report - Light Reading

SECURITY FROM 3GPP IMS TO TISPAN NGN
TISPAN NGN Security
The overall NGN security architecture
[7] is derived from the TISPAN
functional architecture by splitting it
into three views (see Figure 7):
• access view (“first hop” or “first
mile”) security;
• NGN Core view (intra-operator
domain) security;
• interconnecting view ( inter-operator
domain) security.
Figure 7: TISPAN NGN Security Architecture
Access View Security
The access view is a difficult part of
CPE
the NGN architecture to secure
because of the different access technologies
it interconnects. It consists of
the network attachment part and the
service layer part. Network attachment
includes network authentication
between the user equipment and
the NASS. Network authentication is
access technology-dependent, and
typical examples in the case of DSL
(Digital Subscriber Line) are implicit
authentication with the line identity,
or explicit with, e.g., IEEE 802.1x
(port-based network access control).
For IMS access security, the main objective is to align with
the 3GPP solution. This is straightforward when there is no NAT
in the CPE: TISPAN has adopted the 3GPP solution, i.e., IPsec
transport mode and SIP Digest AKA. This solution assumes the
use of an ISIM application on UICC in the terminal, in the residential
gateway, or in a split terminal (a secondary terminal
such as a UMTS mobile connected to the first via, e.g., an air
interface, and which performs the actual authentication). In
cases where there is a NAT in the CPE, two solutions are being
discussed by TISPAN with 3GPP SA3, one being IPsec-based,
Figure 8: Simplified example of inter-operator security
CPE
e1
Visited NGN
Access Network
A-RACF
SEG
SEG
Za-type
interfaces
Home NGN Network
SEG
SEG
Home Access
Network
"Zb"
e2
"Zb"
CLF SEG
SEG CLF
"Zb" "Zb"
a2 a4
a4 "Zb"
"Zb"
e5
"Zb"
NACF UAAF SEG
SEG UAAF
(PDBF)
"Zb" a1 a3 "Zb"
AMF
Zb-type
interface
"Zb"
Rq
e4
Zb-type
interface
"Zb"
NASS
UPSF
Applications
Transfer Functions
NGN Core View
Security
IMS
RACS
Other
Networks
and the other TLS-based. The decision is pending, but it should
be noted that, since 3GPP may be confronted with the NAT
issue in the future, the solution selected for TISPAN might end
up being used in 3GPP for achieving convergence.
Because of the existing installed base, and in order to facilitate
IMS rollout in the fixed networks, TISPAN is also specifying
an IMS access mechanism bundled with the network attachment
authentication. This solution requires a trust relationship
between the access and IMS providers. It bundles IMS access with
implicit or explicit network access authentication.
The intra-domain security is the sole responsibility of the
operator but is not obvious. Protection
at the borders of the domain is not sufficient,
as experience has shown that
Home Core
Network
Service Control
Subsystems and
Applications
Gq'
SPDF
PES
Interconnecting
View Security
many attacks are launched from inside
the network. The separation principle,
whereby information flow types (signaling,
management and media) and node
types are isolated and individually protected,
will significantly decrease the
extent of an attack. Databases need to
be concentrated in zones that are
highly protected with firewalls. Administrative
rules will further control
potential sources of internal attack.
When needed, the operator can choose
intra-domain security based on IPsec
ESP tunnel mode with IKE for control
and management layers.
An important distinction between
the 3GPP and TISPAN architectures is
that the latter supports more business
roles. These roles extend from the
access and regional network providers
to service providers. As a consequence,
many reference points
www.alcatel.com/atr 4 th Quarter 2005 - Alcatel Telecommunications Review - 307