Securing emerging wireless networks and services

Transcription

1 Securing emerging wireless networks and services 4 th ESTI security workshop, January ETSI, Sophia Antipolis, France Ganesh Sundaram, Distinguished Member of Technical Staff Wireless Advanced Technology Labs, Alcatel-Lucent ganeshs@alcatel-lucent.com

2 10k feet view of this talk Capturing the thought process: Multiple dimensions to mobile security Networks have evolved 1G 2G 3G 4G Applications have evolved Cellular Voice , VPN WAP + music + video Mobile Internet Users have evolved Convenient to have a cell phone (early 90 s). Can I afford it? Need to have a mobile device to download all those free apps How do we use our mobile devices? Securing the enigma of mobile broadband? Secure each dimension based on needs and capabilities Discussion on changing needs of mobile security and pointers to solutions. Not a Tutorial!! 2 Presentation Title Month 2006

3 Mobile networking evolution PSTN INTERNET MSG MSG MSG H-GW MSC MSC PLMN V-GW Early: Mobile access to the telephony MSC MSC MSC network Growth: A public land mobile network Now: PLMN plus mobile access to the Internet Early networks: Securing access, and networks 3 Presentation Title Month 2006

4 What is 4G? 4G = I see $$ 4G = Mobile OFDM! 4G = Mobilizing the Internet 4G = Flat IP 4G = fatter pipes = higher bandwidth 4G = multiple deployment options 4G = streamlining mobile packet switched services Next Generation = The entire elephant. Security challenges across multiple layers. 4 Presentation Title Month 2006

5 Evolution of applications Cellular WAP Mobilize the Voice, SMS VPN Music, Video Internet Operator controlled services Operator enterprise partnership s Walled garden The iphone generation Mobile Applications: Securing this colorful evolution; Who is responsible for what? 5 Presentation Title Month 2006

6 Evolution of mobile subscriber Early days: Convenient! Hmm. Pay for it? Morning Infotainment Productivity During the day Evening Entertainment Mobile subscriber needs increasing, but is security improving? 6 Presentation Title Month 2006

7 Changing business models Multiple Deployment Options. Who owns the user? MARKET DRIVERS Free Bandwidth. Who owns the network? Browser enabled phones. Who controls the application? New business models driving the market. What is the impact on security? 7 Presentation Title Month 2006

8 Next generation security conundrum Security Requirements Multiple security requirements Authentication, User Privacy Securing service layer Securing Applications Securing the network Securing Devices Device Limitations New business models Changing landscape: Multiple orthogonal dimensions Devices are challenged power, computing cost, form-factor Business models are changing Deployment models Ownership of bandwidth, application 8 Presentation Title Month 2006

9 Flat IP What is Flat IP, and Why? Consolidation of wireless functions at the edge Evolution from existing systems Capacity improvements (cross-layer optimization) IP aware base stations Reduce complexity, ease of management and upgrades What about security? Securing the cell-site! Cryptographic security not physical security Means to satisfy cell-site security Tamper resistant, secure computing environment Secure interfaces Protection against intrusion, eavesdropping, DoS, etc Flat IP: Security not an after-thought 9 Presentation Title Month 2006

10 Flat IP security architecture: Securing access Cell-site vault provides: 1. Physical security for all session keys maintained by cell site 2. Performs ciphering and integrity protection for user and signaling plane 3. Secure tunnels to home agent and AuC/AAA Public/private IP network IP Gateway Shared secret key IPsec Cell-site vault AAA inter-cell site ck + ik SLP+RLP FA rr + signaling Session Keys SIM IPSec Gateway Secure tunnel Protocol stack Bearer path Protocol stack ik + ck Secure tamper resistant computing environment 10 Presentation Title Month 2006 Flat system s cell site User equipment

11 Network layer security Network layer security: From CMIP to Simple IP with PMIP Security assumptions Mobility Agent is in secure environment: Node specific keys Mobility Agent is in insecure environment: User specific keys Key bootstrapping problems Multiple solutions being proposed in standards based on network assisted single-sign-on Local breakout What? - How do we keep local traffic local? How? - Multiple solutions under discussion Example: supported through route optimization in mobile IPv6 Is there a network based solution, that is secure and universal? IP layer mobility Evolving towards secure network based solutions 11 Presentation Title Month 2006

12 Securing applications? Brave new world of mobile applications are they secure? What is security at the application layer? Privacy e2e privacy especially for mobile-to-mobile applications New paradigm: Secure identity based authenticated key agreement Applies even if users are in two different networks Can provide e2e security without risks and responsibilities of key escrow Trust Example: guarantee application is not a virus Mobile handsets are thin clients, very diverse operating systems Challenges: Easier to attack, computationally deprived environment New paradigm: Network based methods to filter applications Challenges: How to make this computationally efficient and cost effective? Mobilizing Internet Applications: Emerging paradigms and new trends 12 Presentation Title Month 2006

13 Other next generation considerations Multiple deployment options Security architecture evolving Macro cellular High mobility and outdoor environments Micro cellular Hot spots and coverage holes (low mobility) Pico cellular Enterprise environments with licensed spectrum Femto cellular Home environments with licensed spectrum Threat models and security requirements differ May span across providers New deployment options require fresh look 13 Presentation Title Month 2006

14 IP services over mobile wireless: New paradigms to launch attacks! Radio Network Controller Packet Core VPN Users can Consume on Average, 10x the Airtime as Typical Users Bandwidth Exhaustion P2P Users Download 10 s of GB per day, Consuming 30% of Bandwidth Mobile DoS: Need new tools! Signaling Exhaustion Delivery Devices on Average, cause 10X the Signaling Load as Phones or Aircards Used for Webbrowsing Infected / Malfunctioning Devices Consume Disproportionate Amounts of Signaling Resources 14 Presentation Title Month 2006

15 Nextgen devices: A purist s nightmare vs the ELEGANT engineer s solution 16 OS s and are too thin 2 words: Mini Browser! Free 4G BW with worms on the side Free applications & viruses to go! Not enough battery power Not enough processing power I have a SOLUTION Food for thought! 15 Presentation Title Month 2006

16 Thank You! Ganesh Sundaram Presentation Title Month 2006