Security Considerations for Signaling Transport (SIGTRAN) Protocols
RFC 3788

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 03

Network Working Group                                        J. Loughney
Request for Comments: 3788                         Nokia Research Center
Category: Standards Track                                 M. Tuexen, Ed.
                                      Univ. of Applied Sciences Muenster
                                                        J. Pastor-Balbas
                                                    Ericsson Espana S.A.
                                                               June 2004

                      Security Considerations for
                Signaling Transport (SIGTRAN) Protocols

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2004).

Abstract

   This document discusses how Transport Layer Security (TLS) and IPsec
   can be used to secure communication for SIGTRAN protocols.  The main
   goal is to recommend the minimum security means that a SIGTRAN node
   must implement in order to attain secured communication.  The support
   of IPsec is mandatory for all nodes running SIGTRAN protocols.  TLS
   support is optional.

Loughney, et al.            Standards Track                     [Page 1]
RFC 3788                    SIGTRAN Security                   June 2004

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
       1.1.  Overview . . . . . . . . . . . . . . . . . . . . . . . .  2
       1.2.  Abbreviations  . . . . . . . . . . . . . . . . . . . . .  3
   2.  Convention . . . . . . . . . . . . . . . . . . . . . . . . . .  3
   3.  Security in Telephony Networks . . . . . . . . . . . . . . . .  4
   4.  Threats and Goals  . . . . . . . . . . . . . . . . . . . . . .  4
   5.  IPsec Usage  . . . . . . . . . . . . . . . . . . . . . . . . .  6
   6.  TLS Usage  . . . . . . . . . . . . . . . . . . . . . . . . . .  7
   7.  Support of IPsec and TLS . . . . . . . . . . . . . . . . . . .  8
   8.  Peer-to-Peer Considerations  . . . . . . . . . . . . . . . . .  9
   9.  Security Considerations  . . . . . . . . . . . . . . . . . . . 10
   10. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 10
   11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
   12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
       12.1. Normative References . . . . . . . . . . . . . . . . . . 11
       12.2. Informative References . . . . . . . . . . . . . . . . . 11
   13. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12
   14. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 13

1.  Introduction

1.1.  Overview

   The SIGTRAN protocols are designed to carry signaling messages for
   telephony services.  These protocols will be used between

   o  customer premise and service provider equipment in case of ISDN
      Q.921 User Adaptation Layer (IUA) [9].

   o  service provider equipment only.  This is the case for SS7 MTP2
      User Adaptation Layer (M2UA) [12], SS7 MTP2 Peer-to-Peer User
      Adaptation Layer (M2PA) [15], SS7 MTP3 User Adaptation Layer
      (M3UA) [13] and SS7 SCCP User Adaptation Layer (SUA) [16].  The
      carriers may be different and may use other transport network
      providers.

   The security requirements for these situations may be different.

   SIGTRAN protocols involve the security needs of several parties, the
   end-users of the services, the service providers and the applications
   involved.  Additional security requirements may come from local
   regulation.  While having some overlapping security needs, any
   security solution should fulfill all of the different parties' needs.

   The SIGTRAN protocols assume that messages are secured by using
   either IPsec or TLS.

Loughney, et al.            Standards Track                     [Page 2]
RFC 3788                    SIGTRAN Security                   June 2004

1.2.  Abbreviations

   This document uses the following abbreviations:

   ASP: Application Server Process

   CA: Certification Authority

   DOI: Domain Of Interpretation

   ESP: Encapsulating Security Payload

   FQDN: Full-Qualified Domain Names

   IPsec: IP Security Protocol

   IKE: Internet Key Exchange Protocol

   ISDN: Integrated Services Digital Network

   IUA: ISDN Q.921 User Adaptation Layer

   M2PA: SS7 MTP2 Peer-to-Peer User Adaptation Layer

   M2UA: SS7 MTP2 User Adaptation Layer

   M3UA: SS7 MTP3 User Adaptation Layer

   PKI: Public Key Infrastructure

   SA: Security Association

   SCTP: Stream Control Transmission Protocol

   SS7: Signaling System No. 7

   SUA: SS7 SCCP User Adaptation Layer