TS 29.109 [21]. The TS 33.220 specifies an application independent mechanism based on 3GPP AKA protocol to provide a client and application server with a common secret key. GBA takes advantage of this mechanism and reuses AKA to bootstrap application security. GBA introduces a new network element (NE) called the Bootstrapping Server Function (BSF). This BSF has an interface with the HSS. Support for Subscriber Certificates (SSC) as described in TS 33.221 [22] specifies a mechanism to dynamically issue a digital certificate to a mobile subscriber. Figure 8.16 shows that the result of the process of issuing a certificate to a mobile subscriber is that the UE is loaded with a certificate corresponding to its (public, private) key pair (shown by the arrow). Once the certificate is in place it can be used (together with the corresponding (public, private) key pair) to authenticate the UE. This is indicated by the black dotted lines that connect "certificates" to the underlying applications (HTTPS and 6 Director Access Protocol (DAP) specified in X.511 is a computer networking standard for accessing X.500 directory service. Its functions have been adapted by LDAP (Lightweight Directory Access Protocol). LDAP is an application protocol for querying and modifying directory services running over TCP/IP. Next Generation Mobile Communications Ecosystem TR 33.919 TS 33.220 Certificates TS 33.222 HTTPS No AP Presence TS 33.221 Figure 8.15 GAA building blocks. Reproduced with permission from © 2007 3GPP [18] SSC in Figure 8.15). The (public, private) key pair and the corresponding digital certificate can also be used for integrity protection (or less likely confidentiality) but these are not part of the scope of GAA. HTTPS (Secure Hyper Text Transfer Protocol) can be used with a number of services to secure the application session between UE and the application server. HTTPS can be used with or without Authentication Proxy (AP) as stated in TS 33.222 [23]. Figure 8.16 illustrates a relationship between GAA, GBA, and SSC. There