1、 International Telecommunication Union ITU-T K.81TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (11/2009) SERIES K: PROTECTION AGAINST INTERFERENCE High-power electromagnetic immunity guide for telecommunication systems Recommendation ITU-T K.81 Rec. ITU-T K.81 (11/2009) i Recommendation ITU-T K.81
2、 High-power electromagnetic immunity guide for telecommunication systems Summary In an information security management system (ISMS), based on Recommendation ITU-T X.1051 and ISO/IEC Standards 27001 and 27002, physical security is a key issue. The electromagnetic interference caused by a high-power
3、electromagnetic (HPEM) attack and the ability to intercept information due to unintentional electromagnetic emissions of equipment are significantly determined by the applied physical security measures. When security is managed, it is necessary to evaluate the threat and mitigate either the equipmen
4、t or the site. The threat is related to “vulnerability“ and “confidentiality“ in ISMS. Recommendation ITU-T K.81 presents guidance on establishing the threat level presented by an intentional HPEM attack and the physical security measures that may be used to minimize this. The HPEM sources considere
5、d are those presented in IEC 61000-2-13, High-power electromagnetic (HPEM) environments Radiated and conducted, as well as some additional sources that have emerged more recently. This Recommendation also gives vulnerability of equipment. The equipment is assumed to meet the immunity requirements pr
6、esented in Recommendation ITU-T K.48 and relevant resistibility requirements, such as Recommendations ITU-T K.20, ITU-T K.21 and ITU-T K.45. Source Recommendation ITU-T K.81 was approved on 29 November 2009 by ITU-T Study Group 5 (2009-2012) under Recommendation ITU-T A.8 procedures. ii Rec. ITU-T K
7、.81 (11/2009) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is respon
8、sible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the IT
9、U-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborativ
10、e basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mand
11、atory provisions (to ensure e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. Th
12、e use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU take
13、s no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual proper
14、ty, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2010 All rights reserved.
15、No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T K.81 (11/2009) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 2 3.1 Terms defined elsewhere 2 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and ac
16、ronyms 3 5 Classifications of threat 4 5.1 Definition of threat portability level . 4 5.2 Definition of the intrusion area . 4 5.3 Definition of availability levels 6 5.4 Examples of threat 6 6 Vulnerability of devices to be protected . 7 6.1 Definition of vulnerability classifications 7 6.2 Example
17、 of vulnerability of equipment to be protected . 8 7 Determination of EM mitigation levels 9 7.1 General . 9 Appendix I HPEM threat and vulnerability 12 I.1 Calculating HPEM threat . 12 I.2 Vulnerability of IT equipment 28 Appendix II Examples of EM mitigation Levels 34 II.1 Example of EM mitigation
18、 levels for an IP network service . 34 Appendix III IEC Standards related to HPEM 38 III.1 Overview of the IEC HPEM Series 38 Bibliography. 41 Rec. ITU-T K.81 (11/2009) 1 Recommendation ITU-T K.81 High-power electromagnetic immunity guide for telecommunication systems 1 Scope This Recommendation pre
19、sents guidance on: establishing the threat level presented by an intentional high-power electromagnetic (HPEM) attack on an electronic equipment or system; the physical security measures that may be employed to reduce this threat level; establishing the vulnerability of the equipment (or system) to
20、be protected from an HPEM attack. When establishing detailed countermeasures to HPEM attacks, it is extremely important that the threat level (strength) of the attack be adequately estimated. Underestimation means that the applied countermeasures will be insufficient and hence increases the risk tha
21、t equipment may malfunction; whereas overestimation means that the applied countermeasures may add significant (and unnecessary) cost to the equipment or system. Estimation of the threat level (strength) is calculated using sources such as the IEC Standards, as well as the independent market studies
22、 performed during the preparation of this Recommendation. The vulnerability of the equipment (or system) to be protected is based on either an assessment of the standards that the equipment (or system) satisfy, or the results of independent evaluation (i.e., test) of a sample device. The threat and
23、vulnerability levels considered within this Recommendation reflect the technology levels current as of March 2004. Hence it is expected that this Recommendation will require periodic review in the light of the ongoing technological change in order to remain current. 2 References The following ITU-T
24、Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation a
25、re therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. ITU-T K.20 Recommendation ITU-T K.20 (2008), Resistibility of telecommunica
26、tion equipment installed in a telecommunications centre to overvoltages and overcurrents. ITU-T K.21 Recommendation ITU-T K.21 (2008), Resistibility of telecommunication equipment installed in customer premises to overvoltages and overcurrents. ITU-T K.42 Recommendation ITU-T K.42 (1998), Preparatio
27、n of emission and immunity requirements for telecommunication equipment General principles. ITU-T K.43 Recommendation ITU-T K.43 (2009), Immunity requirements for telecommunication network equipment. ITU-T K.44 Recommendation ITU-T K.44 (2008), Resistibility tests for telecommunication equipment exp
28、osed to overvoltages and overcurrents Basic Recommendation. 2 Rec. ITU-T K.81 (11/2009) ITU-T K.45 Recommendation ITU-T K.45 (2008), Resistibility of telecommunication equipment installed in the access and trunk networks to overvoltages and overcurrents. ITU-T K.48 Recommendation ITU-T K.48 (2006),
29、EMC requirements for telecommunication equipment Product family Recommendation. ITU-T K.66 Recommendation ITU-T K.66 (2004), Protection of customer premises from overvoltages. IEC 61000-2-13 IEC 61000-2-13 (2005), Electromagnetic compatibility (EMC) Part 2-13: Environment High-power electromagnetic
30、(HPEM) environments Radiated and conducted. IEC CISPR 24 CISPR 24 (1997), Information technology equipment Immunity characteristics Limits and methods of measurement. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 availability b-ISO 17
31、799: Ensuring that authorized users have access to information and associated assets when required. 3.1.2 emanation b-IETF RFC 2828: A signal (electromagnetic, acoustic, or other medium) that is emitted by a system (through radiation or conductance) as a consequence (i.e., by product) of its operati
32、on, and that may contain information. (See: TEMPEST.) 3.1.3 integrity b-ISO 17799: Safeguarding the accuracy and completeness of information and processing methods. 3.1.4 TEMPEST b-IETF RFC 2828: A nickname for specifications and standards for limiting the strength of electromagnetic emanations from
33、 electrical and electronic equipment and thus reducing vulnerability to eavesdropping. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 confidentiality: Ensuring that information is accessible only to those authorized to have access. EMSEC is a risk to
34、lose this confidentiality. In this Recommendation, if the equipment cannot be mitigated itself, the emission values of existing electromagnetic compatibility (EMC) requirement show the level of this confidentiality. 3.2.2 EM mitigation: The preparations made to avoid either a malfunction due to a vu
35、lnerability caused by high-altitude electromagnetic pulses (HEMP) or high-power electromagnetic (HPEM) emissions, or the lack of confidentiality due to an insufficient emanation security (EMSEC). The level of the EM mitigation of the equipment can be calculated from the threat level and the vulnerab
36、ility level. 3.2.3 electromagnetic emanations security (EMSEC): Physical constraints to prevent information compromise through signals emanated by a system; particularly the application of TEMPEST technology to block electromagnetic radiation. In this Recommendation, EMSEC means only information lea
37、kage due to unintentional electromagnetic emission. 3.2.4 threat: A potential security violation that arises from taking advantage of a vulnerability caused by high-altitude electromagnetic pulses (HEMP) or high-power electromagnetic (HPEM) Rec. ITU-T K.81 (11/2009) 3 emissions, and which could lead
38、 to a lack of confidentiality due to an insufficient electromagnetic emanation security (EMSEC). The level of an HPEM threat is defined by the intrusion area, the portability, and the availability. An HPEM threat is defined as the strength of the electromagnetic field that is described in clause 5.
39、Parameters intrusion area, portability, and availability are defined in that same Recommendation. 3.2.5 vulnerability: The possibility that the equipment does not function correctly when exposed to HEMP or HPEM. The possibility that equipment does functional false with HEMP and HPEM 4 Abbreviations
40、and acronyms This Recommendation uses the following abbreviations and acronyms: AM Amplitude Modulation ASP Application Service Provider CB Citizen Band CSP Contents Service Provider CW Continuous Wave DB Database DC Direct Current EM Electromagnetic EMC Electromagnetic Compatibility EMSEC EM emanat
41、ions Security ERP Enterprise Resource Planning EU European Union FET Field Effect Transistor FM Frequency Modulation FTP File Transfer Protocol GTEM Gigahertz Transverse Electromagnetic HEMP High-altitude EM Pulse HF High Frequency HPEM High Power EM IGBT Insulated Gate Bipolar Transistor IP Interne
42、t Protocol IRA Impulse Radiating Antenna ISMS Information Security Management System ISP Internet Service Provider IT Information Technology LAN Local Area Network MSP Management Service Provider NEBS Network Equipment Building Systems 4 Rec. ITU-T K.81 (11/2009) PC Personal Computer TCP Transfer Co
43、ntrol Protocol VSWR Voltage Standing Wave Ratio 5 Classifications of threat In order to evaluate a threat, it is necessary to consider its: portability level; intrusion areas; availability level. 5.1 Definition of threat portability level This Recommendation defines the four levels of threat portabi
44、lity presented in Table 5.1-1. Table 5.1-1 Definitions of threat portability levels Threat portability level Definition PI Pocket-sized or body-worn (Note 1) PII Briefcase or Backpack sized (Note 2) PIII Motor-Vehicle sized (Note 3) PIV Trailer-sized (Note 4) NOTE 1 This portability level applies to
45、 threat devices that can be hidden in the human body and/or in the clothing. NOTE 2 This portability level applies to threat devices that are too large to be hidden in the human body and/or in the clothing, but is still small enough to be carried by a person (such as in a briefcase or a back-pack).
46、NOTE 3 This portability level applies to threat devices that are too large to be easily carried by a person, but large enough to be hidden in a typical consumer motor vehicle. NOTE 4 This portability level applies to threat devices that are too large to be either easily carried by a person or hidden
47、 in a typical consumer motor vehicle. Such threat devices require transportation using a commercial/industrial transportation vehicle. 5.2 Definition of the intrusion area This Recommendation recognizes the concept of intrusion area. This concept indicates both: the portability levels of threat devi
48、ce(s) that may be present; the typical minimum separation distance that may be achieved between the threat device and the electronic equipment to be protected. The concept of intrusion area is depicted in Figure 5.2-1 and summarized in Table 5.2-1. Intrusion area Zone 0 applies to the public spaces
49、located about the site or building that houses the equipment to be protected. Within this area, people and vehicles are free to move in accordance with local legal requirements (i.e., the owner of the equipment to be protected has no ability to control the movement of people and/or vehicles). Hence, Zone 0 can contain threat devices of all the portability levels defined in Table 5.1-1. The typical minimum separation between the threat devices located in this zone and the equipment to be protected is
