1、 International Telecommunication Union ITU-T Y.2740TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (01/2011) SERIES Y: GLOBAL INFORMATION INFRASTRUCTURE, INTERNET PROTOCOL ASPECTS AND NEXT-GENERATION NETWORKS Next Generation Networks Security Security requirements for mobile remote financial transac
2、tions in next generation networks Recommendation ITU-T Y.2740 ITU-T Y-SERIES RECOMMENDATIONS GLOBAL INFORMATION INFRASTRUCTURE, INTERNET PROTOCOL ASPECTS AND NEXT-GENERATION NETWORKS GLOBAL INFORMATION INFRASTRUCTURE General Y.100Y.199 Services, applications and middleware Y.200Y.299 Network aspects
3、 Y.300Y.399 Interfaces and protocols Y.400Y.499 Numbering, addressing and naming Y.500Y.599 Operation, administration and maintenance Y.600Y.699 Security Y.700Y.799 Performances Y.800Y.899 INTERNET PROTOCOL ASPECTS General Y.1000Y.1099 Services and applications Y.1100Y.1199 Architecture, access, net
4、work capabilities and resource management Y.1200Y.1299 Transport Y.1300Y.1399 Interworking Y.1400Y.1499 Quality of service and network performance Y.1500Y.1599 Signalling Y.1600Y.1699 Operation, administration and maintenance Y.1700Y.1799 Charging Y.1800Y.1899 IPTV over NGN Y.1900Y.1999 NEXT GENERAT
5、ION NETWORKS Frameworks and functional architecture models Y.2000Y.2099 Quality of Service and performance Y.2100Y.2199 Service aspects: Service capabilities and service architecture Y.2200Y.2249 Service aspects: Interoperability of services and networks in NGN Y.2250Y.2299 Numbering, naming and add
6、ressing Y.2300Y.2399 Network management Y.2400Y.2499 Network control architectures and protocols Y.2500Y.2599 Smart ubiquitous networks Y.2600Y.2699 Security Y.2700Y.2799Generalized mobility Y.2800Y.2899 Carrier grade open environment Y.2900Y.2999 Future networks Y.3000Y.3099 For further details, pl
7、ease refer to the list of ITU-T Recommendations. Rec. ITU-T Y.2740 (01/2011) i Recommendation ITU-T Y.2740 Security requirements for mobile remote financial transactions in next generation networks Summary Within the last few years, a great variety of remote payment networks using mobile networks ha
8、ve been established. While implementing different approaches, quite often they lack of security. At the same time communication networks, including mobile networks, yield substantial changes undergoing transition to the next generation networks (NGN). Recommendation ITU-T Y.2740 elaborates approache
9、s to develop system security for mobile commerce and mobile banking in the next generation networks (NGN). It describes security requirements for the mobile commerce and the mobile banking systems, based on four specified security levels. It outlines probable risks in mobile commerce and mobile bank
10、ing systems, and specifies means for risk reduction. History Edition Recommendation Approval Study Group 1.0 ITU-T Y.2740 2011-01-28 13 Keywords Mobile banking, mobile commerce, mobile payments, remote payments, security. ii Rec. ITU-T Y.2740 (01/2011) FOREWORD The International Telecommunication Un
11、ion (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions
12、and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on t
13、hese topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the ex
14、pression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applic
15、ability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with th
16、e Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicabi
17、lity of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement
18、 this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2011 All rights reserved. No part of this publication may be reproduced, by any means
19、whatsoever, without the prior written permission of ITU. Rec. ITU-T Y.2740 (01/2011) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 2 5 Conventions 2 6 Security considerations for mob
20、ile banking and mobile commerce systems in the next generation network . 3 6.1 Basic risks in mobile remote financial transactions . 3 6.2 Security goals . 3 6.3 Security levels and means to support them 3 Bibliography. 8 Rec. ITU-T Y.2740 (01/2011) 1 Recommendation ITU-T Y.2740 Security requirement
21、s for mobile remote financial transactions in next generation networks 1 Scope This Recommendation describes security risks associated with remote mobile financial transactions supported by the next generation network (NGN) application services and the risk mitigation and counter measures based on f
22、our security levels. This Recommendation also specifies the minimum requirements for protecting the privacy of an individuals personal data regarding remote mobile financial transactions. 2 References The following ITU-T Recommendations and other references contain provisions which, through referenc
23、e in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most rec
24、ent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.800 Recommenda
25、tion ITU-T X.800 (1991), Security architecture for Open Systems Interconnection for CCITT applications. ITU-T X.805 Recommendation ITU-T X.805 (2003), Security architecture for systems providing end-to-end communications. ITU-T Y.2720 Recommendation ITU-T Y.2720 (2009), NGN identity management frame
26、work. ITU-T Y.2741 Recommendation ITU-T Y.2741 (2011), Architecture of secure mobile financial transactions in next generation networks. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 access control ITU-T X.800: The prevention of unaut
27、horized use of a resource, including the prevention of use of a resource in an unauthorized manner. 3.1.2 application ITU-T Y.2741: A special mobile banking or mobile commerce application uploaded to Clients (users) mobile device. 3.1.3 authentication ITU-T X.800: See data origin authentication, and
28、 peer entity authentication. NOTE In this Recommendation, the term “authentication“ is not used in connection with data integrity, the term “data integrity“ is used instead. 3.1.4 availability ITU-T X.800: The property of being accessible and useable upon demand by an authorized entity. 3.1.5 client
29、 ITU-T Y.2741: Private individual or corporate entity that has signed a contractual agreement on the use of telecommunication services and the system of mobile commerce. 2 Rec. ITU-T Y.2740 (01/2011) 3.1.6 confidentiality ITU-T X.800: The property that information is not made available or disclosed
30、to unauthorized individuals, entities, or processes. 3.1.7 data integrity ITU-T X.800: The property that data has not been altered or destroyed in an unauthorized manner. 3.1.8 data origin authentication ITU-T X.800: The corroboration that the source of data received is as claimed. 3.1.9 mobile paym
31、ent system ITU-T Y.2741: Mobile banking and/or mobile commerce System. 3.1.10 next generation network (NGN) b-ITU-T Y.2001: A packet-based network able to provide telecommunication services and able to make use of multiple broadband, QoS-enabled transport technologies and in which service-related fu
32、nctions are independent from underlying transport-related technologies. It enables unfettered access for users to networks and to competing service providers and for services of their choice. It supports generalized mobility which will allow consistent and ubiquitous provision of services to users.
33、3.1.11 privacy ITU-T X.800: The right of individuals to control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. NOTE Because this term relates to the right of individuals, it cannot be very precise and its use shoul
34、d be avoided except as a motivation for requiring security. 3.1.12 repudiation ITU-T X.800: Denial by one of the entities involved in a communication of having participated in all or part of the communication. 3.1.13 security dimension ITU-T X.805: A set of security measures designed to address a pa
35、rticular aspect of the network security. 3.1.14 security layer ITU-T X.805: A hierarchy of network equipment and facility groupings. 3.1.15 security planes ITU-T X.805: A certain type of network activity protected by security dimensions. 3.2 Terms defined in this Recommendation This Recommendation u
36、ses the following term: 3.2.1 security level: Security specification of the system which defines effectiveness of risk protection. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: GSM Global System for Mobile Communications MPS Mobile Payment System MSI
37、SDN Mobile Station International ISDN Number NGN Next Generation Network PA-DSS Payment Application Data Security Standard PCI DSS Payment Card Industry Data Security Standard 5 Conventions None. Rec. ITU-T Y.2740 (01/2011) 3 6 Security considerations for mobile banking and mobile commerce systems i
38、n the next generation network Mobile payment system (MPS) security in the next generation network (NGN) is based on the MPS architecture and the MPS participants roles specified in ITU-T Y.2741, Architecture of secure mobile financial transactions in next generation networks as well as on the MPS pa
39、rticipants risk analysis, described below. 6.1 Basic risks in mobile remote financial transactions This clause does not consider factors that condition new global and industrial risks run by the participants when implementing the MPS system, strategic, country and sovereign, market, interest, liquid
40、ity, legal, reputation risks, etc. The clause touches upon the information risks that may arise directly at time of remote mobile payments and require deciding security issues to minimize the risks: The risk of confidentiality loss which implies unauthorized access to confidential information; The r
41、isk of data integrity violation which is the distortion of information when transferring or processing data; The risk of electronic documents forgery (the risk to authenticity) which is when electronic documents are generated by unauthorized participants; The risk of repudiation which involves the d
42、enial of authorship of an electronic document; The risk of information destruction, either intended or due to negligence; Transactional risk which involves failure to finish or complete a transaction (e.g., owing to bad transmission quality). 6.2 Security goals To improve the mobile payment security
43、 and minimize the risks of the participants, the solution must ensure the realization of the following goals: to reduce the possibility of interception of personal or financial information at time of a transaction; to reduce the possibility of retrieving personal or financial information from databa
44、ses; to reduce the possibility of substitution or distortion of personal or financial information at time of a transaction; to reduce the possibility to use the solution by unauthorized persons and persons attempting a masquerade by implementation of a unique authentication; to reduce the possibilit
45、y of using “stolen“ information in the solution; to provide the grounds to make it impossible for a transaction initiator or participant to deny his actions after they have been performed; to ensure the compliance with legal rights and duties of all interoperation participants; to ensure the complet
46、ion of transaction. 6.3 Security levels and means to support them This Recommendation describes four MPS security levels based on MPS participants risk analysis. The System security level is defined by the set of security dimensions implementations (see Table 1). Thus, the fourth (the highest) secur
47、ity level must have the strongest implementations of security dimensions. Nevertheless, requirements for some security dimensions are unified for all security levels. 4 Rec. ITU-T Y.2740 (01/2011) Parties using MPS should be aware of the System security level and the Systems risks. The acceptable se
48、curity level for a certain risk of any System component is determined by the party taking this risk. The parties can additionally mitigate the risks of using MPS by operational measures which may include limiting the frequency or monetary value of individual transactions, the availability of the ser
49、vice to users with high loyalty level, etc. The client is identified to the System by using an NGN network public identifier (e.g., MSISDN for GSM networks). 6.3.1 Implementation of security dimensions for all security levels The System security is entrusted upon every System participant and is achieved by the physical and the administrative facilities of security assurance at data transfer, processing and storage. The System participants shall ensure the implementation of in
