Norsk Telefoningeniørmøte 1992 - Telenor

4.2 Security Management
Functions
Security mechanisms management
functions as discussed in chapter 3 shall
include mainly:
Key Management for generation, distribution
and updating of RSA keys; initiation
of periodical updates of DES key
for IMSI-Ki database encryption, including
its re-encryption.
Authentication Management for operator
access to highly security-sensitive nodes
should be based on smart cards, with
one-way authentication. Authentication
parameters provided by the SMC.
Authorisation and Access Control
Management of operators provided
locally with security event records on
any change; remote barring of operators.
Security Reporting and Auditing security
alarms on events where security
functions are affected like manual access
to security box; security records on
normal and abnormal security events of
minor importance, collected in the nodes
and transferred in a file to SMC on its
request.
4.3 Secure Communication
Functionality
GSM relies on the OSI framework for
network management which is a prerequisite
for a flexible and open
architecture, allowing the interworking of
network entities from different manufacturers.
It provides also the freedom for
supplementary additions (12.00).
Additions in the application layer will be
necessary until ongoing OSI standards
for secure network management have
been developed.
Security management as part of systems
management shall provide services and
protocols for security-related management
information transfer. This should be
supported by enhancements to the ISO
protocol stack. It is proposed to introduce
specific Security Management Application
Service Elements which shall provide
services using the above mentioned
security mechanisms. The security-ASE
is still only a working document in ISO
and it will probably not reach IS-status
before 1994-95. For the time being it
may be necessary to add security services
in a sub-layer to the applications. It shall
itself use the Common Management
Information Service Element (CMISE)
(12), ACSE (11) and ROSE (16).
The following security services are
recognised and will be used by the secure
TMN functions:
Secure Management Information Services,
providing:
- Authenticated Association Establishment
and Authenticated Release,
authentication parameters sent as user
information
- Secure Operation Service to interact by
initiating actions with reply
- Secure Notification Service for transfer
of events with reply.
The latter two services shall provide data
integrity (signature over hashed data) and
make use of the confirmed M-ACTION
and M-EVENT services of CMISE in the
confirmed mode.
Secure File Transfer Service, providing:
- File transfer with FTAM (10) enhanced
with security mechanisms for
data integrity and non-repudiation.
This will require the use of ACSE and
of M-ACTION for association establishments
and for transfer of filename
and control information.
Secure communication functions make
use of operations which deal with secret
keys, e.g. for provision of signatures or
data encryption. Such functions will be
Functional
"C" lib
SCSI
device
driver
Figure 3 Security Box Block Diagram
supported by the security box described
below.
4.4 Implementation of the
Security Box in AUC
The Security Box (SB) is a dedicated
hardware for process intensive cryptographic
computations. It is a server,
located within the system hardware of
e.g. AUC, and supports the clients i.e.
security applications. This is done
through a functional cryptographic
library, which translates the function
calls of the client system to parameter
blocks that are transferred to the SB.
Communication interface to the SB is the
SCSI bus, which allows the use of more
than one SB for redundancy and/or for
load sharing.
The SB can handle cryptographic sessions
in parallel and supports cryptographic
functions on dedicated hardware.
It includes a smart card reader for loading
of RSA keys for node initialisation
and for key update, if not done by communication.
The secret RSA key is stored
in non-volatile memory of the SB, other
keys are backed up on disk of the host in
a signed form, where the secret DES key
for Ki encryption on database is
encrypted. These measures allow recovery
after power down without externally
loading keys. Fig. 3 shows the block diagram
of the SB and its interface to a host.
The SB is physically protected in a separate
metal cabinet. Any attempt to open it
Host Computer Security Box
SCSI
bus
SCSI
driver
Crypto
HW
Board
SW
Smartcard
reader
39