7.8 Security Enhancements for ims (ims-Sec) uid_370078

Resources: S3,C1,C4

References

Document	Title/Contents
WID(s)
SP-070496	S3 WID on Security Enhancements for IMS
CP-070781	C1 WID on NASS Bundled Authentication
Impacted Specifications
TS 23.008	Organization of subscriber data - C4 (Add line identity relating to NBA over the Cx interface)
TS 24.229	Internet Protocol (IP) multimedia call control protocol based on Session Initiation Protocol (SIP) and Session Description Protocol (SDP); Stage 3 - C1 (Specify NBA as alternative to existing security mechanisms)
TS 29.228	IP Multimedia (IM) Subsystem Cx and Dx Interfaces; Signalling flows and message contents - C4 (Add parameters, information element names and mappings relating to NBA over the Cx interface)
TS 29.229	Cx and Dx interfaces based on the Diameter protocol; Protocol details - C4 (Add ABNF relating to NBA over the Cx interface)
TS 33.141	Presence service; Security
TS 33.203	3G security; Access security for IP-based services
TS 33.803	Coexistence between TISPAN and 3GPP authentication schemes
TS 33.978	Security aspects of early IP Multimedia Subsystem (IMS)
New Dedicated Specifications/Reports
-	-

Supporting Individual Members: Alcatel-Lucent, BT, Ericsson, Nokia Siemens Networks, Nokia, Rogers Wireless, Telecom Italia, Telenor, T-Mobile, Vodafone.

UID	Name	Resource	Hyperlink	TS_TR
370078	Security Enhancements for IMS	S3,C1,C4	SP-070496	-
360017	Stage 2 for IMS-Sec	S3	SP-070496	33.203, 33.141, 33.803
390054	CT1 part of Stage 3 for IMS-Sec	C1	-	-
390154	CT4 part of Stage 3 for IMS-Sec	C4	-	-
380012	CT1 part of NASS Bundled Authentication	C1	CP-070781	24.229
380013	CT4 part of NASS Bundled Authentication	C4	CP-070781	29.229, 29.228, 23.008

SA3 extended the existing IMS security architecture to meet the new security requirements coming from common IMS.

Stage 2 security enhancements for IMS address TS 33.203, TS 33.141, TR 33.978, TR 33.828 and TR 33.803. A series of normative annexes added to TS 33.203, take into account alternative authentication methods to Full IMS AKA:

• NASS-IMS Bundled Authentication (NBA);

• SIP Digest - based authentication;

• Access security with TLS;

• 3GPP2 Access;

Another new annex covers the co-existence of authentication schemes; explaining how to handle in Common IMS the following authentication mechanisms: Full IMS AKA, Early IMS (re-named GIBA, GPRS-IMS Bundled Authentication), NBA, SIP Digest.

SA3 continued the work on co-existence of authentication schemes, ensuring that all IMS security solutions could co-exist. It assessed how an operator can control what authentication schemes can be used in his network.

SA3 identified requirements and specified solutions on media protection for IMS.

SA3 identified which parts of the work performed in TISPAN should be moved to 3GPP, and how the work in TISPAN is integrated into 3GPP specifications.

SA3 specified mechanisms to protect users from unsolicited IMS communication and reduced the number of options for solving the same requirement. Lawful interception was also covered.

CT WGs work on NASS (Network Attachment Sub-System) Bundled Authentication

TISPAN R1 has an authentication mechanism entitled NASS Bundled Authentication (NBA). NBA works by extending the successful authentication in the NASS layer to the service layer.

During the network attachment, the NASS authenticates the UE and allocates an IP address. It stores the layer‑2 and layer‑3 identities in the NASS profile. When UE registers with the P‑CSCF, the P‑CSCF queries the NASS (actually the CLF functional entity), to obtain its location information. The P‑CSCF embeds the location information into the SIP message and forwards it towards the S‑CSCF for verification. The S‑CSCF verifies this location information with the location information obtained from the UPSF. On successful verification, the user is authenticated at the IMS layer.

As part of the Common IMS work, SA3 have agreed to re-document the TISPAN R1 mechanism as a normative annex to TS 33.203. As a result, work is necessary in specifications owned by TSG CT. Preventing fraud attack is an important aspect of this WID that CT1 must implement in the protocol based on the SA3 requirements.

CT1, CT4 documented NASS Bundled Authentication (NBA) in TSG CT owned specifications.