Telcordia TL1 Security Specifications

Telcordia's document GR 815 proposes the generic security features required of a total Network Element -Network System (NE/NS) environment. It defines the baseline security requirements and is not specific to any particular NE/NS. 

Telcordia's document TR 835 proposes the message structures and data elements for NE/NS security administration. It specifies five types of security views for implementing system access control and resource access control. It also defines set of commands for manipulating all the security view data. 

 

5 security views specified in TR 835

User security view - Contains system access control parameters such as user name, password, password aging, privilege, etc. NE uses this data to authenticate a user when he tries to establish a session with the NE.  Channel security view - Contains channel related security parameters such as channel name, privilege, time-out interval, etc. Command security view - Contains command access control parameters such as command name and privilege associated with all operation related commands.  Operations parameter related security view   - Contains restrictions on the accessibility of records (rows) and fields (column) of an operations-related database.  Resource-related security view   - Contains the resource access control parameters such as resource name and privilege associated with all operations-related resources, such as executable programs that may not provide database type "view".

Implementing Security in TL1

The following are the key challenges faced in TL1 security administration.
 

• User Authentication
• Restricting the authenticated users from using privileged commands.
• Restricting the authenticated users from accessing specific resources in the NE.
• Restricting the authenticated users from accessing privileged data from the data tables.
• Implementing security over the various channels through which the session is established.
• Keeping track of all the security related events that happen in the network.

The resident TL1 agent in the NE serves as the single point of communication for all TL1 messages. The agent can be configured for implementing security on the device. It can execute or reject commands to ensure there is no security violations.

You can configure the agent and store authorized usernames and passwords in the NE [refer user security view in TR-835]. When users login with their username-password, the system access control (authentication mechanism) authorizes the establishment of session. NE uses the data stored in the user security view for validating the username-password. 

The input message for entering new user details into the user security view takes the following format. 
ENT-USER-SECU ::<UID>:<CTag>: PID,CID,UAP :  PCND,PCNN,POINT,UOUT,LSTOILIST;
where, PID,CID and UAP are position defined and their values have to be entered in that order. The next list is name defined and can be entered in any sequence provided the right values are assigned to the appropriate parameters.

Example :
The following command creates a new user "user1" with user security parameter values shown in it.
ENT-USER-SECU::user1:13::user1,TCP,2:56,8,4,10,87,file;
 

Other commands related to user security view

ED-USER-SECU: For editing existing user details. DLT-USER-SECU :For deleting an user. (session will not be established for this user) INH-USER-SECU: For inhibiting or disabling an existing user without deleting the user account. ALW-USER-SECU : For allowing a user ID which has been inhibited earlier. CANC-USER-SECU: For terminating a user session.

You can configure the agent to store authorized commands for every user in the NE [refer command security view in TR-835]. When users send commands, the command access control mechanism authorizes the commands. NE uses the data stored in the command security view for this purpose. The command is either executed or rejected based on the output of the validation.

The input message for entering security parameters associated with a command takes the following format.
ENT-CMD-SECU:<TID>:<AID>:<CTag>: <GB> :CAP;

Example :
The following command enters the security parameters for the command get-sm-msgda in the command security view.
ENT-CMD-SECU::get-sm-msgda:11::1&2;
 

Other commands related to command security view

ED-CMD-SECU: For editing the security parameter values of a command. DEL-CMD-SECU: For deleting the security parameters associated with a command.  RTRV-CMD-SECU: For retrieving the details of any command.

A device may comprise of many entities such as ports, database tables etc. Access to certain entities should be restricted for security reasons. You can configure the agent to store a list of authorized resources for every user in the NE [refer resource related security view in TR-835]. When the agent receives a command, it compares the equipment ID of the command with the data stored in the table. The command is either executed or rejected based on the output of the validation.

The input command for storing security parameters associated with the resources takes the following format.
ENT-RSC-SECU:<TID>:<AID>: <CTag>:<GB>:RAP;

Example:
ENT-RSC-SECU::device1:23::2; 
 

Other commands related to resource related security view

ED-RSC-SECU: For editing the security parameters associated with resources in the NE. DLT-RSC-SECU: For deleting the security parameters associated with resources in the NE. RTRV-RSC-SECU: For retrieving the details of any resource available in the resource related security view.

NE stores all the information in data tables. To prevent users from accessing high privileged data, you have to configure the agent and enable it to store the permissible data for every user. [refer operations parameter related security view in TR-835]. When the agent receives a command, it validates the requested data against the data stored in the operations parameter related security view. The NE executes the command based on the output of the validation. 

The input command for storing security parameters in the operations parameter related security view takes the following format.
ENT-SECU:<TID>:<AID>: <CTag>:<GB>:a,RCI:FAP ;
where, "a" is the position-defined parameter that specifies the view. RCI  is a position-defined list of Record Control Identifier(s) authorized to access the AID. FAP  is a keyword-defined parameter block that may contain any keyword that specifies any field (i.e., column) of the view specified by the parameter "a". 

Example:
ENT-SECU::1:6::adiskTable,TCP:adiskCapacity=2;
 

Other commands related to operations parameter related security view

ED-SECU: For editing the security parameters associated with the fields of a record(s) in a user implemented view (e.g., Line View, Trunk View). DLT-SECU: For deleting any security parameters associated with the fields of a record(s) in a user implemented view (e.g., Line View, Trunk View).

It is true that a session is required to communicate with an NE. Channel refers to the session or the transmission line. A channel may be of any protocol such as such as TCP/IP, EOC, RS232, and X2.5. You can configure NEs for the following, with respect to channel security. 1) How many incorrect login attempts can be tolerated, 2) How long should the channel be locked out if the incorrect login attempt exceeds the limit, 3) How long should it take for the connection to re-establish after a failed login attempt. 

The input command for storing channel related security parameters in the channel security view takes the following format
ENT-CID-SECU : <TID> : <CID>: <CTag>:<GB>:CHAP:DURAL,MXINV,TMOUT;
where, CHAP is a  position defined parameter.  DURAL, MXINV, TMOUT are name defined and can be entered in any sequence provided the right values are assigned to the appropriate parameters.

Example : 
The following command adds a new channel "craft " to the channel security view.
ENT-CID-SECU::craft:10::2:5,0013-23,26; 
 

Other commands related to operations parameter related security view

ED-CID-SECU: For editing security parameters values associated with a channel identifier in the channel security view.  DLT-CID-SECU: For deleting security parameter values of any channel identifier. CANC-CID-SECU: For terminating a session which is ongoing with the NE over a channel ID. RTRV-CID-SECU: For retrieving values of security parameters associated with a channel identifier.

Logging refers to keeping track of the events that happen in the network. The Agent should record security related events such as invalid login attempts, unauthorized attempts to access resources etc., in the security log. Security log is a tool for security audit. Network administrators can infer more from the security logs and security audit. Security logging system should be capable of sending event notification to the system administrator.