against requirements p. 72
7.4.3 Solution #3.3 : New server specific key for MBMS subchannel control message protection p. 72
7.4.3.1 Overview p. 72
7.4.3.2 Motivating security requirements p. 72
7.4.3.3 Solution description p. 72
7.4.3.4 Evaluation against requirements p. 74
7.4.4 Solution #3.4 : Key management for Temporary Group Call - regroup call p. 74
7.4.4.1 Overview p. 74
7.4.4.2 Motivating security requirements p. 74
7.4.4.3 Solution description p. 74
7.4.4.4 Evaluation against requirements p. 76
7.4.5 Solution #3.5 : Concealment of group identifiers using group specific pseudonyms p. 76
7.4.5.1 Overview p. 76
7.4.5.2 Motivating security requirements p. 76
7.4.5.3 Solution description p. 76
7.4.5.4 Evaluation against requirements p. 78
7.4.6 Solution #3.6 : Concealment of group identifiers using session specific pseudonyms p. 78
7.4.6.1 Overview p. 78
7.4.6.2 Motivating security requirements p. 78
7.4.6.3 Solution description p. 78
7.4.6.4 Evaluation against requirements p. 80
7.4.7 Solution #3.7 : Key management for First-to-answer call p. 80
7.4.7.1 Overview p. 80
7.4.7.2 Motivating security requirements p. 80
7.4.7.3 Solution description p. 81
7.4.7.3.1 Introduction p. 81
7.4.7.3.2 First to Answer Request p. 81
7.4.7.3.3 First to Answer Response p. 81
7.4.7.3.4 First-to-answer Call Setup Procedures (including security) p. 81
7.4.7.4 Evaluation against requirements p. 83
7.5 Security solutions for data (MCData) p. 83
7.5.1 Solution #4.1 : SDS key distribution through signalling channel p. 83
7.5.1.1 Overview p. 83
7.5.1.2 Motivating security requirements p. 83
7.5.1.3 Solution description p. 83
7.5.1.3.1 General p. 83
7.5.1.3.2 Procedures for one-to-one key distribution for SDS p. 83
7.5.1.3.3 Procedures for group key distribution for SDS p. 84
7.5.1.3.4 Protection of SDS messaging p. 84
7.5.1.4 Evaluation against requirements p. 84
7.5.2 Solution #4.2 : SDS key distribution alongside messages p. 84
7.5.2.1 Overview p. 84
7.5.2.2 Motivating security requirements p. 85
7.5.2.3 Solution description p. 85
7.5.2.4 Evaluation against requirements p. 86
7.5.3 Solution #4.3 : MCData SDS protection p. 86
7.5.3.1 Overview p. 86
7.5.3.2 Motivating security requirements p. 86
7.5.3.3 Solution description p. 87
7.5.3.3.1 Key management for one-to-one SDS protection p. 87
7.5.3.3.2 Key management for group SDS protection p. 87
7.5.3.3.3 SDS protection (group and one-to-one SDS) p. 87
7.5.3.4 Evaluation against requirements p. 89
7.5.4 Solution #4.4 : MCData SDS/FD signalling and payload protection p. 89
7.5.4.1 Overview p. 89
7.5.4.2 Motivating security requirements p. 89
7.5.4.3 Solution description p. 89
7.5.4.3.1 Defined protected MCData payloads p. 89
7.5.4.3.2 Requirements for protected payloads Payload p. 90
7.5.4.3.3 Requirements for authenticated payloads p. 90
7.5.4.3.4 Key derivation for protected payloads p. 90
7.5.4.3.5 Format of protected payloads p. 90
7.5.4.3.6 Encryption of protected payloads p. 91
7.5.4.3.7 Authenticated payloads p. 91
7.5.4.4 Evaluation against requirements p. 92
7.5.5 Solution #4.5 : MCData Key management p. 92
7.5.5.1 Overview p. 92
7.5.5.2 Motivating security requirements p. 92
7.5.5.3 Solution description p. 92
7.5.5.4 Evaluation against requirements p. 93
7.5.6 Solution #4.6 : MCData key distribution p. 93
7.5.6.1 Overview p. 93
7.5.6.2 Motivating security requirements p. 93
7.5.6.3 Solution description p. 93
7.5.6.3.1 General p. 93
7.5.6.3.2 Distribution of CSK, MuSiK, SPK and GMK p. 93
7.5.6.3.3 Distribution of PCK to support one-to-one MCData service p. 93
7.5.6.4 Evaluation against requirements p. 94
7.6 Security solutions for video (MCVideo) p. 94
7.6.1 Solution #5.1: Mission critical video (MCVideo) p. 94
7.6.1.1 General p. 94
7.6.1.2 MCVideo key management functional model p. 94
7.6.1.3 MCVideo private and group key management p. 94
7.6.1.4 Protected MCVideo private communications p. 94
7.6.1.5 Protected MCVideo group communications p. 94
7.6.1.6 Application plane protection for MCVideo p. 95
7.6.1.7 Floor control protection for MCVideo p. 95
7.7 Security solutions for migration and interconnect (MCSMI) p. 95
7.8 Security solutions for interworking between LTE and non-LTE systems (MCCI) p. 97
7.8.1 Solution #7.1: MC Security Gateway (SeGy) acts as a single MC client p. 97
7.8.1.1 Overview p. 97
7.8.1.2 Motivating security requirements p. 97
7.8.1.3 Solution description p. 98
7.8.1.4 Evaluation against requirements p. 98
7.8.2 Solution #7.2: MC Security Gateway (SeGy) acts as many MC clients p. 98
7.8.2.1 Overview p. 98
7.8.2.2 Motivating security requirements p. 98
7.8.2.3 Solution description p. 99
7.8.2.4 Evaluation against requirements p. 99
7.8.3 Solution #7.3: MC Security Gateway (SeGy) acts as many migrated MC clients p. 99
7.8.3.1 Overview p. 99
7.8.3.2 Motivating security requirements p. 99
7.8.3.3 Solution description p. 99
7.8.3.4 Evaluation against requirements p. 100
7.8.4 Solution #7.4: MC Security Gateway (SeGy) acts as an external MC Domain p. 100
7.8.4.1 Overview p. 100
7.8.4.2 Motivating security requirements p. 100
7.8.4.3 Solution description p. 100
7.8.4.4 Evaluation against requirements p. 101
7.8.5 Solution #7.5: MC Security Gateway (SeGy) acts as a single user in an external MC Domain p. 101
7.8.5.1 Overview p. 101
7.8.5.2 Motivating security requirements p. 101
7.8.5.3 Solution description p. 101
7.8.5.4 Evaluation against requirements p. 101
7.8.6 Solution #7.6: Interworking security data management using MCData SDS when security data is home to non-3GPP system. p. 102
7.8.6.1 Overview p. 102
7.8.6.2 Motivating security requirements p. 102
7.8.6.3 Solution description p. 102
7.8.6.4 Evaluation against requirements p. 103
7.8.7 Solution #7.7: Interworking security data management using SIP MESSAGE message when security data is home to non-3GPP system. p. 103
7.8.7.1 Overview p. 103
7.8.7.2 Motivating security requirements p. 104
7.8.7.3 Solution description p. 104
7.8.7.4 Evaluation against requirements p. 105
