Access SBC, P-CSCF/AGW Architecture

James Ni

July.18th, 2012

2

IMS Architecture

3

Zoom In: Access SBC

4

Zoom In: P-CSCF

5

Zoom In: IMS AGW

6

P-CSCF/AGW Architecture

7

P-CSCF Function Summary

Proxies SIP user registration:

• Validates registration

• Multiple IMPU

• Resolves home domain address

• Establishes security associations

Proxies SIP session transactions

• Validates and forwards SIP messages

• Translates SDP and interacts with PCRF

• Compress/de-compress SIP messages

• NAT and session border controlling

Acts as SIP UA

• 3rd party registration on behalf of UE

• Session control on behalf of UE

• Subscriber information exchange with S-CSCF etc.

Maintains signaling integrity and security

• IMS AKA, IPSec ESP

• SIP message confidentiality

8

P-CSCF Function Summary

Subscribes to Registration event package

• Subscriber public information

• Network event notifications

Application Level Gateway (ALG) functions

• SDP examination and handling

• Media transcoding control

• Media NAT/NAPT/NAPT-PT

• Media security

• AGW control

• Optimal Media Routing (OMR)

• Explicit Congestion Notification (ECN)

• IMS Communication Enablers (ICE)

Supports PCRF/PDF

• Interacts with external PCRF/PDF

• Implements internal PDF

• QoS/Advanced QoS Features

9

P-CSCF Function Summary Charging

• Interface with CRF/CDF

• CDR

Handles Emergency sessions

• Interface with external E-CSCF

• E-CSCF functions

Mobility Support

• Visited P-CSCF functions

Lawful Intercept

Access Transfer Control Function (ATCF)

10

IMS AGW Function Summary

Transcoding

Media NAT

Media Security

Media Access Transfer Gateway (ATGW)

11

P-CSCF Protocols Overview

12

P-CSCF: Basic Registration and Call Control

13

P-CSCF Registration & Authentication (AKA)

14

P-CSCF Registration & Authentication (TLS)

15

P-CSCF Call / Session Flow

16

P-CSCF: Event Package Subscription

17

UE’s Reg-state event package subscription

18

UE’s debug event package subscription

19

P-CSCF: Multiple IMPUI Registration

20

Multiple IMPUI Registration after Initial Registration

21

P-CSCF: ALG Functionality

22

IMS-ALG Functionality Overview

Foundation

• SDP Examination

• AGW control procedure

• ECN

• OMR

IP Interworking

• Hosted NAT

• NAT Traversal

• Media Address Translation

• NA(P)T and NA(P)T-PT

• ICE

Security

• Media Security

Transcoding

23

SDP Examination

24

AGW Control: Non-call related procedures

3GPP TS 23.334

25

AGW Control: Call related procedures

3GPP TS 23.334

26

AGW Control: OMR

3GPP TS 29.079

Control signaling path

Media path after OMR

Realm: X.operatorX.net, Y.operatorY.net

UE-A UE-B

IBCF-2

TrGW

IBCF-1

TrGW

IBCF-3

TrGW

P-CSCF B P-CSCF A

Intermediate IMS

CN subsystem entities

IBCF-4

TrGW

Visited network X:

Realm Xa.operatorX.net

Home IMS network Y:

Realm Yb.operatorY.net

190.1.15.2 190.1.15.3

192.0.2.2 192.0.2.3

13.24.1.2 13.24.1.3

13.24.1.1 13.24.1.4

192.0.2.1 192.0.2.4 PCRF

PDNGW

PCRF

PDNGW

27

AGW Control: OMR basic message flow

28

AGW Control: OMR transcoding flow no MR reservation

29

AGW Control: OMR transcoding flow no MR reservation

30

AGW Control: OMR bypass unused MR

31

AGW Control: ECN

3GPP TS 24.229 / 23.334

32

IP Interworking

NAT Traversal

• RFC3581 rport – not applicable to RTP/RTCP

• RFC4961 Symmetric RTP/RTCP

• RFC3489/RFC5389 STUN (client-server)

• STUN, TURN & ICE

• SBC

NA(P)T & NA(P)T-PT

• For IMS-AGW in media path

• IP version interworking (NA(P)T-PT)

• IP address/port translation (NA(P)T)

Hosted NAT

• Both signaling and media paths traverse a NA(P)T device located in the customer premises domain

• Modify IP and port based on IP and port received from (for?) AGW

ICE (Interactive Connectivity Establishment)

• STUN: Session Traversal Utilities for NAT

• TURN: Traversal Using Relay NAT

33

IP Interworking: Hosted NAT

On receiving initial SIP REGISTER without integrity protection:

• Do hosted NAT only If address in top-most via header != IP level address,

For SIP REGISTER without integrity protection and responses

• Makes use of “received” and “rport” headers (RFC3261, RFC3581)

For other protected SIP messages

• Applies UDP tunnel mode encapsulation to IPSec packets (RFC3948, TS33.203)

34

IP Interworking: Hosted NAT: Unprotected REGISTER and Response

35

IP Interworking: Hosted NAT: Protected Traffic

Protected traffic are delivered through IPSec ESP tunnel between UE and P-CSCF

UDP ESP tunnel mode is used between the hosted NAT device and P-CSCF for NATing the IPSec ESP tunneled traffic

36

IP Interworking: Media Address Translation

37

IP Interworking: ICE

STUN/TURN Client function

STUN/TURN Server function

Transportation: UDP, TCP, TLS-TCP

38

Transcoding Control

If ALG is acting as ATCF

• Before PS to CS transfer, no transcoding is added

• MSC server selected codec takes priority during PS to CS transfer

39

Security

Signaling Security

• AKA, IPSec ESP

• TLS

Media Security

40

P-CSCF: Security

41

Signaling Security: Mechanism Summary

Mechanism Authentication Integrity protection

Use of security agreement in accordance

with RFC 3329 [48]

Support (as defined in 3GPP TS 33.203 [19])

IMS AKA plus IPsec ESP IMS AKA IPsec ESP Yes Mandatory for all P-CSCF, I-CSCF, S-CSCF

SIP digest plus check of IP association (note2)

SIP digest None (note 3) No Optional for P-CSCF, I-CSCF, S-CSCF

SIP digest plus Proxy Authentication (note 2)

SIP digest None (note 3) No Optional for P-CSCF, I-CSCF, S-CSCF

SIP digest with TLS SIP digest TLS session Yes Optional for P-CSCF, I-CSCF, S-CSCF

NASS-IMS bundled authentication (notes 4, 5)

not applicable (note 1)

None (note 3)

No Optional for P-CSCF, I-CSCF, S-CSCF

GPRS-IMS-Bundled authentication (note 5)

not applicable (note 1)

None (note 3) No Optional for P-CSCF, I-CSCF, S-CSCF

NOTE 1: Authentication is not provided as part of the IM CN subsystem signalling.

NOTE 2: The term "SIP digest without TLS" is used in this specification to refer to both "SIP digest plus check of IP

association" and "SIP digest plus Proxy Authentication".

NOTE 3: This security mechanism does not allow SIP requests to be protected using an IPsec security association

because it does not perform a key agreement procedure.

NOTE 4: A P-Access-Network-Info aware P-CSCF is required in order to provide NASS-IMS bundled authentication.

NOTE 5: The P-CSCF is restricted to the home network when performing this security mechanism.

NOTE 6: Trusted node authentication. For example the MSC server enhanced for IMS centralized services has

authenticated the UE and as a consequence S-CSCF will skip authentication.

3GPP TS24.229

42

Signaling Security: AKA

43

Signaling Security: IPSec ESP Transport Mode

TS33.203 required

44

Signaling Security: IPSec ESP Tunnel Mode

TS33.203 NOT required

45

Signaling Security: TLS

46

Media Security: Mechanism Summary Key Management

Mechanism

Applicable to media Support required by UE Support required by IM CN subsystem entities

Network support outside IM CN

subsystem entities

End-to-access-edge media security using SDES.

RTP based media only. Support RFC 3329 additions specified in draft-dawes-dispatch-mediasec-parameter [174] and SDP extensions specified in table A.317, items A.317/34, A.317/36 and A.317/37.

P-CSCF (IMS-ALG) is required. P-CSCF needs to support RFC 3329 additions specified in draft-dawes-dispatch-mediasec-parameter [174] and SDP extensions specified in table A.317, items A.317/34, A.317/36 and A.317/37. (NOTE)

Not applicable.

End-to-end media security using SDES.

RTP based media only. Support SDP extensions specified in table A.317, items A.317/34 and A.317/36.

Not applicable. Not applicable.

End-to-end media security using KMS.

RTP based media only. Support SDP extensions specified in table A.317, items A.317/34 and A.317/35.

Not applicable. GBA and KMS support required.

NOTE: Support of end-to-access-edge security is determined entirely by the network operator of the P-CSCF, which need not be the same network operator as that of the S-CSCF.

Irrespectively of key management solution used, SRTP is used as the security protocol to protect RTP based traffic.

3GPP TS24.229

47

Media Security: SDES e2ae Procedure

3GPP TS33.328

48

Media Security: SDES e2e Procedure

3GPP TS33.328

49

Media Security: KMS e2e Procedure

3GPP TS33.328

50

P-CSCF: Emergency Service

51

ECS Network Architecture

HSS DNS

ENUM

I-CSCF S-CSCF

Customer

Access

Network

IMS Emergency

Services Network

SIP

AS AS LRF/RDF

P-CSCF Backbone

Packet

Network

Access

MGCF

MGW

BGCF

SIP

SIP

SIP SIP

SIP

SIP

SIP

SIP SIP

Diameter

RTP

RTP

RTP

MS

MRFC

P-CSCF SIP

SIP

(1) Call delivered to

IP PSAP with

location

Call enters IMS with

location info

location is used to

determine PSAP

H.248

SS7

ISUP

TDM

CAMA

E-MF Legacy

PSAP

CAMA

E-MF

(2) Call delivered to

legacy network

without Location

(Query for location

needed)

IP PSAP

RTP

RTP

U

E

52

ECS Call Flow

53

Emergency Call Service (ECS)

P-CSCF Responses to ECS request:

• Reject (ECS not supported in IMS)

• Routing to CS ECS

• Accept

Functional Requirements to P-CSCF:

• ECS for registered and unregistered users

• ECS within non-ECS registration

• Unprotected requests

P-CSCF shall

• Store a configurable list of local ECS identifiers (ECS number, URN)

• Store a configurable list of roaming partners’ ECS identifiers

Handling ECS in P-CSCF

• Routing requests to E-CSCF

• Implementing E-CSCF functions

54

P-CSCF: Charging

55

Network Charging Overview

3GPP TS22.115

56

Logical Charging Architecture and Information Flows

CDF

Billing Domain

ONLINE OFFLINE CHARGING

WLAN

MRFC

SIP AS

PCRF

AF

CS - NE

SGSN

CGF

OCS IMS-

GWF S-CSCF

Service - NE

P-GW

PCEF

MGCF

BGCF

IBCF

P-CSCF

I-CSCF

S-GW

ePDG

MME

CHARGING

3GPP TS32.240

57

IMS Offline Charging Architecture

DOCUMENTTYPE 1 (1)

TypeUnitOrDepartmentHere TypeYourNameHere TypeDateHere

IBCF

Billing Domain

Rf

SIP AS

E-CSCF Rf

S-CSCF

MGCF MRFC

MRFC MGCF

SIP AS

BGCF

CDF CDF

CGF CGF

Rf

Ga

Bi

Rf

Rf

Rf

Rf

Rf

I-CSCF

P-CSCF Rf

S-CSCF

3GPP TS32.260

58

IMS Charging Flow

3GPP TS32.260

59

P-CSCF: ATCF

60

Access Transfer Control Function Transfer services between access networks for service continuity

• Sessions are anchored at the SCC AS

• Sessions may also be anchored at ATCF in visited network

Access Transfer cases

• PS – CS

• PS – PS

ATCF

• Allocates STN-SR (Session Transfer Number for SRVCC)

• Includes itself for the SIP session

• Controls ATGW to anchor the media path

• Tracks session states to perform access transfer

• Performs access transfer and updates ATGW media path

• Updates SCC AS on access transfer

• Handles failure cases during access transfer

• Cleans up ATGW media after access transfer

ATCF inclusion

• For roaming UEs

• Based on local configuration, registered service, media capabilities, access type

61

ATCF flow: PS-PS

62

ATCF flow: PC-CS

63

P-CSCF: Mobility Roaming & Handover Capability

64

3GPP Roaming Model UE Accessing IMS Services with P-GW/GGSN in the Home network

65

3GPP Roaming Model UE Accessing IMS Services with P-GW/GGSN in the Visited network

66

3GPP Roaming Model UE Accessing IMS Services with P-GW/GGSN in the Visited network

via Visited Network IMS

67

P-CSCF Mobility Roaming Capability as a Visited P-CSCF

• Optimal Media Routing (OMR)

• Roaming charging

• Home Routing

68

P-CSCF Mobility: OMR

69

P-CSCF Mobility: Home Routing

70

P-CSCF Mobility: Handin

Registration

re-INVITE

71

P-CSCF Mobility: Handout

72

P-CSCF: Policy & Rule Functions

73

P-CSCF PCRF Interactions (Registration & Subscribe

to Notifications)

74

P-CSCF PCRF Interactions (UE Originated Session/Call)

75

P-CSCF PCRF Interactions (UE Terminated Session/Call)

76

P-CSCF QoS Parameter Mapping

TS 29.213 section 6.2

77

P-CSCF: Lawful Intercept (LI)

78

LI Architecture and Interfaces X-interfaces are proprietary

• CLI/SNMP ICE: Intercept Control Element

• RADIUS

• DIAMETER

79

P-CSCF and LI Interfaces

X2: Call control events delivery

X1_1: (Optional) LI provisioning

80

P-CSCF with ICE: LI Activation Flow

81

P-CSCF with ICE: LI Deactivation Flow