Security for usage of Generic Bootstrapping Architecture (GBA) with a User Equipment (UE) browser
This work in this Technical Report has the following scope:
- Study the potential threats for different GBA credentials use scenarios via a web browser. These new use scenarios (e.g. using HTML forms, using Javascript, using widgets) are not covered by current specifications.
The scope of this Technical Report will cover the following:
- Study, identify and specify any protection mechanism that maybe additionally required for the GBA credentials;
- Study, identify and potentially specify usage control for GBA credentials;
- Study, identify and potentially specify access control mechanism for GBA module;
- Study, identify and potentially specify the usage of web based GBA as an extension on the current protocol mechanisms used on Ua reference point (e.g. new Ua protocol identifier);
- Identify and outline how GBA can be used with HTML Forms and Javascript securely (e.g. describing GBA - web specific common practices and examples).
This Technical Report will collect the potential specification improvements, which are then at a later stage of work transferred to the appropriate Technical Specifications. The potential improvements for access control to GBA credentials and potential Ua protocol impacts will then be documented in TS 33.220 [2]. The threat analysis, common security implementation practices and examples may build a new chapter 5 in TS 33.222 [3].
Relation to GBA variants defined in other documents: Web based GBA aims at defining web enhancements for the use of HTML forms with GBA. It is a new variant for the Ua interface and does not affect the Ub interface, as opposed to the GBA variants defined in TS 33.220. Web based GBA is orthogonal to these other GBA variants and can be used with any of them.