Norsk Telefoningeniørmøte 1992 - Telenor

Sikkerhetskrav og realisering av disse i mobile nettverk
RUNE HAGEN
Denne artikkelen er en del av et samarbeid
der også Alcatel-enheter i andre
land har deltatt. Den er derfor på engelsk.
1 Introduction
Mobility of users and their equipment
will imply new security requirements in
addition to the ones existing for ordinary
network services. The users must be protected
against each other and against
illegal operations of the network. Experience
also shows that mobile equipment is
exposed to theft. The network operators
and service providers will like to ensure
that only legitimate customers get access
to their services, and that the right person
is billed for use of the services. This
causes an obvious need for authentication
of users and their terminals that want to
access the network. The users and the
network must exchange security related
information when a network connection
is established. This requires in turn that
there must exist a way to personalise user
equipment with e.g. a smart card, and to
distribute and maintain security parameters
in the network. Reliable operation
of mobile networks will require a certain
level of security management to control
and distribute security parameters. This
security management must support rules
for operation and storage of secret keys
and algorithms.
2 Security Considerations
This paper will only discuss mobile services
where users and terminals move
around and not look at services with
mobile users accessing terminals at fixed
locations (7).
The terminals in a mobile network may
be able to prove the identity of the user.
As seen from the network different levels
of binding between user and terminal can
be thought of:
- The user is to be authenticated; the terminal-id
entity unknown to the
network
- The terminal is authenticated; a user-id
is assumed implicitly from terminal id
- The terminal and the user are two independent
entities, both to be authenticated
by the network.
The European GSM network is an
example of a mobile network where the
user terminal must use radio transmission
to reach an entry point to the network,
the Base Transceiver Station. It is
assumed that the network will need to
authenticate the users and not really be
concerned with terminal identities.
Several references have given a systematic
listing of the threats to a communication
network (8, 6). Examples of generic
threats are:
- masquerading entities
- illegitimate access to information
- disclosure of data
- modification of information
- denial of service, etc.
The generic threats also apply to mobile
networks. The nature of mobile networks
will in fact make some of these threats
particularly relevant.
User needs for security can relate to
keeping privacy or to protecting against
illegitimate use of their resources. Illegitimate
use includes protection against
impersonation of a user and against
utilisation of stolen equipment. Security
services and mechanisms will be added
to the network to fulfil user needs and
counter security threats.
The brief list below shows possible use
of the security services in ISO’s reference
model (8). The security services are
generic by nature and can implement
user requirements for security as well as
securing management and operation of
the network.
Authentication: The user terminal must
prove its identity when it will access the
network. In addition there can also exist
methods implemented locally in the terminal
equipment that prevent use of the
terminal by unauthorised persons.
Authentication is an essential requirement
for protection against fraudulent
use and to ensure correct billing. The
authentication procedure can be either
one-way or two-way where the user terminal
also verifies the authenticity of the
network. Peer-entity authentication is in
many cases also a fundamental requirement
for management of a network.
The network element that is to be
managed, may need to verify that the
access request originates from a valid
operations system.
Access control: The user should at subscription
time get access to a set of
actions and services. The network must
ensure that the subscriber gets access to
what he is entitled to, while attempts of
unauthorised actions must be rejected.
The network can also provide incoming
access control; protecting users from
getting unwanted calls.
Data confidentiality: Relevant aspects of
confidentiality are:
a Confidentiality of a user’s subscription
data and service profile
b Confidentiality of a user’s actual
physical location
c Confidentiality of user information
sent over open radio links
d Confidentiality of security parameters
transferred over the management
network.
Data integrity: Data integrity services
can be applied to management data,
signalling information and to user data to
prevent, detect or take recovery from
unauthorised or unintended modification.
Non-repudiation: Non-repudiation services
can be useful for billing purposes
and for resolving disputes between subscribers,
service providers and network
operators.
Pervasive mechanisms: In addition to
these services the network will need to
operate pervasive mechanisms for event
handling and logging. Examples are:
a A way to handle security relevant
events in the network and possibly
take immediate actions against subscribers,
service providers or network
operators.
b Provision of a security audit trail for
storage of event records defined as
security relevant.
Network providers and subscribers are
likely to stress different service requirements.
A good security system should
cater for the needs of both groups. In
addition to these service related requirements,
the security solution of a mobile
network shall also fulfil the following
generic properties:
a It should as far as possible be based
upon international standards and drafts
for security. Use of standard mechanisms
and methods open for competition
between vendors. A practical
concern here, however, is that many of
the most well-known algorithms are
covered by patents or export
regulations.
35