ericssonhistory.com

Communications security in an all-IP worldLuis Barriga, Rolf Blom, Christian Gehrmann, and Mats NaslundThe increased use of the IP suite creates a strong need for comprehensivesecurity solutions. In an all-IP world, users will have connectivity viaresidential LANs, at work, at public kiosks or Internet cafes, at hotels, andwhile on the move, over the air via the mobile Internet.In this article, the authors exemplify the need for security in differentcommunications scenarios. They also give an overview of basic protectionmechanisms and protocols and describe how security has beenincorporated into various applications and products. Finally, they discussfuture trends in the field of security.IntroductionThe increased use of the Internet protocol(IP) suite creates a strong need for comprehensivesecurity solutions. Packet networks,such as the Internet and intranets, introducemany new security threats. Today, malicioususers can easily tap (eavesdrop) IP traffic,redirect traffic, insert false packets, modifypackets, mount denial of service attacks,and introduce harmful software into systems.One way of countering these attacksis to maintain strict control of access to thenetwork by restricting access to trustedusers. This kind of control can be achievedusing• firewalls to control packet flows at the networkborder; and• secure login procedures.Most corporations currently protect theirintranets in this way. However, it is usuallydifficult to maintain security in the networksimply by restricting access. In thefirst place, the main objective of the networkis to give easy and open access to the Internet.What is more, in a large network withmany users it is difficult to maintain strictcontrol of each user and each machine. Andsecurity-related problems proliferate asusers become mobile—users will soon enjoycontinuous, anywhere IP connectivity, employingmany different methods to accessthe Internet and intranets.To complement access control and obtainthe necessary level of security, the traffic itselfmust be protected. Cryptography providesthe basic techniques needed to buildsecure communications solutions. Protectionmechanisms authenticate users, encryptpackets, and protect them from beingmodified. Security mechanisms of this kindare already part of Ericsson's products. Forexample, the GSM system contains mechanismsfor authenticating users in the net-BOX A, ABBREVIATIONS3GPPA5/1AAAACCAESCADESDHCPEESSIESPGGSNGPRSGSMHLRHMACIETFIKEIPIPsecIPv4ISAKMPISPIVLANMACThird-generation Partnership ProjectStream-cipher in GSMAuthentication, authorizationand accountingAdvanced computercommunicationsAdvanced encryption standardCertificate authorityData encryption standardDynamic host configuration protocolEuropean Electronic SignatureStandardization InitiativeEncapsulation security payloadGateway GPRS support nodeGeneral packet radio serviceGlobal system for mobilecommunicationHome location registerKeyed-hashing for messageauthenticationInternet Engineering Task ForceInternet key exchangeInternet protocolIP securityIP version 4Internet security association and keymanagement protocolInternet service providerInitialization vectorLocal area networkMessage authentication codeNESSIENISTPKIPKIXPoPPOPRADIUSRC4RC5RSASASGSNSMGS/MIMESSHSSLTLSUDPURLVPNWAPWLANWPKIWTLSX.509New European schemes forsignatures, integrity, and encryptionNational Institute of Standards andTechnology (US)Public-key infrastructurePublic-key infrastructure (X.509)Point of presencePost office protocolRemote authentication dial-in userservicePopular stream cipherPopular block cipherRivest-Shamir-Adleman public-keysystemSecurity associationServing GPRS support nodeSecure mail gatewaySecure multipurpose Internet mailextensionSecure shellSecure socket layerTransport layer securityUser datagram protocolUniversal resource locatorVirtual private networkWireless application protocolWireless LANWireless PKIWireless TLSITU standard for public keycertificatesEricsson Review No. 2, 2000