ETSI TS 129 204-2018 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) Signalling System No 7 (SS7) security gateway Arc.pdf

1、 ETSI TS 129 204 V15.0.0 (2018-07) Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Signalling System No. 7 (SS7) security gateway; Architecture, functional description and protocol details (3GPP TS 29.204 version 15.0.0 Release 15) TECH

2、NICAL SPECIFICATION GLOBAL SYSTEM FOR MOBILE COMMUNICATIONSRETSI ETSI TS 129 204 V15.0.0 (2018-07)13GPP TS 29.204 version 15.0.0 Release 15Reference RTS/TSGC-0429204vf00 Keywords GSM,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47

3、16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in pr

4、int. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the

5、Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/p

6、ortal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electr

7、onic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All

8、 rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTETMare trademarks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its M

9、embers. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 129 204 V15.0.0 (2018-07)23GPP TS 29.204 version 15.0.0 Release 15Intellectual Property Rights Essential patents IPRs essential or potentially essential to normative deliverables may have been declar

10、ed to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which i

11、s available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ET

12、SI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners. ETSI claims no ownership of these except for an

13、y which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks. Forewo

14、rd This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corre

15、sponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cann

16、ot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 129 204 V15.0.0 (2018-07)33GPP TS 29.204 version 15.0.0 Releas

17、e 15Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 4g3Introduction 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 5g33.1 Definitions 5g33.2 Abbreviations . 6g34 Network architecture 6g34.1 Scenarios 6g34.1.1 Outbound traffic (not yet pro

18、tected) from own to foreign NE 6g34.1.2 Inbound traffic from foreign to own NE . 7g34.1.3 Inbound transit traffic . 8g34.1.4 Outbound transit traffic (not relayed) . 8g34.1.5 Outbound traffic from own to own NE . 9g34.1.6 Inbound traffic from own to own NE . 9g34.1.7 Outbound traffic from foreign to

19、 own NE 10g34.1.8 Inbound traffic from own to foreign NE . 11g34.1.9 Outbound traffic (already protected) from own to foreign NE . 12g34.1.10 Outbound transit traffic (relayed by SRF) 12g35 Detailed Behaviour of the SS7 Security Gateway 13g35.1 TCAP user traffic . 13g35.1.1 General 13g35.1.2 Interac

20、tions with Mobile Number Portability . 28g35.1.3 Interactions with SCCP segmentation. 28g35.1.4 Protocol details . 29g35.1.4.1 Transformation of unprotected message to protected message . 29g35.1.4.2 Transformation of protected message to unprotected message . 33g35.1.4.3 Handling of received XUDTS

21、messages and UDTS messages . 36g3Annex A (informative): Change history . 39g3History 40g3ETSI ETSI TS 129 204 V15.0.0 (2018-07)43GPP TS 29.204 version 15.0.0 Release 15Foreword This Technical Specification has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present

22、 document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z w

23、here: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit i

24、s incremented when editorial only changes have been incorporated in the document. Introduction The absence of security in Signalling System No. 7 (SS7) networks is an identified security weakness in 2G systems. This was formerly perceived not to be a problem, since the SS7 networks were the province

25、s of a small number of large institutions. This is no longer the case, and so there is now a need for security precautions. For 3G systems it is a clear goal to be able to protect inter-network SS7 signalling protocols. The protection is done by security gateways which are located at the network bor

26、der. As a consequence intra network SS7 signalling is not protected and network elements other than Security Gateways are not impacted. ETSI ETSI TS 129 204 V15.0.0 (2018-07)53GPP TS 29.204 version 15.0.0 Release 151 Scope The present document provides functional description of the SS7 Security Gate

27、way. The document covers also network architecture, routeing considerations, and protocol details. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. - References are either specific (identified by date of pub

28、lication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly re

29、fers to the latest version of that document in the same Release as the present document. 1 3GPP TS 29.002: “Mobile Application Part (MAP) specification“. 2 3GPP TS 29.078: “Customized Applications for Mobile network Enhanced Logic (CAMEL) Phase 4; CAMEL Application Part (CAP) specification“. 3 ETSI

30、ETS 300 358: “ISDN Completion of Calls to Busy Subscriber (CCBS) supplementary service; Functional capabilities and information flows“. 4 3GPP TS 23.066: “Support of GSM Mobile Number Portability (MNP) stage 2“. 5 ITU-T Recommendation Q.773: “Specifications of Signalling System No.7; Transaction cap

31、abilities formats and encoding“. 6 3GPP TS 33.200: “3G Security; Network Domain Security (NDS); Mobile Application Part (MAP) application layer security“. 7 ITU-T Recommendation E.164: “ The international public telecommunication numbering plan“. 8 3GPP TS 33.204: “3G Security; Network Domain Securi

32、ty (NDS); Transaction Capabilities Application Part (TCAP) user security“. 9 ITU-T Recommendations Q.711 to Q.716 (07/96), White Book Signalling Connection Control Part (SCCP). 10 3GPP TS 21.905: “Vocabulary for 3GPP Specifications“. 3 Definitions and abbreviations 3.1 Definitions For the purposes o

33、f the present document, the terms and definitions given in TR 21.905 10 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905 10. TCAP user: Application Part identified by one of the following SCCP Subsystem Number

34、s: 0000 0110 HLR (MAP) 0000 0111 VLR (MAP) 0000 1000 MSC (MAP) 0000 1001 EIR (MAP) 0000 1010 is allocated for evolution (possible Authentication Centre) 1001 0001 GMLC (MAP) 1001 0010 CAP 1001 0011 gsmSCF (MAP) or IM-SSF (MAP) or Presence Network Agent ETSI ETSI TS 129 204 V15.0.0 (2018-07)63GPP TS

35、29.204 version 15.0.0 Release 151001 0101 SGSN (MAP) 1001 0110 GGSN (MAP) 0000 1011 SSAP 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: CC Country Code GSMA Global System for Mobile communications Association IV Initialisation Vector MAC Message Authen

36、tication Code MNP Mobile Number Portability MSISDN Mobile Station International ISDN Number NDC National Destination Code NE Network Entit PLMN Public Land Mobile Network y RN Routeing Number SAD Security Association Database SEG Security Gateway SPD Security Policy Database SPI Security Parameter I

37、ndex SRF Signalling Relay Functio TCAP Transcaction Capabilities Application Part UDT SCCP Unitdata message XUDT SCCP Extended Unitdata message n 4 Network architecture In a PLMN that employs SS7 Security Gateways all TCAP user signalling messages entering or leaving the PLMN have to transit an SS7

38、Security Gateway which belongs to the PLMN and which performs the protection of leaving (i.e. outbound) messages and the protection checking and de-protection or blocking of entering (i.e. inbound) messages. One or several SS7 Security Gateways may be employed within a PLMN. An SS7 Security Gateway

39、may be co-located with any TCAP user NE or it may stand alone. However, for the purpose of this document and without imposing any restrictions, it is assumed that the SS7 Security Gateways is a stand alone entity. It is further assumed that the SS7 Security Gateways are located at the boarder of the

40、 PLMN i.e. inbound messages transit an SS7 Security Gateway before they reach any other node within the PLMN, and outbound messages transit an SS7 Security Gateway immediately before reaching a node outside the PLMN. SS7 routeing is not impacted by the SS7 Security Gateway Architecture. As a consequ

41、ence SS7 Security Gateways are stateless at TCAP level: No TCAP dialogue states are maintained in the SS7 Security Gateway since the outbound dialogue request message may transit a different SS7 Security Gateway than the corresponding inbound dialogue response message; similarly the inbound dialogue

42、 request message may transit a different SS7 Security Gateway than the corresponding outbound dialogue response message. 4.1 Scenarios SS7 Security Gateways perform protection, de-protection, blocking and unmodified passing of TCAP user messages depending on the scenario as described below: Note tha

43、t scenarios 4.1.5, 4.1.6, 4.1.7, 4.1.8, and 4.1.9 are not applicable if all PLMNs TCAP user NEs are interconnected by PLMN internal signalling links and routing tables are set up not to allow these scenarios. 4.1.1 Outbound traffic (not yet protected) from own to foreign NE This scenario is shown in

44、 figure 4.1.1. The message is originated at a NE inside the PLMN. It may transit several transit nodes inside the PLMN before it reaches the SS7 Security Gateway. This SS7 Security Gateway protects the message ETSI ETSI TS 129 204 V15.0.0 (2018-07)73GPP TS 29.204 version 15.0.0 Release 15according t

45、o the relevant Security Policy with the relevant Security Association. The message may then transit several nodes outside the PLMN (including an SS7 Security Gateway) before it reaches its destination. Figure 4.1.1: Outbound traffic (not yet protected) from own to foreign NE 4.1.2 Inbound traffic fr

46、om foreign to own NE This scenario is shown in figure 4.1.2. The message is originated at a NE outside the PLMN. It may transit several transit nodes (including an SS7 Security Gateway) outside the PLMN before it reaches the PLMNs SS7 Security Gateway. This SS7 Security Gateway checks whether the me

47、ssage is correctly protected according to the relevant security association. If it is not, the message is blocked (discarded), otherwise it is de-protected. To determine the relevant security association the fact that the message may have been relayed by an MNP-SRF in a transit network (see Clause 4

48、1.10 and 5.1.2) needs to be taken into account. After successful de-protection the message may then transit several nodes inside the PLMN before it reaches the TCAP user NE. Figure 4.1.2: Inbound traffic from foreign to own NE TCAP user NE SS7 Security Gateway Transit Node to destination PLMN unpro

49、tected TCAP user message protected TCAP user message TCAP user NE SS7 Security Gateway Transit Node from origin PLMN unprotected TCAP user message protected TCAP user message ETSI ETSI TS 129 204 V15.0.0 (2018-07)83GPP TS 29.204 version 15.0.0 Release 154.1.3 Inbound transit traffic This scenario is shown in figure 4.1.3. The message is originated at a NE outside the transit PLMN. It may transit several transit nodes outside the transit PLMN before it reaches the SS7 Security Gateway in inbound direction. This SS7 Security Gateway passes the message