1. EN/FAD 109 0015 How can AAA infrastructure support services and applications in roaming architectures Ericsson Bay Area Research (EBAR) Theodore Havinis

2. EN/FAD 109 0015 The future trust model Terminal/ User Visited Home PLMN operator Service Provider Service/ Content Provider Corporate Network for services that use resources in visited

3. EN/FAD 109 0015 Identifying the issues The FACT is: The AAA infrastructure has a role to play in the service plain The QUESTION is then: What is exactly the role that the AAA infrastructure could play in the service plain considering: –3G mobile roaming model –multimedia, e-Commerce applications etc.

4. EN/FAD 109 0015 Possible uses of AAA infrastructure End-User (EU) authentication –authentication always from EU-to-home Key distribution management –network-2-network (n2n) security is needed in some cases –AAA infrastructure is used for distributing keys. –Preparing for full IKE security association (SA) negotiation Transporting User profile Policy Decision Point

5. EN/FAD 109 0015 Home Distinguish btw E-U authentication and N2N security UA Home operator Home operator UA SIP Proxy SIP Proxy Home operator Home operator 3G SIP: Network-2-Network Visited End-User authentication IETF SIP: End-2-End N2N security End-User authentication In IETF SIP, the SIP proxy is transparent to End-User authentication In IETF SIP, the SIP proxy is transparent to End-User authentication In 3G, the SIP proxy cannot be transparent for various reasons, one being capability to route calls locally e.g E-911 In 3G, the SIP proxy cannot be transparent for various reasons, one being capability to route calls locally e.g E-911

6. EN/FAD 109 0015 Initial SAs: SIP Server at Home UEProxy AAAH SIP server AAAL LS Visited Home SA 2 K SA2 SA M KMKM KMKM SA 3 K SA3 SA 1 K SA1 Home network decides where the SIP server is located Home network decides where the SIP server is located UA Initial SAs according to roaming model Initial SAs according to roaming model 3G operators are considering gateways btw networks for protecting internal infrastructure 3G operators are considering gateways btw networks for protecting internal infrastructure

7. EN/FAD 109 0015 Initial SAs: SIP Server at Visited UEProxy AAAHAAAL LS Visited Home SA 2 K SA2 SA M KMKM KMKM SA 3 K SA3 Home network decides where the SIP server is located Home network decides where the SIP server is located UA SIP server UA Initial SAs according to roaming model Initial SAs according to roaming model 3G operators are considering gateways btw networks for protecting internal infrastructure 3G operators are considering gateways btw networks for protecting internal infrastructure

8. EN/FAD 109 0015 How can a AAA server be used with n2n What is the proposal 1To use the AAA infrastructure for provisioning the shared secrets. 2In addition, to use the AAA infrastructure for n2n authentication and security according to the selected mode of operation Modes of operation for Network-2-Network security –In -band: complete piggybacking of SIP:REGISTER and its response over AAA infrastructure –Out-of-band: complete piggybacking of SIP:REGISTER, SAs established when SIP:REGISTER sent externally –Transparent: AAA used only for establishing SAs.

9. EN/FAD 109 0015 Network-to-Network: In-band Home UEProxy AAAH SIP server AAAL 1 45 7 10 LS Visited 6 8 9 12 2 311 UA K s2 K s1 SIP: INVITE SIP: REGISTER PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, does Auth/Accounting & policy selection. Trusts established SIP:INVITE externally PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, does Auth/Accounting & policy selection. Trusts established SIP:INVITE externally Policies enabled

10. EN/FAD 109 0015 Network-to-Network: Out-of-band UEProxy AAAH SIP server AAAL 1 23 45 8 LS 67 VisitedHome 910 UA K s1 K s2 SIP: INVITE SIP: REGISTER PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, just authentication done & policy downloaded to SIP server SIP:REGISTER sent externally and used for key distribution management, resulting in building-up trusts. SIP:INVITE externally PRINCIPLE SIP:REGISTER sent piggybacked through AAA infrastructure, just authentication done & policy downloaded to SIP server SIP:REGISTER sent externally and used for key distribution management, resulting in building-up trusts. SIP:INVITE externally Policies enabled

11. EN/FAD 109 0015 Network-to-Network: Transparent UEProxy AAAH SIP server AAAL 1 23 6 LS Visited Home 45 10 9 UA K s2 K s1 SIP: INVITE SIP: REGISTER 78 PRINCIPLE AAA infrastructure used for key generation & policy downloading to SIP server. SIP:REGISTER sent externally and used for key distribution management, resulting in building up trusts. SIP:INVITE externally PRINCIPLE AAA infrastructure used for key generation & policy downloading to SIP server. SIP:REGISTER sent externally and used for key distribution management, resulting in building up trusts. SIP:INVITE externally Policies enabled

12. EN/FAD 109 0015 Thank you