1、 International Telecommunication Union ITU-T X.1114TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (11/2008) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security Authorization framework for home networks Recommendation ITU-T X.1114 ITU-T X-SERIES RECOMMENDATION
2、S DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECUR
3、ITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.11
4、00X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1
5、249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1114 (11/2008) i Recommendation ITU-T X.1114 Authorization
6、framework for home networks Summary Alongside the wide deployment of home network services and the increasing development of a variety of technologies for telecommunication, contents provision, remote control, etc., concerns over the security of the home network are increasing. As a basic security f
7、unction for protecting the home network, authorization ensures that only an authorized entity (including user, device) can access the home network resources. Recommendation ITU-T X.1114 describes the security threats and authorization requirements for the home network, identifies the authorization e
8、ntities and methods, and develops authorization models and authorization modes for guaranteeing the security of the home network. Source Recommendation ITU-T X.1114 was approved on 13 November 2008 by ITU-T Study Group 17 (2009-2012) under Recommendation ITU-T A.8 procedure. Keywords Access control,
9、 access control list, authorization framework, authorization mode, authorization model, role-based access control. ii Rec. ITU-T X.1114 (11/2008) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and comm
10、unication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. T
11、he World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution
12、 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a
13、 recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure e.g. interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. T
14、he words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibilit
15、y that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recomm
16、endation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information
17、and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2009 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1114 (11/2008) iii CONTENTS Page 1 Scop
18、e 1 2 References. 1 3 Terms and definitions . 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation. 3 4 Abbreviations and acronyms 3 5 Conventions 3 6 Authorization for the home network 3 7 Authorization entities for the home network 5 8 Authorization models for the home network
19、6 8.1 Centralized authorization model. 7 8.2 Distributed authorization model. 10 9 Relationship between authorization entities and home network entities 11 10 Authorization modes. 12 10.1 Static authorization mode. 12 10.2 Dynamic authorization mode . 12 11 Security threats for authorization in the
20、home network 14 12 Authorization requirements for the home network. 15 12.1 Data confidentiality 15 12.2 Data integrity 16 12.3 Authentication 16 12.4 Availability. 16 12.5 Consistency. 16 13 Relationship between security threats and requirements 16 Appendix I Authorization methods. 17 Appendix II C
21、onceptual policy model for authorization 19 Appendix III Service scenario of the dynamic authorization mode 21 Appendix IV Use cases of authorization models 23 Bibliography 25 Rec. ITU-T X.1114 (11/2008) 1 Recommendation ITU-T X.1114 Authorization framework for home networks 1 Scope This Recommendat
22、ion describes an authorization framework for home networks, which includes a number of home network resources such as home network users, three types of home devices, the service servers, the services provided, a variety of applications and the heterogeneous network protocols and middleware for comm
23、unication and service development. The scope of this Recommendation covers the authorization framework for home networks as described below: Security threats in authorization for the home network. Authorization requirements for the home network. Relationship between security threats and authorizatio
24、n requirements. Classification of authorization entities. Authorization model for the home network. Authorization mode required while enforcing access control. The following items are also described in the appendices: Authorization methods for the home network. Conceptual policy model used in author
25、izing the home network. Service scenario of the authorization mode. Use case of the authorization model. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of public
26、ation, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the
27、 currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.1111 Recommendation ITU-T X.1111 (2007), Framework of security technologies for home network. 3 T
28、erms and definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 access control b-ITU-T X.800: The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner. 3.1.2 access control list b-
29、ITU-T X.800: A list of entities, together with their access rights, which are authorized to have access to a resource. 2 Rec. ITU-T X.1114 (11/2008) 3.1.3 application server b-ITU-T X.1121: An entity that connects to an open network for data communication with mobile terminals. 3.1.4 authentication
30、b-ITU-T X.811: The provision of assurance of the claimed identity of an entity. NOTE The usage of the word identity is made with the understanding that, in the context of telecommunications, it is an identifier or set of identifiers that is trusted, meaning it is considered to be reliable for the pu
31、rposes of a particular situation to represent a network element, network terminal equipment, or user, after the completion of a validation process. As the term is used here, one cannot conclude that trusted identifiers constitute positive validation of a person. 3.1.5 authorization b-ITU-T X.800: Th
32、e granting of rights, which includes the granting of access based on access rights. 3.1.6 availability b-ITU-T X.800: The property of being accessible and useable upon demand by an authorized entity. 3.1.7 capability b-ITU-T X.800: A token used as an identifier for a resource such that possession of
33、 the token confers access rights for the resource. 3.1.8 confidentiality b-ITU-T X.800: The property that information is not made available or disclosed to unauthorized individuals, entities or processes. 3.1.9 data integrity b-ITU-T X.800: The property that data has not been altered or destroyed in
34、 an unauthorized manner. 3.1.10 decision b-ITU-T X.1142: The result of evaluating a rule, policy or policy set. 3.1.11 identification b-NIST SP800-47: The process of verifying the identity of user, process or device, usually as a prerequisite for granting access to resources in an IT system. 3.1.12
35、identifier b-ITU-T Y.2091: A series of digits, characters and symbols or any other form of data used to identify subscriber(s), user(s), network element(s), function(s), network entity(ies) providing services/applications, or other entities (e.g., physical or logical objects). Identifiers can be use
36、d for registration or authorization. They can be either public to all networks, shared between a limited number of networks or private to a specific network (private identifiers are normally not disclosed to third parties). 3.1.13 password b-ITU-T X.800: Confidential authentication information, usua
37、lly composed of a string of characters. 3.1.14 permission b-ITU-T X.1142: The ability or right to perform some action on some resource, possibly only under certain specified conditions. 3.1.15 policy (security policy) b-ITU-T X.800: The set of criteria for the provision of security services. 3.1.16
38、privacy b-ITU-T X.800: The right of individuals to control or influence what information related to them may be collected and stored and by whom, and to whom that information may be disclosed. 3.1.17 resource b-ITU-T X.1142: Data, service or system component. 3.1.18 role b-ITU-T X.1142: A job functi
39、on within the context of an organization that has associated semantics regarding the authority and responsibility conferred on the user assigned to the role. 3.1.19 role based access control (RBAC) b-ITU-T X.1142: A model for controlling access to resources where permitted actions on resources are i
40、dentified with roles rather than with individual subject identities. 3.1.20 rule b-ITU-T X.1142: A target, an effect and a condition, a component of a policy. Rec. ITU-T X.1114 (11/2008) 3 3.1.21 subject b-ITU-T X.1142: An actor whose attributes may be referenced by a predicate. 3.1.22 target b-ITU-
41、T X.1142: The set of decision requests, identified by definitions for resource, subject and action, that a rule, policy or policy set is intended to evaluate. 3.1.23 threat b-ITU-T X.800: A potential violation of security. 3.2 Terms defined in this Recommendation This Recommendation defines the foll
42、owing terms: 3.2.1 authorization administrator: A person who is responsible for the management of policy used in authorization. 3.2.2 authorization server: An entity that is in charge of authorizing a home subject by controlling access from the home subject to a home resource. 3.2.3 home resource: A
43、 resource that provides home network services based on the decision by the authorization server. 3.2.4 home subject: A home user or home device that has a profile, i.e., an identifier, that wants to access the home resource within the home network. 4 Abbreviations and acronyms This Recommendation us
44、es the following abbreviations and acronyms: ACL Access Control List AS Authorization Server CA Certificate Authority CCTV Closed-Circuit Television DAC Discretionary Access Control HR Home Resource HS Home Subject MAC Mandatory Access Control PDP Policy Decision Point PEP Policy Enforcement Point R
45、BAC Role Based Access Control URI Uniform Resource Identifier URL Uniform Resource Locator 5 Conventions None. 6 Authorization for the home network The purpose of authorization for the home network is to protect the home network from illegal or unnecessary access by restricting the privilege of the
46、accessing entity and controlling access even though the entity has been successfully authenticated. The accessing entity includes devices, users and other resources, depending on the application. When a certain entity is going to use the home network service, the authorization function makes a decis
47、ion as to whether to permit access or not based on the authorization policy managed by the authorization administrator. The decision can be 4 Rec. ITU-T X.1114 (11/2008) made by the service provider itself, a trusted third party responsible for the authorization, or the owner of the accessed resourc
48、e after an appropriate instant confirmation procedure, e.g., personal allowance or person-to-person conversation. The authorization database includes the policy used for access control consisting of a set of records wherein each record must implicitly contain the following information: Subjects info
49、rmation, which uniquely identifies an accessing entity or a set of entities. Resources information, which uniquely identifies the accessed entity or a set of entities. Information on the permission of the subject: May be either an allowance or a rejection. The identifier of the HS is supposed to be provided by a corresponding authenticator, the subjects themselves or other trusted functions and must be addressed in the authorization policy. The identifier of the HR is like
