ETSI TS 133 210-2016 Digital cellular telecommunications system (Phase 2+) (GSM) Universal Mobile Telecommunications System (UMTS) LTE 3G security Network Domain Security (NDS) IP .pdf

1、 ETSI TS 1Digital cellular telecommUniversal Mobile TelNetwork IP ne(3GPP TS 33.2TECHNICAL SPECIFICATION133 210 V13.0.0 (2016mmunications system (Phase elecommunications System (LTE; 3G security; k Domain Security (NDS); network layer security .210 version 13.0.0 Release 1316-01) e 2+) (GSM); (UMTS)

2、; 13) ETSI ETSI TS 133 210 V13.0.0 (2016-01)13GPP TS 33.210 version 13.0.0 Release 13Reference RTS/TSGS-0333210vd00 Keywords LTE ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but no

3、n lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of

4、 the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific n

5、etwork drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in th

6、e present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as au

7、thorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM,

8、PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Assoc

9、iation. ETSI ETSI TS 133 210 V13.0.0 (2016-01)23GPP TS 33.210 version 13.0.0 Release 13Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ET

10、SI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/i

11、pr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential

12、 to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted

13、as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “wi

14、ll“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 210 V13.0.0 (2016-01)33GPP

15、 TS 33.210 version 13.0.0 Release 13Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs terminology 2g3Foreword . 5g3Introduction 5g31 Scope 6g32 References 6g33 Definitions, symbols and abbreviations . 7g33.1 Definitions 7g33.2 Symbols 8g33.3 Abbreviations . 8g34 Overview over networ

16、k domain security for IP based protocols . 9g34.1 Introduction 9g34.2 Protection at the network layer . 9g34.3 Security for native IP based protocols 9g34.4 Security domains 9g34.4.1 Security domains and interfaces . 9g34.5 Security Gateways (SEGs) . 10g35 Key management and distribution architectur

17、e for NDS/IP . 10g35.1 Security services afforded to the protocols . 10g35.2 Security Associations (SAs) . 10g35.2.0 General 10g35.2.1 Security Policy Database (SPD) . 11g35.2.2 Security Association Database (SAD) 11g35.3 Profiling of IPsec 11g35.3.0 General 11g35.3.1 Support of ESP . 11g35.3.2 Supp

18、ort of tunnel mode . 12g35.3.3 Support of ESP encryption transforms . 12g35.3.4 Support of ESP authentication transforms 12g35.3.5 Requirements on the construction of the IV . 12g35.4 Profiling of IKEv2 12g35.4.0 General 12g35.4.1 Void 13g35.4.2 Profiling of IKEv2 13g35.4.3 Void 14g35.5 Security pol

19、icy granularity . 14g35.6 Network domain security key management and distribution architecture for native IP based protocols . 14g35.6.1 Network domain security architecture outline 14g35.6.2 Interface description . 15g3Annex A (informative): Other issues 17g3A.1 Network Address Translators (NATs) a

20、nd Transition Gateways (TrGWs) . 17g3A.2 Filtering routers and firewalls 17g3A.3 The relationship between BGs and SEGs . 17g3Annex B (normative): Security protection for GTP . 18g3B.0 General . 18g3B.1 The need for security protection . 18g3ETSI ETSI TS 133 210 V13.0.0 (2016-01)43GPP TS 33.210 versi

21、on 13.0.0 Release 13B.2 Policy discrimination of GTP-C and GTP-U . 18g3B.3 Protection of GTP-C transport protocols and interfaces 19g3Annex C (normative): Security protection of IMS protocols . 20g3C.0 General . 20g3C.1 The need for security protection . 20g3C.2 Protection of IMS protocols and inter

22、faces 20g3Annex D (normative): Security protection of UTRAN/GERAN IP transport protocols . 21g3D.0 General . 21g3D.1 The need for security protection . 21g3D.2 Protection of UTRAN/GERAN IP transport protocols and interfaces . 21g3Annex E (informative): RFC-4303 compared with RFC-2406 . 22g3Annex F (

23、informative): Change history . 23g3History 24g3ETSI ETSI TS 133 210 V13.0.0 (2016-01)53GPP TS 33.210 version 13.0.0 Release 13Foreword This Technical Specification has been produced by the 3rdGeneration Partnership Project (3GPP). The contents of the present document are subject to continuing work w

24、ithin the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TS

25、G for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes

26、have been incorporated in the document. Introduction An identified security weakness in 2G systems is the absence of security in the core network. This was formerly perceived not to be a problem, since the 2G networks previously were the provinces of a small number of large institutions. This is no

27、longer the case, and so there is now a need for security precautions. Another significant development has been the introduction of IP as the network layer in the GPRS backbone network and then later in the UMTS network domain. Furthermore, IP is not only used for signalling traffic, but also for use

28、r traffic. The introduction of IP therefore signifies not only a shift towards packet switching, which is a major change by its own accounts, but also a shift towards completely open and easily accessible protocols. The implication is that from a security point of view, a whole new set of threats an

29、d risks must be faced. For 3G and fixed broadband systems it is a clear goal to be able to protect the core network signalling protocols, and by implication this means that security solutions must be found for both SS7 and IP based protocols. This technical specification is the stage-2 specification

30、 for IP related security in the 3GPP and fixed broadband core networks. The security services that have been identified as being needed are confidentiality, integrity, authentication and anti-replay protection. These will be ensured by standard procedures, based on cryptographic techniques. ETSI ETS

31、I TS 133 210 V13.0.0 (2016-01)63GPP TS 33.210 version 13.0.0 Release 131 Scope The present document defines the security architecture for network domain IP based control planes, which shall be applied to NDS/IP-networks (i.e. 3GPP and fixed broadband networks). The scope of network domain control pl

32、ane security is to cover the control signalling on selected interfaces between network elements of NDS/IP networks. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified

33、 by date of publication, edition number, version number, etc.) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference im

34、plicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TS 21.133: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Security Threats and Requirements“. 2 3GPP TR 21.905: “3rd Generation Par

35、tnership Project; Technical Specification Group Services and System Aspects; Vocabulary for 3GPP Specifications“. 3 3GPP TS 23.002: “3rd Generation Partnership Project; Technical Specification Group Services and Systems Aspects; Network architecture“. 4 3GPP TS 23.060: “3rd Generation Partnership Pr

36、oject; Technical Specification Group Services and System Aspects; General Packet Radio Service (GPRS); Service description; Stage 2“. 5 3GPP TS 23.228: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; IP Multimedia Subsystem (IMS); Stage 2“. 6 3GPP TS 2

37、9.060: “3rd Generation Partnership Project; Technical Specification Group Core Network; General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GTP) across the Gn and Gp Interface“. 7 3GPP TS 33.102: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspect

38、s; 3G Security; Security Architecture“. 8 3GPP TS 33.103: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G security; Integration guidelines“. 9 3GPP TS 33.120: “3rd Generation Partnership Project; Technical Specification Group Services and System Asp

39、ects; 3G Security; Security Principles and Objectives“. 10 3GPP TS 33.203: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Access security for IP-based services“. 11 -25 Void. 26 RFC-3554: “On the Use of Stream Control Transmission Protocol (SCTP) with

40、 IPsec“. 27 RFC-1750: “Randomness Recommendations for Security“. 28 3GPP TS 25.412: “3rd Generation Partnership Project; Technical Specification Group Radio Access Network; UTRAN Iu interface signalling transport“. 29 RFC-3602: “The AES-CBC Cipher Algorithm and Its Use with IPsec“. ETSI ETSI TS 133

41、210 V13.0.0 (2016-01)73GPP TS 33.210 version 13.0.0 Release 1330 3GPP TS 33.310: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Network domain security; Authentication Framework“. 31 RFC-4303: “IP Encapsulating Security Payload (ESP)“ 32

42、Void. 33 Void 34 Void. 35 RFC-4301: “Security Architecture for the Internet Protocol“. 36 RFC-4835: “Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)“. 37 RFC-5996: “Internet Key Exchange Protocol Version 2 (IKEv2)“. 38 3GPP

43、TS 25.422: “3rd Generation Partnership Project; Technical Specification Group Radio Access Network; UTRAN Iur interface signalling transport“. 39 3GPP TS 25.467: “3rd Generation Partnership Project; Technical Specification Group Radio Access Network; UTRAN architecture for 3G Home Node B (HNB); Stag

44、e 2“. 40 3GPP TS 25.468: “3rd Generation Partnership Project; Technical Specification Group Radio Access Network; UTRAN Iuh Interface RANAP User Adaption (RUA) signalling“. 41 3GPP TS 25.471: “3rd Generation Partnership Project; Technical Specification Group Radio Access Network; UTRAN Iurh Interfac

45、e RNSAP User Adaption (RNA) signalling“. 42 RFC-6311: “Protocol Support for High Availability of IKEv2/IPsec“. 43 RFC-7296: “Internet Key Exchange Protocol Version 2 (IKEv2)“. 44 IANA: “Internet Key Exchange Version 2 (IKEv2) Parameters“. 45 RFC-7321: “Cryptographic Algorithm Implementation Requirem

46、ents and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply. Anti-replay protection: Anti-replay protection is a special

47、case of integrity protection. Its main service is to protect against replay of self-contained packets that already have a cryptographical integrity mechanism in place. Confidentiality: The property that information is not made available or disclosed to unauthorised individuals, entities or processes

48、. Data integrity: The property that data has not been altered in an unauthorised manner. Data origin authentication: The corroboration that the source of data received is as claimed. Entity authentication: The provision of assurance of the claimed identity of an entity. Key freshness: A key is fresh

49、 if it can be guaranteed to be new, as opposed to an old key being reused through actions of either an adversary or authorised party. NDS/IP Traffic: Traffic that requires protection according to the mechanisms defined in this specification. ETSI ETSI TS 133 210 V13.0.0 (2016-01)83GPP TS 33.210 version 13.0.0 Release 13NDS/IP-networks: 3GPP and fixed broadband networks. IPsec Security Association: A unidirectional logical connection created for security purposes. All traffic traversing a SA is provided the