Bootstrapping of application security using AKA and support for subscriber certificates; System description
The present document describes the security features and a mechanism to bootstrap authentication and key agreement for application security from the 3GPP AKA mechanism. Candidate applications to use this bootstrapping mechanism include but are not restricted to subscriber certificate distribution, etc. Subscriber certificates support services whose provision mobile operator assists, as well as services that mobile operator provides.
The scope of this specification includes two parts. The first part presents a generic AKA bootstrapping function, an architecture overview and the detailed procedure how to bootstrap the credential. The second part is the requirement for applications utilizing the bootstrapping function, as well as the procedure of the utilization. Specifically the present document presents signalling procedures for support of issuing certificates to subscribers and the standard format of certificates and digital signatures. It is not intended to duplicate existing standards being developed by other groups on these topics, and will reference these where appropriate.
Editor’s note: The specification objects are scheduled currently in phases. For the first phase of standardisation, only the case is considered where bootstrapping server functionality and network application function are located in the same network as the HSS. In later phases, other configurations may be considered.