EN/FAD How can AAA infrastructure support services and applications in roaming architectures Ericsson Bay Area Research (EBAR) Theodore Havinis
EN/FAD The future trust model Terminal/ User Visited Home PLMN operator Service Provider Service/ Content Provider Corporate Network for services that use resources in visited
EN/FAD Identifying the issues The FACT is: The AAA infrastructure has a role to play in the service plain The QUESTION is then: What is exactly the role that the AAA infrastructure could play in the service plain considering: –3G mobile roaming model –multimedia, e-Commerce applications etc.
EN/FAD Possible uses of AAA infrastructure End-User (EU) authentication –authentication always from EU-to-home Key distribution management –network-2-network (n2n) security is needed in some cases –AAA infrastructure is used for distributing keys. –Preparing for full IKE security association (SA) negotiation Transporting User profile Policy Decision Point
EN/FAD Home Distinguish btw E-U authentication and N2N security UA Home operator Home operator UA SIP Proxy SIP Proxy Home operator Home operator 3G SIP: Network-2-Network Visited End-User authentication IETF SIP: End-2-End N2N security End-User authentication In IETF SIP, the SIP proxy is transparent to End-User authentication In IETF SIP, the SIP proxy is transparent to End-User authentication In 3G, the SIP proxy cannot be transparent for various reasons, one being capability to route calls locally e.g E-911 In 3G, the SIP proxy cannot be transparent for various reasons, one being capability to route calls locally e.g E-911
EN/FAD Initial SAs: SIP Server at Home UEProxy AAAH SIP server AAAL LS Visited Home SA 2 K SA2 SA M KMKM KMKM SA 3 K SA3 SA 1 K SA1 Home network decides where the SIP server is located Home network decides where the SIP server is located UA Initial SAs according to roaming model Initial SAs according to roaming model 3G operators are considering gateways btw networks for protecting internal infrastructure 3G operators are considering gateways btw networks for protecting internal infrastructure
EN/FAD Initial SAs: SIP Server at Visited UEProxy AAAHAAAL LS Visited Home SA 2 K SA2 SA M KMKM KMKM SA 3 K SA3 Home network decides where the SIP server is located Home network decides where the SIP server is located UA SIP server UA Initial SAs according to roaming model Initial SAs according to roaming model 3G operators are considering gateways btw networks for protecting internal infrastructure 3G operators are considering gateways btw networks for protecting internal infrastructure
EN/FAD How can a AAA server be used with n2n What is the proposal 1To use the AAA infrastructure for provisioning the shared secrets. 2In addition, to use the AAA infrastructure for n2n authentication and security according to the selected mode of operation Modes of operation for Network-2-Network security –In -band: complete piggybacking of SIP:REGISTER and its response over AAA infrastructure –Out-of-band: complete piggybacking of SIP:REGISTER, SAs established when SIP:REGISTER sent externally –Transparent: AAA used only for establishing SAs.
EN/FAD Network-to-Network: In-band Home UEProxy AAAH SIP server AAAL LS Visited UA K s2 K s1 SIP: INVITE SIP: REGISTER PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, does Auth/Accounting & policy selection. Trusts established SIP:INVITE externally PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, does Auth/Accounting & policy selection. Trusts established SIP:INVITE externally Policies enabled
EN/FAD Network-to-Network: Out-of-band UEProxy AAAH SIP server AAAL LS 67 VisitedHome 910 UA K s1 K s2 SIP: INVITE SIP: REGISTER PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, just authentication done & policy downloaded to SIP server SIP:REGISTER sent externally and used for key distribution management, resulting in building-up trusts. SIP:INVITE externally PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, just authentication done & policy downloaded to SIP server SIP:REGISTER sent externally and used for key distribution management, resulting in building-up trusts. SIP:INVITE externally Policies enabled
EN/FAD Network-to-Network: Transparent UEProxy AAAH SIP server AAAL LS Visited Home UA K s2 K s1 SIP: INVITE SIP: REGISTER 78 PRINCIPLE AAA infrastructure used for key generation & policy downloading to SIP server. SIP:REGISTER sent externally and used for key distribution management, resulting in building up trusts. SIP:INVITE externally PRINCIPLE AAA infrastructure used for key generation & policy downloading to SIP server. SIP:REGISTER sent externally and used for key distribution management, resulting in building up trusts. SIP:INVITE externally Policies enabled
EN/FAD Thank you