ETSI TS 133 250-2017 LTE Security assurance specification for the PGW network product class (V14 0 0 3GPP TS 33 250 version 14 0 0 Release 14).pdf

1、 ETSI TS 133 250 V14.0.0 (2017-07) LTE; Security assurance specification for the PGW network product class (3GPP TS 33.250 version 14.0.0 Release 14) TECHNICAL SPECIFICATION ETSI ETSI TS 133 250 V14.0.0 (2017-07)13GPP TS 33.250 version 14.0.0 Release 14Reference DTS/TSGS-0333250ve00 Keywords LTE,SEC

2、URITY ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded fr

3、om: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or per

4、ceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to rev

5、ision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/Comm

6、iteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written

7、authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are trademarks of ETSI registered for

8、the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSM and the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 133 250 V14.0.0 (2017-07)23GPP TS 33.250 version 14.0.0 Release 14Intellectual Pr

9、operty Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs);

10、 Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been car

11、ried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI 3rd Gen

12、eration Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GSM, UMTS, 3GP

13、P and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Draft

14、ing Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 250 V14.0.0 (2017-07)33GPP TS 33.250 version 14.0.0 Release 14Contents Intellectual Property Rights 2g3Foreword . 2g3Modal verbs

15、 terminology 2g3Foreword . 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 5g33.1 Definitions 5g33.2 Abbreviations . 5g34 PGW-specific security requirements and related test cases . 6g34.1 Introduction 6g34.2 PGW-specific security functional adaptations of requirements and related te

16、st cases . 6 g34.2.1 Introduction. 6g34.2.2 Security functional requirements on the PGW deriving from 3GPP specifications and related test cases 6g34.2.2.1 Security functional requirements on the PGW deriving from 3GPP specifications General approach 6g34.2.2.2 Per-user based packet filtering 6g34.2

17、.2.3 Charging ID Uniqueness . 7g34.2.2.4 TEID UNIQUENESS 8g34.2.3 Technical baseline. 9g34.2.3.1 Introduction . 9g34.2.3.2 Protecting data and information 9g34.2.3.2.1 Protecting data and information general . 9g34.2.3.2.2 Protecting data and information unauthorized viewing 9g34.2.3.2.3 Protecting

18、data and information in storage 9g34.2.3.2.4 Protecting data and information in transfer . 9g34.2.3.2.5 Logging access to personal data 9g34.2.3.3 Protecting availability and integrity 9g34.2.3.4 Authentication and authorization 9g34.2.3.5 Protecting sessions 9g34.2.3.5.1 Unpredictable GTP TEID 9g34

19、.2.3.6 Logging . 10g34.2.4 Operating systems . 11g34.2.5 Web servers 11g34.2.6 Network devices . 11g34.2.6.1 Protection of Data and Information . 11g34.2.6.2 Protecting availability and integrity 11g34.2.6.3 IP Address reallocation interval 11g34.2.6.4 MS/UE-Mutual Access Prevention . 12g34.3 PGW-sp

20、ecific adaptations of hardening requirements and related test cases . 13g34.3.1 Introduction. 13g34.3.2 Technical baseline. 13g34.3.3 Operating systems . 13g34.3.4 Web servers 13g34.3.5 Network devices . 13g34.3.5.1 Traffic separation 13g34.3.5.2 User Plane Traffic Differentiation . 14g34.4 PGW-spec

21、ific adaptations of basic vulnerability testing requirements and related test cases 15g3Annex A (informative): Change history . 16g3History 17g3ETSI ETSI TS 133 250 V14.0.0 (2017-07)43GPP TS 33.250 version 14.0.0 Release 14Foreword This Technical Specification has been produced by the 3rd Generation

22、 Partnership Project (3GPP). The contents of the present document are subject to continuing work within the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and a

23、n increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enha

24、ncements, corrections, updates, etc. z the third digit is incremented when editorial only changes have been incorporated in the document. ETSI ETSI TS 133 250 V14.0.0 (2017-07)53GPP TS 33.250 version 14.0.0 Release 141 Scope The present document contains requirements and test cases that are specific

25、 to the PGW network product class. It refers to the Catalogue of General Security Assurance Requirements and formulates specific adaptions of the requirements and test cases given there, as well as specifying requirements and test cases unique to the PGW network product class. 2 References The follo

26、wing documents contain provisions which, through reference in this text, constitute provisions of the present document. - References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not

27、apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document. 1 3GPP TR 21.905: “Vocabulary fo

28、r 3GPP Specifications“. 2 3GPP TR 41.001: “GSM Release specifications“. 3 3GPP TS 33.117: “Catalogue of General Security Assurance Requirements“. 4 3GPP TR 33.916: “Security assurance scheme for 3GPP network products for 3GPP network product classes“. 5 3GPP TS 33.401: “3GPP System Architecture Evol

29、ution (SAE); Security architecture“. 6 3GPP TS 23.401: “General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access“. 7 3GPP TS 33.102: “3G security; Security architecture“. 8 3GPP TS 32.251: “Telecommunication management; Charging managem

30、ent; Packet Switched (PS) domain charging“. 9 3GPP TS 23.060: “General Packet Radio Service (GPRS); Service description; Stage 2“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in 3GPP TR 21.905 1 and the following apply. A

31、term defined in the present document takes precedence over the definition of the same term, if any, in 3GPP TR 21.905 1. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in 3GPP TR 21.905 1 and the following apply. An abbreviation defined in the present document ta

32、kes precedence over the definition of the same abbreviation, if any, in 3GPP TR 21.905 1. ETSI ETSI TS 133 250 V14.0.0 (2017-07)63GPP TS 33.250 version 14.0.0 Release 144 PGW-specific security requirements and related test cases 4.1 Introduction The structure of the present document is aligned with

33、TS 33.1173 such that the PGW-specific adaptation of a generic requirement in 33.1173, clause 4, can be always found in clause 4 of present document. The text on pre-requisites for testing in clause 4.1.2 of TS 33.117 3 applies also to the present document. 4.2 PGW-specific security functional adapta

34、tions of requirements and related test cases 4.2.1 Introduction 4.2.2 Security functional requirements on the PGW deriving from 3GPP specifications and related test cases 4.2.2.1 Security functional requirements on the PGW deriving from 3GPP specifications General approach In addition to the require

35、ments and test cases in TS 33.1173, clause 4.2.2, a PGW shall satisfy the following: It is assumed for the purpose of the present SCAS that a PGW conforms to all mandatory security-related provisions pertaining to a PGW in: - 3GPP TS 33.4015: “EPS security architecture“; - other 3GPP specifications

36、that make reference to TS 33.4015 or are referred to from TS 33.4015 (e.g. TS 23.401 6 , TS 23.0609, etc.); - 3GPP TS 32.2518: “ Packet Switched (PS) domain charging“. Since the PDN GW is the gateway which terminates the SGi interface, the security procedures pertaining to the PGW are typically rela

37、ted to gateway functions. For example: - Per-user based packet filtering (by e.g. deep packet inspection). - Every IP-CAN bearer shall be assigned a unique identity number for billing purposes. (i.e. the Charging Id). - The TEID is a unique identifier within one IP address of a logical node. 4.2.2.2

38、 Per-user based packet filtering Requirement Name: Per-user based packet filtering Requirement Reference: TBA Requirement Description: This requirement is identical to per-user based packet filtering (by e.g. deep packet inspection) as specified in TS 23.401, clause 4.4.3.3. Threat References: TBA S

39、ecurity Objective References: TBA Test Case: Purpose: ETSI ETSI TS 133 250 V14.0.0 (2017-07)73GPP TS 33.250 version 14.0.0 Release 14Verify that PGW supports a Per-user based packet filtering. Pre-Conditions: - The tester has a privilege to configure the filtering policy on the PGW to make the PGW c

40、an filter the packets per-user - Some UE (e.g. UE1 and UE2) are registered on the PGW. - The PGW can receive the packets from the UE1 and UE2. - A network traffic analyser on the PGW (e.g. tcpdump) is available. Execution Steps 1. The tester configures the different filtering policy for the UE1and t

41、he UE2 on the PGW, e.g. the PGW forwards the packets from the UE1 to SGi and drops the packets from the UE2. 2. The tester sends the packets from the UE1 to the PGW. 3. The tester sends the packets from the UE2 to the PGW. 4. The tester checks the filtered packets using the network traffic analyser.

42、 Expected Results: The PGW can filter the packets per- user according the configured filtering policy, e.g. the PGW forwards the packets from the UE1 to SGi in the step 2 and drops the packets from the UE2 in the step 3. Expected format of evidence: Evidence suitable for the interface, e.g. screensh

43、ot contains the operation results, pcap file demonstrating that the UE2s packets are correctly received but unavailable on the SGi interface while the UE1s packets are correctly sent to SGi. 4.2.2.3 Charging ID Uniqueness Editors Note: Reuse of Charging ID is FFS. Requirement Name: Charging ID Uniqu

44、eness Requirement Reference: TBA Requirement Description: “Every IP-CAN bearer shall be assigned a unique identity number for billing purposes. (i.e. the Charging Id)“ as specified in 3GPP TS 32.251 8, clause 5.1.1. Threat References: TBA Security Objective References: TBA Test Case: Purpose: Verify

45、 that the Charging ID value set in the Information Element Bearer Context within a CreateSessionResponse is unique. Pre-Conditions: Test environment with P-GW and S-GW, PCRF. PCRF and S-GW may be real nodes or simulated. The tester is able to trace traffic between the P-GW and the S-GW (real or simu

46、lated) Execution Step 1. The tester intercepts the traffic between the P-GW and the S-GW. ETSI ETSI TS 133 250 V14.0.0 (2017-07)83GPP TS 33.250 version 14.0.0 Release 142. The tester trigger more than one (e.g. at least 10000) consecutive CreateSessionRequest for an Initial UE Attach towards the P-G

47、W (using a real or a simulated S-GW) in order to setup a new IP-CAN bearer. 3. The P-GW creates a UE/S-GW context and communicates with the PCRF (real or simulated) for QOS and APN resolve. That procedures shall be successfully in order to permit to the P-GW to send back to the S-GW a CreateSessionR

48、esponse containing at least : a. A Success cause. b. The P-GWs F-TEID for control plane c. The PDN Address Allocation (PAA) d. A Bearer Contexts Created. 4. The tester verifies that the Charging ID within Bearer Contexts Created in each generated CreateSessionResponse are different. Expected Results

49、: The Charging ID assigned to every IP-CAN bearer requested by different CreateSessionRequest is unique. Expected format of evidence: Files containing the triggered GTP messages (e.g. pcap trace). 4.2.2.4 TEID UNIQUENESS Editors Note: Reuse of TEID is FFS. Requirement Name: TEID Uniqueness Requirement Reference: TBA Requirement Description: “The TEID is a unique identifier within one IP address of a logical node.“ as specified in TS 23.060 9, clause 14.6. Threat References: TBA Security Objective References: TBA T