T.4 GIBA Security Mechanism

33.2033G Security3GPPAccess security for IP-based servicesTS

The GIBA security solution works by creating a secure binding in the HSS between the public/private user identity (SIP-level identity) and the IP address currently allocated to the user at the GPRS level (bearer/network level identity). Therefore, IMS level signaling, and especially the IMS identities claimed by a user, can be connected securely to the PS domain bearer level security context.

When using IPv6, stateless autoconfiguration is the only IP address allocation method mandatorily supported by the terminal in GPRS. With this method, a primary PDP context is bound only to the 64-bit prefix of the 128-bit IPv6 address, not the full address. This needs to be taken into account in GIBA procedures.

The GGSN terminates each user’s PDP context and has assurance that the IMSI used within this PDP context is authenticated. The GGSN shall provide the user’s IP address (or the prefix in the case of IPv6 stateless autoconfiguration), IMSI and MSISDN to a RADIUS server in the HSS over the Gi interface when a PDP context is activated towards the IMS system. The HSS has a binding between the IMSI and/or MSISDN and the IMPI and IMPU(s), and is therefore able to store the currently assigned IP address (or the prefix in the case of IPv6 stateless autoconfiguration) from the GGSN against the user’s IMPI and/or IMPU(s). The precise way of the handling of these identities in the HSS is outside the scope of standardization. The GGSN informs the HSS when the PDP context is deactivated/modified so that the stored IP address (or the prefix in the case of IPv6 stateless autoconfiguration) can be updated in the HSS. When the S-CSCF receives a SIP registration request or any subsequent requests for a given IMPU, it checks that the IP address (or the prefix in the case of IPv6 stateless autoconfiguration) in the SIP header (verified by the network) matches the IP address (or the prefix in the case of IPv6 stateless autoconfiguration) that was stored against that subscriber’s IMPU in the HSS.

The mechanism assumes that the GGSN does not allow a UE to successfully transmit an IP packet with a source IP address (or the prefix in the case of IPv6 stateless autoconfiguration) that is different to the one assigned during PDP context activation. In other words, the GGSN must prevent "source IP spoofing". The mechanism also assumes that the P-CSCF checks that the source IP address in the SIP header is the same as the source IP address in the IP header received from the UE (the assumption here, as well as for the full security solution, is that no NAT is present between the GGSN and the P-CSCF).

The mechanism prevents an attacker from using his own IP address in the IP header but spoofing someone else’s IMS identity or IP address in the SIP header, so that he pays for GPRS level charges, but not for IMS level charges. The mechanism also prevents an attacker spoofing the address in the IP header so that he does not pay for GPRS charges. It therefore counters the threat scenarios given in clause T.3.