ETSI TS 187 016-2010 Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN) NGN Security Identity Protection (Protection Profile) (V3 1 1_1.pdf

1、 ETSI TS 187 016 V3.1.1 (2010-06)Technical Specification Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN);NGN Security;Identity Protection (Protection Profile)ETSI ETSI TS 187 016 V3.1.1 (2010-06)2Reference DTS/TISPAN-07035-NGN-R3 Keywords ID, securit

2、y ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can

3、 be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the

4、reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI docum

5、ents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written perm

6、ission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2010. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Membe

7、rs. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and own

8、ed by the GSM Association. ETSI ETSI TS 187 016 V3.1.1 (2010-06)3Contents Intellectual Property Rights 5g3Foreword . 5g31 Scope 6g32 References 6g32.1 Normative references . 6g32.2 Informative references 7g33 Definitions and abbreviations . 8g33.1 Definitions 8g33.2 Abbreviations . 10g34 Identity an

9、d privacy protection in the NGN . 11g34.1 Identity and privacy in the NGN 11g34.2 Regulatory requirements for privacy 11g34.3 Behaviour and identity . 11g34.4 Identity protection objectives . 12g34.5 NGN identity and identifiers 12g34.5.1 Identifying NGN users 12g34.5.2 Identifier attributes for ide

10、ntity protection 12g34.5.3 User Identifiers for non-communication services . 12g34.5.4 User Identifiers for communication services 13g34.5.5 Device Identifiers 13g34.5.6 NGN Service Identifiers . 13g34.5.7 Network entity Identifiers within the NGN 13g35 Analysis of regulatory requirements 14g35.1 Id

11、entification of personal data in the NGN 14g35.2 Privacy requirements 14g35.2.1 Privacy exceptions required by regulation 15g36 Identity protection functional requirements . 15g36.1 Summary of security functional requirements 15g36.2 Security capabilities required in the NGN for identity protection

12、17g36.2.1 Access control measures . 17g36.2.1.1 Authenticity . 17g36.2.2 Privacy measures 18g36.2.2.1 Pseudonymity 18g36.2.2.2 Unlinkability . 18g36.2.3 Confidentiality measures 18g36.2.4 Integrity measures . 18g36.2.4.1 Transmitted data protection (integrity) 18g36.2.5 Credential management 19g36.2

13、.6 Audit and accounting measures 19g37 Identity Protection Framework . 20g37.1 PKI-based Framework elements . 20g37.2 Public Key Infrastructure (PKI) . 20g37.2.1 Public Key Certification (PKC) 20g37.2.1.1 Traceable time-variant pseudonym certificates with authoritative identity . 21g37.2.1.2 Traceab

14、le anonymous certificates with authoritative identity . 21g37.2.2 Privilege Management Infrastructure (PMI) . 22g37.2.2.1 ITU-T Recommendation X.509 22g37.2.2.2 Kerberos 22g37.2.2.3 Security Assertion Markup Language (SAML) 22g37.2.2.4 Access control models in PMI 23g37.3 Analysis of framework eleme

15、nts 24g37.3.1 Public Key Infrastructure (PKI) 24g3ETSI ETSI TS 187 016 V3.1.1 (2010-06)47.3.2 Public Key Certification . 25g37.3.3 Privilege Management Infrastructure (PMI) . 26g37.3.4 Summary of analysis results and recommendations . 27g38 Identity management and protection within the NGN 27g38.1 N

16、GN identifiers 27g38.2 Identity protection in SIP (current state) 28g38.2.1 SIP privacy handling in the NGN . 28g38.3 Identity protection in IMS (IMS-AKA) 29g38.3.1 Overview 29g38.3.2 IMS security analysis 29g38.4 Resolution protocols in NGN . 31g38.4.1 DNS and ENUM . 31g38.5 NGN Authentication, Reg

17、istration and Authorization . 31g38.5.1 Overview 31g38.5.2 NGN Authentication and Registration 31g38.5.3 NGN Authorization. 31g38.6 Gap analysis . 34g38.7 Detailed requirements . 34g3Annex A (normative): Protection Profile Proforma for Identity Protection in the NGN 35g3Annex B (informative): Policy

18、 and Procedure countermeasures . 38g3Annex C (informative): Security terms and concepts . 39g3C.1 Security associations 39g3C.2 Confidentiality 39g3C.3 Integrity 39g3C.4 Authenticity 39g3C.5 Authority 40g3Annex D (informative): Privacy in the NGN - TVRA . 41g3D.1 Identification of the ToE 41g3D.2 Ob

19、servations on the ToE 42g3Annex E (informative): Bibliography . 44g3History 46g3ETSI ETSI TS 187 016 V3.1.1 (2010-06)5Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if an

20、y, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available o

21、n the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) w

22、hich are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TS 187 016 V3.1.1 (2010-06)61 S

23、cope The present document specifies countermeasures to assure that users of the NGN have protection from abuse of identity. This covers authenticity and integrity countermeasures, including use of existing systems, and credential management in support of identity protection. The present document: id

24、entifies the security objectives; defines the functional requirements (including those from ISO/IEC 15408-2 i.6 that apply); defines the detail requirements for protection of identity in the NGN. In doing so the present document: defines measures that provide protection of the NGN user identity from

25、 malicious traffic analysis; identifies those measures that allow compliance with the privacy legislation in the regions where the NGN is to be deployed where such legislation is known and public; identifies in Annex B a number of countermeasures in the form of policies or procedures. The present do

26、cument follows the recommendations of ES 202 382 2 and provides an IdM PP Proforma which may be used as a basis for developing a PP for identity protection in an NGN subsystem deployment. The identity protection PP proforma is provided in Annex A. 2 References References are either specific (identif

27、ied by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amendments) applies. Referenced documents which are not found to be p

28、ublicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references The following referenced documents are neces

29、sary for the application of the present document. 1 ETSI EG 202 387: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method for application of Common Criteria to ETSI deliverables“. . 2 ETSI ES 202 382: “Telecommunications an

30、d Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method and proforma for defining Protection Profiles “. 3 ITU-T Recommendation X.509: “Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate fram

31、eworks“. NOTE: Also available as ISO/IEC 9594-8. 4 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).

32、 ETSI ETSI TS 187 016 V3.1.1 (2010-06)75 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks

33、and amending Directive 2002/58/EC. 6 European Union Council Resolution COM 96/C329/01 of 17 January 1995 on the Lawful Interception of Telecommunications. 7 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the process

34、ing of personal data and on the free movement of such data. 8 ETSI TS 184 002: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Identifiers (IDs) for NGN“. . 9 ETSI TS 184 009: “Telecommunications and Internet converged Services and Protocols for Ad

35、vanced Networking (TISPAN); Rules covering the use of TV URIs for the Identification of Television Channels“. 10 IETF RFC 3325: “Private Extensions to the Session Initiation Protocol (SIP) for Asserted Identity within Trusted Networks“. 11 IETF RFC 5636: “Traceable Anonymous Certificate“. 12 OASIS S

36、ecurity Services: “Security Assertion Markup Language (SAML) v2.0“. 2.2 Informative references The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 ETSI TS 102 165-1: “Telecommunication

37、s and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and proforma for Threat, Risk, Vulnerability Analysis“. i.2 UK Home Office, R.V.Clark: “Hot Products: understanding, anticipating and reducing demand for stolen goods“, ISBN 1-8408

38、2-278-3. i.3 ISO/IEC 17799 (2005): “Information technology - Security techniques - Code of practice for information security management“. i.4 ISO/IEC 13335: “Information technology - Security techniques - Guidelines for the management of IT security“. NOTE: ISO/IEC 13335 is a multipart publication a

39、nd the reference above is used to refer to the series. i.5 ISO/IEC 15408-1: “Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model“. i.6 ISO/IEC 15408-2: “Information technology - Security techniques - Evaluation criteria for IT s

40、ecurity - Part 2: Security functional requirements“. i.7 AS/NZS 4360: “Risk Management“. i.8 United Nations General Assembly resolution 217 A (III) 10 December 1948: “Universal Declaration of Human Rights“. i.9 ITU-T Recommendation X.200: “Information technology - Open Systems Interconnection - Basi

41、c Reference Model: The basic model“. NOTE: Also available as ISO/IEC IS 7498-1. i.10 ETSI TS 102 165-2: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 2: Protocol Framework Definition; Security Counter Measures“. ETSI E

42、TSI TS 187 016 V3.1.1 (2010-06)8i.11 ETSI TR 187 002: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); TISPAN NGN Security (NGN-SEC); Threat, Vulnerability and Risk Analysis“. i.12 Council of Europe European Treaties ETS No. 5: “Convention For Prote

43、ction Of Human Rights And Fundamental Freedoms Rome, 4.XI.1950 “. i.13 ISO/IEC 15408-3: “Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance requirements“. i.14 ISO/IEC 10181-6: “Information technology - Open Systems Interconnection - Secur

44、ity frameworks for open systems: Integrity framework“. i.15 ETSI TS 133 203: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; 3G security; Access security for IP-based services (3GPP TS 33.203 version 8.6.0 Release 8)“. i.16 ETSI TS 131

45、103: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Characteristics of the IP Multimedia Services Identity Module (ISIM) application (3GPP TS 31.103)“.“. i.17 ETSI TS 133 102: “Universal Mobile Telecommunications System (UMTS); LTE; 3G

46、 security; Security architecture (3GPP TS 33.102)“. i.18 IETF RFC 3323: “A Privacy Mechanism for the Session Initiation Protocol (SIP)“. i.19 ETSI TR 187 010: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Security; Report on issues related to

47、 security in identity imanagement and their resolution in the NGN“. i.20 ETSI TS 133 210: “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; 3G security; Network Domain Security (NDS); IP network layer security (3GPP TS 33.210 version 8.3.

48、0 Release 8)“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in EG 202 387 11, ISO/IEC 17799 i.3, ISO/IEC 13335-1 i.4 and the following apply: asset: anything that has value to the organization, its business operations and i

49、ts continuity authentication: ensuring that the identity of a subject or resource is the one claimed availability: property of being accessible and usable on demand by an authorized entity (ISO/IEC 13335-1 i.4) call: connection established by means of a publicly available telephone service allowing two-way communication in real time (Directive 2002/58/EC 4) communication: any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic