An Oracle White Paper December The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks

Transcription

1 An Oracle White Paper December 2013 The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks

2 Introduction Today s mobile networks are no longer limited to voice calls. With the advent of smartphones, subscribers are now using the mobile network for accessing their bank accounts, paying for products using e-commerce applications, purchasing through online stores, and keeping up with social networks. This also means subscribers are connecting with many different types of mobile devices, including computers, smartphones, tablets, and dongles. With the introduction of many new device types into the network comes a new issue: cybersecurity. In mobile networks, mobile phones have to authenticate prior to accessing any services. This was implemented to prevent theft of these devices. However, there are now devices behind the devices that are a concern. For example, connecting a laptop through a dongle introduces the possibility of viruses from the laptop gaining access to the network. The network is not equipped to deal with viruses of this nature. As a result, these viruses are getting through the network and into other devices that are also connected. Websites and portals also risk infection. By connecting to other networks through the use of IP transport, service providers are introducing yet another portal for viruses and security breaches unless security becomes a top priority. This paper discusses network security vulnerabilities and concerns, and provides several recommendations for implementing security mechanisms. 1

3 Challenges in Securing IP Networks The Third Generation Partnership Project (3GPP) has gone to great measures to add additional security enhancements in Long Term Evolution (LTE) networks. The problem is that many handsets must still support 3G and Wi-Fi, which opens up vulnerabilities from these technologies. This makes it even more difficult to make sure the core network is protected from all vulnerabilities. CTOvision.com stated in an article that mobile devices are generally vulnerable to client-side attacks the iphone s use of 3G to connect to Wi-Fi allows an infected device to connect to sensitive networks. We have already seen instances in cybersecurity where some viruses can be used to gain access into other networks and then used to launch denial of service (DoS) attacks or redirect traffic (referred to as hijacking) to another destination. Hijacking is already becoming prevalent in the United States. This is often enabled through Voice over IP (VoIP) networks that are able to intercept calls to mobile phones and redirect them to a recording. The sole purpose of this is to keep the caller on the line, therefore increasing the minutes-of-use that are then charged back to the interconnect partner. CoreSecurity noted events in Europe where fake 2G base stations are used to attack 3G and LTE nodes, and service providers in Eastern Europe are exploiting roaming vulnerabilities by boosting the power of cell towers in border regions to jam signals from neighboring countries. Fake networks can easily claim to be roaming partners. In the United States, one incident involved selling hundreds of thousands of minutes using VoIP by selling calls through the internet, routing the calls through VoIP networks that were hacked, and rerouting the international calls through bona fide phone companies in the United States, Canada, and Europe. As service providers connect to partner networks using IP technology, every security mechanism available should be implemented to ensure that the interconnection is not compromised. Issues with Roaming over IP IP is susceptible to a number of different vulnerabilities. Fortunately, there are ways to prevent vulnerabilities from resulting in network breaches. One of the best methods is through the use of gateways at the network edge and the hiding of critical network element addresses. In Signaling System No. 7 (SS7) networks, Global Title Translation (GTT) is used at the Signal Transfer Point (STP) to do the following: 1. Prevent the need to enter network addresses in the routing tables of every node in the network 2. Hide the address of critical network elements such as the Home Location Register (HLR) The concept is simple. When a switch needs to connect to the HLR to retrieve data, it sends a query that includes the identity of a subscriber. This identity is used by the HLR to retrieve data, but also by 2

4 the STP to determine how to reroute the query. The query is routed by the switch not to the HLR directly, but rather to the STP. The STP then references its own internal routing database (GTT) to determine the actual network address of the HLR to send the query. This simple concept has been replicated for Diameter and is referred to as Home Subscriber Server (HSS) address resolution. Security over IP Connections Another concern of IP is advertising the IP addresses of the various network elements as a packet is routed through the network. Some routing protocols will add the IP address of the router or proxy as the packet travels through the network so the responses can be sent back through the same route. This practice can be an excellent way to prevent man-in-the-middle attacks if the proxies are using something called record-route. However, when sending a packet outside of the network, it is not advisable to send the IP addresses of the various network elements to the partner network. It is highly recommended that the IP addresses be hidden from view once the packet is routed outside the network. This requires a node at the edge of the network capable of not only hiding the IP addresses, but replacing them with a generic address and maintaining a stateful log of every dialogue so messages sent to another network can be correctly routed back into the home network. This is known as topology hiding, and Oracle Communications Diameter Signaling Router provides this capability. It can become the access gateway into the network, thus enhancing the security of the interconnection point as well as providing security within the network itself, as 80 percent of network breaches occur inside the network. There are several different flavors of topology hiding available in Oracle Communications products. For example, Oracle Communications Diameter Signaling Router supports both HSS and Mobility Management Entity (MME) topology hiding, as well as path topology hiding. With either HSS or MME, when a Diameter message is sent from one of these entities to an outside network, Oracle Communications Diameter Signaling Router will replace the actual address of the node with a generic address known only to it. Oracle Communications Diameter Signaling Router also maintains a log of each dialogue so when responses are sent back, it can route the message to the correct node by replacing the generic address with the actual address. This is critical to preventing outside networks from identifying internal assets and sending rogue messages into the network through breached connections. This is also paramount to preventing manin-the-middle attacks. Last but not least, IP Security (IPsec) and Transport Layer Security (TLS) are paramount in IP connections. IPsec provides internal protection through encryption, while TLS provides encryption and authentication outside of the network. TLS utilizes two methods for securing the connection. The first is the TLS Handshake Protocol. This protocol is used to exchange credentials between two networks (authentication) and to negotiate an encryption algorithm and cryptographic keys. Once this process is complete, the Diameter message is then sent using the TLS Record Protocol, which is 3

5 encrypted. Encryption will prevent unauthorized networks from hijacking a Diameter message and eavesdropping on the transmission. This prevents hackers and unauthorized networks from accessing the Diameter contents. Considerations for Roaming Between Networks Because many devices will have to support both 3G and LTE, interworking between these networks is a requirement. The interworking can be done in a variety of ways, but the most efficient and secure means is through Oracle Communications Diameter Signaling Router acting as the network gateway. Oracle Communications Diameter Signaling Router provides interworking between the mobile application part (MAP) and the Diameter protocols. It can also provide address resolution much like the STP provides GTT. Address resolution is important at the Diameter access gateway because it prevents the partner networks from knowing the addressing of internal assets. Following are some recommended examples of how to implement interworking with Oracle Communications products. 3G Subscriber Roaming on an LTE Network In this scenario, a 3G subscriber is roaming on an LTE network. The Visited Public Land Mobile Network (VPLMN) will send a Diameter message over the S6d interface to Oracle Communications Diameter Signaling Router in the Home Public Land Mobile Network (HPLMN). Oracle Communications Diameter Signaling Router checks its HSS address resolution database to determine if the subscriber identity is in this database, identifying the subscriber then as an LTE subscriber. When it is determined that the subscriber is not in this database, Oracle Communications Diameter Signaling Router converts the Diameter message into a MAP message, and forwards the message to the STP over the Gr interface. The STP can then use its own GTT database to route the message to the appropriate HLR. The HLR will send a response back to the VPLMN through the Gr interface, through Oracle Communications Diameter Signaling Router which will again convert the message from MAP back into Diameter and forward over the S6d interface to the VPLMN. LTE Subscriber Roaming on a Partner LTE Network When an LTE subscriber roams on another LTE network, the VPLMN will send a Diameter message to the LTE network using the S6d interface. Oracle Communications Diameter Signaling Router in the home network then receives this message and checks the HSS address resolution database. Oracle Communications Diameter Signaling Router determines that the subscriber is an LTE subscriber, and routes the Diameter message to the correct HSS. In this case, no interworking is required because the subscriber is an LTE subscriber and there is no requirement to connect to the 3G network. The HSS address resolution database provides the proper routing instructions to the correct HSS for the specific subscriber, eliminating the need to advertise this information to the VPLMN. 4

6 Conclusion Diameter is designed to be a more secure connection between service providers than traditional SS7; SS7 is a text-based protocol and used between trusted networks during a time when network security was not a major concern. In today s environment, network security should be the primary concern of every service provider. Utilizing the mechanisms defined by 3GPP and Third Generation Partnership Project Two (3GPP2) will only enhance the security and efficiency of network interconnection. Using Oracle Communications Diameter Signaling Router provides service providers with the safest means of interconnection over the S6d interface. 5

7 The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks December 2013 Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: oracle.com Copyright 2012, 2013, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only, and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document, and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. 1213