ITU-T SERIES X SUPP 28-2016 ITU-T X 1245 C Technical measures and mechanisms on countering spoofed calls in the terminating network of voice over long term evolution (Study Group 1.pdf

1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T Series X TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 28 (09/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY ITU-T X.1245 Technical measures and mechanisms on countering spoofed calls in

2、 the terminating network of voice over long term evolution ITU-T X-series Recommendations Supplement 28 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399

3、 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network secur

4、ity X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169

5、Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI relate

6、d Recommendations X.1340X.1349 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and disc

7、overy X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other clou

8、d computing security X.1680X.1699 For further details, please refer to the list of ITU-T Recommendations. X series Supplement 28 (09/2016) i Supplement 28 to ITU-T X-series Recommendations ITU-T X.1245 Technical measures and mechanisms on countering spoofed calls in the terminating network of voice

9、over long term evolution Summary Since the rapid development of the fourth generation (4G) based on the Internet protocol (IP) multimedia subsystem (IMS) network generated the renovation of the network architecture and the service mode, it is possible for spoofed calls to cause security and financia

10、l threats, as well as creating new difficulties to terminal users and operators alike. The difficulties and threats can be labelled as fraud issues generated by callers who use highly impersonated telephone numbers, which are faked by certain legal or illegal measures, to allure the callee. However,

11、 in spite of the new threats and difficulties, some new opportunities have also arisen to counter spoofed calls, since particular technical measures can be implemented in the IMS network. The objective of this Supplement to Recommendation ITU-T X.1245 is to analyse the threats and to recommend techn

12、ical measures and mechanisms to counter spoofed calls in the terminating network of voice over long term evolution (VoLTE) if the identity of the incoming calls cannot be trusted securely by the terminating network. This Supplement to Recommendation ITU-T X.1245 focuses mainly on the protection of V

13、oLTE users, to prevent them from the risk of receiving spoofed calls or to warn them in advance of suspicious spoofed calls by deploying procedures both on the network side and the user side (smartphone), after having conducted a threat analysis of spoofed calls. History Edition Recommendation Appro

14、val Study Group Unique ID* 1.0 ITU-T X Suppl. 28 2016-09-07 17 11.1002/1000/13073 Keywords IMS, spoofed call, VoLTE. * To access the Supplement, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Supplements unique ID. For example, http:/handle.itu.int/11.10

15、02/1000/ 11830-en. ii X series Supplement 28 (09/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is

16、a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, e

17、stablishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary

18、 standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this publication is voluntary. However, the publ

19、ication may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are us

20、ed to express requirements. The use of such words does not suggest that compliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this publication may involve the use of a claimed Intellectual P

21、roperty Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication development process. As of the date of approval of this publication, ITU had not received notice of in

22、tellectual property, protected by patents, which may be required to implement this publication. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2017 All rig

23、hts reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. X series Supplement 28 (09/2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Suppleme

24、nt 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Background . 2 7 Threats and difficulties of the analysis . 3 7.1 Participants . 3 7.2 Existing threats . 3 7.3 Scenario analysis 4 8 Proposed measures 5 8.1 General aspects . 5 8.2 Detecting and verifying measures 6 8.3 Blocking measures 7 8.4 A

25、lerting measures . 8 8.5 Measures integration 8 Appendix I Legal issues 9 Bibliography. 10 X series Supplement 28 (09/2016) 1 Supplement 28 to ITU-T X-series Recommendations ITU-T X.1245 Technical measures and mechanisms on countering spoofed calls in the terminating network of voice over long term

26、evolution 1 Scope This Supplement gives an overview of spoofed calls in the Internet protocol (IP) multimedia subsystem (IMS) network, analyses several aspects of existing threats and new technical difficulties, and also proposes technical measures and procedures to counter spoofed calls. This Suppl

27、ement only focuses on spoofed calls in the terminating network of voice over long term evolution (VoLTE), where there are no reliable trust mechanisms. The proposed measures and anti-spoof application servers (ASs) described are all targeted towards the IMS network. Compliance with all relevant laws

28、 and regulations should be considered before adopting the measures discussed in this Supplement. 2 References ITU-T X.1246 Recommendation ITU-T X.1246 (2015), Technologies involved in countering voice spam in telecommunication organizations. 3 Definitions 3.1 Terms defined elsewhere This Supplement

29、uses the following term defined elsewhere: 3.1.1 vishing b-ITU-T X.1244: An illegal act of gaining access to private personal and financial information through the voice over IP (VoIP) service. The term vishing is a contraction of “voice phishing“. 3.2 Terms defined in this Supplement This Supplemen

30、t defines the following terms: 3.2.1 non-licensed ID prefix: The prefix of a terminal ID in telephone systems that has not been licensed (or enabled officially) in a living market. 3.2.2 spoofing caller: A technical device or platform that can cause a telephone network to indicate to the receiver of

31、 a call that the originator of the call is a terminal other than the true originating terminal. 3.2.3 swatting: An act which deceives an emergency service into dispatching an emergency response based on the false report of an ongoing critical incident. 4 Abbreviations and acronyms This Supplement us

32、es the following abbreviations and acronyms: 4G Fourth Generation ARPU Average Revenue Per User AS Application Server BOSS Business and Operation Support System CLI Calling Line Identification 2 X series Supplement 28 (09/2016) CS Circuit Switched CSCF Call Session Control Function DoS Denial of Ser

33、vice HSS Home Subscriber Server I/S-CSCF Interrogating/Serving Call Session Control Function ID Identity IMS IP Multimedia Subsystem IN Intelligent Network IP Internet Protocol RCS Rich Communication Service SCP Service Control Point SIM Subscriber Identity Module SLF Subscriber Location Function SS

34、7 Signalling System No. 7 VoIP Voice over Internet Protocol VoLTE Voice over Long Term Evolution 5 Conventions None. 6 Background Spoofed calls are a type of call that exists in the telecommunication voice service. Spoofed calls are identity faked or identity modified of unwanted and unsolicited cal

35、ls with the objective of fraud, vishing, identity (ID) theft, etc. As the IMS network is developing rapidly, the VoLTE service, providing a new mode of communication, has already been deployed or is in process by some operators. Since the IMS network might not deliver complete and trusted calling in

36、formation from the originating network to the terminating network, and since various new value-added services based on the VoLTE service are likely to be imported or created, security issues associated with spoofed calls are becoming more complicated compared to those in the traditional (circuit swi

37、tched (CS) network. Spoofed calls can be generated much more easily by the caller, which causes several threats to both terminal users and operators. Both in the traditional network and in the fourth generation (4G) network, spoofed calls are generated due to protocol and management vulnerabilities.

38、 However, in the traditional network, once a spoofed call arrives at the terminated network, operators can scarcely identify whether an incoming call user identity (mostly from other networks) is spoofed or not. IETF WG secure telephone identity revisited (STIR) and 3GPP Service nuisance calls, unso

39、licited commercial calls from impersonated numbers (3GPP SA3, IETF WG STIR); 4 X series Supplement 28 (09/2016) violations of various phone solicitation rules used as a platform for significant fraud, identity theft and social engineering (3GPP SA3); various malicious uses of caller information, inc

40、luding these categories: swatting, vishing and denial of service (DoS) (3GPP SA3). Compared to the above threats, the spoofed calls cause more threats in the IMS network than in the traditional network. The IMS network allows the originating network to verify the identity of a call through a certain

41、 protocol field, which may not be delivered to the terminating network; therefore, the terminating network may not be able to display the real calling identity to the callee. The characteristics of the IMS network cause new difficulties in that the spoofed calls are generated more easily by spoofing

42、 callers and are very difficult to detect by the operators in the terminating networks. In the IMS network, services can be of various kinds, such as the one-card-multi-numbers, which is a fundamental service that can provide users with multiple calling line identities or caller names (IDs), by usin

43、g only one subscriber identity module (SIM) or an equivalent card. These types of services increase significantly the difficulty of identifying the exact spoofed caller. Another service named the “multi-party call“ involves multiple communication parties in one call, which increases the probability

44、and spreading range of spoofed calls. 7.3 Scenario analysis Generally speaking, the new difficulties could be classified into the following threat patterns: The spoofing caller and its originating/visiting network is not within the trusted domain; hence, the caller can fake, imitate or directly use

45、the real calling ID to dupe the callee without hindrance. The spoofing caller is allowed to use a certain legal calling ID, which is highly similar or partially the same as some famous or important public service IDs. According to the international exchange protocol of CLI, the caller ID can be hidd

46、en and is not completely displayed on the callees terminal, whereas the national number and the local area number are displayed, which could be quiet similar to some famous or important public service IDs. Video calling identity fraud: In compliance with the faked ID, a spoofed caller forges some ki

47、nd of physical environment in a video call, which is faked but similar to a public service authority or financial organization; hence, callees may be deceived more easily based on what they have seen. The origins and spread paths of spoofed calls in the terminating network of VoLTE can be classified

48、 into the following scenarios: IMS network to IMS network: A VoLTE service user in the IMS network fakes a calling ID and generates a call to another VoLTE service user. CS network to IMS network: A traditional service user in the CS network fakes a calling ID and generates a call through the signal

49、ling system No. 7 (SS7) to a callee of the VoLTE service and the call is transferred to the IMS network, where the callee is visiting. IMS network to CS network: A VoLTE service user in the IMS network fakes a calling ID and generates a call to a callee of the VoLTE service and the call is transferred to the CS network, where the callee is visiting because of falling back from the 4G network to the 2G/3G network. CS network to IMS network to CS network: A traditional service user in