ATIS 0100014-2007 Information & Communications Security for NGN Converged Services IP Networks and Infrastructure.pdf

1、 TECHNICAL REPORT ATIS-0100014 INFORMATION Confidentiality Policies versus Integrity Policies . 63 4.8.2 Available Security Models . 64 4.8.3 Security Model Summary 68 4.9 Security Requirements . 68 5 SECURITY ARCHITECTURES, SERVICES AND MECHANISMS . 69 5.1 Architectural Types 69 5.1.1 Abstract Arch

2、itectures . 69 5.1.2 Generic Architecture 69 5.1.3 Logical Architecture . 73 5.1.4 Specific Architecture 73 5.2 Security Services 74 5.2.1 Authentication 75 5.2.2 Authorization - Access Control 76 5.2.3 Data confidentiality 76 5.2.4 Integrity 77 5.2.5 Non-repudiation . 79 5.3 Necessary Communication

3、s Security Services 79 5.3.1 Architectural Context for Security Services . 79 5.3.2 Mapping Security Services to the Architectural Model 110 5.4 Security Mechanisms . 120 5.4.1 Operating System Security Mechanisms and Hardening 120 5.4.2 Applicable Protocol Security Mechanisms 152 5.4.3 Major Securi

4、ty Protocols 167 5.4.4 Application Frameworks 179 5.5 Management of Security Mechanisms . 179 5.5.1 Integrated Security Management 179 5.5.2 Securing management Related Communications . 179 5.5.3 Storage of Security Information . 180 5.5.4 Security Management within Elements . 180 5.6 Certification,

5、 Auditing December 2002 RFC 3415 View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP), December 2002 RFC 3436 Transport Layer Security over Stream Control Transmission Protocol, December 2002 RFC 3456 Dynamic Host Configuration Protocol (DHCPv4) Configuration of I

6、Psec Tunnel Mode, January 2003 RFC 3472 Generalized Multi-Protocol Label Switching (GMPLS) Signaling Constraint-based Routed Label Distribution Protocol (CR-LDP) Extensions RFC 3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE), May 2003 RFC 3534 Media Gateway

7、 Control Protocol (MGCP) Version 1.0, January 2003. RFC 3546 Transport Layer Security (TLS) Extensions, June 2003 RFC 3550 RTP: A Transport Protocol for Real-Time Applications, July 2003 RFC 3554 On the Use of Stream Control Transmission Protocol (SCTP) with IPsec, July 2003 RFC 3566 The AES-XCBC-MA

8、C-96 Algorithm and Its Use With IPsec, September 2003 RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec, September 2003 RFC 3664 The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE), January 2004 RFC 3686 Using Advanced Encryption Standard (AES) Counter Mode With IP

9、sec Encapsulating Security Payload (ESP), January 2004 RFC 3711 The Secure Real-time Transport Protocol (SRTP), March 2004 RFC 3826 The Advanced Encryption Standard (AES) Cipher Algorithm in the SNMP User-based Security Model, June 2004 ATIS-0100014 7 RFC 3830 MIKEY: Multimedia Internet KEYing, Augu

10、st 2004 RFC 3947 Negotiation of NAT-Traversal in the IKE, January 2005 RFC 3948 UDP Encapsulation of IPsec ESP Packets, January 2005 RFC 4030 The Authentication Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Option, March 2005 RFC 4033 DNS Security Introduction and Requirem

11、ents, March 2005 RFC 4034 Resource Records for the DNS Security Extensions, March 2005 RFC 4035 Protocol Modifications for the DNS Security Extensions, March 2005. RFC 4086 Randomness Requirements for Security, June 2005 RFC 4106 The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security P

12、ayload (ESP), June 2005 RFC 4109 Algorithms for Internet Key Exchange version 1 (IKEv1), May 2005 RFC 4217 Securing FTP with TLS, October 2005 RFC 4251 The Secure Shell (SSH) Protocol Architecture, January 2006 RFC 4252 The Secure Shell (SSH) Authentication Protocol, January 2006 RFC 4253 The Secure

13、 Shell (SSH) Transport Layer Protocol, January 2006 RFC 4256 Generic Message Exchange Authentication for the Secure Shell Protocol (SSH), January 2006 RFC 4279 Pre-Shared Key Ciphersuites for Transport Layer Security (TLS), December 2005 RFC 4282 The Network Access Identifier, December 2005 RFC 4301

14、 Security Architecture for the Internet Protocol, December 2005 RFC 4302 IP Authentication Header, December 2005 RFC 4303 P Encapsulating Security Payload (ESP), December 2005 RFC 4304 Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI) for Internet Security Association a

15、nd Key Management Protocol (ISAKMP), December 2005 RFC 4306 Internet Key Exchange (IKEv2) Protocol, December 2005 RFC 4307 Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2), December 2005 RFC 4308 Cryptographic Suites for IPsec, December 2005 RFC 4309 Using Advanced Enc

16、ryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP), December 2005 RFC 4344 The Secure Shell (SSH) Transport Layer Encryption Modes RFC 4345 Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol, January 2006 RFC 4346 The Transport Layer Security (TLS

17、) Protocol Version 1.1, April 2006 RFC 4347 Datagram Transport Layer Security, April 2006 RFC 4359 The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH), January 2006 RFC 4419 Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Laye

18、r Protocol, March 2006 RFC 4432 RSA Key Exchange for the Secure Shell (SSH) Transport Layer Protocol, March 2006 RFC 4434 The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE), February 2006 RFC 4470 Minimally Covering NSEC Records and DNSSEC On-line Signing, April 2006 RFC 449

19、4 The AES-CMAC-96 Algorithm and Its Use with IPsec, June 2006 RFC 4510 Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map, June 2006 RFC 4511 Lightweight Directory Access Protocol (LDAP): The Protocol, June 2006 RFC 4512 Lightweight Directory Access Protocol (LDAP): Direc

20、tory Information Models, June 2006 RFC 4513 Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms, June 2006 RFC 4543 The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH, May 2006 RFC 4567 Key Management Extensions for Session Description P

21、rotocol (SDP) and Real Time Streaming Protocol (RTSP), July 2006 RFC 4568 Session Description Protocol (SDP) Security Descriptions for Media Streams, July 2006 RFC 4615 The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128) Algorithm f

22、or the Internet Key Exchange Protocol (IKE), August 2006 RFC 4650 HMAC-Authenticated Diffie-Hellman for Multimedia Internet KEYing (MIKEY); September 2006 RFC 4718 IKEv2 Clarifications and Implementation Guidelines, October 2006 RFC 4738 MIKEY-RSA-R: An Additional Mode of Key Distribution in Multime

23、dia Internet KEYing (MIKEY), November 2006 ATIS-0100014 8 RFC 4785 Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS), January 2007 RFC 4819 Secure Shell Public Key Subsystem, March 2007 RFC 4835 Cryptographic Algorithm Implementation Requirements for Encapsula

24、ting Security Payload (ESP) and Authentication Header (AH)., April 2007. RFC 4868 Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec, May 2007 RFC 4869 Suite B Cryptographic Suites for IPsec, May 2007 RFC 4895 Authenticated Chunks for the Stream Control Transmission Protocol (SCTP), Augus

25、t 2007 1.2.6 Institute of Electrical and Electronics Engineers (IEEE) References7IEEE 802.1q IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks, December 1998 IEEE 802.1x IEEE Standards for Local and Metropolitan Area Networks: Port-Based network Access Cont

26、rol, December 2004 IEEE 802.3 IEEE Standard for Information technology Telecommunications and information exchange between systemsLocal and metropolitan area networksSpecific requirements Part 3: Carrier sense multiple access with collision detection (CSMA/CD) access method and physical layer specif

27、ications, December 2005 IEEE 802.11a Supplement to IEEE Standard for Information technology Telecommunications and information exchange between systems Local and metropolitan area networks Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications

28、 High-speed Physical Layer in the 5 GHz Band, June 2003 IEEE 802.11b Supplement to IEEE Standard for Information technologyTelecommunications and information exchange between systemsLocal and metropolitan area networksSpecific requirementsPart 11: Wireless LAN Medium Access Control (MAC) and Physica

29、l Layer (PHY) specifications: Higher-Speed Physical Layer Extension in the 2.4 GHz Band, June 2003 IEEE 802.11i IEEE Standard for Information technologyTelecommunications and information exchange between systemsLocal and metropolitan area networksSpecific requirements Part 11: Wireless LAN Medium Ac

30、cess Control (MAC) and Physical Layer (PHY) specifications Amendment 6: Medium Access Control (MAC) Security Enhancements, July 2004 1.2.7 Government References8DoD Standard 5200.28 Department of Defense Trusted Computer System Evaluation Criteria (TCSEC), Dec 1985 ITSEC Information Technology Secur

31、ity Evaluation Criteria Ver 1.2, Department of Trade and Industry, London, June 1991 FIPS 180-2 Secure Hash Standard FIPS 197 Federal Information Processing Standards Publication (FIPS) 197, “ ADVANCED ENCRYPTION STANDARD (AES)“, NIST, November 2001 NIST 800-37 Guide for the Security Certification a

32、nd Accreditation of Federal Information Systems NISTIR 7359 Information Security Guide for Government Executives 1.2.8 Other References CMMI for Development, Version 1.2 Model, August 20069GAISP V3.0, “Generally Accepted Information Security Principles“, May 200610PKCS 12 v1.0: Personal Information

33、Exchange Syntax, RSA Laboratories, June 24, 1999117These documents are available from the Institute of Electrical and Electronics Engineers (IEEE). 8These documents are available from the Government Printing Office at . 9This document is available from 10This document is available from . ATIS-010001

34、4 9 1.2.9 ETSI References12TS 102 165-1 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and proforma for Threat, Risk, Vulnerability Analysis TS 102 165-2 Telecommunications and Internet converged Services and P

35、rotocols for Advanced Networking (TISPAN); Methods and protocols; Part 2: Protocol Framework Definition; Security Counter Measures TR 102 420 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Review of activity on security TS 102 556 Telecommunication

36、s and Internet converged Services and Protocols for Advanced Networking (TISPAN); Protection Profile TS 187 001 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN SECurity (SEC); Requirements TR 187 002 Telecommunications and Internet converged Ser

37、vices and Protocols for Advanced Networking (TISPAN); TISPAN NGN Security (NGN_SEC); Threat and Risk Analysis TS 187 003 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Security; Security Architecture ES 202 382 Telecommunications and Internet c

38、onverged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method and proforma for defining Protection Profiles ES 202 383 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method and proforma for d

39、efining Security Targets EG 202 387 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method for application of Common Criteria to ETSI deliverables EG 202 549 Telecommunications and Internet converged Services and Protocols for

40、 Advanced Networking (TISPAN); Design Guide; Application of security countermeasures to service capabilities 2 Definitions This TR uses the definitions of security related terms from ATIS-0100523.200713. The sections below list terms above and beyond those found in the Glossary. 2.1 Basic Reference

41、Model definitions This Technical Report makes use of the following general security-related terms defined in ITU-T Rec. X.200 (ISO/IEC 7498-1): (N)-connection; (N)-data-transmission; (N)-entity; (N)-facility; (N)-layer; Open system; Peer entities; (N)-protocol; (N)-protocol-data-unit; (N)-relay; Rou

42、ting; Sequencing; (N)-service; (N)-service-data-unit (N)-SDU); (N)-user-data; (N)-unitdata (N)-userdata Sub-network; 11This document is available from 12These documents are available from the European Telecommunications Standards Institute (ETSI). 13This document can be found at . ATIS-0100014 10 Se

43、gmenting; OSI resource Transfer syntax; End system; application process; entity; facility; function; real open system; real system. service. 2.2 Security architecture definitions This Technical Report makes use of the following terms defined in ITU-T Rec. X.800 (ISO 7498-2): access control list; acc

44、ess control; Accountability; Active threat; audit (also security audit); audit trail; authentication exchange; authentication information; authentication; authorization; availability; capability;channel; ciphertext; cleartext; confidentiality; connection integrity; credentials; cryptanalysis; crypto

45、graphic check value: cryptography; data integrity (also integrity); data origin authentication; decipherment; decryption; denial of service; digital signature (also signature); encipherment; encryption; end-to-end encipherment identity-based security policy; insider threat; integrity; key management

46、; key; link-by-link encipherment; manipulation detection; masquerade; notarization; outsider threat; passive threat; password; peer-entity authentication; physical security; plaintext; policy; privacy; repudiation;routing control; rule-based security policy; security audit trail (also audit trail, l

47、og); Security Audit; security label; security policy; security service; selective field protection. sensitivity; signature; threat. Traffic analysis Traffic flow confidentiality Traffic padding Trusted functionality 2.3 Security framework definitions This Technical Report makes use of the following

48、general security-related terms defined in ITU-T Rec. X.810 (ISO/IEC 10181-1): asymmetric cryptographic algorithm; certification authority; conditionally trusted entity; cryptographic chaining; digital fingerprint; distinguishing identifier; hash function; one-way function; one-way hash function; pri

49、vate key; public key; revocation certificate; revocation list certificate; seal; sealed; secret key; secure interaction policy; secure interaction rules; security administrator; security authority; security certificate chain; ATIS-0100014 11 security certificate; security domain authority; security domain; security information; security policy rules; security recovery; security token; symmetric cryptographic algorithm; trust; trusted entity; trusted third party; unconditionally trusted entity; This Technical Report makes use of the following general security-related terms defined in