1、 TIA-102.AAAB-A (Revision of TIA-102.AAAB) January 2005Project 25 Digital Land Mobile Radio - Security Services Overview ANSI/TIA-102.AAAB-A 2005 APPROVED: JANUARY 6, 2005 REAFFRIMED: FEBRURAY 3, 2011 NOTICE TIA Engineering Standards and Publications are designed to serve the public interest through
2、 eliminating misunderstandings between manufacturers and purchasers, facilitating interchangeability and improvement of products, and assisting the purchaser in selecting and obtaining with minimum delay the proper product for their particular need. The existence of such Standards and Publications s
3、hall not in any respect preclude any member or non-member of TIA from manufacturing or selling products not conforming to such Standards and Publications. Neither shall the existence of such Standards and Publications preclude their voluntary use by Non-TIA members, either domestically or internatio
4、nally. Standards and Publications are adopted by TIA in accordance with the American National Standards Institute (ANSI) patent policy. By such action, TIA does not assume any liability to any patent owner, nor does it assume any obligation whatever to parties adopting the Standard or Publication. T
5、his Standard does not purport to address all safety problems associated with its use or all applicable regulatory requirements. It is the responsibility of the user of this Standard to establish appropriate safety and health practices and to determine the applicability of regulatory limitations befo
6、re its use. (From Project No. 3-4912-RV1-RF1, formulated under the cognizance of the TIA TR-8 Mobile and Personal Private Radio, TR-8.3 Subcommittee on Encryption. . Published by TELECOMMUNICATIONS INDUSTRY ASSOCIATION Standards and Technology Department 2500 Wilson Boulevard Arlington, VA 22201 U.S
7、.A. PRICE: Please refer to current Catalog of TIA TELECOMMUNICATIONS INDUSTRY ASSOCIATION STANDARDS AND ENGINEERING PUBLICATIONS or call IHS, USA and Canada (1-877-413-5187) International (303-397-2896) or search online at http:/www.tiaonline.org/standards/catalog/ All rights reserved Printed in U.S
8、.A. NOTICE OF COPYRIGHT This document is copyrighted by the TIA. Reproduction of these documents either in hard copy or soft copy (including posting on the web) is prohibited without copyright permission. For copyright permission to reproduce portions of this document, please contact the TIA Standar
9、ds Department or go to the TIA website (www.tiaonline.org) for details on how to request permission. Details are located at: http:/www.tiaonline.org/standards/catalog/info.cfm#copyright or Telecommunications Industry Association Technology (b) there is no assurance that the Document will be approved
10、 by any Committee of TIA or any other body in its present or any other form; (c) the Document may be amended, modified or changed in the standards development or any editing process. The use or practice of contents of this Document may involve the use of intellectual property rights (“IPR”), includi
11、ng pending or issued patents, or copyrights, owned by one or more parties. TIA makes no search or investigation for IPR. When IPR consisting of patents and published pending patent applications are claimed and called to TIAs attention, a statement from the holder thereof is requested, all in accorda
12、nce with the Manual. TIA takes no position with reference to, and disclaims any obligation to investigate or inquire into, the scope or validity of any claims of IPR. TIA will neither be a party to discussions of any licensing terms or conditions, which are instead left to the parties involved, nor
13、will TIA opine or judge whether proposed licensing terms or conditions are reasonable or non-discriminatory. TIA does not warrant or represent that procedures or practices suggested or provided in the Manual have been complied with as respects the Document or its contents. If the Document contains o
14、ne or more Normative References to a document published by another organization (“other SSO”) engaged in the formulation, development or publication of standards (whether designated as a standard, specification, recommendation or otherwise), whether such reference consists of mandatory, alternate or
15、 optional elements (as defined in the TIA Engineering Manual, 4thedition) then (i) TIA disclaims any duty or obligation to search or investigate the records of any other SSO for IPR or letters of assurance relating to any such Normative Reference; (ii) TIAs policy of encouragement of voluntary discl
16、osure (see Engineering Manual Section 6.5.1) of Essential Patent(s) and published pending patent applications shall apply; and (iii) Information as to claims of IPR in the records or publications of the other SSO shall not constitute identification to TIA of a claim of Essential Patent(s) or publish
17、ed pending patent applications. TIA does not enforce or monitor compliance with the contents of the Document. TIA does not certify, inspect, test or otherwise investigate products, designs or services or any claims of compliance with the contents of the Document. ALL WARRANTIES, EXPRESS OR IMPLIED,
18、ARE DISCLAIMED, INCLUDING WITHOUT LIMITATION, ANY AND ALL WARRANTIES CONCERNING THE ACCURACY OF THE CONTENTS, ITS FITNESS OR APPROPRIATENESS FOR A PARTICULAR PURPOSE OR USE, ITS MERCHANTABILITY AND ITS NONINFRINGEMENT OF ANY THIRD PARTYS INTELLECTUAL PROPERTY RIGHTS. TIA EXPRESSLY DISCLAIMS ANY AND
19、ALL RESPONSIBILITIES FOR THE ACCURACY OF THE CONTENTS AND MAKES NO REPRESENTATIONS OR WARRANTIES REGARDING THE CONTENTS COMPLIANCE WITH ANY APPLICABLE STATUTE, RULE OR REGULATION, OR THE SAFETY OR HEALTH EFFECTS OF THE CONTENTS OR ANY PRODUCT OR SERVICE REFERRED TO IN THE DOCUMENT OR PRODUCED OR REN
20、DERED TO COMPLY WITH THE CONTENTS. TIA SHALL NOT BE LIABLE FOR ANY AND ALL DAMAGES, DIRECT OR INDIRECT, ARISING FROM OR RELATING TO ANY USE OF THE CONTENTS CONTAINED HEREIN, INCLUDING WITHOUT LIMITATION ANY AND ALL INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING DAMAGES FOR LOSS OF
21、 BUSINESS, LOSS OF PROFITS, LITIGATION, OR THE LIKE), WHETHER BASED UPON BREACH OF CONTRACT, BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING NEGATION OF DAMAGES IS A FUNDAMENTAL ELEMENT OF THE USE OF T
22、HE CONTENTS HEREOF, AND THESE CONTENTS WOULD NOT BE PUBLISHED BY TIA WITHOUT SUCH LIMITATIONS. TIA 102.AAAB-A i Contents 1 Introduction 1 1.1 Scope . 1 1.2 Document Description 2 1.3 Document Revision History 3 1.4 Definitions 3 1.5 Abbreviations . 5 1.6 References . 6 1.7 Overview 6 2 Security Thre
23、ats 7 2.1 Message Interception . 7 2.2 Message Replay 7 2.3 Spoofing . 7 2.4 Misdirection 8 2.5 Jamming 8 2.6 Traffic Analysis . 9 2.7 Subscriber Unit Duplication 9 2.8 Theft of Service 10 2.9 Theft of Unit . 10 3 Confidentiality 11 3.1 Encryption Transformation . 12 3.1.1 Traffic Encryption 14 3.1.
24、2 Air Interface Encryption 15 4 Integrity 16 4.1 Chronological Integrity . 16 4.2 Message Integrity . 17 5 Authentication 19 6 Key Management 22 6.1 Physical Key Distribution 23 6.2 Over-the-Air Key Distribution 23 6.2.1 Automated Key Management . 24 6.2.2 Public Key Techniques . 26 6.3 Key Compromi
25、se 26 TIA 102.AAAB-B ii Foreword (This foreword is not part of this document.) This document has been submitted to APCO/NASTD/FED by the Telecommunications Industry Association (TIA), as provided for in a Memorandum of Understanding (MOU) dated December, 1993. That MOU provides that APCO/NASTD/FED w
26、ill devise a Common System Standard for digital public safety communications (the Standard), and that TIA shall provide technical assistance in the development of documentation for the Standard. This document has been developed by TR8.3 (Encryption) with inputs from the APCO Project 25 Interface Com
27、mittee (APIC), the APIC Encryption Task Group, and TIA Industry members. This document is being published to provide technical information on the emerging digital techniques for Land Mobile Radio Service. Security services are intended to neutralize security threats to a radio system. The nature of
28、these threats is discussed in this document, and the security services to counter these threats are defined. These services apply to both conventional and trunking systems. This document presents security services that were recommended by TIA to APCO/NASTD/FED as being suitable for use as part of th
29、eir standard for a digital public safety radio system (Project 25). TIA 102.AAAB-A iii Patent Identification The readers attention is called to the possibility that compliance with this document may require the use of one or more inventions covered by patent rights. By publication of this document n
30、o position is taken with respect to the validity of those claims or any patent rights in connection therewith. The patent holders so far identified have, we believe, filed statements of willingness to grant licenses under those rights on reasonable and nondiscriminatory terms and conditions to appli
31、cants desiring to obtain such licenses. The following patent holders and patents have been identified in accordance with the TIA intellectual property rights policy: No patents have been identified. TIA shall not be responsible for identifying patents for which licenses may be required by this docum
32、ent or for conducting inquiries into the legal validity or scope of those patents that are brought to its attention. TIA 102.AAAB-B iv This page is intentionally left blank. TIA 102.AAAB-A 1 1 INTRODUCTION In many cases, information security is a vital component of a general land mobile radio system
33、. Several security services are available for implementation in these systems. The services are generally optional and they operate within the bounds of the interfaces defined for non-secure operation. This security overlay may be used to provide security of information transferred across general FD
34、MA or TDMA land mobile radio systems. The purpose of this document is to define the meaning of these security services. The definition and detail of how security services are provided is outside the scope of this document. This document was generated in response to Project 25 requirements for securi
35、ty services; however, it is applicable to any general land mobile communications system. TIA 102 security standard documents define protection of Phase 1 and Phase 2 systems. The security services defined in the TIA 102 security documents are to be interoperable across the Phase 1 and Phase 2 air in
36、terfaces. 1.1 Scope A general land mobile radio communications system consists of subscriber units, base stations, fixed equipment for single-site to wide area operation, console operator positions, and computer equipment. The subscriber units include portable radios for handheld operation and mobil
37、e radios for vehicular operation. The base stations are for geographically fixed installations. Other fixed equipment is used for wide area operation and console operator positions, and computer equipment is used for interface between each of these equipment items. A standard should exist to describ
38、e any given specific instance of such a general land mobile radio system. This document will refer to such a specific instance of a general land mobile radio system as a “Land Mobile Radio system,“ to distinguish it from the entire universe of general land mobile radio systems. Specific Land Mobile
39、Radio systems are referenced in the appendices for the instantiation of the security services described in this document. Instances of Land Mobile Radio systems that may apply these security services are given by TSB 102-A (reference 1) and TIA 905 (reference 2) System and Standards Definition (shel
40、l) documents. This document provides an overview of the security services available in Land Mobile Radio systems. It provides the context in which to understand why security services are required and gives a general high level description of how they are provided. The purpose of security services is
41、 to neutralize information security threats to a system. The nature of these threats is discussed in this document and the security services to counter these threats are defined. TIA 102.AAAB-B 2 The security services defined here apply to all aspects of Land Mobile Radio systems, including trunking
42、 and conventional systems as well as voice and data systems. In general the subject of security includes encryption, and this topic is discussed in general terms to explain the different levels of encryption algorithms available within the standard, and their application to security services. In the
43、 context of this document, the specific security requirements are generalized into four security topics: 1. Confidentiality (also known as Privacy) 2. Authentication 3. Integrity 4. Key management These four categories correspond to the security services available to Land Mobile Radio systems. This
44、document does not provide specific message formats or operational details of these security services. Detailed information is provided in the companion documents identified in section 1.6. 1.2 Document Description This document establishes general principles for a security services designed to prote
45、ct the family of Project 25 systems. Section 1 provides a general description, definitions and abbreviations. Section 2 provides an overview of security threats. Section 3 provides an overview of the confidentiality service. Section 4 provides an overview of the integrity service. Section 5 provides
46、 an overview of the authentication service. Section 6 provides an overview of key management services. TIA 102.AAAB-A 3 1.3 Document Revision History Revision date Revision comments August 9, 1994 P25.ETG.(94)9, the initial draft version submitted to the Project 25 Encryption Task Group for review a
47、nd comment. January 9, 1995 P25.ETG.(95)01, revision to complete description of key management. April 24, 1995 P25.ETG.(95)01.a, revised to incorporate Task Group comments. May 26, 1995 P25.950524.1.0, revised after approval to incorporate Task Group comments. September 15, 1995 revised to incorpora
48、te TR-8.10 letter ballot comments. September 15, 1995 revision 2, to make the document generic. Added Annex A. October 27, 1995 revision 3, to accommodate additional comments. Published as TSB-102.AAAB. March 28, 2001 SP-3-4912, updated TSB-102.AAAB to ballot as a full standard (mainly reference and
49、 editorial changes). July 16, 2002 TIA/EIA-102.AAAB, minor editorial corrections from letter ballot. March 20, 2003 revision 1, modified for Phase 2 proposal. May 20, 2003 revision 2, updated document to include proposals, editorial corrections. July 31, 2003 revision 3, update to accommodate comments. October 10, 2003 revision 4, update to converge security services proposals. December 3, 2003 revision 5, updated to incorporate comments received on the document. October 1, 2004 TIA 102.AAAB-A, minor editorial corrections from letter ballot. 1.4 Definitions Advanced Enc
