6 API Definitions

29.3093GPPBootstrapping Server Function (GBA BSF) ServicesRelease 17TS

6.1 Nbsp_GBA Service API

6.1.1 Introduction

The Nbsp_GBA service shall use the Nbsp_GBA API.

The API URI of the Nbsp_GBA API shall be:

{apiRoot}/<apiName>/<apiVersion>

The request URIs used in HTTP requests from the NF service consumer towards the NF service producer shall have the Resource URI structure defined in clause 4.4.1 of 3GPP TS 29.501 [5], i.e.:

{apiRoot}/<apiName>/<apiVersion>/<apiSpecificResourceUriPart>

with the following components:

– The {apiRoot} shall be set as described in 3GPP TS 29.501 [5].

– The <apiName> shall be "nbsp-gba".

– The <apiVersion> shall be "v1".

– The <apiSpecificResourceUriPart> shall be set as described in clause 6.1.3.

6.1.2 Usage of HTTP

6.1.2.1 General

HTTP/2, IETF RFC 7540 [11], shall be used as specified in clause 5 of 3GPP TS 29.500 [4].

HTTP/2 shall be transported as specified in clause 5.3 of 3GPP TS 29.500 [4].

The OpenAPI [6] specification of HTTP messages and content bodies for the Nbsp_GBA API is contained in Annex A.

6.1.2.2 HTTP standard headers

6.1.2.2.1 General

See clause 5.2.2 of 3GPP TS 29.500 [4] for the usage of HTTP standard headers.

6.1.2.2.2 Content type

JSON, IETF RFC 8259 [12], shall be used as content type of the HTTP bodies specified in the present specification as specified in clause 5.4 of 3GPP TS 29.500 [4]. The use of the JSON format shall be signalled by the content type "application/json".

"Problem Details" JSON object shall be used to indicate additional details of the error in a HTTP response body and shall be signalled by the content type "application/problem+json", as defined in IETF RFC 7807 [13].

6.1.2.3 HTTP custom headers

The mandatory HTTP custom header fields specified in clause 5.2.3.2 of 3GPP TS 29.500 [4] shall be supported, and the optional HTTP custom header fields specified in clause 5.2.3.3 of 3GPP TS 29.500 [4] may be supported.

6.1.3 Resources

In this release of this specification, no resources are defined for the Nbsp_GBA service.

6.1.3.1 Overview

The structure of the Resource URIs of the Nbsp_GBA service is shown in figure 6.1.3.1-1.

Figure 6.1.3.1-1: Resource URI structure of the Nbsp_GBA API

6.1.4 Custom Operations without associated resources

6.1.4.1 Overview

Table 6.1.4.1-1: Custom operations without associated resources

Operation Name

Custom operation URI

Mapped HTTP method

Description

Bootstrapping Info Retrieval

/bootstrapping-info-retrieval

POST

Push Info Retrieval

/push-info-retrieval

POST

6.1.4.2 Operation: Bootstrapping Info Retrieval

6.1.4.2.1 Description
6.1.4.2.2 Operation Definition

This operation shall support the response data structures and response codes specified in tables 6.1.4.2.2-1 and 6.1.4.2.2-2.

Table 6.1.4.2.2-1: Data structures supported by the POST Request Body

Data type

P

Cardinality

Description

BootstrappingInfoRequest

M

1

Request body of the Bootstrapping Info Request

Table 6.1.4.2.2-2: Data structures supported by the POST Response Body

Data type

P

Cardinality

Response

codes

Description

BootstrappingInfoResponse

M

1

200 OK

A response body containing the BootstrappingInfoResponse shall be returned.

RedirectResponse

O

0..1

307 Temporary Redirect

Temporary redirection. The response shall include a Location header field containing a different URI. The URI shall be an alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

RedirectResponse

O

0..1

308 Permanent Redirect

Permanent redirection. The response shall include a Location header field containing a different URI. The URI shall be an alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

ProblemDetails

O

0..1

403 Forbidden

The NAF is not authorized to request Bootstrapping Information from the GBA BSF.

NOTE: The mandatory HTTP error status code for the POST method listed in Table 5.2.7.1-1 of 3GPP TS 29.500 [4] also apply.

Table 6.1.4.2.2-3: Headers supported by the 307 Response Code

Name

Data type

P

Cardinality

Description

Location

string

M

1

An alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

3gpp-Sbi-Target-Nf-Id

string

O

0..1

Identifier of the target NF (service) instance ID towards which the request is redirected.

Table 6.1.4.2.2-4: Headers supported by the 308 Response Code

Name

Data type

P

Cardinality

Description

Location

string

M

1

An alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

3gpp-Sbi-Target-Nf-Id

string

O

0..1

Identifier of the target NF (service) instance ID towards which the request is redirected.

6.1.4.3 Operation: Push Info Retrieval

6.1.4.3.1 Description
6.1.4.3.2 Operation Definition

This operation shall support the response data structures and response codes specified in tables 6.1.4.3.2-1 and 6.1.4.3.2-2.

Table 6.1.4.3.2-1: Data structures supported by the POST Request Body

Data type

P

Cardinality

Description

PushInfoRequest

M

1

Request body of the Push Info Request

Table 6.1.4.3.2-2: Data structures supported by the POST Response Body

Data type

P

Cardinality

Response

codes

Description

PushInfoResponse

M

1

200 OK

A response body containing the PushInfoResponse shall be returned.

RedirectResponse

O

0..1

307 Temporary Redirect

Temporary redirection. The response shall include a Location header field containing a different URI. The URI shall be an alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

RedirectResponse

O

0..1

308 Permanent Redirect

Permanent redirection. The response shall include a Location header field containing a different URI. The URI shall be an alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

ProblemDetails

O

0..1

403 Forbidden

The Push-NAF is not authorized to request GBA Push Information (GPI) from the GBA BSF.

NOTE: The mandatory HTTP error status code for the POST method listed in Table 5.2.7.1-1 of 3GPP TS 29.500 [4] also apply.

Table 6.1.4.3.2-3: Headers supported by the 307 Response Code

Name

Data type

P

Cardinality

Description

Location

string

M

1

An alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

3gpp-Sbi-Target-Nf-Id

string

O

0..1

Identifier of the target NF (service) instance ID towards which the request is redirected.

Table 6.1.4.3.2-4: Headers supported by the 308 Response Code

Name

Data type

P

Cardinality

Description

Location

string

M

1

An alternative URI of the resource located on an alternative service instance within the same GBA BSF (service) set.

3gpp-Sbi-Target-Nf-Id

string

O

0..1

Identifier of the target NF (service) instance ID towards which the request is redirected.

6.1.5 Notifications

In this release of this specification, no notifications are defined for the Nbsp_GBA service.

6.1.6 Data Model

6.1.6.1 General

This clause specifies the application data model supported by the API.

Table 6.1.6.1-1 specifies the data types defined for the Nbsp_GBA service-based interface protocol.

Table 6.1.6.1-1: Nbsp_GBA specific Data Types

Data type

Clause defined

Description

BootstrappingInfoRequest

6.1.6.2.2

Request body of the HTTP POST operation for resource "/bootstrapping-info-request".

BootstrappingInfoResponse

6.1.6.2.3

Response body of the HTTP POST operation for resource "/bootstrapping-info-request".

PushInfoRequest

6.1.6.2.4

Request body of the HTTP POST operation for resource "/push-info-request".

PushInfoResponse

6.1.6.2.5

Response body of the HTTP POST operation for resource "/push-info-request".

NafId

6.1.6.2.6

NAF ID, containing the NAF FQDN and the Ua Security Protocol Identifier.

UssListItem

6.1.6.2.7

Data item in a User Security Settings array list.

Uss

6.1.6.2.8

User Security Settings for a given GAA Service.

UeIdsItem

6.1.6.2.9

Data item in a UE ID array list.

FlagsItem

6.1.6.2.10

Data item in a Flags array list.

GsId

6.1.6.3.2

GAA Service Identifier.

GsType

6.1.6.3.2

GAA Service Type.

BtId

6.1.6.3.2

Bootstrapping Transaction Identifier.

MeKeyMaterial

6.1.6.3.2

ME Key Material (hex-encoded string).

UiccKeyMaterial

6.1.6.3.2

UICC key material (hex-encoded string).

UeId

6.1.6.3.2

Public Identity of the UE.

Impi

6.1.6.3.2

IMS Private Identity of the UE

Flag

6.1.6.3.2

GAA authorization flags, as defined in 3GPP TS 29.109 [17], Annex C.

GbaPushInfo

6.1.6.3.2

GBA Push Info (hex-encoded string).

NafGroup

6.1.6.3.2

NAF Group (string).

PtId

6.1.6.3.2

P-TID.

UiccAppLabel

6.1.6.3.2

UICC Application Label (string).

Auts

6.1.6.3.2

AUTS in UMTS AKA.

Rand

6.1.6.3.2

RAND in UMTS AKA.

KeyChoice

6.1.6.3.3

Type of key (ME-based or UICC-based) that the NAF shall use.

UiccOrMe

6.1.6.3.4

Indicates whether GBA_ME or GBA_U is to be used for GBA push.

SecFeature

6.1.6.3.5

Security features supported by the BSF or the NAF.

GbaType

6.1.6.3.6

Authentication type used by the UE for GBA.

UeIdType

6.1.6.3.7

Type of UE Identity (public or private).

Table 6.1.6.1-2 specifies data types re-used by the Nbsp_GBA service-based interface protocol from other specifications, including a reference to their respective specifications and when needed, a short description of their use within the Nbsp_GBA service-based interface.

Table 6.1.6.1-2: Nbsp_GBA re-used Data Types

Data type

Reference

Comments

Uint32

3GPP TS 29.571 [18]

Unsigned 32-bit integer.

DateTime

3GPP TS 29.571 [18]

String with a "date-time" format, as defined by OpenAPI [6].

ProblemDetails

3GPP TS 29.571 [18]

Response body of error response messages.

RedirectResponse

3GPP TS 29.571 [18]

Response body of a redirect response message.

Fqdn

3GPP TS 29.571 [18]

Fully Qualified Domain Name

6.1.6.2 Structured data types

6.1.6.2.1 Introduction

This clause defines the structures to be used in resource representations.

6.1.6.2.2 Type: BootstrappingInfoRequest

Table 6.1.6.2.2-1: Definition of type BootstrappingInfoRequest

Attribute name

Data type

P

Cardinality

Description

btId

BtId

M

1

Bootstrapping Transaction Identifier

nafId

NafId

M

1

NAF Identifier

gbaUAware

boolean

O

0..1

GBA-U Awareness Indicator.

true: The sending node is GBA_U aware

false (default) or absent: The sending node is not GBA_U aware.

gsIds

array(GsId)

O

1..N

GBA Service Identifiers

6.1.6.2.3 Type: BootstrappingInfoResponse

Table 6.1.6.2.3-1: Definition of type BootstrappingInfoResponse

Attribute name

Data type

P

Cardinality

Description

meKeyMaterial

MeKeyMaterial

M

1

ME key material (Ks_NAF or Ks_Ext_NAF)

uiccKeyMaterial

UiccKeyMaterial

O

0..1

UICC key material (Ks_Int_NAF)

keyExpiryTime

DateTime

O

0..1

Key expiry time

bootstrappingInfoCreationTime

DateTime

O

0..1

Bootstrapping Info Creation Time

ussList

array(UssListItem)

O

1..N

GBA User Security Settings per GBA Service Identifier

gbaType

GbaType

O

0..1

Authentication type that was used by the UE during the bootstrapping procedure.

impi

Impi

O

0..1

UE Private Identity

6.1.6.2.4 Type: PushInfoRequest

Table 6.1.6.2.4-1: Definition of type PushInfoRequest

Attribute name

Data type

P

Cardinality

Description

ueId

UeId

M

1

User Identity.

ueIdType

UeIdType

M

1

Type of UE identity (public or private).

uiccAppLabel

UiccAppLabel

M

1

UICC Application Label.

nafId

NafId

M

1

NAF Identifier.

ptId

PtId

M

1

P-TID (NAF SA Identifier).

uiccOrMe

UiccOrMe

M

1

Indicates whether GBA_ME or GBA_U is to be used for GBA push.

requestedLifeTime

DateTime

M

1

Requested key lifetime for the NAF keys.

privateIdRequest

boolean

O

0..1

Indicates to the BSF whether the UE private identity shall be returned to the NAF in the response message.

true: the private identity is requested by the NAF, and it shall be returned by the BSF.

false (default) or absent: the private identity is not requested by the NAF.

gbaUAware

boolean

O

0..1

GBA-U Awareness Indicator.

gsIds

array(GsId)

O

1..N

GBA Service Identifiers.

auts

Auts

O

0..1

AUTS in UMTS AKA.

rand

Rand

O

0..1

RAND in UMTS AKA.

securityFeaturesRequest

array(SecFeature)

O

1..N

Security Features supported by the NAF.

6.1.6.2.5 Type: PushInfoResponse

Table 6.1.6.2.5-1: Definition of type PushInfoResponse

Attribute name

Data type

P

Cardinality

Description

meKeyMaterial

MeKeyMaterial

M

1

ME key material (Ks_NAF or Ks_Ext_NAF).

gbaPushInfo

GbaPushInfo

M

1

GBA Push Info

uiccKeyMaterial

UiccKeyMaterial

O

0..1

UICC key material (Ks_Int_NAF).

keyExpiryTime

DateTime

O

0..1

Key expiry time.

bootstrappingInfoCreationTime

DateTime

O

0..1

Bootstrapping Info Creation Time.

ussList

array(UssListItem)

O

1..N

GBA User Security Settings per GBA Service Identifier

gbaType

GbaType

O

0..1

GBA Type.

impi

Impi

O

0..1

UE Private Identity.

securityFeaturesResponse

array(SecFeature)

O

0..N

If the BSF does not support the usage of securityFeatures or the NAF did not include any securityFeaturesRequest attribute in the PushInfoRequest message, this IE shall be absent.

If securityFeatures element is not defined in the GUSS of the UE, or there is no common securityFeature between NAF and BSF, the BSF shall include an empty array in the securityFeaturesResponse attribute.

6.1.6.2.6 Type: NafId

Table 6.1.6.2.6-1: Definition of type NafId

Attribute name

Data type

P

Cardinality

Description

nafFqdn

Fqdn

M

1

FQDN of the NAF.

uaSecProtId

string

M

1

Ua Security Protocol Identifier.

It shall contain 5 octets, as described in 3GPP TS 33.220 [14], encoded as a sequence of 10 hexadecimal characters.

pattern: "^[A-Fa-f0-9]{10}$"

6.1.6.2.7 Type: UssListItem

Table 6.1.6.2.7-1: Definition of type UssListItem

Attribute name

Data type

P

Cardinality

Description

uss

Uss

M

1

User Security Settings.

6.1.6.2.8 Type: Uss

Table 6.1.6.2.8-1: Definition of type Uss

Attribute name

Data type

P

Cardinality

Description

gsId

GsId

M

1

GAA Service ID.

gsType

GsType

M

1

GAA Service Type.

ueIds

array(UeIdsItem)

M

1..N

List of UE Identities

nafGroup

NafGroup

O

0..1

NAF Group.

flags

array(FlagsItem)

O

1..N

List of security flags supported for the current GAA service.

keyChoice

KeyChoice

O

0..1

Type of key that the NAF shall use.

6.1.6.2.9 Type: UeIdsItem

Table 6.1.6.2.9-1: Definition of type UeIdsItem

Attribute name

Data type

P

Cardinality

Description

ueId

UeId

M

1

Identity of the UE

6.1.6.2.10 Type: FlagsItem

Table 6.1.6.2.10-1: Definition of type FlagsItem

Attribute name

Data type

P

Cardinality

Description

flag

Flag

M

1

Security flag supported for the corresponding GAA Service.

6.1.6.3 Simple data types and enumerations

6.1.6.3.1 Introduction

This clause defines simple data types and enumerations that can be referenced from data structures defined in the previous clauses.

6.1.6.3.2 Simple data types

The simple data types defined in table 6.1.6.3.2-1 shall be supported.

Table 6.1.6.3.2-1: Simple data types

Type Name

Type Definition

Description

GsId

Uint32

GAA Service Identifier.

For 3GPP standardized values, see 3GPP TS 29.109 [17], Annex B.

GsType

Uint32

GAA Service Type.

For 3GPP standardized values, see 3GPP TS 29.109 [17], Annex B.

BtId

string

Bootstrapping Transaction Identifier. It shall take the form of a NAI, where the realm part identifies the FQDN of the BSF. See 3GPP TS 33.220 [14].

MeKeyMaterial

string

ME key material, containing a 256-bit key, encoded as a sequence of 64 hexadecimal characters.

pattern: "^[A-Fa-f0-9]{64}$"

UiccKeyMaterial

string

UICC key material, containing a 256-bit key, encoded as a sequence of 64 hexadecimal characters.

pattern: "^[A-Fa-f0-9]{64}$"

UeId

string

Identity of the UE.

Impi

string

IMS Private Identity of the UE.

Flag

Uint32

GAA authorization flags, associated to the specific GAA Service Type, as defined in 3GPP TS 29.109 [17], Annex C.

GbaPushInfo

string

GBA Push Info binary data, as defined in 3GPP TS 33.223 [15], clause 5.3.5, encoded as a sequence of hexadecimal characters.

pattern: "^([A-Fa-f0-9]{2})+$"

NafGroup

string

NAF Group.

PtId

string

P-TID.

UiccAppLabel

string

UICC Application Label.

Auts

string

AUTS in UMTS AKA, containing a 112-bit value, encoded as a sequence of 28 hexadecimal characters.

pattern: "^[A-Fa-f0-9]{28}$"

Rand

string

RAND in UMTS AKA, containing a 128-bit value, encoded as a sequence of 32 hexadecimal characters.

pattern: "^[A-Fa-f0-9]{32}$"

6.1.6.3.3 Enumeration: KeyChoice

The enumeration KeyChoice represents the type of key that the NAF shall use. It shall comply with the provisions defined in table 6.1.6.3.3-1.

Table 6.1.6.3.3-1: Enumeration KeyChoice

Enumeration value

Description

"ME_BASED_KEY"

Ks_ NAF or Ks_ext_NAF shall be used by the NAF.

"UICC_BASED_KEY"

Ks_int_NAF shall be used by the NAF.

"ME_UICC_BASED_KEYS"

Ks_ext_NAF or Ks_int_NAF can be used by the NAF.

6.1.6.3.4 Enumeration: UiccOrMe

The enumeration UiccOrMe represents whether GBA_ME or GBA_U is to be used for GBA push. It shall comply with the provisions defined in table 6.1.6.3.4-1.

Table 6.1.6.3.4-1: Enumeration UiccOrMe

Enumeration value

Description

"GBA_ME"

GBA_ME shall be used.

"GBA_U"

GBA_U shall be used.

6.1.6.3.5 Enumeration: SecFeature

The enumeration SecFeature represents security features supported by the BSF or the NAF. It shall comply with the provisions defined in table 6.1.6.3.5-1.

Table 6.1.6.3.5-1: Enumeration SecFeature

Enumeration value

Description

"GPL_U"

The UICC supports Generic Push Layer, as specified in 3GPP TS 33.224 [16].

6.1.6.3.6 Enumeration: GbaType

The enumeration GbaType represents the authentication type that was used during bootstrapping procedure. It shall comply with the provisions defined in table 6.1.6.3.6-1.

Table 6.1.6.3.6-1: Enumeration GbaType

Enumeration value

Description

"3G_GBA"

The 3G GBA has been performed as defined in 3GPP TS 33.220 [14].

"2G_GBA"

The 2G GBA has been performed as defined in 3GPP TS 33.220 [14], Annex I.

"GBA_DIGEST"

The GBA Digest has been performed as defined in 3GPP TS 33.220 [14], Annex M.

6.1.6.3.7 Enumeration: UeIdType

The enumeration UeIdType represents the type of the identity of the user. It shall comply with the provisions defined in table 6.1.6.3.7-1.

Table 6.1.6.3.7-1: Enumeration UeIdType

Enumeration value

Description

"PUBLIC"

Public user identity.

"PRIVATE"

Private user identity.

6.1.7 Error Handling

6.1.7.1 General

For the Nbsp_GBA API, HTTP error responses shall be supported as specified in clause 4.8 of 3GPP TS 29.501 [5]. Protocol errors and application errors specified in table 5.2.7.2-1 of 3GPP TS 29.500 [4] shall be supported for an HTTP method if the corresponding HTTP status codes are specified as mandatory for that HTTP method in table 5.2.7.1-1 of 3GPP TS 29.500 [4].

In addition, the requirements in the following clauses are applicable for the Nbsp_GBA API.

6.1.7.2 Protocol Errors

No specific procedures for the Nbsp_GBA service are specified.

6.1.7.3 Application Errors

The application errors defined for the Nbsp_GBA service are listed in Table 6.1.7.3-1.

Table 6.1.7.3-1: Application errors

Application Error

HTTP status code

Description

6.1.8 Feature negotiation

The optional features in table 6.1.8-1 are defined for the Nbsp_GBA API. They shall be negotiated using the extensibility mechanism defined in clause 6.6 of 3GPP TS 29.500 [4].

Table 6.1.8-1: Supported Features

Feature number

Feature Name

Description

6.1.9 Security

As indicated in 3GPP TS 33.501 [8] and 3GPP TS 29.500 [4], the access to the Nbsp_GBA API may be authorized by means of the OAuth2 protocol (see IETF RFC 6749 [9]), based on local configuration, using the "Client Credentials" authorization grant, where the NRF (see 3GPP TS 29.510 [10]) plays the role of the authorization server.

If OAuth2 is used, an NF Service Consumer, prior to consuming services offered by the Nbsp_GBA API, shall obtain a "token" from the authorization server, by invoking the Access Token Request service, as described in 3GPP TS 29.510 [10], clause 5.4.2.2.

NOTE: When multiple NRFs are deployed in a network, the NRF used as authorization server is the same NRF that the NF Service Consumer used for discovering the Nbsp_GBA service.

The Nbsp_GBA API defines a single scope "nbsp-gba" for the entire service, and it does not define any additional scopes at resource or operation level.

Annex A (normative): OpenAPI specification