Unsolicited Communication in the NGN

Transcription

1 Unsolicited Communication in the NGN Overview of Status and Activities in different SDOs Thilo Ewald Research Scientist NEC Laboratories Europe NEC Europe Ltd., Heidelberg, Germany Page <date> 1 ETSI Security Workshop

2 Table of content Problem statement Problem Statement & Definition Forecast of next generation SPAM? Technical means of countering UC Technical means for identifying UC Handling & Preventing of UC Standardization of PUC Ongoing work IETF ITU 3GPP TISPAN Questions and Answers May 08-2

3 Problem statement What is SPIT, call/multimedia-spam unsolicited communication and how this be faced by technical means? Page <date> 3 ETSI Security Workshop

4 Problem Statement & Definition SMS/MMS/call-SPAM, multimedia-spam, SPIT (SPAM over Internet Telephony), Similar wording for the same problem Unsolicited communication (UC) Biggest problem: UC perception is highly personalized UC based on human->human or machine->human communication UC classification: social threat (bulk) unsolicited communication, mainly spread advertisement Directed advertisement or VoIP phishing (Vishing) Results in more stress at home and in office More difficult to establish communication e.g. phone switched off to prevent it from ringing Voice mailbox filling with voice spam messages Become sever threat as attack of the availability of the NGN Good call Riiing... Riiing... SPIT calls May 08-4

5 Forecast of next generation SPAM? NGN devices will become ubiquitous as accounts nowadays are Number of subscribers will increase dramatically within the NGN Today SPAM keeps on increasing 3600 spam messages per day for a small enterprise 100 SPAM messages per day for a end users Voice SPAM in Germany identified numbers [Bundesnetzagentur] Auto Dialer for expensive numbers / Phising identified numbers [Bundesnetzagentur] Conclusion UC is expected to become a sever threat in the NGN / for the NGN user May 08-5 em@il SPAM filter results from a small corporate network

6 Technical solution against UC Identification Based on background information (lists) or call history (non intrusive) Based on patterns analysis in the signalization (non intrusive) Based on caller based testing (intrusive) Based on feedback from callee (intrusive) Handling & Reacting Reroute according to operator and user preferences i.e. to mailbox Block / intercept unsolicited communication Only possible by strict contract or last decision at user premises Preventing Reacting in behalf of the user Only possible by having a per user profile for reacting on UC Reacting for protection of the network If UC becomes a threat against the availability of the network itself May 08-6

7 Technical means for identifying UC knowledge base feedback system system callee system callee Stage 1: non-intrusive Stage 2: caller interaction Stage 3: feedback before call Stage 4: feedback during call Stage 5: feedback after call Non-intrusive test Blacklisting / white listing Message/Call rate analysis Simultaneous call analysis Call behavior analysis Statistically analysis Caller Interactions Touring test DTMF check Greylisting Feedback before call buddy list integration consent-based communications Pure Signalization and let user choose Feedback during call SPIT hang-up button FB after call service center Web-Front-end Intelligent user clients General & Personalized Personalized May 08-7

8 Handling & Preventing of UC Technical means for handling UC Explicit handling by re-routing or blocking UC Can be done in the network or at the user device Mark UC attempt for later handling Distributed solution for load-balancing, specialization of identification, etc. Give final decision point back to the user Problem: regulatory aspect of communication No operator is allowed to intercept any kind of communication attempts Only with contractual power operators are allowed to react in behalf of the customer to communication attempts Implicit vs. explicit prevention UC Explicit prevention by handling the communication request at the user premises e.g. UE or home-gateway With or without the assistance of a service from the network Implicit prevention by handling the communication request within the network e.g. as additional service Better technical solutions for identifying and handling UC and personalization of the users UC profile May 08-8

9 Standardization of PUC PUC Prevention of unsolicited communication Recommendations which network entities / interfaces should be enhanced by PUC functionality SDO dependant Standardization of marking of UC identified communication attempts Protocol extensions are needed Standardization of common UC user profile scheme Identify Identify Identify Identify User profiles mark mark mark PUC functionality PUC functionality PUC functionality Caller (SPITer) Access network Core network Access network Callee (Bob) May 08-9

10 Ongoing work in the SDOs IETF, ITU, 3GPP, TISPAN Other.. Page <date> 10 ETSI Security Workshop

11 Overview of UC work in different SDOs sipping-spam (SIPPING WG draft) niccolini-sipping-spitstop RFC 5039 wing-sipping-spam-score niccolini-sipping-feedback-spit tschoefening-sipping-framework-spit-reduction tschoefening-sipping-spit-policy froment-sipping-spit-requirements tschofenig-sipping-captcha jennings-sip-hashcash dhoi-sipping-experiments-spit SPITSTOP discussion Study of preventing UC (TR - WI07025) PUC (TS) Study on SMS MMS spam (TR) PUCI (TS) X.ocsip overview study X.csreq requirements study X.1231 X.fcsip framework study May 08-11

12 UC in the IETF (SPIT) RFC 5038 The Session Initiation Protocol (SIP) and SPAM draft-niccolini-sipping-spitstop Signalling TO Prevent SPIT (SPITSTOP) Reference Scenario draft-niccolini-sipping-feedback-spit SIP Extensions for SPIT identification draft-jung-sipping-authentication-spit Authentication between the Inbound Proxy and the UAS for Protecting SPIT in the Session Initiation Protocol (SIP) draft-schwartz-sipping-spit-saml SPAM for Internet Telephony (SPIT) Prevention using the Security Assertion Markup Language (SAML) draft-froment-sipping-spit-authz-policies Authorization Policies for Preventing SPIT May 08-12

13 UC in the ITU (multimedia SPAM) The ITU is working on the thread Countering spam by technical means in the ITU-T Study Group 17 - Question 17/17 (Study Period ). X.ocsip Overview of countering SPAM for IP multimedia application This Recommendation specifies basic concepts, characteristics, and effects of Spam in IP multimedia applications such as IP Telephony, instant messaging, multimedia conference, etc. It provides technical issues, requirements for technical solutions, and applicability of countering mechanism of spam into IP multimedia spam. It provides basis and guideline for developing further technical solutions on countering Spam. X.fcsip Technical Framework of Countering IP Multimedia SPAM This Recommendation will specify general architecture of countering spam system on IP multimedia applications such as IP Telephony, instant messaging, multimedia conference, etc. It will provide functional blocks of necessary network entities to counter spam and their functionalities, and describe interfaces among the entities. To build secure session against spam attack, User Terminals and Edge Service Entities such as proxy server or application servers will be extended to have spam control functions. We will also show interfaces between these extended peer entities, and interfaces with other network entities which can involve for countering spam. X.1231 (former X.csreq) Requirement on countering SPAM Requirements on countering spam are clarified in this recommendation. There are many types of spam, such as spam, Mobile messaging spam and IP multimedia spam. Various types of spam may have both common and specific requirements on countering it. For one type of spam, the requirement in different entities should also be clarified. May 08-13

14 UC in 3GPP (SMS/MMS SPAM) ETSI TR V6.0.0 / ETSI TS V / ETSI TS V6.0.0 Fraud Information Gathering System (FIGS) FIGS provides the means for the HPLMN to monitor a defined set of subscriber activities. 3GPP TR XXX XXX Protection against SMS, MMS and IMS SPAM; Study of Different SPAM Protection Mechanisms This TR analyzes existing and new mechanisms to limit the effects of SPAM to following services: SMS, MMS, IMS messaging/presence/call and also messages. Investigation based on the 3GPP architecture regarding SMS/MMS/IM SPAM were done Potential solution to counter this threat were analyzed and defense mechanisms were proposed 3GPP TR XXX XXX PUCI - Prevention of Unsolicited Communication in IMS This specification study will give the requirements and recommendation how to prevent UC in the IMS part of the NGN May 08-14

15 UC in OMA OMA OMA has drafted a set of requirements and architecture for Categorization Based Content Screening (CBCS) suggesting among other things usage of ICAP protocol to transfer content categorization information. Content Screening is defined as the act of blocking, allowing or amending content, thereby, it also includes malware. The current OMA work can be found in the following specifications: Categorization Based Content Screening Framework Requirements, Candidate Version July 2006 (a newer one may already exist), Open Mobile Alliance OMA-RD-CBCS-V1_ C The document describes Use Cases for categorization based content screening and high level requirements on the functionality of such a system. Categorization-based Content Screening Framework Architecture, Draft Version Aug 2006, Open Mobile Alliance OMA-AD-CBCS-V1_ D The document presents an architectural model for a two-tier solution of a CBCS Enabler. The CBCS Enabler evaluates and/or enforces Screening Rules. May 08-15

16 UC in TISPAN (unsolicited communication) ETSI TS MCID (Malicious call identification) This service for blacklisting ETSI TS OIR (Originating Identification Restriction ) The service offers personalized lists ETSI EN ACR (Anonymous Communication Rejection) Unknown caller blocking ETSI TS ICB (Incoming Communication Barring) The service offers personalized black / whitelisting ETSI TR Feasibility study of preventing unsolicited communication in the NGN This report deals with the feasibility of counteracting the occurrence of Unsolicited Communications (UC) in the NGN. It has the form of a TVRA and quantifies the likelihood and impact of UC in the NGN. TS xxx xxx - PUC (Prevention of unsolicited communication in the NGN) This specification study will give the requirements and recommendation how to prevent UC in the NGN May 08-16

17 TISPAN best coordination place AS Ut RACS NASS UPSF User profiles Cx Sh AS ISC I/S-CSCF Mw Mx IBCF NNI UE P-CSCF IBGF UE HomeGW SBC IETF ITU-T TISPAN 3GPP OMA protocols framework PUC PUCI CBCS Caller (SPITer) Access network Core network Access network Callee (Bob) May 08-17

18 AOB Question & Answers May 08-18