ETSI TS 187 003-2011 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN) NGN Security Security Architecture (V3 4 1)《电信和互联网融合业务及高级网络协议_1.pdf

1、 ETSI TS 187 003 V3.4.1 (2011-03)Technical Specification Telecommunications and Internet converged Services andProtocols for Advanced Networking (TISPAN);NGN Security;Security ArchitectureETSI ETSI TS 187 003 V3.4.1 (2011-03) 2Reference RTS/TISPAN-07038-NGN-R3 Keywords architecture, security ETSI 65

2、0 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can be downl

3、oaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference

4、 shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is a

5、vailable at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. T

6、he copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2011. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPT

7、M is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the

8、 GSM Association. ETSI ETSI TS 187 003 V3.4.1 (2011-03) 3Contents Intellectual Property Rights 5g3Foreword . 5g31 Scope 6g32 References 6g32.1 Normative references . 6g32.2 Informative references 8g33 Definitions and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 9g34 NGN Security . 12g34

9、.0 Overview 12g34.0a Security services identified in TS 187 001 and TR 187 002 12g34.1 NGN security architecture 13g34.2 Security domains 17g34.3 Void 18g34.4 Void 18g34.5 PES Security Architecture 18g34.5.1 Security for H.248 within PES 18g34.6 Application security architecture 19g34.6.1 Generic Au

10、thentication Architecture (GAA) 19g34.6.1.1 Generic Bootstrapping Architecture (GBA) 20g34.6.1.2 Support for Subscriber Certificates (SSC) 20g34.6.1.3 Access to NAF using HTTPS 20g34.6.2 HTTP Digest authentication for UICC-less CNDs . 20g35 Void 22g36 Void 22g37 Void 22g37.1 Void 22g37.2 Void 22g38

11、Void 22g39 Security Architectures for IPTV . 22g39.1 Content Protection 22g39.1.2 Reference Points . 23g39.1.2.1 LIF UE (s-cp-1) 23g39.1.2.2 KMF LIF (s-cp-2) 23g39.1.2.3 KMF CEF (s-cp-3) . 23g39.1.2.4 CEF MDF (s-cp-4) . 24g39.2 Service Protection. 24g39.3 Optional solutions. 24g39.3.1 Any Content Pr

12、otection 24g39.3.1.1 Reference Points . 25g39.3.1.2 Procedures . 25g39.3.1.2.1 Content Preparation . 25g39.3.1.2.2 Content Delivery . 25g39.3.1.2.3 Right and Key Delivery . 25g39.3.2 OMA BCAST . 25g39.3.2.1 OMA BCAST Functional Architecture . 26g39.3.2.2 Mapping between TISPAN IPTV Architecture and

13、OMA BCAST Service Protection Functional Architecture . 27g39.3.2.3 Mapping between TISPAN IPTV Service Protection based on 4-layer Key Hierarchy and OMA BCAST Service Protection Functional Architecture . 29g3ETSI ETSI TS 187 003 V3.4.1 (2011-03) 49.3.2.4 OMA BCAST Smart Card Profile adaptation to MP

14、EG-2 TS 30g39.3.2.4.1 STKM Transport in MPEG-2 TS 30g39.3.2.4.2 STKM and MPEG-2 TS encryption 32g310 Void 33g311 Void 33g312 Void 33g312.1 Void 33g312.2 Void 33g313 Security Architecture for Corporate Networks . 33g313.1 Subscription Based Business Trunking 33g313.2 Peering Based Business Trunking 3

15、3g314 Security Architecture for Host Enterprise 33g3Annex A (informative): NGN-relevant security interfaces . 34g3A.1 Network attachment security interfaces . 34g3A.1.1 Reference Point e1 (CNG - AMF) 35g3A.1.2 Reference Point e2 (CLF - AF) 35g3A.1.3 Reference Point a3 (AMF - UAAF) . 35g3A.1.4 Refere

16、nce Point e5 (UAAF - UAAF) . 35g3A.2 Service layer security interfaces . 36g3A.2.1 NGN IP Multimedia Subsystem (IMS) 36g3A.2.1.1 Reference Point Gm (UE - P-CSCF) 36g3A.2.1.2 Reference Point Cx (CSCF - UPSF) . 37g3A.2.1.3 Reference Point Gq (P-CSCF - RACS) 37g3A.2.1.4 Reference Point Iw (IWF - non-co

17、mpatible SIP) 37g3A.2.1.5 Reference Point Ic (IBCF - IMS) 37g3A.2.1.6 Void 37g3A.2.1.7 Reference Point Ut (UE - AS) 37g3A.3 Interconnection security interfaces . 38g3A.3.1 Interconnecting security at the transport layer 39g3A.3.2 Interconnecting security at the service layer 39g3Annex B (informative

18、): Mapping of NGN Security Requirements to Security Services . 40g3Annex C: Void 46g3Annex D: Void 47g3Annex E (informative): Open Issues in NGN Security . 48g3Annex F: Void 49g3Annex G (informative): Bibliography . 50g3Annex H (informative): Change history . 52g3History 53g3ETSI ETSI TS 187 003 V3.

19、4.1 (2011-03) 5Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intell

20、ectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investi

21、gation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specific

22、ation (TS) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TS 187 003 V3.4.1 (2011-03) 61 Scope The present document defines the security architecture of NGN. The present document addresses the

23、 security architecture required to fulfil the NGN security requirements defined in TS 187 001 1 and includes the definition of security architectures to provide protection for each of the NGN functional architecture (ES 282 001 2) and its subsystems (NASS ES 282 004 5, PES ES 282 002 3, ES 282 007 1

24、5, SIP and SDP call control ES 283 003 14 and RACS ES 282 003 4). Where appropriate the present document endorses security mechanisms defined in other specifications. The present document addresses the security issues of the NGN core network and the NGN access network(s) and the Customer Premises ne

25、twork (CPN). 2 References References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amen

26、dments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1

27、Normative references The following referenced documents are necessary for the application of the present document. 1 ETSI TS 187 001: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN SECurity (SEC); Requirements“. 2 ETSI ES 282 001: “Telecommuni

28、cations and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Functional Architecture“. 3 ETSI ES 282 002: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); PSTN/ISDN Emulation Sub-system (PES); Functional architecture“.

29、 4 ETSI ES 282 003: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Resource and Admission Control Sub-System (RACS): Functional Architecture“. 5 ETSI ES 282 004: “Telecommunications and Internet converged Services and Protocols for Advanced Networ

30、king (TISPAN); NGN Functional Architecture; Network Attachment Sub-System (NASS)“. 6 ETSI TS 183 033: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); IP Multimedia; Diameter based protocol for the interfaces between the Call Session Control Functio

31、n and the User Profile Server Function/Subscription Locator Function; Signalling flows and protocol details 3GPP TS 29.228 V6.8.0 and 3GPP TS 29.229 V6.6.0, modified“. 7 ETSI TS 133 203: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; 3

32、G security; Access security for IP-based services (3GPP TS 33.203)“. ETSI ETSI TS 187 003 V3.4.1 (2011-03) 78 ETSI TS 133 210: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; 3G security; Network Domain Security (NDS); IP network layer

33、security (3GPP TS 33.210)“. 9 ETSI TS 133 222: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Generic Authentication Architecture (GAA); Access to network application functions using Hypertext Transfer Protocol over Transport Layer Sec

34、urity (HTTPS) (3GPP TS 33.222)“. 10 ETSI TS 133 220: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) (3GPP TS 33.220)“. 11 ETSI ES 283 002: “Telecommuni

35、cations and Internet converged Services and Protocols for Advanced Networking (TISPAN); PSTN/ISDN Emulation Subsystem (PES); NGN Release 1 H.248 Profile for controlling Access and Residential Gateways“. 12 ETSI TS 183 019: “Telecommunications and Internet converged Services and Protocols for Advance

36、d Networking (TISPAN); Network Attachment; User-Network Interface Protocol Definitions“. 13 ETSI ES 283 035: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Network Attachment Sub-System (NASS); e2 interface based on the DIAMETER protocol“. 14 ETSI

37、 ES 283 003: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); IP Multimedia Call Control Protocol based on Session Initiation Protocol (SIP) and Session Description Protocol (SDP) Stage 3“. 15 ETSI ES 282 007: “Telecommunications and Internet conver

38、ged Services and Protocols for Advanced Networking (TISPAN); IP Multimedia Subsystem (IMS); Functional architecture“. 16 ETSI TS 182 006: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); IP Multimedia Subsystem (IMS); Stage 2 description (3GPP TS 23

39、.228 v7.2.0, modified)“. 17 ISO/IEC 11770-1 (2010): “Information technology - Security techniques - Key management - Part 1: Framework“. 18 ITU-T Recommendation X.811: “Information Technology - Open Systems Interconnection - Security frameworks for open systems: Authentication framework“. 19 ITU-T R

40、ecommendation X.812: “Information Technology - Open Systems Interconnection - Security frameworks for open systems: Access control framework“. 20 ITU-T Recommendation X.814: “Information Technology - Open Systems Interconnection - Security frameworks for open systems: Confidentiality framework“. 21

41、ITU-T Recommendation X.815: “Information Technology - Open Systems Interconnection - Security frameworks for open systems: Integrity framework“. 22 ETSI TS 183 017: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Resource and Admission Control: DIA

42、METER protocol for session based policy set-up information exchange between the Application Function (AF) and the Service Policy Decision Function (SPDF); Protocol specification“. 23 IETF RFC 2617: “HTTP Authentication: Basic and Digest Access Authentication“. 24 IEEE 802.1x: “Standard for Local and

43、 Metropolitan Area Networks - Port-Based Network Access Control“. 25 ETSI TS 181 005: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Service and Capability Requirements“. 26 ETSI TS 187 003 Release 1: “Telecommunications and Internet converged Ser

44、vices and Protocols for Advanced Networking (TISPAN); NGN Security; Security Architecture“. ETSI ETSI TS 187 003 V3.4.1 (2011-03) 827 ETSI TS 185 003: “Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN); Customer Network Gateway (CNG) Architecture and R

45、eference Points“. 28 ISO/IEC 13818-1 (2007): “Information technology - Generic coding of moving pictures and associated audio information: Systems“. 29 Open Mobile Alliance OMA-AD-BCAST-v1-0: “Mobile Broadcast Services Architecture“. 30 Open Mobile Alliance OMA-TS-BCAST-SvcCntProtection-v1-0: “Servi

46、ce and Content Protection for Mobile Broadcast Services“. 31 ETSI TS 182 027: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); IPTV Architecture; IPTV functions supported by the IMS subsystem“. 32 ETSI TS 102 165-2: “ Telecommunications and Internet

47、 converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 2: Protocol Framework Definition; Security Counter Measures“. 33 OMA DRM v2.0: “OMA Digital Rights Management V2.0“. NOTE: Available at: http:/www.openmobilealliance.org/Technical/release_program/drm_v2_0

48、.aspx. 34 DVB: “DVB-SI | CA-System-ID“. NOTE: Available at: http:/ 2.2 Informative references The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 ETSI TR 133 919: “Digital cellular tel

49、ecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; 3G Security; Generic Authentication Architecture (GAA); System description (3GPP TR 33.919)“. i.2 ETSI TS 133 221: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Generic Authentication Architecture (GAA); Support for subscriber certificates (3GPP TS 33.221)“. i.3 ETSI TS 102 165