ETSI TS 129 204-2017 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) Signalling System No 7 (SS7) security gateway Arc.pdf

1、 ETSI TS 129 204 V14.0.0 (2017-04) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Signalling System No. 7 (SS7) security gateway; Architecture, functional description and protocol details (3GPP TS 29.204 version 14.0.0 Release 14) TECH

2、NICAL SPECIFICATION GLOBAL SYSTEM FOR MOBILE COMMUNICATIONSRETSI ETSI TS 129 204 V14.0.0 (2017-04)13GPP TS 29.204 version 14.0.0 Release 14Reference RTS/TSGC-0429204ve00 Keywords GSM,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47

3、16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in pr

4、int. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the

5、Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/p

6、ortal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electr

7、onic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telec

8、ommunications Standards Institute 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM a

9、nd the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 129 204 V14.0.0 (2017-04)23GPP TS 29.204 version 14.0.0 Release 14Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information per

10、taining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secre

11、tariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates o

12、n the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identi

13、ties, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document

14、 “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when

15、 used in direct citation. ETSI ETSI TS 129 204 V14.0.0 (2017-04)33GPP TS 29.204 version 14.0.0 Release 14Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 5g33.1 Definitions 5g3

16、3.2 Abbreviations . 6g34 Network architecture 6g34.1 Scenarios 6g34.1.1 Outbound traffic (not yet protected) from own to foreign NE 7g34.1.2 Inbound traffic from foreign to own NE . 7g34.1.3 Inbound transit traffic . 8g34.1.4 Outbound transit traffic (not relayed) . 9g34.1.5 Outbound traffic from ow

17、n to own NE . 9g34.1.6 Inbound traffic from own to own NE . 10g34.1.7 Outbound traffic from foreign to own NE 11g34.1.8 Inbound traffic from own to foreign NE . 11g34.1.9 Outbound traffic (already protected) from own to foreign NE . 12g34.1.10 Outbound transit traffic (relayed by SRF) 13g35 Detailed

18、 Behaviour of the SS7 Security Gateway 13g35.1 TCAP user traffic . 13g35.1.1 General 13g35.1.2 Interactions with Mobile Number Portability . 28g35.1.3 Interactions with SCCP segmentation. 28g35.1.4 Protocol details . 29g35.1.4.1 Transformation of unprotected message to protected message . 29g35.1.4.

19、2 Transformation of protected message to unprotected message . 33g35.1.4.3 Handling of received XUDTS messages and UDTS messages . 36g3Annex A (informative): Change history . 39g3History 40g3ETSI ETSI TS 129 204 V14.0.0 (2017-04)43GPP TS 29.204 version 14.0.0 Release 14Foreword This Technical Specif

20、ication has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG wi

21、th an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for

22、 all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. Introduction The absence of security in Signalling System No. 7 (SS7) networks is an identified security weakness in

23、 2G systems. This was formerly perceived not to be a problem, since the SS7 networks were the provinces of a small number of large institutions. This is no longer the case, and so there is now a need for security precautions. For 3G systems it is a clear goal to be able to protect inter-network SS7

24、signalling protocols. The protection is done by security gateways which are located at the network border. As a consequence intra network SS7 signalling is not protected and network elements other than Security Gateways are not impacted. ETSI ETSI TS 129 204 V14.0.0 (2017-04)53GPP TS 29.204 version

25、14.0.0 Release 141 Scope The present document provides functional description of the SS7 Security Gateway. The document covers also network architecture, routeing considerations, and protocol details. 2 References The following documents contain provisions which, through reference in this text, cons

26、titute provisions of the present document. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the cas

27、e of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 29.002: “Mobile Application Part (MAP) specification“. 2 3GPP TS 29.078: “Customized Applications f

28、or Mobile network Enhanced Logic (CAMEL) Phase 4; CAMEL Application Part (CAP) specification“. 3 ETSI ETS 300 358: “ISDN Completion of Calls to Busy Subscriber (CCBS) supplementary service; Functional capabilities and information flows“. 4 3GPP TS 23.066: “Support of GSM Mobile Number Portability (M

29、NP) stage 2“. 5 ITU-T Recommendation Q.773: “Specifications of Signalling System No.7; Transaction capabilities formats and encoding“. 6 3GPP TS 33.200: “3G Security; Network Domain Security (NDS); Mobile Application Part (MAP) application layer security“. 7 ITU-T Recommendation E.164: “ The interna

30、tional public telecommunication numbering plan“. 8 3GPP TS 33.204: “3G Security; Network Domain Security (NDS); Transaction Capabilities Application Part (TCAP) user security“. 9 ITU-T Recommendations Q.711 to Q.716 (07/96), White Book Signalling Connection Control Part (SCCP). 10 3GPP TS 21.905: “V

31、ocabulary for 3GPP Specifications“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 21.905 10 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any,

32、 in TR 21.905 10. TCAP user: Application Part identified by one of the following SCCP Subsystem Numbers: 0000 0110 HLR (MAP) 0000 0111 VLR (MAP) 0000 1000 MSC (MAP) 0000 1001 EIR (MAP) 0000 1010 is allocated for evolution (possible Authentication Centre) 1001 0001 GMLC (MAP) ETSI ETSI TS 129 204 V14

33、.0.0 (2017-04)63GPP TS 29.204 version 14.0.0 Release 141001 0010 CAP 1001 0011 gsmSCF (MAP) or IM-SSF (MAP) or Presence Network Agent 1001 0101 SGSN (MAP) 1001 0110 GGSN (MAP) 0000 1011 SSAP 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: CC Country Cod

34、e GSMA Global System for Mobile communications Association IV Initialisation Vector MAC Message Authentication Code MNP Mobile Number Portability MSISDN Mobile Station International ISDN Number NDC National Destination Code NE Network Entit PLMN Public Land Mobile Network y RN Routeing Number SAD Se

35、curity Association Database SEG Security Gateway SPD Security Policy Database SPI Security Parameter Index SRF Signalling Relay Functio TCAP Transcaction Capabilities Application Part UDT SCCP Unitdata message XUDT SCCP Extended Unitdata message n 4 Network architecture In a PLMN that employs SS7 Se

36、curity Gateways all TCAP user signalling messages entering or leaving the PLMN have to transit an SS7 Security Gateway which belongs to the PLMN and which performs the protection of leaving (i.e. outbound) messages and the protection checking and de-protection or blocking of entering (i.e. inbound)

37、messages. One or several SS7 Security Gateways may be employed within a PLMN. An SS7 Security Gateway may be co-located with any TCAP user NE or it may stand alone. However, for the purpose of this document and without imposing any restrictions, it is assumed that the SS7 Security Gateways is a stan

38、d alone entity. It is further assumed that the SS7 Security Gateways are located at the boarder of the PLMN i.e. inbound messages transit an SS7 Security Gateway before they reach any other node within the PLMN, and outbound messages transit an SS7 Security Gateway immediately before reaching a node

39、 outside the PLMN. SS7 routeing is not impacted by the SS7 Security Gateway Architecture. As a consequence SS7 Security Gateways are stateless at TCAP level: No TCAP dialogue states are maintained in the SS7 Security Gateway since the outbound dialogue request message may transit a different SS7 Sec

40、urity Gateway than the corresponding inbound dialogue response message; similarly the inbound dialogue request message may transit a different SS7 Security Gateway than the corresponding outbound dialogue response message. 4.1 Scenarios SS7 Security Gateways perform protection, de-protection, blocki

41、ng and unmodified passing of TCAP user messages depending on the scenario as described below: Note that scenarios 4.1.5, 4.1.6, 4.1.7, 4.1.8, and 4.1.9 are not applicable if all PLMNs TCAP user NEs are interconnected by PLMN internal signalling links and routing tables are set up not to allow these

42、scenarios. ETSI ETSI TS 129 204 V14.0.0 (2017-04)73GPP TS 29.204 version 14.0.0 Release 144.1.1 Outbound traffic (not yet protected) from own to foreign NE This scenario is shown in figure 4.1.1. The message is originated at a NE inside the PLMN. It may transit several transit nodes inside the PLMN

43、before it reaches the SS7 Security Gateway. This SS7 Security Gateway protects the message according to the relevant Security Policy with the relevant Security Association. The message may then transit several nodes outside the PLMN (including an SS7 Security Gateway) before it reaches its destinati

44、on. Figure 4.1.1: Outbound traffic (not yet protected) from own to foreign NE 4.1.2 Inbound traffic from foreign to own NE This scenario is shown in figure 4.1.2. The message is originated at a NE outside the PLMN. It may transit several transit nodes (including an SS7 Security Gateway) outside the

45、PLMN before it reaches the PLMNs SS7 Security Gateway. This SS7 Security Gateway checks whether the message is correctly protected according to the relevant security association. If it is not, the message is blocked (discarded), otherwise it is de-protected. To determine the relevant security associ

46、ation the fact that the message may have been relayed by an MNP-SRF in a transit network (see Clause 4.1.10 and 5.1.2) needs to be taken into account. After successful de-protection the message may then transit several nodes inside the PLMN before it reaches the TCAP user NE. TCAP user NE SS7 Securi

47、ty Gateway Transit Node to destination PLMN unprotected TCAP user message protected TCAP user message ETSI ETSI TS 129 204 V14.0.0 (2017-04)83GPP TS 29.204 version 14.0.0 Release 14Figure 4.1.2: Inbound traffic from foreign to own NE 4.1.3 Inbound transit traffic This scenario is shown in figure 4.1

48、.3. The message is originated at a NE outside the transit PLMN. It may transit several transit nodes outside the transit PLMN before it reaches the SS7 Security Gateway in inbound direction. This SS7 Security Gateway passes the message unmodified. The message may then transit several transit nodes i

49、nside the transit PLMN, another SS7 Security Gateway of the transit PLMN in outbound direction (see Clause 4.1.4), and several transit nodes outside the transit and destination PLMN (potentially including an SS7 Security Gateway) before it reaches the destination PLMN. Note: A PLMN operator may decide not to act as transit network for specific or all combinations of origin and destination. In this case the SS7 Security Gateway may block the inbound message. Figure 4.1.3: Inbound transit traffic TCAP user NE SS7 Security Gateway Transit Node from ori