1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1248 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2017) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cyberspace security Countering spam Technical requirements for countering instant messaging s
2、pam Recommendation ITU-T X.1248 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING
3、 AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X
4、.1099 SECURE APPLICATIONS AND SERVICES (1) Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols (1) X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CY
5、BERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES (2) Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1319 Smart grid security X.1330X.1339 Certified mail X.1340X.1349 Internet
6、of things (IoT) security X.1360X.1369 Intelligent transportation system (ITS) security X.1370X.1389 Distributed legder technology security X.1400X.1429 Security protocols (2) X.1450X.1459 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1
7、539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing sec
8、urity design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1248 (09/2017) i Recomme
9、ndation ITU-T X.1248 Technical requirements for countering instant messaging spam Summary Recommendation ITU-T X.1248 identifies characteristics of spam over instant messaging (SPIM) and specifies technical requirements for countering it. As instant messaging (IM) increases in popularity, the prolif
10、eration of SPIM becomes an increasingly serious problem. The characteristics of IM, such as being Internet protocol (IP)-based with widespread usage that is free of charge, potentially allows SPIM to spread widely and uncontrollably. If SPIM problems are not carefully addressed, they can have negati
11、ve impacts on the utilization of the IM service itself. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X.1248 2017-09-06 17 11.1002/1000/13262 Keywords Instant messaging spam, SPIM. * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of y
12、our web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1248 (09/2017) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and co
13、mmunication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis.
14、 The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resoluti
15、on 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and
16、 a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are me
17、t. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibi
18、lity that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Rec
19、ommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest informati
20、on and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2017 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1248 (09/2017) iii Table of Contents
21、 Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Characteristics and generation scenarios of SPIM . 2 7 Functional IM architecture for countering SPIM . 2 7.1 Overview 2 7.2
22、Components functionality 3 8 Working procedures 5 8.1 Working procedure of sending rate control 5 8.2 Working procedure of blacklists 6 8.3 Procedures of authorization management 7 8.4 Procedures of user registration management 7 8.5 Procedures for SPIM complaints 8 8.6 Procedure of SPIM filtering .
23、 8 Appendix I Roles and functions of IM system . 9 Bibliography. 10 iv Rec. ITU-T X.1248 (09/2017) Introduction With the rapid development of the Internet and mobile Internet, instant messaging (IM) has grown from being a simple chat tool to an integrated information platform that integrates communi
24、cation, information, entertainment, search, e-commerce, business collaboration and enterprise customer services as a whole. Because of its low price and ease of use, more and more people are switching to IM, thus having a huge impact on traditional communication fields. Currently, telecom operators
25、are increasingly providing IM services; but at the same time, IM has become critically subject to spreading spam on voice and short message service (SMS) services. Telecom operators around the world are aware of and/or impacted by spam over instant messaging (SPIM) to varying degrees. SPIM not only
26、wastes network resources, but also causes loss of time and productivity of users. In addition, SPIM is used for phishing, and spreading viruses, worms, spyware and other forms of malware, and can even carry harmful information offensive to users. Thus, SPIM reduces user satisfaction in using IM and
27、has become an important factor hindering the usage of IM. Although many anti-spam countermeasures have been implemented on IM systems, many weaknesses in IM systems still exist that may cause SPIM, such as: unlimited registration rate, lack of confirmation when receiving messages, insecure network t
28、ransmission mechanisms, lack of message sending rate controls for users, inevitable vulnerabilities in IM systems. This Recommendation specifies technical requirements for countering SPIM in view of functions of an IM system, in order to stop the production and propagation means of SPIM. For example
29、, it is important to require that a registration mechanism be designed to prevent mass automated registrations, and that the IM system provides users the function of choosing whether to receive or block all messages from authorized/unauthorized entities, and to limit a users sending rate if they hav
30、e exceeded a normal threshold. Rec. ITU-T X.1248 (09/2017) 1 Recommendation ITU-T X.1248 Technical requirements for countering instant messaging spam 1 Scope This Recommendation identifies types and characteristics of spam over instant messaging (SPIM). In order to mitigate the production and propag
31、ation of SPIM, this Recommendation specifies technical requirements for countering SPIM, involving both the instant messaging (IM) client and the IM server. This Recommendation mainly focuses on anti-SPIM measures of the IM system layer, and is applicable for IM service operators. 2 References None.
32、 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 instant messaging (IM) b-IETF RFC 3428: An exchange of content between a set of participants in near real time. Generally, the content is short text messages, although that need not be th
33、e case. 3.1.2 spam b-ITU-T X.1240: The meaning of the word “spam“ depends on each national perception of privacy and what constitutes spam from the national technological, economic, social and practical perspectives. In particular, its meaning evolves and broadens as technologies develop, providing
34、novel opportunities for misuse of electronic communications. Although there is no globally agreed definition for spam, this term is commonly used to describe unsolicited electronic bulk communications over e-mail or mobile messaging for the purpose of marketing commercial products or services. 3.1.3
35、 spam over instant messaging (SPIM) b-ITU-T X.1244: A spam targeting users of instant messaging service. 3.1.4 spimmer b-ITU-T X.1244: Sender of SPIM. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: ID Ide
36、ntity IM Instant Messaging IP Internet Protocol SMS Short Message Service SPIM Spam over Instant Messaging 2 Rec. ITU-T X.1248 (09/2017) 5 Conventions None. 6 Characteristics and generation scenarios of SPIM SPIM refers to an instant message that is received by a user, which is perceived as being un
37、wanted or as causing disruption to that user. Thus, SPIM has the following characteristics: SPIM usually occurs in real-time. In the case where both the sender and the receiver are online, SPIM is received at almost the same time as it is sent. Even if the receiver is not currently online, SPIM can
38、be immediately received after the receiver comes online; SPIM is often sent in bulk, thus a large number of messages, with the same content, are transmitted concurrently; Spimmer is the term used to define an unauthorized sender of SPIM to IM recipients. However, at times, a friends account may be c
39、ompromised and instructed to send SPIM due to an infection by malicious code or due to disclosure of account and password information. SPIM sent by friends is more deceptive, especially when it contains links to malicious websites or executable files which most recipients will click on and thus thei
40、r systems will more likely be infected with malicious code; SPIM cannot easily be traced since accounts can be arbitrarily created, and usually are not traceable to a real identity. The generation of SPIM is closely related with IM system functions (refer to Appendix I), and the scenarios that may g
41、enerate SPIM are as follows: Spimmers can use automatic registration software to register a large number of accounts, and use these accounts to spread SPIM; Malicious users may use false IM accounts, and can use these false accounts to send SPIM; If a malicious attacker has obtained control of a leg
42、itimate user account without authorization, they can modify the users information such as password, or other authentication information, to use of this account (often for a long time) to send SPIM; If an IM clients receiving parameter is modified without authorization, SPIM could be received without
43、 any limitation; Instant messages can be tampered during transmission. Advertisements or malicious code may be inserted into an IM and turn it into SPIM; Due to the lack of confirmation mechanisms, a spimmer can be free to add friends, and to send SPIM to those friends. For the prevention of SPIM, i
44、t is necessary to fully consider the characteristics of SPIM and the scenarios that may cause SPIM, in order to take comprehensive preventive measures. 7 Functional IM architecture for countering SPIM 7.1 Overview The functional IM architecture for countering SPIM is depicted in Figure 7-1. Rec. ITU
45、-T X.1248 (09/2017) 3 Figure 7-1 Functional IM architecture for countering SPIM This architecture integrates functionalities to counter SPIM, including blacklist filters, user registration controls, and SPIM complaint. More importantly, the architecture supports filtering based on limiting the IM se
46、nding rate, and controlling authorization of the IM sender. Appendix I describes, in greater detail, the IM client and IM server functionalities, and the roles of the IM sender, IM receiver and spimmer. 7.2 Components functionality 7.2.1 IM server The IM server component functionality includes the f
47、ollowing six elements: 1) User registration control It is required to use manual confirmation methods, such as verification codes, e-mail verifications, SMS verification codes, to prevent users from automatic registration. This would prevent spimmers who have a large number of automatically-register
48、ed accounts from sending SPIM. 2) Authorization control It is required to forward a users request to add a friend, and to authorize the friends relationship with the user based on the IM clients feedback. 3) Blacklist filtering 4 Rec. ITU-T X.1248 (09/2017) It is required that the IM server filters
49、instant messages based on an integrated blacklist and a set of user-specific blacklists. 4) SPIM complaints It is required that users complaints about accounts which send SPIM are accepted, and to determine whether to add these accounts to the integrated suspicious blacklist or the integrated blacklist. It is required to interface with external SPIM complaints-handling systems, and to import and export the integrated blacklist. 5) Sending rate control It is required that the number of ins
