ETSI TS 102 597-2007 METHODS FOR TESTING AND SPECIFICATION (MTS) INTERNET PROTOCOL TESTING (IPT) IPV6 SECURITY INTEROPERABILITY TEST SUITE《测试方法和规范(MTS) 互联网协议测试(IPT) IPv6安全 互用性测试套件(_1.pdf

1、 ETSI TS 102 597 V1.1.1 (2007-05)Technical Specification Methods for Testing and Specification (MTS);Internet Protocol Testing (IPT): IPv6 Security;Interoperability Test SuiteETSI ETSI TS 102 597 V1.1.1 (2007-05) 2 Reference DTS/MTS-IPT-012-IPv6-SecITS Keywords interoperability, IP, IPv6, security E

2、TSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can be

3、 downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the ref

4、erence shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI document

5、s is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permiss

6、ion. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2007. All rights reserved. DECTTM, PLUGTESTSTM and UMTSTM are Trade Marks of ETSI registered for the benefit of its Members. TIPHONTMand the TIPHON logo are Trade Mar

7、ks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TS 102 597 V1.1.1 (2007-05) 3 Contents Intellectual Property Rights4 Foreword.4 Introduction 4 1 Scope 5 2

8、 References 5 3 Abbreviations .5 4 IPv6 Security Interoperability Test Specification 6 4.1 Test Descriptions6 4.1.1 Index of test grouping.6 4.2 Test Descriptions7 Annex A (informative): Interoperability Testing Configurations38 Annex B (informative): IPv6 Interoperability Test Purposes 40 Annex C (

9、informative): Bilbiography.56 History 57 ETSI ETSI TS 102 597 V1.1.1 (2007-05) 4 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI mem

10、bers and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.e

11、tsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, e

12、ssential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Methods for Testing and Specification (MTS). Introduction IPv6 is the next generation Internet. It gives vastly increased address space and true end-to-end communication. It has

13、 improved security and mobility features and allows “plug-and-play“ connection to the network. The complexity of implementing IPv6 technology and the relative openness of IETF standards means that wide-ranging and effective testing of IPv6 products will be one of the key factors in ensuring the depl

14、oyment, interoperability, security and reliability of the IPv6 infrastructure. The present document specifies interoperability tests for IPv6 Security. The test suite results from and analysis of RFC 4301 3, RFC 4302 4, RFC 4303 5, RFC 4305 6 and RFC 4306 7, the extraction of the requirements contai

15、ned in these documents, and a selection of the requirements which could be tested by interoperability means. The methodology and framework used to analyse the RFCs, to extract the requirements, write the Test Purposes, and the test descriptions is described in TS 102 351 1.The reader is strongly enc

16、ouraged to read TS 102 351 1 in order to make the best usage of the present document. ETSI ETSI TS 102 597 V1.1.1 (2007-05) 5 1 Scope The present document specifies the interoperability Test Descriptions (TDs) with integrated Test Purposes (TPs) for the selected IPv6 Security standards. The TDs are

17、presented in the tabular form specified in TS 102 424 8 and the TPs are defined using the TPLan notation also described in ES 202 553 (see bibliography). 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. Refe

18、rences are either specific (identified by date of publication and/or edition number or version number) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. Referenced documents which are not found to be publicly avail

19、able in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 1 ETSI TS 102 351: “Methods for Testing and Specification (MTS); Internet Protocol

20、 Testing (IPT); IPv6 Testing: Methodology and Framework“. 2 ETSI TS 102 558 “Methods for Testing and Specification (MTS); Internet Protocol Testing (IPT): IPv6 Security; Requirements Catalogue“. 3 IETF RFC 4301: “Security Architecture for the Internet Protocol“. 4 IETF RFC 4302: “IP Authentication H

21、eader“. 5 IETF RFC 4303: “IP Encapsulating Security Payload (ESP)“. 6 IETF RFC 4305: “Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)“. 7 IETF RFC 4306: “Internet Key Exchange (IKEv2) Protocol“. 8 ETSI TS 102 424: “Telecommu

22、nications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Requirements of the NGN network to support Emergency Communication from Citizen to Authority“. 3 Abbreviations For the purposes of the present document, the following abbreviations apply: EUT Equipment Under Te

23、st MTU Maximum Transmission Unit QE Qualified Equipment TP Test Purpose TD Test Description TPLan Test Purpose Language TSS Test Suite Structure ETSI ETSI TS 102 597 V1.1.1 (2007-05) 6 4 IPv6 Security Interoperability Test Specification 4.1 Test Descriptions The IPv6 Security Interoperability Test D

24、escriptions (TDs) defined in the following clauses are derived from the Test Purposes (TPs) specified in Annex . Test Description presentation and concepts are explained in TS 102 351 1. Requirements referred to within the Test Description (example: RQ_001_1016) are all contained in TS 102 558 2, th

25、e IPv6 Security “Requirements catalogue“. 4.1.1 Index of test grouping In the present document, tests have been grouped according to the original RFC from which they were extracted. Group 1: RFC 4301 - Internet Security Architecture 7 Group 2: RFC 4306 - Internet Key Exchange protocol (IKEv2).12 Gro

26、up 2.1: Information Exchanges .12 Group 2.2: Message Length 14 Group 2.3: Security Parameter Negotiation 16 Group 2.3.1: Algorithm Negotiation .16 Group 2.3.2: Security Association Lifetime17 Group 2.3.3: Traffic Selector Negotiation.17 Group 2.4: NAT Traversal 18 Group 2.5: Retransmission Timers20

27、Group 3: RFC 4303 - IP Encapsulating Security Protocol (ESP)21 Group 4: RFC 4302 - IP Authentication Header (AH)31 Group 6: RFC 4305 Cryptographic Algorithm Implementation Requirements for ESP and AH32 NOTE: Test Descriptions covering requirements coming from more than one group are repeated in the

28、relevant groups. ETSI ETSI TS 102 597 V1.1.1 (2007-05) 7 4.2 Test Descriptions Group 1: RFC 4301 - Internet Security Architecture Test Description Identifier: TD_SEC_1004_01 Test Purpose: TP_SEC_1004_01 Summary: Support of ESP Roles: Ipsec_host Configuration: CF_SEC_01 References: RQ_002_1004 with E

29、UT configured to protect all traffic to/from QE1 using ESP and QE1 configured to protect all traffic to/from EUT using ESP ensure that when a Security_Association is established between EUT and QE1 then QE1 is able to communicate with EUT Pre-test conditions: Security Policy defined such that: a. Th

30、e EUT will use ESP to secure all communications to and from QE1 b. QE1 will use ESP to secure all communications to and from the EUT Security Association established from the EUT to QE1 Security Association established from QE1 to the EUT Verdict Step Test Sequence Pass Fail 1 Cause QE1 to send an E

31、cho Request to EUT 2 Check: Does QE1 receive an Echo Reply from the EUT? Yes No Observations: . Test Description Identifier: TD_SEC_1005_01 Test Purpose: TP_SEC_1005_01 Summary: Support of AH Roles: Ipsec_host Configuration: CF_SEC_01 References: RQ_002_1005 with EUT configured to protect all traffi

32、c to/from QE1 using AH and QE1 configured to protect all traffic to/from EUT using AH ensure that when a Security_Association is established between EUT and QE1 then QE1 is able to communicate with EUT Pre-test conditions: Security Policy defined such that: a. The EUT will use the Authentication Hea

33、der (AH) to secure all communications to and from QE1 b. QE1 will use the Authentication Header (AH) to secure all communications to and from the EUT Security Association established from the EUT to QE1 Security Association established from QE1 to the EUT Verdict Step Test Sequence Pass Fail 1 Cause

34、 QE1 to send an Echo Request to EUT 2 Check: does QE1 receive an Echo Reply from the EUT? Yes No Observations: ETSI ETSI TS 102 597 V1.1.1 (2007-05) 8 Test Description Identifier: TD_SEC_1020_01 Test Purpose: TP_SEC_1020_01 Summary: IPsec Host support of ESP transport mode Roles: Ipsec_host Configur

35、ation: CF_SEC_01 References: RQ_002_1020, RQ_002_3039 with EUT configured to protect all traffic to/from QE1 using ESP with the transport mode and QE1 configured to protect all traffic to/from EUT using ESP with the transport mode ensure that when a Security_Association is established between EUT an

36、d QE1 then QE1 is able to communicate with EUT Pre-test conditions: Security Policy defined such that: a. The EUT will use ESP in Transport Mode to secure all communications to and from QE1 b. QE1 will use ESP in Transport Mode to secure all communications to and from the EUT Security Association es

37、tablished from the EUT to QE1 Security Association established from QE1 to the EUT Verdict Step Test Sequence Pass Fail 1 Cause QE1 to establish a Security association with EUT 2 Check: Does QE1 receive an Echo Reply from the EUT? Yes No Observations: Test Description Identifier: TD_SEC_1020_02 Test

38、 Purpose: TP_SEC_1020_02 Summary: IPsec Host support of AH transport mode Roles: Ipsec_host Configuration: CF_SEC_01 References: RQ_002_1020, RQ_002_3039 with EUT configured to protect all traffic to/from QE1 using AH with the transport mode and QE1 configured to protect all traffic to/from EUT usin

39、g AH with the transport mode ensure that when a Security_Association is established between EUT and QE1 then QE1 is able to communicate with EUT Pre-test conditions: Security Policy defined such that: a. The EUT will use AH in Transport Mode to secure all communications to and from QE1 b. QE1 will u

40、se AH in Transport Mode to secure all communications to and from the EUT Security Association established from the EUT to QE1 Security Association established from QE1 to the EUT Verdict Step Test Sequence Pass Fail 1 Cause QE1 to send an Echo Request to the EUT 2 Check: Does QE1 receive an Echo Rep

41、ly from the EUT? Yes No Observations: ETSI ETSI TS 102 597 V1.1.1 (2007-05) 9 Test Description Identifier: TD_SEC_1021_01 Test Purpose: TP_SEC_1021_01 Summary: IPsec Host support of ESP tunnel mode Roles: Ipsec_host Configuration: CF_SEC_01 References: RQ_002_1021, RQ_002_3040 with EUT configured to

42、 protect all traffic to/from QE1 using ESP with the tunnel mode and QE1 configured to protect all traffic to/from EUT using ESP with the tunnel mode ensure that when a Security_Association is established between EUT and QE1 then QE1 is able to communicate with EUT Pre-test conditions: Security Polic

43、y defined such that: a. The EUT will use ESP in Tunnel Mode to secure all communications to and from QE1 b. QE1 will use ESP in Tunnel Mode to secure all communications to and from the EUT Security Association established from the EUT to QE1 Security Association established from QE1 to the EUT Verdi

44、ct Step Test Sequence Pass Fail 1 Cause QE1 to send an Echo Request to the EUT 2 Check: Does QE1 receive an Echo Reply from the EUT? Yes No Observations: Test Description Identifier: TD_SEC_1021_02 Test Purpose: TP_SEC_1021_02 Summary: IPsec Host support of AH tunnel mode Roles: Ipsec_host Configura

45、tion: CF_SEC_01 References: RQ_002_1021, RQ_002_3040 with EUT configured to protect all traffic to/from QE1 using AH with the tunnel mode and QE1 configured to protect all traffic to/from EUT using AH with the tunnel mode ensure that when a Security_Association is established between EUT and QE1 the

46、n QE1 is able to communicate with EUT Pre-test conditions: Security Policy defined such that: a. The EUT will use AH in Tunnel Mode to secure all communications to and from QE1 b. QE1 will use AH in Tunnel Mode to secure all communications to and from the EUT Security Association established from th

47、e EUT to QE1 Security Association established from QE1 to the EUT Verdict Step Test Sequence Pass Fail 1 Cause QE1 to send an Echo Request to the EUT 2 Check: Does QE1 receive an Echo Reply from the EUT? Yes No Observations: ETSI ETSI TS 102 597 V1.1.1 (2007-05) 10Test Description Identifier: TD_SEC

48、_1022_01 Test Purpose: TP_SEC_1022_01 Summary: IPsec Gateway support of ESP tunnel mode Roles: Ipsec_gateway Configuration: CF_SEC_03 References: RQ_002_1022, RQ_002_3040 with EUT configured to protect all traffic to/from QE4 using ESP with the tunnel mode and QE4 configured to protect all traffic t

49、o/from EUT using ESP with the tunnel mode ensure that when a Security_Association is established between EUT and QE4 then QE1 and QE2 are able to communicate Pre-test conditions: Security Policy defined such that: a. The EUT will use ESP in Tunnel Mode to secure all communications to and from QE4 b. QE4 will use ESP in Tunnel Mode to secure all communication