ETSI Security Activities
Overview
Charles Brookson
ETSI OCG Sec Chairman, UK DTI
cbrookson@iee.org
Dionisio Zumerle
ETSI Secretariat
dionisio.zumerle@etsi.org
ETSI Security Workshop
January 2007
1
Agenda
‰Overview and OCG Security
‰
‰
‰
‰
‰
‰
‰
Mobile and Wireless Security
Algorithms
Smart Cards
Next Generation Networks Security
Lawful Interception
Electronic Signatures
Future Challenges
ETSI Security Workshop
January 2007
2
ETSI Committees per Security Areas
Emergency
Telecommunications
Mobile/Wireless
Algorithms
SES
Security
Algorithms Group
of Experts
(SAGE)
MESA*
2G/3G Mobile
3GPP*
EMTEL
DECT
Co Mo
m bile
m
er
ce
**
TETRA
In
L
te aw
rc fu
e l
(L pti
I) o n
Electronic
Signatures
(ESI)
SmartCard
Platform
(SCP)
Smart Cards
Information Technology
Infrastructure
AT
Next Generation
Networks
(TISPAN)
Fixed and
Convergent Networks
* ETSI is a founding partner for this partnership project
** Closed Committee
ETSI Security Workshop
January 2007
3
OCG Security
‰ Operational Co-ordination ad hoc Group on Security
‰ Horizontal co-ordination structure for security issues
¾ Ensuring security is properly considered in each ETSI
Technical Body (TB)
¾ Detecting any conflicting or duplicate work
‰ Participation:
¾ TBs are free to nominate Members to participate in the
work of the group
‰ Working methods:
¾ Via email
¾ When necessary co-sited “joint security” technical
working meetings
¾ Issues sent to SECsupport@etsi.org
¾ Mailing list: OCG_SECURITY@LIST.ETSI.ORG
ETSI Security Workshop
January 2007
4
Agenda
‰ Overview and OCG Security
‰Mobile and Wireless Security
‰
‰
‰
‰
‰
‰
Algorithms
Smart Cards
Next Generation Networks Security
Lawful Interception
Electronic Signatures
Future Challenges
ETSI Security Workshop
January 2007
5
GSM and 3G
‰ IMEI (International Mobile Equipment Identity)
¾ Protection against theft
¾ Physical marking of the terminal
¾ Blacklisted by operator if stolen
‰ FIGS (Fraud Information Gathering System)
¾ Monitors activities of roaming subscribers
¾ Home network informed
¾ Fraudulent calls identified terminated
‰ Priority
¾ Public safety service
¾ Allows for high priority access
‰ Location
ETSI Security Workshop
January 2007
6
TETRA
‰ TErrestrial Trunked Radio
‰ Mobile radio communications
¾ Used for public safety services
‰ Security features include:
¾ Mutual Authentication
¾ Encryption
¾ Anonymity
ETSI Security Workshop
January 2007
7
Agenda
‰ Overview and OCG Security
‰ Mobile and Wireless Security
‰Algorithms
‰
‰
‰
‰
‰
Smart Cards
Next Generation Networks Security
Lawful Interception
Electronic Signatures
Future Challenges
ETSI Security Workshop
January 2007
8
Algorithms
‰ ETSI is a world leader in creating cryptographic
algorithms and protocols to prevent fraud and
unauthorised access to ICT and broadcast networks,
and to protect customers’ privacy
‰ ETSI SAGE (Security Algorithm Group of Experts)
¾ Centre of competence for algorithms in ETSI
‰ Algorithms for:
¾
¾
¾
¾
¾
DECT
GSM, GPRS, EDGE
TETRA
UMTS
…
ETSI Security Workshop
January 2007
9
GSM and UMTS Algorithms
‰ GSM and EDGE
¾ A3, A5 and A8 – used in most GSM networks all over the
world
‰ GPRS
¾ GEA3 – encryption algorithms used
‰ UMTS radio interface (UTRA)
¾ UEA1 and UIA1
Providing Encryption and Integrity
¾ UEA2 and UIA2 just released
¾ For more info: ETSI TR 133 908
ETSI Security Workshop
January 2007
10
Agenda
‰ Overview and OCG Security
‰ Mobile and Wireless Security
‰ Algorithms
‰Smart Cards
‰
‰
‰
‰
Next Generation Networks Security
Lawful Interception
Electronic Signatures
Future Challenges
ETSI Security Workshop
January 2007
11
Smart cards
‰ Smart cards
¾ Micro-processor equipped Tokens
¾ Able to store and process information
• Private key
• Biometric template
• …
¾ Provide Strong Authentication
¾ Used in:
•
•
•
•
•
Banking
Healthcare
Telecoms
IT
…
ETSI Security Workshop
January 2007
12
Smart Card Standardization
‰ ETSI Smart Card Standardization
¾ ETSI Technical Committee Smart Card Platform
(TC SCP)
¾ GSM SIM Cards: among most widely deployed smart cards ever
¾ Work extended with UMTS USIM Card and UICC Platform
‰ Current challenges
¾ Expand the smart card platform
¾ Implement Extensible Authentication Protocol (EAP) in Smart
Cards
¾ Allow users access to global roaming
¾ UICC platform in secure financial transactions over mobile
communications systems
ETSI Security Workshop
January 2007
13
Agenda
‰
‰
‰
‰
Overview and OCG Security
Mobile and Wireless Security
Algorithms
Smart Cards
‰Next Generation Networks Security
‰ Lawful Interception
‰ Electronic Signatures
‰ Future Challenges
ETSI Security Workshop
January 2007
14
ETSI TISPAN WG7
‰ NGN concept: fixed-mobile network convergence to
packet-switched technology delivering multimedia
services
‰ ETSI extending the 3GPP IMS concepts
in TISPAN Committee designing NGN
¾ (TISPAN = Telecommunication and Internet converged Services
and Protocols for Advanced Networking)
‰ Working Group 7 NGN competence centre for
security with a group of security experts
‰ WG7 standardizes NGN security
www.tispan.org
ETSI Security Workshop
January 2007
15
NGN R1 Security Standards
NGN Architecture (NASS, RACS, …)
IMS Security Architecture
NGN Release 1
Security Requirements
TR 187 001
NGN Release 1
Threat, Vulnerabilities, Risk Analysis
TR 187 002
NGN Release 1 Security Architecture TS 187 003
Security Domains
Security Services
Security Functions
Countermeasures
Security Components and Building Blocks
NGN Release 2 Security Architecture
ETSI Security Workshop
January 2007
16
Agenda
‰
‰
‰
‰
‰
Overview and OCG Security
Mobile and Wireless Security
Algorithms
Smart Cards
Next Generation Networks Security
‰Lawful Interception
‰ Electronic Signatures
‰ Future Challenges
ETSI Security Workshop
January 2007
17
What is Lawful Interception?
‰ Delivery of intercepted communications
to Law Enforcement Authorities
¾ To support criminal investigation
¾ To counter terrorism
‰ Applies to data in transit
¾ not a search of records
‰ Applied to any data in transit
¾
¾
¾
¾
¾
Signalling
Speech
Video
Email
Web
ETSI Security Workshop
January 2007
18
Simple architecture
Interception
interface
Correspondent
target
Handover interface
Monitor
ETSI Security Workshop
January 2007
19
Agenda
‰
‰
‰
‰
‰
‰
Overview and OCG Security
Mobile and Wireless Security
Algorithms
Smart Cards
Next Generation Networks Security
Lawful Interception
‰Electronic Signatures
‰ Future Challenges
ETSI Security Workshop
January 2007
20
Electronic Signatures
‰ ETSI and CEN co-operation on the European
Electronic Signature
‰ Goal: provide Europe with a
reliable electronic signatures framework
¾ Enabling electronic commerce
¾ Supporting eSignature EC Directive
‰ Current challenges
¾ eInvoicing
¾ Registered EMail (REM)
‰ International collaboration
¾ Certificate Policy mapped and aligned with US policy
¾ XML Signature Standard adopted in Japan
ETSI Security Workshop
January 2007
21
Agenda
‰
‰
‰
‰
‰
‰
‰
Overview and OCG Security
Mobile and Wireless Security
Algorithms
Smart Cards
Next Generation Networks Security
Lawful Interception
Electronic Signatures
‰Future Challenges
ETSI Security Workshop
January 2007
22
Future Challenges
‰ A number of issues are open
¾ Product Proofing
¾ DRM
¾ NGN
¾ Retained Data
¾ …
‰ Security Standards for the
Future Technologies are the Next Challenge
‰ ETSI can meet that challenge
ETSI Security Workshop
January 2007
23
Thank you for your attention
cbrookson@iee.org
dionisio.zumerle@etsi.org
OCG_SECURITY@LIST.ETSI.ORG
ETSI Security Workshop
January 2007
24