1、 ETSI TS 102 165-2 V4.2.1 (2007-02)Technical Specification Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN);Methods and protocols; Part 2: Protocol Framework Definition; Security Counter MeasuresETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 2 Reference RTS/
2、TISPAN-07007-Tech Keywords IP, Protocol, Security, VoIP ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Importan
3、t notice Individual copies of the present document can be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Po
4、rtable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Informat
5、ion on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part
6、may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2007. All rights reserved. DECTTM, PLUGTESTSTM and UMTSTM are Trade Marks of ETSI registered for the benefit
7、of its Members. TIPHONTMand the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 3 Contents Intellec
8、tual Property Rights6 Foreword.6 Introduction 6 1 Scope 8 2 References 8 3 Definitions and abbreviations.10 3.1 Definitions10 3.2 Abbreviations .11 3.3 Notation11 4 Architecture considerations for security in ICT .12 4.1 Mapping to 3GPP and NGN architectures .13 4.2 Use of functions from ISO/IEC 154
9、08.13 4.3 Requirements model in communications security13 5 Authentication counter-measures.14 5.1 Introduction 14 5.1.1 Single versus multi-factor authentication .16 5.1.1.1 Behavioural extension for authentication models .16 5.2 Authentication service requirements 16 5.3 Overall stage 1 model for
10、authentication18 5.3.1 Procedures.18 5.3.1.1 Provision/withdrawal 18 5.3.1.2 Normal procedures18 5.3.1.2.1 Invocation and operation .18 5.3.1.3 Exceptional procedures .18 5.3.1.3.1 Activation/deactivation/registration/interrogation.18 5.3.1.3.2 Invocation and operation .18 5.3.2 Interactions with ot
11、her security services.19 5.3.3 Interworking considerations19 5.4 Specific authentication models (stage 2 models)19 5.4.1 Challenge response authentication19 5.4.2 Authenticate service capability.22 5.4.3 Message authentication code model .26 5.4.3.1 Hash function-based MAC27 5.4.3.2 Block cipher MAC
12、 27 5.4.4 Digital signature27 6 Access control counter-measures .28 6.1 Introduction 28 6.2 Overall stage 1 model for access control29 6.2.1 Procedures.29 6.2.1.1 Provision/withdrawal 29 6.2.1.2 Normal procedures29 6.2.1.2.1 Activation/deactivation/registration/interrogation.29 6.2.1.2.2 Invocation
13、and operation .29 6.2.1.3 Exceptional procedures .29 6.2.1.3.1 Activation/deactivation/registration/interrogation.29 6.2.1.3.2 Invocation and operation .30 6.2.2 Interactions with other security services.30 6.2.3 Interworking considerations30 6.3 Specific access control models (stage 2 models)30 7 C
14、onfidentiality service .32 7.1 Introduction 32 ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 4 7.2 Provided services32 7.2.1 Description32 7.2.2 Encryption mechanism .33 7.2.3 Implicit authentication 33 7.3 Overall stage 1 model for confidentiality.34 7.3.1 Procedures.34 7.3.1.1 Provision/withdrawal 34 7.
15、3.1.2 Normal procedures34 7.3.1.2.1 Activation/deactivation/registration/interrogation.34 7.3.1.2.2 Invocation and operation .34 7.3.1.3 Exceptional procedures .34 7.3.1.3.1 Activation/deactivation/registration/interrogation.34 7.3.1.3.2 Invocation and operation .34 7.3.2 Interactions with other sec
16、urity services.34 7.3.3 Interworking considerations34 7.4 Specific confidentiality models (stage 2 models).34 8 Integrity service35 8.1 Introduction 35 8.2 Provided services35 8.3 Requirements statements for integrity service functional capabilities (ISO/IEC 15408-2)36 8.4 Overall stage 1 model for
17、integrity.37 8.4.1 Procedures.37 8.4.1.1 Provision/withdrawal 37 8.4.1.2 Normal procedures37 8.4.1.2.1 Activation/deactivation/registration/interrogation.37 8.4.1.2.2 Invocation and operation .37 8.4.1.3 Exceptional procedures .37 8.4.1.3.1 Activation/deactivation/registration/interrogation.37 8.4.1
18、.3.2 Invocation and operation .37 8.4.2 Interactions with other security services.37 8.4.3 Interworking considerations37 8.5 Specific integrity models (stage 2 models).37 8.6 Implicit authentication38 9 Non-repudiation service .38 9.1 Overview 38 9.2 Requirements statements for non-repudiation servi
19、ce functional capabilities (ISO/IEC 15408-2)39 9.3 Overall stage 1 model for non-repudiation.40 9.3.1 Procedures.40 9.3.1.1 Provision/withdrawal 40 9.3.1.2 Normal procedures40 9.3.1.2.1 Activation/deactivation/registration/interrogation.40 9.3.1.2.2 Invocation and operation .40 9.3.1.3 Exceptional p
20、rocedures .40 9.3.1.3.1 Activation/deactivation/registration/interrogation.40 9.3.1.3.2 Invocation and operation .40 9.3.2 Interactions with other security services.41 9.3.3 Interworking considerations41 9.4 Specific non-repudiation stage 2 models41 10 Subscription Services .42 11 Authorization serv
21、ices42 12 Key management service42 12.1 Overview 42 12.2 Symmetric key management 43 12.3 Asymmetric key management 44 12.3.1 Overview 44 12.3.2 Certificate generation44 12.3.3 Certificate extension .44 12.3.4 Certification authority.45 ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 5 Annex A (informative)
22、: Modelling techniques in countermeasure development .46 A.1 Introduction 46 A.2 Use of UML patterns46 A.3 Use of UML stereotypes.46 Annex B (informative): Use of IPsec to implement countermeasures .47 B.1 Overview 47 B.1.1 Identification of principals .48 B.2 IPsec architecture .48 B.3 Key manageme
23、nt for IPsec.48 B.4 IPsec implementation of authentication and integrity48 B.4.1 Authentication algorithm selection.48 B.4.1.1 Combined algorithm selection 48 B.5 IPsec implementation of data confidentiality.49 B.5.1 Confidentiality algorithm selection 49 B.5.1.1 Combined algorithm selection 49 B.5.
24、2 Requirements on the construction of the IV.49 B.5.3 Application of AES-CBC.49 Annex C (informative): Bibliography.50 History 51 ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 6 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The
25、 information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available fro
26、m the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETS
27、I SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networki
28、ng (TISPAN). Introduction The present document is one of a set of documents that addresses standardization of security protocols and mechanisms within the context of the eEurope 2005 programme. The suite of documents in this suite is composed as follows: ETSI EG 202 387: “Telecommunications and Inte
29、rnet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method for application of Common Criteria to ETSI deliverables“. ETSI ES 202 383: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide;
30、Method and proforma for defining Security Targets“. ETSI ES 202 382: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Security Design Guide; Method and proforma for defining Protection Profiles“. ETSI TS 102 165-1 10: “Telecommunications and Interne
31、t converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Method and proforma for Threat, Risk, Vulnerability Analysis“. ETSI TS 102 165-2: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Protocol Framework Definit
32、ion; Security Counter Measures“. ETSI TS 102 556: “Telecommunication and Internet converged Services and Protocols for Advanced Networking (TISPAN); Protection Profile“. ETSI EG 202 549: “Telecommunication and Internet converged Services and Protocols for Advanced Networking (TISPAN); Design Guide;
33、Application of security countermeasures to service capabilities“. These documents are developed based on the objectives of the eEurope programme and are also developed to ensure they comply with the overall objectives of the European regulatory framework as defined in the following documents: Direct
34、ive 2002/19/EC of the European Parliament and of the council of 7 March 2002 on access to, and interconnection of, electronic communications networks and associated facilities (Access Directive). Directive 2002/20/EC of the European Parliament and of the council of 7 March 2002 on the authorization
35、of electronic communications networks and services (Authorization Directive). Directive 2002/21/EC of the European Parliament and of the council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive). ETSI ETSI TS 102 165-2 V4.2.1 (
36、2007-02) 7 Directive 2002/22/EC of the European Parliament and of the council of 7 March 2002 on universal service and users rights relating to electronic communications networks and services (Universal Service Directive). Directive 2002/58/EC of the European Parliament and of the council of 12 July
37、 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). In particular the present document forms part of the standardization initiative for the Next Generation Network (NGN) platform
38、to be used in eEurope and upon which the trust and viability of the e-enabled community will, to a very large part, depend on. The eEurope 2005 action plan has been drawn up to focus on “the widespread availability and use of broadband networks throughout the Union and the security of networks and i
39、nformation, eGovernment, eHealth and eBusiness“ requiring a supporting infrastructure, which is truly pan-European. To quote COM(2002)263: “By 2005 Europe should have a secure information infrastructure“. ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 8 1 Scope The present document defines by means of an i
40、nformation model and functional entity behavioural model, the security countermeasures for the ICT in general and where examples are shown they are shown with respect to the NGN. Countermeasures are grouped by their key feature, i.e. Authentication, Integrity. The Unified Modelling Language (UML) is
41、 used to model the countermeasures as a semi-formal tool with verification and simulation capabilities deployed during development. NOTE: This is in accordance with the goals of the eEurope project under objective Good practices (COM(2002) 263 page 18). The countermeasures defined in the present doc
42、ument have been identified from an analysis of the NGN presented in TS 102 165-1 10 and in TR 187 002 9 as those most likely to be required for mitigation of risk in the NGN. The deployment of the countermeasures in the NGN is extrapolated from TR 187 002 9 and defined in this document. The present
43、document is intended for designers of security countermeasures. NOTE: The definition of cryptographic algorithms is not provided by this document but the invocation of algorithms in protocol sequences is shown. The specific use of IPsec 11 in ESP mode 12, including IKEv2 18 and is reviewed in annex
44、B of this document as a specific stage 3 implementation of the stage 1 and stage 2 capabilities. The authentication countermeasures outlined as structural and behavioural patterns in the present document cover the following scenarios: Source authentication as defined for IPsec ESP. NASS-IMS bundled
45、authentication including mechanisms for NASS authentication. Early IMS authentication (by reference to TR 133 978 20). 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identif
46、ied by date of publication and/or edition number or version number) or non-specific. For a specific reference, subsequent revisions do not apply. For a non-specific reference, the latest version applies. Referenced documents which are not found to be publicly available in the expected location might
47、 be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 1 ISO/IEC 10181-3: “Information technology - Open Systems Interconnection - Security frameworks for open systems: Acc
48、ess control framework“. NOTE: Equivalent to ITU-T X.812. 2 ISO/IEC 9798-2: “Information technology - Security techniques - Entity authentication - Part 2: Mechanisms using symmetric encipherment algorithms“. 3 ISO/IEC 9798-3: “Information technology - Security techniques - Entity authentication - Pa
49、rt 3: Entity authentication using a public key algorithm“. 4 ISO/IEC 9798-4: “Information technology - Security techniques - Entity authentication - Part 4: Mechanisms using a cryptographic check function“. ETSI ETSI TS 102 165-2 V4.2.1 (2007-02) 9 5 ITU-T Recommendation Z.100: “Specification and description language (SDL)“. 6 ETSI TS 187 001: “Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN); NGN SECurity (SEC); Requirements“. 7 ETSI TS 187 003: “Telecommunic
