ETSI TS 129 204-2016 Digital cellular telecommunications system (Phase 2+) Universal Mobile Telecommunications System (UMTS) Signalling System No 7 (SS7) security gateway Architect.pdf

1、 ETSI TS 1Digital cellular telecoUniversal Mobile TelSignalling SystemArchitecture, function(3GPP TS 29.2TECHNICAL SPECIFICATION129 204 V13.0.0 (2016communications system (Phaelecommunications System (tem No. 7 (SS7) security gatewional description and protoco.204 version 13.0.0 Release 13GLOBAL SYS

2、TEMOBILE COMMUN16-01) hase 2+); (UMTS); eway; col details 13) TEM FOR ICATIONSRETSI ETSI TS 129 204 V13.0.0 (2016-01)13GPP TS 29.204 version 13.0.0 Release 13Reference RTS/TSGC-0429204vd00 Keywords GSM,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 F

3、ax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic ve

4、rsions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document i

5、s the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is av

6、ailable at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any mean

7、s, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. Europ

8、ean Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partne

9、rs. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 129 204 V13.0.0 (2016-01)23GPP TS 29.204 version 13.0.0 Release 13Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The inform

10、ation pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the E

11、TSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the

12、updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3G

13、PP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present

14、 document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables ex

15、cept when used in direct citation. ETSI ETSI TS 129 204 V13.0.0 (2016-01)33GPP TS 29.204 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 5g33.1 Defini

16、tions 5g33.2 Abbreviations . 6g34 Network architecture 6g34.1 Scenarios 6g34.1.1 Outbound traffic (not yet protected) from own to foreign NE 7g34.1.2 Inbound traffic from foreign to own NE . 7g34.1.3 Inbound transit traffic . 8g34.1.4 Outbound transit traffic (not relayed) . 9g34.1.5 Outbound traffi

17、c from own to own NE . 9g34.1.6 Inbound traffic from own to own NE . 10g34.1.7 Outbound traffic from foreign to own NE 11g34.1.8 Inbound traffic from own to foreign NE . 11g34.1.9 Outbound traffic (already protected) from own to foreign NE . 12g34.1.10 Outbound transit traffic (relayed by SRF) 13g35

18、 Detailed Behaviour of the SS7 Security Gateway 13g35.1 TCAP user traffic . 13g35.1.1 General 13g35.1.2 Interactions with Mobile Number Portability . 28g35.1.3 Interactions with SCCP segmentation. 28g35.1.4 Protocol details . 29g35.1.4.1 Transformation of unprotected message to protected message . 2

19、9g35.1.4.2 Transformation of protected message to unprotected message . 33g35.1.4.3 Handling of received XUDTS messages and UDTS messages . 36g3Annex A (informative): Change history . 39g3History 40g3ETSI ETSI TS 129 204 V13.0.0 (2016-01)43GPP TS 29.204 version 13.0.0 Release 13Foreword This Technic

20、al Specification has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by t

21、he TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is increm

22、ented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction The absence of security in Signalling System No. 7 (SS7) networks is an identified security we

23、akness in 2G systems. This was formerly perceived not to be a problem, since the SS7 networks were the provinces of a small number of large institutions. This is no longer the case, and so there is now a need for security precautions. For 3G systems it is a clear goal to be able to protect inter-net

24、work SS7 signalling protocols. The protection is done by security gateways which are located at the network border. As a consequence intra network SS7 signalling is not protected and network elements other than Security Gateways are not impacted. ETSI ETSI TS 129 204 V13.0.0 (2016-01)53GPP TS 29.204

25、 version 13.0.0 Release 131 Scope The present document provides functional description of the SS7 Security Gateway. The document covers also network architecture, routeing considerations, and protocol details. 2 References The following documents contain provisions which, through reference in this t

26、ext, constitute provisions of the present document. References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the

27、case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 29.002: “Mobile Application Part (MAP) specification“. 2 3GPP TS 29.078: “Customized Application

28、s for Mobile network Enhanced Logic (CAMEL) Phase 4; CAMEL Application Part (CAP) specification“. 3 ETSI ETS 300 358: “ISDN Completion of Calls to Busy Subscriber (CCBS) supplementary service; Functional capabilities and information flows“. 4 3GPP TS 23.066: “Support of GSM Mobile Number Portability

29、 (MNP) stage 2“. 5 ITU-T Recommendation Q.773: “Specifications of Signalling System No.7; Transaction capabilities formats and encoding“. 6 3GPP TS 33.200: “3G Security; Network Domain Security (NDS); Mobile Application Part (MAP) application layer security“. 7 ITU-T Recommendation E.164: “ The inte

30、rnational public telecommunication numbering plan“. 8 3GPP TS 33.204: “3G Security; Network Domain Security (NDS); Transaction Capabilities Application Part (TCAP) user security“. 9 ITU-T Recommendations Q.711 to Q.716 (07/96), White Book Signalling Connection Control Part (SCCP). 10 3GPP TS 21.905:

31、 “Vocabulary for 3GPP Specifications“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 10 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if a

32、ny, in TR 21.905 10. TCAP user: Application Part identified by one of the following SCCP Subsystem Numbers: 0000 0110 HLR (MAP) 0000 0111 VLR (MAP) 0000 1000 MSC (MAP) 0000 1001 EIR (MAP) 0000 1010 is allocated for evolution (possible Authentication Centre) ETSI ETSI TS 129 204 V13.0.0 (2016-01)63GP

33、P TS 29.204 version 13.0.0 Release 131001 0001 GMLC (MAP) 1001 0010 CAP 1001 0011 gsmSCF (MAP) or IM-SSF (MAP) or Presence Network Agent 1001 0101 SGSN (MAP) 1001 0110 GGSN (MAP) 0000 1011 SSAP 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: CC Country

34、Code GSMA Global System for Mobile communications Association IV Initialisation Vector MAC Message Authentication Code MNP Mobile Number Portability MSISDN Mobile Station International ISDN Number NDC National Destination Code NE Network Entit PLMN Public Land Mobile Network y RN Routeing Number SAD

35、 Security Association Database SEG Security Gateway SPD Security Policy Database SPI Security Parameter Index SRF Signalling Relay Functio TCAP Transcaction Capabilities Application Part UDT SCCP Unitdata message XUDT SCCP Extended Unitdata message n 4 Network architecture In a PLMN that employs SS7

36、 Security Gateways all TCAP user signalling messages entering or leaving the PLMN have to transit an SS7 Security Gateway which belongs to the PLMN and which performs the protection of leaving (i.e. outbound) messages and the protection checking and de-protection or blocking of entering (i.e. inboun

37、d) messages. One or several SS7 Security Gateways may be employed within a PLMN. An SS7 Security Gateway may be co-located with any TCAP user NE or it may stand alone. However, for the purpose of this document and without imposing any restrictions, it is assumed that the SS7 Security Gateways is a s

38、tand alone entity. It is further assumed that the SS7 Security Gateways are located at the boarder of the PLMN i.e. inbound messages transit an SS7 Security Gateway before they reach any other node within the PLMN, and outbound messages transit an SS7 Security Gateway immediately before reaching a n

39、ode outside the PLMN. SS7 routeing is not impacted by the SS7 Security Gateway Architecture. As a consequence SS7 Security Gateways are stateless at TCAP level: No TCAP dialogue states are maintained in the SS7 Security Gateway since the outbound dialogue request message may transit a different SS7

40、Security Gateway than the corresponding inbound dialogue response message; similarly the inbound dialogue request message may transit a different SS7 Security Gateway than the corresponding outbound dialogue response message. 4.1 Scenarios SS7 Security Gateways perform protection, de-protection, blo

41、cking and unmodified passing of TCAP user messages depending on the scenario as described below: Note that scenarios 4.1.5, 4.1.6, 4.1.7, 4.1.8, and 4.1.9 are not applicable if all PLMNs TCAP user NEs are interconnected by PLMN internal signalling links and routing tables are set up not to allow the

42、se scenarios. ETSI ETSI TS 129 204 V13.0.0 (2016-01)73GPP TS 29.204 version 13.0.0 Release 134.1.1 Outbound traffic (not yet protected) from own to foreign NE This scenario is shown in figure 4.1.1. The message is originated at a NE inside the PLMN. It may transit several transit nodes inside the PL

43、MN before it reaches the SS7 Security Gateway. This SS7 Security Gateway protects the message according to the relevant Security Policy with the relevant Security Association. The message may then transit several nodes outside the PLMN (including an SS7 Security Gateway) before it reaches its destin

44、ation. Figure 4.1.1: Outbound traffic (not yet protected) from own to foreign NE 4.1.2 Inbound traffic from foreign to own NE This scenario is shown in figure 4.1.2. The message is originated at a NE outside the PLMN. It may transit several transit nodes (including an SS7 Security Gateway) outside t

45、he PLMN before it reaches the PLMNs SS7 Security Gateway. This SS7 Security Gateway checks whether the message is correctly protected according to the relevant security association. If it is not, the message is blocked (discarded), otherwise it is de-protected. To determine the relevant security ass

46、ociation the fact that the message may have been relayed by an MNP-SRF in a transit network (see Clause 4.1.10 and 5.1.2) needs to be taken into account. After successful de-protection the message may then transit several nodes inside the PLMN before it reaches the TCAP user NE. TCAP user NE SS7 Sec

47、urity Gateway Transit Node to destination PLMN unprotected TCAP user message protected TCAP user message ETSI ETSI TS 129 204 V13.0.0 (2016-01)83GPP TS 29.204 version 13.0.0 Release 13Figure 4.1.2: Inbound traffic from foreign to own NE 4.1.3 Inbound transit traffic This scenario is shown in figure

48、4.1.3. The message is originated at a NE outside the transit PLMN. It may transit several transit nodes outside the transit PLMN before it reaches the SS7 Security Gateway in inbound direction. This SS7 Security Gateway passes the message unmodified. The message may then transit several transit node

49、s inside the transit PLMN, another SS7 Security Gateway of the transit PLMN in outbound direction (see Clause 4.1.4), and several transit nodes outside the transit and destination PLMN (potentially including an SS7 Security Gateway) before it reaches the destination PLMN. Note: A PLMN operator may decide not to act as transit network for specific or all combinations of origin and destination. In this case the SS7 Security Gateway may block the inbound message. Figure 4.1.3: Inbound transit traffic TCAP user NE SS7 Security Gateway Transit Node