Trusted Identity Information

Description

Trusted identity information refers to network-generated user public identity information that is used in 3GPP systems to establish secure and trusted communication between the user equipment (UE) and various application servers or services. This concept was introduced in Release 7 and has been maintained across subsequent releases. It is defined in specifications such as 24.196, 24.407, 24.408, 24.508, 24.607, and 24.608, which cover various aspects of identity management, authentication, and authorization in the IP Multimedia Subsystem (IMS) and other service frameworks.

The primary purpose of trusted identity information is to provide a reliable and secure means of identifying users to network services. Unlike user-provided identities, which can be spoofed or manipulated, trusted identity information is generated and managed by the network operator. This ensures that the identity is authentic and can be used for billing, authorization, and personalization without the risk of impersonation. The network generates this information based on the user's subscription and authentication credentials, and it is typically included in signaling messages or service requests.

In practice, trusted identity information is used in various contexts, such as the IMS, where it may be included in SIP messages to identify the user to application servers. It is also used in other service enablers, such as presence, messaging, and location services. The information is often derived from the IMSI or other permanent identifiers but is presented in a format that can be safely shared with external entities without revealing sensitive details. The network ensures that the identity information is trustworthy by applying cryptographic protections and by managing the lifecycle of the identity.

The specifications that define trusted identity information cover different aspects: 24.196 deals with the IMS service centralization and continuity, 24.407 and 24.408 cover the IMS messaging and supplementary services, 24.508 addresses the IMS conferencing, and 24.607 and 24.608 cover the IMS multimedia telephony and supplementary services. Across these specs, the common thread is that the network provides a trusted identity that can be used by application servers to make authorization decisions and to personalize services.

From a security perspective, trusted identity information helps mitigate risks such as identity theft, unauthorized access, and fraud. By relying on network-generated identities, service providers can be assured that the user is who they claim to be, as the identity is bound to the authenticated subscription. This is particularly important in multi-party services and in scenarios where users interact with third-party applications. The evolution of this term has been stable, with the definition remaining consistent across releases, indicating its foundational role in 3GPP identity management.

Purpose & Motivation

Trusted identity information was introduced to address the need for a secure and reliable way to identify users to network services. Before its introduction, services often relied on user-provided identities, which could be easily spoofed, leading to security vulnerabilities and fraud. The network-generated identity ensures that the identity is authentic and tied to the user's subscription, enabling service providers to trust the identity for authorization and billing purposes.

The concept emerged in Release 7 as part of the broader effort to enhance security in the IMS and other service frameworks. It solved the problem of identity spoofing by providing a mechanism for the network to generate and assert the user's identity. This allowed service providers to offer personalized services without the risk of impersonation. Over time, as more services moved to IP-based platforms, the need for trusted identity became even more critical, and the term has been maintained across releases to support evolving service architectures.

In essence, trusted identity information exists to bridge the gap between the user's authenticated subscription and the identity presented to services. It enables a trust model where the network acts as the identity provider, and service providers can rely on that identity without needing to perform their own authentication. This simplifies the deployment of new services and enhances the overall security of the ecosystem.