1、 ETSI TR 102 780 V1.1.1 (2009-02)Technical Report Methods for Testing and Specification (MTS); Security; Guide to the use of methods in development of ETSI security standardsETSI ETSI TR 102 780 V1.1.1 (2009-02) 2Reference DTR/MTS-00109 OCG_SEC_DOC Keywords methodology, security ETSI 650 Route des L
2、ucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can be downloaded from: h
3、ttp:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the
4、 printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at h
5、ttp:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyright
6、and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2009. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM is a Trade
7、Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Associat
8、ion. ETSI ETSI TR 102 780 V1.1.1 (2009-02) 3Contents Intellectual Property Rights 5g3Foreword . 5g31 Scope 6g32 References 6g32.1 Normative references . 6g32.2 Informative references 6g33 Definitions, symbols and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 9g34 Security design guidelin
9、es 10g34.1 Introduction 10g34.2 Standards and requirements 11g34.3 Communications security . 12g34.4 Primary security technologies 12g34.4.1 Confidentiality 12g34.4.2 Integrity 13g34.4.3 Authenticity 13g34.4.4 Authority. 14g34.5 Secondary security attributes 14g34.5.1 Availability . 14g34.5.2 Reliab
10、ility . 15g34.5.3 Repeatability . 15g34.5.4 Resilience 15g34.6 Security associations 15g34.6.1 IPsec and SAs . 16g35 Risk analysis . 16g35.1 Attacks and attack vectors 16g35.1.1 Conventional attacks. 16g35.1.1.1 Masquerade . 16g35.1.1.2 Manipulation . 16g35.1.1.3 Eavesdropping . 16g35.1.2 Social and
11、 combination attacks . 16g36 Security boundary analysis and establishment . 17g37 Countermeasure patterns and specialization 17g38 Cryptographic selection and design . 17g38.1 Specification of algorithms and other cryptographic processes . 18g38.2 Attacks on cryptographic implementations 18g38.2.1 B
12、rute force attacks 18g38.2.2 Birthday attacks and cryptographic hash security . 19g38.2.3 Message entropy and cryptography 19g39 Security testing . 20g39.1 Protocol testing . 20g39.2 Penetration testing 20g39.2.1 Penetration standards and methods . 20g3Annex A: Review of US Standards Development Org
13、anizations relating to ICT Security Requirements 21g3A.1 ANSI. 21g3A.2 IEEE . 21g3ETSI ETSI TR 102 780 V1.1.1 (2009-02) 4A.3 NIST . 22g3A.3.1 FIPS 22g3A.4 TIA . 23g3A.5 IETF . 23g3History 24g3ETSI ETSI TR 102 780 V1.1.1 (2009-02) 5Intellectual Property Rights IPRs essential or potentially essential
14、to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to
15、 ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be gi
16、ven as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Methods for Testing and Specificat
17、ion (MTS). ETSI ETSI TR 102 780 V1.1.1 (2009-02) 61 Scope The present document is a guide to the use of ETSI security standardization methods. The document identifies existing process documents and illustrates their use in order to provide a unified method for the preparation of security documents (
18、guides, standards, algorithms). NOTE: The present document is a companion to the “Security“ pages on ETSIs “Making Better Standards“ website i.15. 2 References References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For a specific r
19、eference, subsequent revisions do not apply. Non-specific reference may be made only to a complete document or a part thereof and only in the following cases: - if it is accepted that it will be possible to use all future changes of the referenced document for the purposes of the referring document;
20、 - for informative references. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term
21、validity. 2.1 Normative references The following referenced documents are indispensable for the application of the present document. For dated references, only the edition cited applies. For non-specific references, the latest edition of the referenced document (including any amendments) applies. No
22、t applicable. 2.2 Informative references The following referenced documents are not essential to the use of the ETSI deliverable but they assist the user with regard to a particular subject area. For non-specific references, the latest version of the referenced document (including any amendments) ap
23、plies. i.1 ETSI EG 200 234: “Telecommunications security; A guide to specifying requirements for cryptographic algorithms“. i.2 ETSI EG 202 238: “Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON); Evaluation criteria for cryptographic algorithms“. i.3 ETSI EG 202 387: “Te
24、lecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method for application of Common Criteria to ETSI deliverables“. i.4 ETSI ES 202 382: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TIS
25、PAN); Security Design Guide; Method and proforma for defining Protection Profiles“. ETSI ETSI TR 102 780 V1.1.1 (2009-02) 7i.5 ETSI ES 202 383: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method and proforma for defining
26、Security Targets“. i.6 ETSI EN 300 392-7: “Terrestrial Trunked Radio (TETRA); Voice plus Data (V+D); Part 7: Security“. i.7 ETSI ETR 232: “Security Techniques Advisory Group (STAG); Glossary of security terminology“. i.8 ETSI ETR 237: “Security Techniques Advisory Group (STAG); Baseline security sta
27、ndards; Features and mechanisms“. i.9 ETSI ETR 332: “Security Techniques Advisory Group (STAG); Security requirements capture“. i.10 ETSI TR 187 011: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Security; Application of ISO-15408-2 requireme
28、nts to ETSI standards - guide, method and application with examples“. i.11 ETSI TS 102 165-1: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and proforma for Threat, Risk, Vulnerability Analysis“. i.12 ETSI TS
29、 102 165-2: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 2: Protocol Framework Definition; Security Counter Measures“. i.13 ETSI TS 133 203: “Digital cellular telecommunications (Phase 2+); Universal Mobile Telecommun
30、ications System (UMTS); 3G Security; Access security for IP-based services“. i.14 ETSI White Paper OCG/SEC. i.15 ETSI Portal - Making Better Standards. NOTE: Available from http:/portal.etsi.org/mbs/. i.16 ISO/IEC 15408-1: “Information technology - Security techniques - Evaluation criteria for IT se
31、curity - Part 1: Introduction and general model“. i.17 ISO/IEC 15408-2: “Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional requirements“. i.18 ISO/IEC 15408-3: “Information technology - Security techniques - Evaluation criteria for IT se
32、curity - Part 3: Security assurance requirements“. i.19 ISO/IEC 15408: “Information technology - Security techniques - Evaluation Criteria for IT security“. NOTE: When referring to all parts of ISO/IEC 15408 the reference above is used. i.20 ISO/IEC 27001:2005: “Information technology - Security tec
33、hniques - Information security management systems - Requirements“. i.21 ISO/IEC 10181-2: “Information technology - Open Systems Interconnection - Security frameworks for open systems: Authentication framework“. i.22 ISO/IEC 10181-3: “Information technology - Open Systems Interconnection - Security f
34、rameworks for open systems: Access control framework“. i.23 ISO/IEC 10181-4: “Information technology - Open Systems Interconnection - Security frameworks for open systems: Non-repudiation framework“. i.24 ISO/IEC 10181-5: “Information technology - Open Systems Interconnection - Security frameworks f
35、or open systems: Confidentiality framework“. ETSI ETSI TR 102 780 V1.1.1 (2009-02) 8i.25 ISO/IEC 10181-6: “Information technology - Open Systems Interconnection - Security frameworks for open systems: Integrity framework“. i.26 ISO/IEC 10181-7: “Information technology - Open Systems Interconnection
36、- Security frameworks for open systems: Security audit and alarms framework“ . NOTE: Equivalent to ITU-T Recommendation X.815. i.27 ISO/IEC 13335-1: “Information technology - Security techniques - Management of information and communications technology security - Part 1: Concepts and models for info
37、rmation and communications technology security management“. i.28 ISO 14977: “Extended Backus-Naur Form (EBNF) syntactic meta-language“. i.29 Common Criteria Portal. NOTE: Available from http:/moncriteriaportal.org/. i.30 ANSI Homeland Security Standards Panel Emergency Communications Report . NOTE:
38、Available from http:/publicaa.ansi.org/sites/apdl/Documents/Standards%20Activities/Homeland%20Security%20Standards%20Panel/Workshop%20Reports/Emergency%20Communications.pdf. i.31 Federal Information Processing Standard (FIPS) 140-2: “Security Requirements For Cryptographic Modules“. i.32 Federal Inf
39、ormation Processing Standard (FIPS) 140-3: “Security Requirements For Cryptographic Modules“. NOTE: FIPS 140-3 will supersede FIPS 140-2 when it is completed. i.33 Federal Information Processing Standard (FIPS) 180-2: “Secure Hash Signature Standard (SHS)“. i.34 Federal Information Processing Standa
40、rd (FIPS) 197: “Advanced Encryption Standard (AES)“. i.35 NIST guide to conformance: “Conformance Resources and Information“. NOTE: Available from “http:/www.itl.nist.gov/div897/ctg/conformProject.html“. i.36 NIST Special Publication 800-115: “Technical Guide to Information Security Testing and Asse
41、ssment“. i.37 NIST Computer Security Division; Security Testing and Metrics group. NOTE: Available from “http:/csrc.nist.gov/groups/STM/index.html“. i.38 OASIS: “Security Assertion Markup Language (SAML)“. NOTE: Available from http:/www.oasis-open.org/specs/#samlv2.0). i.39 IETF RFC1321: “ The MD5 M
42、essage-Digest Algorithm“. i.40 C.E. Shannon: “A Mathematical Theory of Communication“, Bell System Technical Journal, vol. 27, pp. 379-423, 623-656, July, October, 1948. i.41 IETF RFC 4301: “Security Architecture for the Internet Protocol“. i.42 IETF RFC 4303: “IP Encapsulating Security Payload (ESP
43、)“. i.43 IETF RFC 4306: “Internet Key Exchange (IKEv2) Protocol“. i.44 IETF RFC 4305: “Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)“. i.45 IETF RFC 5246: “The Transport Layer Security (TLS) Protocol Version 1.2“. i.46 IET
44、F RFC 3566: “The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec“. ETSI ETSI TR 102 780 V1.1.1 (2009-02) 9i.47 IETF RFC 3602: “The AES-CBC Cipher Algorithm and Its Use with IPsec“. i.48 IETF RFC 3686: “Using Advanced Encryption Standard (AES) Counter Mode With IPsec Encapsulating Security Payload (
45、ESP)“. i.49 ITU-T Recommendation X.509: “Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks“. i.50 ISECOM - The Institute for Security and Open Methodologies: “The Open Source Security Testing Methodology Manual“. i.51 Information S
46、ystems Security Assessment Framework (ISSAF) Penetration Testing Framework. NOTE: Available from http:/www.oissg.org/issaf. i.52 Auguste Kerckhoffs: “La cryptographie militaire“, Journal des sciences militaires, vol. IX, pp. 5-38, Jan. 1883, pp. 161-191, Feb. 1883. i.53 IEEE Std 802.11-2007: “IEEE S
47、tandard for Information Technology - Telecommunications and Information Exchange Between Systems - Local and Metropolitan Area Networks - Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications“. i.54 IEEE Std 1394-1995: “IEEE Standard for Hi
48、gh Performance Serial Bus Bridges“. 3 Definitions, symbols and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETR 232 i.7, ETR 237 i.8, ISO/IEC 13335-1 i.27 apply. 3.2 Abbreviations For the purposes of the present document, the following ab
49、breviations apply: AMI Authority Management Infrastructure ANSI The American National Standards Institute API Application Programming Interface CRC Cyclic Redundancy Check DoS Denial of Service EBNF Extended Backus-Naur Form FIPS The Federal Information Processing Standards ICT Information and Communication Technologies IEEE Institute of Electrical and Electronics Engineers ISSAF The Information Systems Security Assessment Framework MAC Messag
