Signalling Security RESIST Roaming Evolution to Secure IPX

Signalling Security RESIST Roaming Evolution to Secure IPX Signalling Together 30/05/2018

Executive summary • • • Diameter signalling is vulnerable A long term approach is proposed by GSMA (DESS) and 3 GPP to secure E 2 E Diameter (4 G) and HTTP (5 G) by using signed/encrypted parameters An IPX Signaling proposal (short term) in order to improve IPX Signaling security hop-byhop (IPX Signaling + trusted environment) could be to implement a basic Cat 0 Diameter security by checking on all DRA that the origin Realm/Host corresponds to the real sender • QUESTION: Interest from IPX Signaling providers to implement such filter on the DRA? secure Diameter E 2 E MNO 1 Interne Orange DRA 1 DRA 2 secure Diameter hop-by-hop MNO 2 IPX Signaling trusted domain

GSMA (DESS) proposes a long term approach to improve signalling security § Goal: Provide solution (directions) to secure the inter-operator interface for LTE (Diameter) and 5 G (HTTP) § Coverage: A mature security solution is targeted that includes authenticity, integrity, confidentiality and anti-replay Ø Diameter security: add signed AVP for Authenticity/Integrity Ø HTTP security: under definition at 3 GPP (security by design) § Need to manage crypto keys 3 Interne Orange

Comparison with airplane Traveler Luggage Airport 1 Airport 2 Traveler Trusted domain (by checking at the entry) MNO 1 4 Interne Orange Diameter IPX 1 IPX 2 MNO 2

DRAs will improve the security by implementing Cat 0 filters on all incoming messages on the 1 rst DRA IPX Signaling trusted domain MNO 1 Diameter DRA 1 DRA 2 MNO 2 Cat 0 filters for MNO 1: - Check if orig realm/host corresponds to the real sender (MNO 1) by correlating with IP or CNXid - Check if Application-id (S 6 a) is authorized with this sender (MNO 1) 5 Interne Orange

MNO 2 will be protected against realm spoofing if all DRA 1 x are implementing Cat 0 filters IPX Signaling trusted domain MNO 1 a MNO 1 b DRA 1 a DRA 1 b DRA 2 d MNO 2 DRA 2 e MNO 1 c 6 Interne Orange DRA 1 c

MNO DRAs could improve security by implementing Cat 0 filters on all incoming messages on the 1 rst DRA IPX Signaling trusted domain MVN O 1 MNO 1 DRA 2 MNO Cat 0 filters for MVNO: - Check if orig realm/host corresponds to the real sender (MVNO 1) by correlating with IP or CNXid - Check if Application-id (ex: S 6 a) is authorized with this sender (MVNO 1) 7 Interne Orange MNO 2 MNO Cat 0 filters for IPX: Signaling - Check if orig realm/host does not correspond to MNO 2 - Check if orig realm/host does not correspond to a roaming partner - Check if Application-id (ex: S 6 a) is authorized with IPX Signaling

SGSN Charging WSMS SBC Hermes Camel UMTS CRBT Hubbing MME GRX carrier 3 GPP GPRS TCAP SMS SS 7 GLR Vo. IP RFI CDR NOSC NRTRDE Voice IMEI LBO OMA M 2 M MSC MSISDN AMEA TAP CAP retail wholesale MSISDN So. R ABS Architecture Dual IMSI GSM WLAN SIM API DRF IREG SIP MMS EPC DCH Saturne CAPEX GMSC GSMA CFU DATA SIF Interconnection E 2 E Flash OTA TADIG project VPN Performance RFP SHR GGSN CEC IMSI Sigtran IOT MVNE MNP 2. 5 G FCH EME ISUP EU REG Fraud HLR RAEXCRIPP Skill center training Applet Prepaid MVNO PLMN SCP SMS control PCRF VHE CLI HUR WIFI MS planning hub CF IPv 4 OPEX Diameter STP ETSI BEREC Alliage Postpaid PSTN ARP Apps Roaming IPX RCS Services NITZ USIM Billing ORLCF OLN QOS IP OCS MOC DNS LTE SMSC LBO HD OCSI MTC IPv 6 OR Mercury 3 G INAP Rin DSP 2 G IT I 3 Thank You! IMS 4 G RBE PP Operation MAP simbox GSE VLR Vo. LTE Rout CTI ISD ODB