Secure Application Deployment with GPRS/EDGE/UMTS paper begins with an overview of GPRS/EDGE/UMTS security that ... GTP General Packet Radio Service (GPRS) Tunneling Protocol HLR Home Location Register

Download Secure Application Deployment with GPRS/EDGE/UMTS  paper begins with an overview of GPRS/EDGE/UMTS security that ... GTP General Packet Radio Service (GPRS) Tunneling Protocol HLR Home Location Register

Post on 09-Mar-2018

212 views

Category:

Documents

0 download

Embed Size (px)

TRANSCRIPT

<ul><li><p>Cingular Wireless Developer Program 2005 Cingular Wireless LLC. All rights reserved. </p><p>Secure Application Deployment with GPRS/EDGE/UMTS devCentral White Paper </p><p>Document Number 12792 Revision 6.0 Revision Date 03/28/05 </p></li><li><p>devCentral White Paper ii 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Legal Disclaimer </p><p>This document and the information contained herein (collectively, the "Information") is provided to you (both the individual receiving this document and any legal entity on behalf of which such individual is acting) ("You" and "Your") by Cingular Wireless II, LLC, on behalf of itself and its affiliates ("Cingular") for informational purposes only. Cingular is providing the Information to You because Cingular believes the Information may be useful to You. The Information is provided to You solely on the basis that You will be responsible for making Your own assessments of the Information and are advised to verify all representations, statements and information before using or relying upon any of the Information. Although Cingular has exercised reasonable care in providing the Information to You, Cingular does not warrant the accuracy of the Information and is not responsible for any damages arising from Your use of or reliance upon the Information. You further understand and agree that Cingular in no way represents, and You in no way rely on a belief, that Cingular is providing the Information in accordance with any standard or service (routine, customary or otherwise) related to the consulting, services, hardware or software industries. CINGULAR DOES NOT WARRANT THAT THE INFORMATION IS ERROR-FREE. CINGULAR IS PROVIDING THE INFORMATION TO YOU "AS IS" AND "WITH ALL FAULTS." CINGULAR DOES NOT WARRANT, BY VIRTUE OF THIS DOCUMENT, OR BY ANY COURSE OF PERFORMANCE, COURSE OF DEALING, USAGE OF TRADE OR ANY COLLATERAL DOCUMENT HEREUNDER OR OTHERWISE, AND HEREBY EXPRESSLY DISCLAIMS, ANY REPRESENTATION OR WARRANTY OF ANY KIND WITH RESPECT TO THE INFORMATION, INCLUDING, WITHOUT LIMITATION, ANY REPRESENTATION OR WARRANTY OF DESIGN, PERFORMANCE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, OR ANY REPRESENTATION OR WARRANTY THAT THE INFORMATION IS APPLICABLE TO OR INTEROPERABLE WITH ANY SYSTEM, DATA, HARDWARE OR SOFTWARE OF ANY KIND. CINGULAR DISCLAIMS AND IN NO EVENT SHALL BE LIABLE FOR ANY LOSSES OR DAMAGES OF ANY KIND, WHETHER DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, SPECIAL OR EXEMPLARY, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF GOODWILL, COVER, TORTIOUS CONDUCT OR OTHER PECUNIARY LOSS, ARISING OUT OF OR IN ANY WAY RELATED TO THE PROVISION, NON-PROVISION, USE OR NON-USE OF THE INFORMATION, EVEN IF CINGULAR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES. </p></li><li><p>devCentral White Paper iii 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Revision History </p><p>All marks, trademarks, and product names used in this document are the property of their respective owners. </p><p>Date Revision Description 05/13/03 1.0 Document released. 09/05/03 2.0 New devCentral template applied to document 9/17/03 3.0 Adds references to EDGE. 9/23/03 4.0 Updated Section 1.3, Resources, to include links to referenced </p><p>documentation. 07/16/04 5.0 Updated for new IP/APN services, WAP 2.0 and UMTS. 03/28/05 6.0 Updated to Cingular-branded template. </p></li><li><p>devCentral White Paper iv 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Table of Contents </p><p>1. Introduction .............................................................................................................................................1 1.1 Audience.......................................................................................................................................1 1.2 Contact Information ......................................................................................................................1 1.3 Resources.....................................................................................................................................2 1.4 Terms and Acronyms....................................................................................................................3 </p><p>2. GPRS/EDGE/UMTS Security Overview.................................................................................................5 </p><p>3. User Authentication ................................................................................................................................9 </p><p>4. Network Access Authentication ............................................................................................................10 </p><p>5. Encryption.............................................................................................................................................11 5.1 Comparison with CDPD..............................................................................................................13 </p><p>6. GPRS/EDGE/UMTS Network Infrastructure ........................................................................................14 6.1 Cingular Wireless Network .........................................................................................................14 6.2 Roaming Scenario ......................................................................................................................14 </p><p>7. IP Address Management ......................................................................................................................17 </p><p>8. Security Options for Custom Access Point Names (APNs)..................................................................19 8.1 IP Addressing Options for Custom APNs...................................................................................20 8.2 Firewall Options for Custom APNs .............................................................................................21 </p><p>9. Commercial Connectivity Services .......................................................................................................23 </p><p>10. Customer-Supplied VPN ......................................................................................................................25 </p><p>11. WAP Security........................................................................................................................................27 </p><p>12. Other Security Topics ...........................................................................................................................36 12.1 Short Message Service (SMS) ...................................................................................................36 12.2 Digital Rights Management ........................................................................................................36 12.3 RIM Blackberry Security .............................................................................................................36 12.4 Application-Level Security ..........................................................................................................37 12.5 SSL-Based Security....................................................................................................................37 </p><p>Figures Figure 1: End-to-End Security with GPRS/EDGE .................................................................................... 8 Figure 2: GPRS/EDGE Protocol Diagram Showing Encryption ............................................................. 12 Figure 3: GPRS/EDGE Roaming............................................................................................................ 15 Figure 4: Fixed-End Connectivity Options .............................................................................................. 24 Figure 5: WAP1 Security Architecture .................................................................................................... 28 </p></li><li><p>devCentral White Paper v 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Table of Contents </p><p>Figure 6: WAP2 Security Architecture .................................................................................................... 31 Figure 7: WAP Protocols as Deployed (on networks formerly owned by AT&amp;T Wireless)..................... 32 </p><p>Tables Table 1: Terms and Acronyms ................................................................................................................ 3 Table 2: Security Implications of Different IP Addresses ...................................................................... 18 Table 3: Security-Related Options and Implications for Custom APNs ................................................ 19 Table 4: Supported WTLS Protocols (for the networks formerly owned by AT&amp;T Wireless) ................ 29 Table 5: Supported SSL Protocols (for the networks formerly owned by AT&amp;T Wireless) ................... 30 Table 6: Recommended SSL Certificate Authorities (for use with networks formerly owned by AT&amp;T </p><p>Wireless ................................................................................................................................... 33 </p></li><li><p>devCentral White Paper 1 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Secure Application Deployment with GPRS/EDGE/UMTS</p><p>1. Introduction </p><p>This paper explains how you can securely deploy applications that use the GPRS/EDGE and UMTS networks formerly owned by AT&amp;T Wireless. Unlike the vulnerabilities found with some other popular wireless technologies, GPRS/EDGE/UMTS networks employ robust security architecture with comprehensive security mechanisms. This paper describes these in the following security-related areas: </p><p> Security mechanisms available with GPRS/EDGE/UMTS technology </p><p> Security enhancements that Cingular Wireless offers in its network Security options available to customers Additional measures that customers can deploy themselves to </p><p>augment security This paper begins with an overview of GPRS/EDGE/UMTS security that provides sufficient information for any reader who simply wants a high-level understanding of GPRS/EDGE network security. The paper then explores in detail the various security aspects of the network and customer options, including user authentication, network access authentication, encryption of the radio interface, the GPRS network infrastructure, IP address management, custom Access Point Names (APNs), the Commercial Connectivity Services (CCS), and customer-supplied Virtual Private Networks (VPNs). </p><p>1.1 Audience </p><p>This paper has been developed for independent developers, enterprise developers, Cingular Wireless Alliances, content developers, and system integrators engaged in GPRS/EDGE/UMTS application development and deployment. This paper assumes you have an understanding of GPRS/EDGE/UMTS technology and some understanding of computer and network security concepts. </p><p>1.2 Contact Information </p><p>E-mail any comments or questions regarding this document to developer.program@cingular.com. Please reference the title of this document in your e-mail. </p><p>Document Author: Peter Rysavy </p><p>mailto:developer.program@cingular.com</p></li><li><p>devCentral White Paper 2 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Secure Application Deployment with GPRS/EDGE/UMTS</p><p>1.3 Resources </p><p>3GPP Technical Specification TS 33.102; 3G Security; Security Architecture (Release 1999) http://www.3gpp.org/ 3GPP Technical Specification TS 03.60, General Packet Radio Service (GPRS), Service Description http://www.3gpp.org/ 3GPP Technical Specification; Digital Cellular Telecommunications System (Phase 2+); General Packet Radio Service (GPRS); GPRS Ciphering Algorithm Requirements (GSM 01.61 version 8.0.0 Release 1999) http://www.3gpp.org/ftp/Specs/2003-06/R1999/01_series/0161-800.zip 3GPP Technical Specification; Digital Cellular Telecommunications System (Phase 2+); Security Related Network Functions (GSM 3.20 Release 1999) http://www.3gpp.org/ftp/Specs/2003-06/R1999/03_series/0320-810.zip 3GPP Technical Specification 33.102; 3G Security; Security Architecture (Release 1999) http://www.3gpp.org/ftp/Specs/2004-03/R1999/33_series/33102-3d0.zip 3GPP Technical Specification 35.202: Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 2: Kasumi Algorithm Specification http://www.3gpp.org/ftp/Specs/2004-03/R1999/35_series/35202-312.zip Research in Motion, BlackBerry Security Technical White Paper for Lotus Domino http://www.blackberry.net/support/pdfs/bb_enterprise_server_lotus_domino_technical_wp.pdf Research in Motion, BlackBerry Security Technical White Paper for Microsoft Exchange http://www.blackberry.net/support/pdfs/bb_security_technical_wp_exchange_21.pdf </p><p>http://www.3gpp.org/http://www.3gpp.org/http://www.3gpp.org/ftp/Specs/2003-06/R1999/01_series/0161-800.ziphttp://www.3gpp.org/ftp/Specs/2003-06/R1999/01_series/0161-800.ziphttp://www.3gpp.org/ftp/Specs/2003-06/R1999/03_series/0320-810.ziphttp://www.3gpp.org/ftp/Specs/2003-06/R1999/03_series/0320-810.ziphttp://www.3gpp.org/ftp/Specs/2004-03/R1999/33_series/33102-3d0.ziphttp://www.3gpp.org/ftp/Specs/2004-03/R1999/33_series/33102-3d0.ziphttp://www.3gpp.org/ftp/Specs/2004-03/R1999/35_series/35202-312.ziphttp://www.3gpp.org/ftp/Specs/2004-03/R1999/35_series/35202-312.ziphttp://www.blackberry.net/support/pdfs/bb_enterprise_server_lotus_domino_technical_wp.pdfhttp://www.blackberry.net/support/pdfs/bb_enterprise_server_lotus_domino_technical_wp.pdfhttp://www.blackberry.net/support/pdfs/bb_security_technical_wp_exchange_21.pdfhttp://www.blackberry.net/support/pdfs/bb_security_technical_wp_exchange_21.pdf</p></li><li><p>devCentral White Paper 3 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Secure Application Deployment with GPRS/EDGE/UMTS</p><p>1.4 Terms and Acronyms </p><p>Table 1 defines terms and acronyms used in this document. </p><p>Table 1: Terms and Acronyms </p><p>Term or Acronym Definition 3DES Triple DES APN Access Point Name BG Border Gateway BSC Base Station Controller BTS Base Transceiver Station CA Certification Authority CCS Commercial Connectivity Services CDPD Cellular Digital Packet Data DES Digital Encryption Standard DNS Domain Name System DRM Digital Rights Management EDGE Enhanced Data Rates for GSM Evolution FES Fixed End System GEA GPRS Encryption Algorithm GGSN GPRS Gateway Support Node GPRS General Packet Radio Service GRX GPRS Roaming Exchange GSM Global System for Mobile Communications GTP General Packet Radio Service (GPRS) Tunneling Protocol HLR Home Location Register HTML Hypertext Markup Language IETF Internet Engineering Task Force IMSI International Mobile System Identity IP Internet Protocol IPSec Internet Protocol Security LLC Logical Link Control MS Mobile Station (mobile computer plus communications device) MSC Mobile Switching Center MSISDN Mobile Subscriber Integrated Services Digital Network NAT Network Address Translation NDIS Network Driver Interface Specification </p></li><li><p>devCentral White Paper 4 03/28/05 12792 Rev. 6.0 2005 Cingular Wireless LLC </p><p>Secure Application Deployment with GPRS/EDGE/U...</p></li></ul>