1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1033 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Information and network security Network security Guidelines on security of individual inform
2、ation services provided by operators Recommendation ITU-T X.1033 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DI
3、RECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.
4、1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV
5、 security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERSEC
6、URITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1
7、580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For f
8、urther details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1033 (04/2016) i Recommendation ITU-T X.1033 Guidelines on security of individual information services provided by operators Summary Recommendation ITU-T X.1033 addresses security aspects of the information services prov
9、ided by telecommunication operators. In the transformation from providing traditional basic telecommunication services to providing comprehensive information services, operators have expanded their services to include content services and information and communication technology (ICT). These new ser
10、vices not only change the operational models but they also add new security issues to be resolved. This Recommendation provides guidelines on the security of the individual information services provided by telecommunication operators. The scope of this Recommendation covers the classification, secur
11、ity requirements, mechanisms and coordination of individual information services. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X.1033 2016-04-29 17 11.1002/1000/12849 Keywords Information service, security. * To access the Recommendation, type the URL http:/handle.itu.int
12、/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1033 (04/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommuni
13、cations, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunica
14、tions on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure
15、 laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommu
16、nication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these
17、mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU dra
18、ws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members o
19、r others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not rep
20、resent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2016 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1033 (04/
21、2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 2 5 Conventions 2 6 Information services provided by telecommunication operators 2 6.1 Communication services 3 6.2 Co
22、ntent services 3 6.3 Informationization service 4 6.4 Individual information service . 4 6.5 Classification of roles . 4 7 Security objectives 5 8 Security requirements . 5 8.1 Security requirements of traditional telecommunication services 5 8.2 Security requirements of content services 7 8.3 Secur
23、ity requirements of informationization services 8 8.4 Security coordination 9 9 Security mechanism 9 Bibliography. 12 Rec. ITU-T X.1033 (04/2016) 1 Recommendation ITU-T X.1033 Guidelines on security of individual information services provided by operators 1 Scope This Recommendation provides guideli
24、nes on the security of individual information services provided by telecommunication operators. It describes the classification of the individual information services provided by telecommunication operators as well as security objectives, requirements, mechanisms and coordination of individual infor
25、mation services. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are s
26、ubject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a docume
27、nt within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. None. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 bearer service b-ITU-T I.112: A type of telecommunication service that prov
28、ides the capability for the transmission of signals between user-network interfaces. 3.1.2 teleservice b-ITU-T I.112: A type of telecommunication service that provides the complete capability, including terminal equipment functions, for communication between users according to protocols established
29、by agreement between Administrations and/or recognized operating agencies (ROAs). 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 basic telecommunication service: A bearer service or teleservice. The terms “bearer service“ and “teleservice“ are defined
30、 in clauses 3.1.1 and 3.1.2, respectively. 3.2.2 individual information service: This is the service process of content searching, indexing, information collection, filtering, ordering and provision of content to specific user(s) or to user groups based on information obtained of users requirements,
31、 privileges, preferences and habitual behaviours, etc. 3.2.3 informationization service: A service that offers solutions to encountered issues or a service that provides assessment, prediction and prevention of possible problems by using information technology and other high-tech means. 2 Rec. ITU-T
32、 X.1033 (04/2016) 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: CRM Customer Resource Management ICP Internet Content Provider ICT Information and Communication Technology IPTV Internet Protocol TeleVision ISP Internet Service Provider IT Information
33、 Technology OA Office Automation QoS Quality of Service ROA Recognized Operating Agency SMS Short Message Service TV Television 5 Conventions None. 6 Information services provided by telecommunication operators Information services provided by telecommunication operators include voice services, data
34、 services and information services such as online information providing and data indexing via public networks, e.g., fixed networks, mobile networks, Internet and other telecommunication infrastructures. The informationization service provided to other organizations by operators is also included. To
35、 provide information services, telecommunication operators and/or other third parties must collect, analyse and process information and construct a platform to help users to access, share and exchange the information. Information services provided by telecommunication operators can be classified int
36、o three categories (as shown in Figure 1): Communication service; Content service; and Informationization service. Figure 1 Composition of information services provided by telecommunication operators Rec. ITU-T X.1033 (04/2016) 3 6.1 Communication services Traditionally, telecommunication operators
37、provide communication services with their network infrastructures including fixed networks, mobile networks, Internet, satellite, etc. These services include voice, video, data and multimedia. Typical communication services include: Telephone services; Internet broadband service; Mobile services; Di
38、rectory service; Telegraph service; Telematic service; Message handling service; Videophone. 6.2 Content services Content services are the extension of communication services. These kinds of services may be provided by operators as well as by third parties, such as Internet service providers (ISPs)
39、and Internet content providers (ICPs). Typical content services include: Access portal; Web indexing/searching; Application store; Mobile reading/advertising/newspaper; Mobile television (TV)/Internet protocol television (IPTV); Location service/mobile navigation; Social networking. Usually, in orde
40、r to address the application and content services area, operators need to design and develop applications and produce content themselves or simply collect contents from other companies that produce music, television programmes, or financial services such as credit cards, stock trading, etc. In the t
41、ransformation from providing traditional basic telecommunication services to providing comprehensive information services, the operators expand their services to include content services and information and communication technology (ICT). Consequently their business value chain changes to include th
42、ese new businesses, as shown in Figure 2 below. 4 Rec. ITU-T X.1033 (04/2016) Figure 2 Content service chain 6.3 Informationization service Informationization is the goal of an information society. The informationization service is the service that offers solutions to encountered issues or the servi
43、ce that provides assessment, prediction and prevention of possible problems by using information technology and other high-technical means. Currently operators enter this area with their advantages in information technology (IT) knowledge and network infrastructure. They provide solutions for encoun
44、tered issues, or provide assessment, prediction and prevention of possible problems, such as consulting, training and information outsourcing, etc. Typical informationization services include: E-government (for governments); E-commerce, mobile office automation (OA) (for enterprises); Digital live,
45、digital entertainment (for homes); E-health, e-education (for persons). 6.4 Individual information service Individual information service is the service process of content searching, indexing, information collection, filtering, ordering and provision of content to specific user(s) or user groups bas
46、ed on the information obtained of users requirements, privileges, preferences and habitual behaviours, etc. In this process, the users requirements, privileges, preferences and habitual behaviours, etc., are (under the users authorization) perceived by individual information service providers and ar
47、e used for content searching, indexing, information collection, filtering, sorting and processing, etc. The searching and collecting of user-preferred content information should abide by the users privileges, while the method, the process and the extent of information provided should comply with the
48、 users preferences and habitual behaviours. The information should be provided to users with user-preferred security and quality of service. 6.5 Classification of roles As mentioned, stakeholders involved in the information services provided by telecommunication operators can be classified, based on
49、 their roles, into regulators, operators, third-party service providers and end users. Under this classification of roles, different stakeholders each have their own security requirements: Regulators. Based on service regulations and legislations, regulators need to put forward security requirements for operators and service providers to ensure service availability, fair competition and privacy protection, etc. Rec. ITU-T X.1033 (04/2016) 5 Operators. Operators need se
