3G Security; Network Domain Security / Authentication Framework (NDS/AF); Feasibility Study to support NDS/IP evolution
The scope of this feasibility study is limited to authentication of network elements which are using NDS/IP, and located in the inter-operator domain.
It means that this study concentrates on authentication of Security Gateways (SEG), and the corresponding Za‑interfaces. Authentication of elements in the intra-operator domain is considered as an internal issue for the operators. This is quite much in line with [6] which states that only Za is mandatory, and that the security domain operator can decide if the Zb-interface is deployed or not, as the Zb-interface is optional for implementation.
However, NDS/AF can easily be adapted to intra-operator use. This is just a simplification of the inter-operator case as all NDS/IP NEs and the PKI infrastructure belong to the same operator. Validity of certificates may be restricted to the operator's domain.
This work might also later be extended to provide entity authentication services to non-control plane nodes, but this has not been studied.
Possible use of multi-purpose PKI solutions (e.g. providing end-user security) for NDS/AF has not been studied. On the contrary, it is recommended to use a dedicated and profiled PKI for NE authentication in NDS/IP. Different applications make different demands on a PKI and it may make sense to build a lightweight PKI for each purpose rather than to build one that solves all problems. Complexity is one of the main impediments to PKI deployment today [11].
The NDS architecture for IP-based protocols is illustrated in figure 1.
Figure 1: NDS architecture for IP-based protocols [6]