afaefafe

Size: px

Start display at page:

Download "afaefafe"

略毛
5 years ago
Views:

1 Security Study ITU-T SG17 (ITU-T SG17 安全研究进展报告 ) Dr. Jianyong Chen( 陈剑勇博士 ) Technical Advisor, ZTE Corporation( 中兴通讯技术顾问 ) Vice-Chairman, ITU-T Study Group 17(ITU-T 第 17 研究组副主席 ) Chairman, CCSA, Wire Line Network Security Working Group ( 中国通讯标准化协会, 有线网络安全工作组, 组长 ) cjyok2000@hotmail.com

ITU-T Security Manual (ITU-T 安全手册 ) October 2004 (2004 年,12 月版 ) Describe all the security study activities in ITU-T Until 2004 ( 描述到 2004 年为止,ITU-T 所有的安全研究活动 ) Highlights( 重点 ): PKI and privilege

2 ITU-T Security Manual (ITU-T 安全手册 ) October 2004 (2004 年,12 月版 ) Describe all the security study activities in ITU-T Until 2004 ( 描述到 2004 年为止,ITU-T 所有的安全研究活动 ) Highlights( 重点 ): PKI and privilege management with X.509 ( 公钥基础设施 x.509 的系列技术标准 ) Applications (VoIP, IPCablecom, Network Management, e-prescriptions) ( 各种应用所需的安全解决方案, 如 VoIP IPCablecom 医院网络诊断用的电子处方等 ) Security terminology and security-related Questions ( 安全术语, 以及各研究方向的安全工作组 ) Catalog of ITU-T security-related Recommendations ( 列出 ITU-T 安全相关的标准文档 )

ITU-T Study Group 17 (ITU-T 第 17 研究组 ) www.itu.

Coordination/prioritization of security efforts ( 负责协调 ITU-T 个研究组安全相关的研究活动 ) Development of core

4 月 19-28 日, 韩国济州岛召开 ) Lead ITU-T Workshop on Security( 负责领导 ITU-T 安全论坛 ) www.itu.

3 ITU-T Study Group 17 (ITU-T 第 17 研究组 ) Lead Study Group for Telecommunication Security ( 电信网安全领导研究组 ) Coordination/prioritization of security efforts ( 负责协调 ITU-T 个研究组安全相关的研究活动 ) Development of core security Recommendations ( 发展核心的安全标准 ) Forthcoming meeting: 19-28, April 2006, Korea Jeju ( 最近一次会议将在 4 月日, 韩国济州岛召开 ) Lead ITU-T Workshop on Security( 负责领导 ITU-T 安全论坛 ) Initiated the ITU-T Security Project ( 规划 ITU-T 安全研究项目 ) Provide vision and direction for future work( 提供安全技术发展趋势分析 ) Reflect situation of current work( 反映当前的研究工作 )

4 Communicat ion system security project ( 通信系统安全项目 ) Q.5 Security architectur e and framework ( 安全架构 ) Q.

4 ITU-T SG17 Structure (ITU-T 第 17 研究组架构 ) ITU-T SG17 WP1 Frame relay and data communication ( 帧中继和数据通讯 ) WP2 Telecommunication security ( 通信安全 ) WP3 Language and telecommunication software ( 语言和通信软件 ) Q. 4 Communicat ion system security project ( 通信系统安全项目 ) Q.5 Security architectur e and framework ( 安全架构 ) Q. 6 Cyber security ( 计算网络安全 ) Q. 7 Security management ( 安全管理 ) Q.8 Telebiome trics ( 生物测定安全 ) Q.9 Security communic ation service ( 安全通信服务 ) Q. 17 Combating SPAM ( 反垃圾信息 )

5 Study Group 17 Security Questions ( 研究周期, 第 17 研究组安全问题分布 ) Q.7 Security Management ( 安全管理 ) ISMS-T ( 信息系统安全管理 ) *Incident Management ( 事件管理 ) *Risk Assessment Methodology ( 风险评估 ) *X.1051 Systems Users ( 系统用户 ) Systems ( 系统 ) Q.8 Telebiometrics ( 生物测定安全 ) *Utilize User s biological features as authentication tool ( 利用用户的生物特征做为认证工具 ) *X.1081 Secure Communication Q.9 Services( 通信安全服务 ) *Mobile network, home network and security web service security *( 移动网络, 家庭网络和网页安全 ) *X.1121, X.1122 Cyber Security( 计算网络安全 ) Q.6 *Incident Handling Operations( 安全事件处理 ) *Security Strategy( 安全策略 ) Counering SPAM( 反垃圾信息 ) *Countering , VoIP SPAM Q.17 Q.4 Q.4 Security project ( 安全项目 ) *Vision, Project Roadmap, Compendia, ( 安全项目规划 ) Q.5 Security Architecture & Framework ( 安全架构 ) **X.800 series *X.805

6 Highlights on Contents of Security Recommendations planned for consent later in the study period ( ) ( 年研究周期内即将完成的安全标准研究项目, 当前研究进展 )

7 生物特征传感器 Biometric Sensors Q.8 Study areas ( 研究领域 ) Storage NW 存储过程 Acquisition (Capturing) NW Extraction NW Matching Score 匹配过程计算分数生物特征获取过程提取过程 NW Decision NW Application NW: Network NW: 网络判断过程 Yes/No 应用过程

8 Q.8 Extend the application of Biometric systems to the open network ( 将生物测定系统的应用范围扩展到公众网络 ) Since Biometric dada is quite sensitive, it is important to protect it during transmission through open network ( 由于生物特征数据非常敏感, 当数据在公网中传输时, 需要有安全的解决方案 )

9 Q.9 Study areas ( 研究领域 ) 网页服务安全应用服务器移动安全家庭网络移动终端移动网络公众网络家庭网络安全基于应用层的安全协议

Q. 9 Security of home network based on certificates ( 基于证书的家庭网络安全 ) Establish the certification management scheme for home network application. ( 为家庭网络应用建立证书管理体系 ) (Simplifier X.

10 Q. 9 Security of home network based on certificates ( 基于证书的家庭网络安全 ) Establish the certification management scheme for home network application. ( 为家庭网络应用建立证书管理体系 ) (Simplifier X.509 Certificates and use them in devices of home networks. The project study profiles of the simpler certificates. Necessary profiles includes ( 通过适当简化 x.509 证书属性内容, 应用在家庭网络中研究证书简化版本, 例如需要包括以下方面 ): OIDs for device certificate profile for home network ( 设备身份 ) Algorithm identifier for device certificate( 算法标识 ) Basic field ( 基本字段域 ) Version ( 版本 ) Public key type ( 公钥类型 ) Various extensions for device certificate( 扩展字段域 ) subjectkeyidentifier authoritykeyidentifier Key Usage Basic constraint Validity period ( 有效期 ) Certificate security ( 证书安全 ) etc ( 等等 )

11 Q.9 Value-added security Service in mobile communication(x.msec-3) ( 移动通信增值安全服务 ) The classification of assets( 资产的分类 ) Class Description Example Information asset Service asset System asset Valuable data that can be stored, processed, or transferred by computational systems. Application program that offers the manipulation of data to users. Physical hardware components for supporting services and data processing. Additional investment for security ( 安全需要额外的投资 ) Sensitive data, E- transaction data, Business plan Web service service File server Telnet server Different degree of security requirements for various users and applications ( 不同的用户和应用所要求的安全不同 ) Simple and effective security management for users ( 用户需要简单有效的安全管理 )

12 Q.9 Value-added security Service in mobile communication(x.msec-3) ( 移动通信增值安全服务 ) 服务器 / 网关高级安全策略移动终端用户扩展等级非常高等级中等级低等级非常低等级基线安全策略没有安全策略增值安全服务普遍安全服务网络实体安全策略服务提供商

13 Q.9 Value-added security Service in mobile communication(x.msec-3) ( 移动通信增值安全服务 ) 安全策略服务器 Policy Server AAA Server 计费中心 Caller Security Gateway Security Gateway Callee 呼叫方安全网关安全网关被叫方

14 Q.9 Authentication architecture for mobile communication (x.msec-4) ( 移动通信通用认证架构 ) 实体认证中心 Entity Authentication Center (EAC) Entity Subscription Database (ESD) 实体注册数据库 (1) (2) (3) (4) (5) Entity1 实体 1 (6) Entity2 实体 2 Architecture Entity3 实体 3

15 Q. 9 Correlative reacting system in mobile communication(x.crs) ( 移动通信关联响应系统 ) Mobile Terminal 移动终端 Mobile Network 移动网络 DSD SAS-S Open Network 公众网络 SCA SCS TOS-VS ASP CSI CSI 应用服务提供商 TOS SAS-A NAC SAC Air interface CSI: CRS Service Interface NAC: Network Access Controller ASC: Application Service Controller DSD: Dedicated Security Device 空中接口 SAS-A: Security Application Software Agent SAS-S: Security Application Software Server 关联响应系统服务接口网络接入控制器 TOS-VS: Terminal Operating System Vulnerability Server Network boundary 应用服务控制器安全设备安全应用软件代理安全应用软件服务器终端操作系统漏洞检测服务网络边界

16 Q.17 Guideline document on countering SPAM (X.gcs) ( 反垃圾信息指引 ) Legislation ( 法律 ) Training ( 培训 ) Countering Spam Solution Technology ( 技术 ) 反垃圾信息解决方案 Complaint ( 投诉 ) International Cooperation ( 国际合作 ) Industrial selfdiscipline ( 工业自律 )

17 Q.17 Countering VoIP spam ( 反垃圾 VoIP) Causing Factors of VoIP Spam ( 垃圾 VoIP 形成原因 ) Cheap ( 便宜 ) Anonymous ( 匿名 ) Easily automated ( 大量群发 ) Carol has sent IM to David has sent to Emily Frank is this a spammer? Alice Bob

18 Q.17 Countering VoIP spam ( 反垃圾 VoIP) 过滤效果投诉比率费用 Filtering rate Response rate Spamming cost Spreading Power of VoIP Spam: Utility of Spammer VoIP 垃圾扩散能量 Cost of punishment and number of sent spam 惩罚力度 Probability of punishment 被惩罚概率

19 Q.17 Technical framework for countering spam(x.fgs) ( 反垃圾邮件及技术框架 ) Spam processing entity 垃圾邮件处理设备 A Spam processing subentity 垃圾邮件预处理设备 E Countering Spam model B C 邮件服务器 Mail Server Mail Server D Mail Client 邮件用户

Q.17 Platform of countering SPAM ( 反垃圾信息平台 ) 用户 Spam reports Acknowledgment of sender query Contact for procedures Unsubscription assistance Surveys (honeypots)

Gentle reminder Zombie watch Alert authorities 运营商 Report on spam statistics abuse@fai Provision of detailed information 分析排序行动分享 Public authorities Banks,

20 Q.17 Platform of countering SPAM ( 反垃圾信息平台 ) 用户 Spam reports Acknowledgment of sender query Contact for procedures Unsubscription assistance Surveys (honeypots) 垃圾报告蜜罐 Signal Spam 事件报告 Sending incident report Automatic signalling/ip report 自动信令 /IP 报告 Analyse, sort, take action and 电子邮件服务器向有关机构预警 Response: Gentle reminder Zombie watch Alert authorities 运营商 Report on spam statistics abuse@fai Provision of detailed information 分析排序行动分享 Public authorities Banks, brands Semi-automatic alerts on URL phishing Automatic signalling/ip report Reports of incidents declared by senders Semi-automatic alerts on URL phishing 互相共享反垃圾信息

21 Conclusion ( 总结 ) The scope of WP2/SG17 on security is unlimited. Any new technologies/solutions on security are highly recommended to be studied on the study group. (WP2/SG17 在安全方面的研究范围没有限制, 欢迎任何在安全方面的新技术 / 新解决方案提交到该研究组进行研究 )

untitled

untitled LBS Research and Application of Location Information Management Technology in LBS TP319 10290 UDC LBS Research and Application of Location Information Management Technology in LBS , LBS PDA LBS