Generic Bootstrapping Architecture Web Session

Description

A GBA web session is a concept within the Generic Bootstrapping Architecture that defines a secure session between a web browser on a GBA-enabled terminal and a Network Application Function (NAF) over HTTP. It consists of a sequence of related HTTP request/response transactions that share server-side state, allowing the NAF to correlate these transactions as originating from the same terminal and browser instance. This correlation is achieved through the use of a session-specific key, Ks_js_NAF, which is derived from the GBA bootstrapping key Ks_NAF and the TLS session. The lifetime of the GBA web session is bounded by the lifetime of Ks_js_NAF, which is equal to or shorter than both the Ks_NAF lifetime and the TLS session lifetime used to derive it.

The GBA web session mechanism is specified in 3GPP TS 33.222 (Generic Authentication Architecture; Access to network application functions using HTTPS) and TS 33.823 (Study on security impacts of virtualization). It enables web applications to leverage GBA for authentication and secure communication without requiring explicit user login for each transaction. When a browser accesses a NAF, the GBA Function in the terminal performs bootstrapping (if not already done) and derives Ks_NAF. This key is then used to establish a TLS session with the NAF. From this TLS session, a further key Ks_js_NAF is derived, which is used to secure the HTTP transactions within the web session. The NAF can identify the session by associating the Ks_js_NAF with the terminal and browser instance, typically via a session cookie or token.

The key advantage of GBA web sessions is that they provide a standardized way to maintain session state and security across multiple HTTP transactions, which are inherently stateless. This is crucial for web applications that require continuous authentication and authorization, such as online banking, media streaming, or enterprise services. The session key Ks_js_NAF ensures that even if the TLS session is compromised, the impact is limited to that session, and the long-term keys remain secure. The derivation of Ks_js_NAF from the TLS session binds the GBA security to the transport layer, providing defense in depth.

Operationally, the GBA web session begins when the browser first contacts the NAF. The NAF may redirect the browser to the BSF for bootstrapping if no valid GBA session exists. After bootstrapping, the terminal and NAF establish a TLS session, and the GBA Function provides the necessary credentials (B-TID and Ks_NAF) to the browser. The browser then uses these to authenticate to the NAF, which validates them with the BSF. Once authenticated, the NAF and browser derive Ks_js_NAF and use it to protect subsequent HTTP messages. The session ends when the Ks_js_NAF expires or the TLS session is terminated. The NAF must manage session state and ensure that keys are not reused across sessions.

The GBA web session concept was introduced in Release 11 to address the need for secure web-based services using GBA. It has been refined over subsequent releases to improve security and interoperability. Its definition has remained largely stable, with minor wording changes in Rel-12 to clarify the session's composition. The mechanism is particularly relevant for mobile web applications and is a key enabler for single sign-on (SSO) and seamless authentication in 3GPP networks.

Purpose & Motivation

The GBA web session was created to solve the challenge of maintaining secure, authenticated sessions for web-based applications over HTTP, which is a stateless protocol. Traditional web authentication relies on cookies and session IDs, which can be vulnerable to session hijacking and cross-site scripting. GBA web sessions provide a robust, standards-based method to bind a series of HTTP transactions to a specific terminal and browser instance using strong cryptographic keys derived from the cellular authentication infrastructure.

Before GBA web sessions, applications that wanted to use GBA for web access had to manage session state themselves, often leading to interoperability issues and security gaps. The introduction of a standardized session concept allowed NAFs to reliably identify and secure sessions without proprietary extensions. It also enabled the use of GBA in scenarios where the browser is the primary user agent, such as mobile web browsing and progressive web apps.

The motivation was to extend the benefits of GBA—strong authentication, key derivation, and single sign-on—to the web domain, where HTTP is the dominant protocol. By defining a session that is tied to the lifetime of derived keys and the TLS session, 3GPP ensured that security is maintained throughout the session and that keys are not overused. This is particularly important for services that require continuous authentication, such as streaming or interactive applications.