4A Generic Bootstrapping Achitecture Push; Upa

24.1093GPPBootstrapping interface (Ub) and network application function interface (Ua)Protocol detailsRelease 17TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

4A.1 Introduction

Generic Authentication Architecture (GAA) is based on shared secrets provided by generic bootstrapping architecture (GBA). The stage 2 description of GAA framework is described in 3GPP TR 33.919 [2] and the GBA-Push procedures in 3GPP TS 33.223 [24].

The GBA-Push related to the Upa interface is between a NAF and UE. GBA-Push is a mechanism to bootstrap the security between a NAF and a UE, without forcing the UE to contact the BSF to initiate the bootstrapping. GBA-Push is closely related to and builds upon GBA as specified in 3GPP TS 33.220 [1]. GBA-Push is intended for both GBA_U and GBA_ME environments. The end result of the bootstrapping procedure is that the NAF and the UE have security associations, called NAF SAs, in the form of unique identifiers for uplink and downlink references and NAF-key material as defined in 3GPP TS 33.223 [24]. The unique identifiers take the following forms:

RAND@’naf’: Identifies NAF SA in the UE (used by NAF).

Value of P-TID: Identifies NAF SA in the NAF (used by UE).

The GBA-Push procedure shall be based on a disposable-Ks model as described in 3GPP TS 33.223 [24]. The protocol stack of the Upa interface in GBA-Push procedure is presented in figure 4A.1-1. The details are defined in the following clauses.

Figure 4A.1-1: Protocol stack of Upa interface

The bootstrapping procedure described in the present document can result in different key materials depending on whether ME-based or UICC-based GBA is used. However, the bootstrapping procedure over Upa interface itself is the same for both ME-based GBA (GBA_ME), and UICC-based GBA (GBA_U).

4A.2 Bootstrapping procedure

The Push-NAF may initiate the bootstrapping procedure when:

a) the UE is registered for the intended service; and

b) the UE does not or can not perform a bootstrapping procedure directly with the BSF.

According to local policy, the Push-NAF may refresh the NAF SA before the expiry time of the NAF SA.

A Push-NAF and UE shall establish the NAF SA between them by running the bootstrapping procedure. The NAF SA consists of a NAF SA identifier, NAF-key material and. additional information as defined in 3GPP TS 33.223 [24]. The NAF SA is only valid for a certain time period, as determined by the NAF-key lifetime, and shall be deleted in the Push-NAF when the session expires.

The bootstrapping procedure shall be based on disposable Ks model and GBA-Push-Info (GPI) as defined in 3GPP TS 33.223 [24]. The Push-NAF pushes the GPI to the UE. The processing of GPI is defined in 3GPP TS 33.223 [24].

No specific transport method is mandated for transport of the GPI from the Push-NAF to the UE. However, when using specific transport methods, the transport address shall be determined as described in table 4A.2.1.

Table 4A.2.1: Transport addresses for Push message from Push-NAF to UE

Transport Method	Transport Address
SMS	MSISDN
MMS	MSISDN
SIP MESSAGE	IMPU
UDP	IP-Address

Annex J specifies the protocol details when using WAP Push via SMS for the transport of the GPI from the Push-NAF to the UE.

After a successful bootstrapping procedure and processing of the GPI, the UE and the Push-NAF have established NAF SAs as described in 3GPP TS 33.223 [24].

An example flow of a successful bootstrapping procedure can be found in clause A1.3.

4A.3 User authentication failure

User authentication is not applicable to GBA Push since all messages over the Upa interface are network initiated.

4A.4 Network authentication failure

In case the UE fails to authenticate the network, the UE shall abort the bootstrapping procedure.

4A.5 Synchronization failure

A disposable Ks model is used for GBA Push in order to avoid many synchronization problems. One situation when an out-of-synch problem will appear even with the adoption of the disposable Ks model is when the BSF may erase a valid Ks while the UE keeps it due to that the GBA Push message can not be validated at the UE. This will lead to an error situation if the UE tries to use a NAF specific key (Ks_(ext/int)_NAF) which is derived from such a Ks.

When this situation occurs, the Push-NAF will receive an error message from the BSF indicating that the Ks_(ext/int)_NAF (indicated by B‑TID) is not available. The Push-NAF shall send this error message to the terminal. Upon receipt of the error message, indicating that the NAF specific key material is not available at the BSF, the UE shall perform a new bootstrap.