SIST-TS TS 101 888-2 V4.1.1:2004
(Main)Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON) Release 4; Security Test Specifications; Part 2: H.323 Environment
- Abstract
Detailed test specification (including evaluation of intermediate results) for the calculation of the security-token and insertion into the security field in the Call Control Flow using H.235 Annex D and H.235 Annex F.
- Status
- Published
- Publication Date
- 31-Mar-2004
- Technical Committee
- SPN - Services and Protocols for Networks
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 01-Apr-2004
- Due Date
- 01-Apr-2004
- Completion Date
- 01-Apr-2004
SIST-TS TS 101 888-2 V4.1.1:2004 is the Slovenian adoption of ETSI TS 101 888-2 V4.1.1, published by SIST. It defines security test specifications for TIPHON Release 4 in the H.323 environment, with a detailed test specification for calculating the security-token and inserting it into the security field in the Call Control Flow using H.235 Annex D and H.235 Annex F. The document is written for people validating H.323/IP security behavior in interworking systems such as terminals, gateways and gatekeepers.
What does SIST-TS TS 101 888-2 V4.1.1:2004 specify?
SIST-TS TS 101 888-2 V4.1.1:2004 specifies security test specifications for TIPHON Release 4 in the H.323 environment. Its scope is limited to IP based networks, while the signalling path and media path in the SCN are treated as secure under the document’s “Trust by wire” assumption.
The document is organized into:
- Clause 1: Scope
- Clause 2: References
- Clause 3: Definitions and abbreviations
- Clause 4: Security Test Strategy
- Clause 5: H.235 Annex D
- Clause 6: H.235 Annex F
- Clause 7: Global Service Providers
- Annex A: Bibliography
Clause 5 gives the most detailed worked example material, while Clauses 6 and 7 identify additional test areas.
What are the key requirements of SIST-TS TS 101 888-2 V4.1.1:2004?
SIST-TS TS 101 888-2 V4.1.1:2004 is mainly a test specification, so its key requirement is to verify how security bits are generated and inserted into H.323 messages, then to check the result step by step. In practice, that means a tester must inspect both the token content and the message fields that carry it.
- Security testing should be done after vendor product and system testing with the ETSI testing standards. This places the document in the validation phase, not basic implementation.
- The testing goal is to show the generation and insertion of security bits into specific H.323 message parameters. This matters because the standard focuses on whether the token is built and placed correctly, not only on whether a message is accepted.
- Testing uses two interconnected entities that already interwork. This lets the tester isolate security processing rather than general connectivity problems.
- If security information is wrong, the tester should examine the individual steps that build the security bits. Clause 4 makes this a diagnostic method for finding where the failure occurs.
- Clause 4 requires signalling-path testing for Gatekeeper and Terminal, Gatekeeper and Gateway, and Gatekeeper and Gatekeeper. These are the main H.323 control-path cases.
- Clause 4 also requires media-path testing for Terminal and Terminal, Terminal and Gateway, and Gateway and Gateway. These cases matter because media security is separate from signalling security.
- Clause 4 adds Global Service Providers testing for BES and TRC, BES and CH, and BES and CA. These are treated as a third test area.
- Clause 5 applies H.235 Annex D with a sender and receiver stepwise approach. Clause 5.2 and 5.3 show field-by-field reading, checking, hash recomputation and integrity verification for an RRQ/registrationRequest example.
What terms does SIST-TS TS 101 888-2 V4.1.1:2004 define?
SIST-TS TS 101 888-2 V4.1.1:2004 uses the definitions from ITU-T Recommendations H.225.0, H.235, H.245 and H.323, and it lists a few abbreviations in Clause 3.
- IP means Internet Protocol, the network type covered by the security methods.
- SCN means Switched Circuit Networks, which are treated as secure by wire for signalling and media in this document.
- H.323 is the packet-based multimedia communications system used as the environment for the tests.
- H.235 is the security and encryption recommendation whose Annex D and Annex F are used for the test specifications.
- Gatekeeper is the H.323 control entity used in the signalling-path test configurations.
- Gateway is the H.323 interworking entity used in the signalling-path and media-path test configurations.
- Terminal is the endpoint used in the signalling-path and media-path test configurations.
Who uses SIST-TS TS 101 888-2 V4.1.1:2004?
SIST-TS TS 101 888-2 V4.1.1:2004 is used by equipment vendors, interoperability labs, and QA or security teams working on H.323 and VoIP systems. It is particularly useful when a team needs to verify token generation, token insertion, and integrity checks on signalling messages exchanged between terminals, gateways and gatekeepers.
Which standards are used with SIST-TS TS 101 888-2 V4.1.1:2004?
SIST-TS TS 101 888-2 V4.1.1:2004 uses these related documents:
- TR 101 888-1 - the security testing framework for TIPHON Release 4
- ITU-T H.225.0 - call signalling protocols and media stream packetization
- ITU-T H.235 - security and encryption, including Annex D and Annex F
- ITU-T H.245 - control protocol for multimedia communication
- ITU-T H.323 - packet-based multimedia communications systems
- ETSI TS 101 883 - a related TIPHON Release 3 technology mapping document listed in the bibliography
What does the SIST-TS TS 101 888-2 V4.1.1:2004 document contain?
SIST-TS TS 101 888-2 V4.1.1:2004 contains figures that show the sender and receiver steps for H.235 Annex D, plus a worked RRQ example with binary and decoded message views. Clause 5.3 walks through practical verification tasks such as identifying the IP address, reading aliases and token fields, checking OIDs, recomputing the hash and comparing the result.
The document also includes test configuration notes for Gatekeeper and Gatekeeper, with the remark that this case is similar to Terminal and Gatekeeper communication. Annex A provides the bibliography used by the specification.
Get Certified
Connect with accredited certification bodies for this standard
ANCE
Mexican certification and testing association.
Intertek Slovenia
Intertek testing, inspection, and certification services in Slovenia.
LNE (Laboratoire National de Métrologie et d'Essais)
French national laboratory for metrology and testing.
Sponsored listings
Frequently Asked Questions
SIST-TS TS 101 888-2 V4.1.1:2004 is a technical specification published by the Slovenian Institute for Standardization (SIST). Its full title is "Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON) Release 4; Security Test Specifications; Part 2: H.323 Environment". This standard covers: Detailed test specification (including evaluation of intermediate results) for the calculation of the security-token and insertion into the security field in the Call Control Flow using H.235 Annex D and H.235 Annex F.
Detailed test specification (including evaluation of intermediate results) for the calculation of the security-token and insertion into the security field in the Call Control Flow using H.235 Annex D and H.235 Annex F.
SIST-TS TS 101 888-2 V4.1.1:2004 is classified under the following ICS (International Classification for Standards) categories: 33.020 - Telecommunications in general. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST-TS TS 101 888-2 V4.1.1:2004 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-april-2004
Harmonizacija telekomunikacij in internetnega protokola prek omrežij (TIPHON), 4.
izdaja - Specifikacija varnostnega preskusa - 2. del: Okolje H.323
Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON)
Release 4; Security Test Specifications; Part 2: H.323 Environment
Ta slovenski standard je istoveten z: TS 101 888-2 Version 4.1.1
ICS:
33.020 Telekomunikacije na splošno Telecommunications in
general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
Technical Specification
Telecommunications and Internet Protocol
Harmonization Over Networks (TIPHON) Release 4;
Security Test Specifications;
Part 2: H.323 Environment
2 ETSI TS 101 888-2 V4.1.1 (2002-05)
Reference
DTS/TIPHON-06014-2R4
Keywords
H.323, IP, protocol, testing, security, VoIP
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.:+33492944200 Fax:+33 493654716
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
Individual copies of the present document can be downloaded from:
http://www.etsi.org
The present document may be made available in more than one electronic version or in print. In any case of existing or
perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF).
In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive
within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, send your comment to:
editor@etsi.fr
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2002.
All rights reserved.
ETSI
3 ETSI TS 101 888-2 V4.1.1 (2002-05)
Contents
Intellectual Property Rights.4
Foreword.4
1 Scope .5
2 References .5
3 Definitions and abbreviations.5
3.1 Definitions.5
3.2 Abbreviations .5
4 Security Test Strategy .6
5 H.235 annex D.7
5.1 Overview .7
5.2 Received message.10
5.3 Separate Steps .11
5.4 Test configurations.12
5.4.1 Gatekeeper and Terminal.12
5.4.2 Gatekeeper and Gateway .12
5.4.3 Gatekeeper and Gatekeeper .12
6 H.235 annex F .13
7 Global Service Providers.13
Annex A (informative): Bibliography.14
History .15
ETSI
4 ETSI TS 101 888-2 V4.1.1 (2002-05)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://webapp.etsi.org/IPR/home.asp).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in SR 000 314 (or the updates on the ETSI Web server)
which are, or may be, or may become, essential to the present document.
Foreword
This Technical Specification (TS) has been produced by ETSI Project Telecommunications and Internet Protocol
Harmonization Over Networks (TIPHON).
The present document is part 2 of a multi-part deliverable covering Security Test Specifications, as identified below:
Part 1: "Framework";
Part 2: "H.323 Environment".
ETSI
5 ETSI TS 101 888-2 V4.1.1 (2002-05)
1 Scope
The present document is one part of the security testing standards for which a framework is available in TR 101 888-1.
The scope of the present document is to define the security test specifications for TIPHON Release 4 for the H.323
environment.
The security methods considered in the present document are related only to IP based networks. The signalling path and
the media path in the SCN is considered to be secure ("Trust by wire").
2 References
The following documents contain provisions which, through reference in this text, constitute provisions of the present
document.
• References are either specific (identified by date of publication and/or edition number or version number) or
non-specific.
• For a specific reference, subsequent revisions do not apply.
• For a non-specific reference, the latest version applies.
[1] ITU-T Recommendation H.225.0: "Call signalling protocols and media stream packetization for
packet-based multimedia communication systems".
[2] ITU-T Recommendation H.235: "Security and encryption for H.Series (H.323 and other
H.245-based) multimedia terminals".
[3] ITU-T Recommendation H.245: "Control protocol for multimedia communication".
[4] ITU-T Recommendation H.323: "Packet-based multimedia communications systems".
3 Definitions and abbreviations
3.1 Definitions
For the purpose of the present document, the terms and definitions given in the IUT-T Recommendations H.225.0 [1],
H.235 [2], H.245 [3] and H.323 [4] apply.
3.2 Abbreviations
For the purposes of the present document, the following abbreviations apply:
AAudio
DData
IP Internet Protocol
SCN Switched Circuit Networks
ETSI
6 ETSI TS 101 888-2 V4.1.1 (2002-05)
4 Security Test Strategy
Security testing should be performed after a vendor has completed product and system testing with the ETSI testing
standards.
The basic idea for security testing is to show the generation and insertion of the security bits into the specific parameters
of the H.323 messages. Because this mechanism is exactly the same on the senders and the receiver's side, no
distinction is necessary.
To test entities for their implementation of security two entities (that are already interworking) need to be connected. In
the case of an incorrect security information it is necessary to go into the detail of the generation of the security bits. In
order to be able to determine the reason for this failure the security tests strategy is just to look at the different steps of
the generation and insertion of the security bits into the protocol elements. This is the only way to determine the failure.
The Security testing shall be performed for the following configurations:
• Signalling path:
- Gatekeeper and Terminal;
- Gatekeeper and Gateway;
- Gatekeeper and Gatekeeper.
• Media path:
- Terminal and Terminal;
- Terminal and Gateway;
- Gateway and Gateway.
• Global Service Providers:
- BES and TRC;
-BESandCH;
-BESandCA.
The security testing shall be performed in three different parts where the first part deals with the security testing for the
signalling path (Terminal, Gatekeeper, Gateway) using ITU-T Recommendation H.235 [2] annex D. The second part
deals with the security aspects for the signalling path equivalent to the first but using ITU-T Recommendation H.235 [2]
annex F and the media path using H.235. The third part handles the security testing from the BES to the global service
providers.
ETSI
7 ETSI TS 101 888-2 V4.1.1 (2002-05)
5 H.235 annex D
5.1 Overview
Figure 1 shows the basic steps to be taken at the originating entity.
H.225.0 Q.931 message
CryptoH323Token
nestedCryptoToken
CryptoHashedToken token
Default
pattern
general params
Timestamp random hash
OIDs sendersID DH algOID
ID
value
cryptoHashedToken HASHED
ASN1. Encode message
000.0000
H.225.0 Q.931 message
CryptoH323Token
password
Compuet SHA1 hash
Compute hash HMAC SHA1
H.225.0 Q.931 message
CryptoH323Token
Figure 1: Stepwise approach for sender
ETSI
8 ETSI TS 101 888-2 V4.1.1 (2002-05)
Figure 2 shows the basic steps to be taken at the receiving side starting with the entire message, decoding, breaking it
into pieces and extracting the necessary parts and the final computation/verification step.
NOTE 1: The figures just visualize the essential steps as an example and correlate with the print out in clause 5.3;
in any case, the procedures and description of H.235 [2] annex D take precedence.
NOTE 2: The figures and print out reflect H.235v1, i.e. sendersID is not used.
NOTE 3: The figures and print out reflect a scenario endpoint to gatekeeper; other scenarios and examples are not
shown.
ETSI
9 ETSI TS 101 888-2 V4.1.1 (2002-05)
H.225.0 Q.931 message
CryptoH323Token
ASN1. Decode message
H.225.0 Q.931 message
CryptoH323Token
nestedCryptoToken
CryptoHashedToken token
RV
general params
Timestamp random hash
OIDs sendersID DH algOID
ID value
3 5 6
8 11
cryptoHashedToken HASHED
000.000
11a
H.225.0 Q.931 message
CryptoH323Token
password
11b
Compute SHA1 hash
Compute hash HMAC SHA1
RV
Compare/Verify hash values
Figure 2: Stepwise approach for receiver
The example shown uses the RRQ that has been sent by a terminal and received at the gatekeeper.
• The received RRQ message in binary and with all fields shown.
• The received binary message part and the separate steps for the verification.
ETSI
10 ETSI TS 101 888-2 V4.1.1 (2002-05)
5.2 Received message
A received RRQ message with embedded Cryptotoken:
*********************************
* RECEIVE RRQ FROM EP AT GK *
*********************************
14:34:12 TPKTCHAN : Address:
14:34:12 TPKTCHAN : 0> <14> TransportAddress = (0) . <1084> CHOICE .
14:34:12 TPKTCHAN : 1> . <289> ipAddress = (0) . <1081> SEQUENCE
14:34:12 TPKTCHAN : 2> . . <290> ip = (4) '.j' =0x8b17ca6a <139.23.202.106> . <1066> OCTET
STRING (4.4)
14:34:12 TPKTCHAN : 2> . . <292> port = (1720) . <115> INTEGER (0.65535)
14:34:21 UDPCHAN : New message (channel 0) recv <-- registrationRequest:
14:34:21 UDPCHAN : Address:
14:34:2
...