1、 ETSI TR 187 007 V2.1.1 (2008-08)Technical Report Telecommunications and Internet converged Services andProtocols for Advanced Networking (TISPAN);Feasibility study on Media Security in TISPAN NGNETSI ETSI TR 187 007 V2.1.1 (2008-08) 2 Reference DTR/TISPAN-07021-NGN-R2 Keywords multimedia, security
2、ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can b
3、e downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the re
4、ference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documen
5、ts is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permis
6、sion. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2008. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members
7、. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TR 187 007 V2.1.1 (2008-08) 3 Contents Intellectual Property Rights4 Foreword.4 1 Scope 5 2 References 5 2.1 Normative references .5 2.2 Informative references6 3 Definitions
8、 and abbreviations.7 3.1 Definitions7 3.2 Abbreviations .7 4 General Overview.7 5 Media security regulatory considerations.9 5.1 Analysis9 5.2 Lawful Interception and data retention.9 5.3 Requirements10 6 Viability of media security provision.10 6.1 General requirements .10 6.2 Existing NGN capabili
9、ties10 6.3 End to end encryption provision.11 6.4 End to middle encryption provision .11 6.4.1 Advantages .11 6.4.2 Disadvantages .11 6.5 Cryptographic media protection.11 6.6 Summary of requirements 12 6.6.1 NGN12 6.6.2 NGCN.12 7 NGN media transfer architecture for security analysis 12 7.1 Function
10、al model12 7.2 Points of attack in NGN media architecture.13 7.2.1 Direct attack13 7.2.2 Indirect attack .13 8 Media security solution 13 8.1 General .13 8.2 Cryptographic algorithm considerations 13 8.3 Cryptographic key management.14 Annex A: User to user media scenarios15 A.1 SIP Session Establis
11、hment without Media Security.15 A.2 Media Security based on Secure Signalling Path.16 A.3 Media Security based on Key Management Protocol in Signalling Path.16 A.4 Media Security based on Media Path Keying Technique.17 A.5 Mixed Signalling and Media Path Keying Technique .18 Annex B: Bibliography19
12、History 20 ETSI ETSI TR 187 007 V2.1.1 (2008-08) 4 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can
13、be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuan
14、t to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present docume
15、nt. Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TR 187 007 V2.1.1 (2008-08) 5 1 Scope The present document reports on the feasibility of providing media
16、security for TISPAN NGN Release 2 as defined by TR 180 002 i.2. Media security in the present document refers to the capability to securely transport interactive and non-interactive voice, video (including conferencing scenarios), and other multimedia data (including text based) in the user plane of
17、 a Next Generation Network (NGN). The present document provides the results of an analysis of the stage 1 definition of media security requirements and service capabilities; and presents the analysis in support of these requirements for each of simplex and duplex communication in both point-to-point
18、 and point-to-multipoint architectures. The scenarios analysed are also considered with respect to the regulatory environment of NGN. The present document presents, in clause 7, a series of stage 2 architectural models that may implement the stage 1 model for each of the NGN media deployment scenari
19、os. The present document provides in clause 8 some guidance for stage 3 design of security protocol(s) for media security. NOTE 1: Media Security for IMS is not covered by the present document but is addressed by 3GPP TR 33.828 i.17. NOTE 2: Whilst the present document is a technical report it ident
20、ifies requirements for future work. In all cases these requirements are considered indicative pending their ratification in formal ETSI Technical Specifications within the TISPAN Work Programme. 2 References References are either specific (identified by date of publication and/or edition number or v
21、ersion number) or non-specific. For a specific reference, subsequent revisions do not apply. Non-specific reference may be made only to a complete document or a part thereof and only in the following cases: - if it is accepted that it will be possible to use all future changes of the referenced docu
22、ment for the purposes of the referring document; - for informative references. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. For online referenced documents, information sufficient to identify and locate
23、the source shall be provided. Preferably, the primary source of the referenced document should be cited, in order to ensure traceability. Furthermore, the reference should, as far as possible, remain valid for the expected life of the document. The reference shall include the method of access to the
24、 referenced document and the full network address, with the same punctuation and use of upper case and lower case letters. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references The following r
25、eferenced documents are indispensable for the application of the present document. For dated references, only the edition cited applies. For non-specific references, the latest edition of the referenced document (including any amendments) applies. Not applicable. ETSI ETSI TR 187 007 V2.1.1 (2008-08
26、) 6 2.2 Informative references The following referenced documents are not essential to the use of the present document but they assist the user with regard to a particular subject area. For non-specific references, the latest version of the referenced document (including any amendments) applies. i.1
27、 ITU-T Recommendation F.703: “Multimedia conversational services“. i.2 ETSI TR 180 002: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Release 2 definition“. i.3 ETSI TR 180 000: “Telecommunications and Internet converged Services and Protocols fo
28、r Advanced Networking (TISPAN); NGN Terminology“. i.4 Directive 2002/58/EC of the European Parliament and of the council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communication
29、s). i.5 ETSI TS 102 165-1: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and proforma for Threat, Risk, Vulnerability Analysis“. i.6 ETSI ES 282 001 (Release 2): “Telecommunications and Internet converged Ser
30、vices and Protocols for Advanced Networking (TISPAN); NGN Functional Architecture“. i.7 ETSI EG 202 238: “Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON); Evaluation criteria for cryptographic algorithms“. i.8 ETSI SR 002 211 (V1.1.1): “List of standards and/or specific
31、ations for electronic communications networks, services and associated facilities and services; in accordance with Article 17 of Directive 2002/21/EC“. i.9 Wassenaar agreement: http:/www.wassenaar.org/. i.10 IETF RFC 3830 (2004): “MIKEY: Multimedia Internet KEYing“. i.11 IETF RFC 4566 (2006): “SDP:
32、Session Description Protocol“. i.12 IETF RFC 4567 (2006): “Key Management Extensions for Session Description Protocol (SDP) and Real Time Streaming Protocol (RTSP)“. i.13 IETF RFC 4568 (2006): “Session Description Protocol (SDP) Security Descriptions for Media Streams“. i.14 IETF draft-zimmermann-av
33、t-zrtp-04 (2007): “ZRTP: Media Path Key Agreement for Secure RTP“. i.15 IETF draft-fischl-sipping-media-dtls-03.txt (2007): “Datagram Transport Layer Security (DTLS) Protocol for Protection of Media Traffic Established with the Session Initiation Protocol“. i.16 IETF draft-ietf-avt-dtls-srtp-00.txt
34、(2007): “Datagram Transport Layer Security (DTLS) Extension to Establish Keys for Secure Real-time Transport Protocol (SRTP)“. i.17 3GPP TR 33.828: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; IMS media plane security“. ETSI ETSI TR 187 007 V2.1.1 (
35、2008-08) 7 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in TR 180 000 i.3 and the following apply: media security: collective term for provision of security aspects of confidentiality, integrity, authenticity to the transfe
36、r of media across a network NOTE 1: In the NGN media security relates to the protection of interactive voice/video phone/conferencing on an IP transport plane. NOTE 2: Multimedia services are those in the scope of ITU-T Recommendation F.703 i.1. In particular, such conversational services are betwee
37、n two communicating entities where the multimedia service provides real-time transmission of voice, including optionally conferencing with transmission of video and/or text and/or graphics and/or still pictures. 3.2 Abbreviations For the purposes of the present document, the following abbreviations
38、apply: 3GPP 3rd Generation Partnership Project AVP Audio Video Profile DES Data Encryption Standard DTLS Datagram Transport Layer Security IMS IP Multimedia Subsystem ISDN Integrated Services Digital Network MAC Message Authentication Code MKI Master Key Identifier NGCN Next Generation Corporate Net
39、work NGN Next Generation Network PSTN Public Switched Telephone Network RAN Radio Access Network RTP Real-Time Transport Protocol SA Security Association SAVP Secure Audio Video Profile SDES Secure DEScription SDP Session Description Protocol SIP Session Initiation Protocol SIPS Session Initiation P
40、rotocol Secure SRTP Secure Real-time Transport Protocol TEK Traffic Encryption Key UA User Agent 4 General Overview In the PSTN security provisions were mostly physical as the access to the line in order to eavesdrop on traffic, or to inject and modify signalling, was presumed difficult, furthermore
41、 as the terminal devices were dumb (i.e. did not make any processing decisions) it was straightforward to partition trusted and untrusted areas of the network. Development of the PSTN has moved the boundary of the trusted domain to the network termination point and does not include the terminal itse
42、lf. In the NGN however the assumptions have changed. It is assumed in the NGN that eavesdropping of traffic is possible, and that as terminal devices have intelligence (i.e. processing power and state manipulation capability) that injection and modification of signalling is possible by manipulation
43、at the end-points. The environment of the NGN as a PSTN (Public Services Telecommunications Network as opposed to Public Switched Telephone Network) requires that in most deployed regions that care is taken to ensure privacy of the end user. This implies giving some level of assurance that transmitt
44、ed data remains confidential, and that data transmitted is faithfully reproduced. ETSI ETSI TR 187 007 V2.1.1 (2008-08) 8 The NGN, in common with ISDN, provides logical separation of signalling and traffic. The NGN, unlike ISDN, does not provide physical separation of signalling and traffic. For the
45、 purposes of the present document it is assumed that signalling is protected using mechanisms provided by SIP and/or the IMS, A review of the requirements and mechanisms for protection of traffic, where traffic may take the form of any digitized (user generated) content, are presented in the present
46、 document. NOTE: Traffic is used to refer to the general case of media distinguished from signalling, however where specific media types are protected, by example using adaptive media encoding as happens in certain forms of vocoder, the specific media is referred. In order to review the requirements
47、 for media security, and to determine the feasibility of providing mechanisms to implement the requirements it is essential to review how media may be compromised (attacked). Whilst it is suggested in TS 102 165-1 i.5 that there is a small class of threats/attacks there are a very large number of th
48、reat agents/attack vectors to be addressed in analysis. An attacker might be located along: the media path; the signalling path; or both the media and the signalling path. It is also reasonable to consider the capabilities of the attacker (this is in order to evaluate that likelihood of an attack us
49、ing the method defined in TS 102 165-1 i.5). The dynamics of attackers vary and these need to be taken into account as the form of attacker influences the form of attack: a) active attacker; b) passive attacker. The following classifications for attack can be made: Class I: - Passive attack on the signalling and the data path sufficient to reveal the content of the media traffic. Class II: - Active attack on the signalling path and passive attack on the data path to reveal the content of the media traffic. Class III
