{"id":54348,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","title":{"rendered":"\u00davod do architektury zabezpe\u010den\u00ed 5G: NFV, kl\u00ed\u010de a 2-faktorov\u00e1 autentizace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"\u00davod<\/a><\/noindex><\/p>\n

Je z\u0159ejm\u00e9, \u017ee za\u010d\u00ednat v\u00fdvoj nov\u00e9ho komunika\u010dn\u00edho standardu, ani\u017e bychom p\u0159em\u00fd\u0161leli o mechanismech zabezpe\u010den\u00ed, je krajn\u011b pochybn\u00e1 a bezcenn\u00e1 z\u00e1le\u017eitost.<\/p>\n

Architektura zabezpe\u010den\u00ed 5G<\/u> \u2014 soubor mechanism\u016f a bezpe\u010dnostn\u00edch procedur realizovan\u00fdch v 5. generaci s\u00edt\u00ed<\/a><\/noindex> a pokr\u00fdvaj\u00edc\u00edch v\u0161echny komponenty s\u00edt\u011b, od j\u00e1dra a\u017e po r\u00e1diov\u00e9 rozhran\u00ed. <\/p>\n

S\u00edt\u011b 5. generace jsou v podstat\u011b evoluc\u00ed s\u00edt\u00ed 4. generace LTE<\/a><\/noindex>. Nejv\u00fdznamn\u011bj\u0161\u00ed zm\u011bny se t\u00fdkaly technologi\u00ed r\u00e1diov\u00e9ho p\u0159\u00edstupu. Pro s\u00edt\u011b 5. generace byla vyvinuta nov\u00e1 RAT<\/a><\/noindex> (Technologie r\u00e1diov\u00e9ho p\u0159\u00edstupu) \u2014 5G New Radio<\/a><\/noindex>. Co se t\u00fd\u010de j\u00e1dra s\u00edt\u011b, to pro\u0161lo m\u00e9n\u011b v\u00fdznamn\u00fdmi zm\u011bnami. V d\u016fsledku toho byla architektura zabezpe\u010den\u00ed 5G s\u00edt\u00ed navr\u017eena s d\u016frazem na op\u011btovn\u00e9 pou\u017eit\u00ed p\u0159\u00edslu\u0161n\u00fdch technologi\u00ed p\u0159ijat\u00fdch ve standardu 4G LTE.<\/p>\n

Je v\u0161ak t\u0159eba zd\u016fraznit, \u017ee p\u0159ehodnocen\u00ed tak zn\u00e1m\u00fdch hrozeb, jako jsou \u00fatoky na r\u00e1diov\u00e1 rozhran\u00ed a \u00farove\u0148 signalizace (signalling<\/a><\/noindex> plane), DDoS \u00fatoky, \u00fatoky typu Man-In-The-Middle a dal\u0161\u00ed, p\u0159im\u011blo oper\u00e1tory k v\u00fdvoji nov\u00fdch standard\u016f a integraci zcela nov\u00fdch bezpe\u010dnostn\u00edch mechanism\u016f do s\u00edt\u00ed 5. generace.
\n<\/a><\/noindex>
\n\"\u00davod<\/p>\n

P\u0159edpoklady<\/h1>\n

\nV roce 2015 byl Mezin\u00e1rodn\u00edm telekomunika\u010dn\u00edm svazem zpracov\u00e1n prvn\u00ed sv\u00e9ho druhu glob\u00e1ln\u00ed pl\u00e1n rozvoje s\u00edt\u00ed p\u00e1t\u00e9 generace, a proto se ot\u00e1zka v\u00fdvoje mechanism\u016f a procedur zabezpe\u010den\u00ed v 5G s\u00edt\u00edch stala zvl\u00e1\u0161\u0165 aktu\u00e1ln\u00ed. <\/p>\n

Nov\u00e1 technologie nab\u00edzela skute\u010dn\u011b ohromuj\u00edc\u00ed rychlosti p\u0159enosu dat (v\u00edce ne\u017e 1 Gbit\/s), latenci pod 1 ms a schopnost sou\u010dasn\u00e9ho p\u0159ipojen\u00ed p\u0159ibli\u017en\u011b 1 milionu za\u0159\u00edzen\u00ed v okruhu 1 km\u00b2. Takov\u00e9 vysok\u00e9 po\u017eadavky kladen\u00e9 na s\u00edt\u011b 5. generace se projevily i v principech jejich organizace.<\/p>\n

Hlavn\u00edm z nich byla decentralizace, kter\u00e1 p\u0159edpokl\u00e1dala um\u00edst\u011bn\u00ed mnoha lok\u00e1ln\u00edch datab\u00e1z\u00ed a center jejich zpracov\u00e1n\u00ed na periferii s\u00edt\u011b. To umo\u017enilo minimalizovat latenci p\u0159i M2M<\/a><\/noindex>-komunikac\u00edch a uvoln\u011bn\u00ed j\u00e1dra s\u00edt\u011b v d\u016fsledku spr\u00e1vy obrovsk\u00e9ho mno\u017estv\u00ed IoT za\u0159\u00edzen\u00ed. T\u00edmto zp\u016fsobem se hranice s\u00edt\u00ed nov\u00e9 generace roz\u0161i\u0159ovaly a\u017e k z\u00e1kladnov\u00fdm stanic\u00edm, co\u017e umo\u017enilo vytv\u00e1\u0159et m\u00edstn\u00ed centra komunikace a poskytovat cloudov\u00e9 slu\u017eby bez rizika kritick\u00fdch zpo\u017ed\u011bn\u00ed nebo selh\u00e1n\u00ed slu\u017eby. P\u0159irozen\u011b, zm\u011bn\u011bn\u00fd p\u0159\u00edstup k organizaci s\u00edt\u00ed a obsluze z\u00e1kazn\u00edk\u016f zaujal \u00fato\u010dn\u00edky, proto\u017ee jim otev\u00edral nov\u00e9 mo\u017enosti pro \u00fatoky jak na d\u016fv\u011brn\u00e9 informace u\u017eivatel\u016f, tak na samotn\u00e9 komponenty s\u00edt\u011b s c\u00edlem zp\u016fsobit selh\u00e1n\u00ed slu\u017eby nebo si p\u0159ivlastnit v\u00fdpo\u010detn\u00ed zdroje oper\u00e1tora.<\/p>\n

Hlavn\u00ed zranitelnosti s\u00edt\u00ed 5. generace<\/h2>\n

<\/p>\n

Velk\u00e1 \u00fato\u010dn\u00e1 plocha<\/h3>\n

\nV\u00edce informac\u00ed<\/b>P\u0159i budov\u00e1n\u00ed telekomunika\u010dn\u00edch s\u00edt\u00ed 3. a 4. generace se oper\u00e1to\u0159i obvykle omezovali na spolupr\u00e1ci s jedn\u00edm nebo n\u011bkolika dodavateli, kte\u0159\u00ed ihned dod\u00e1vali komplex hardwaru a softwaru. To znamen\u00e1, \u017ee v\u0161e mohlo fungovat, jak se \u0159\u00edk\u00e1, 'z krabice' \u2013 sta\u010dilo pouze nainstalovat a nastavit za\u0159\u00edzen\u00ed zakoupen\u00e9 od dodavatele; p\u0159i\u010dem\u017e nebylo nutn\u00e9 nahrazovat ani dopl\u0148ovat propriet\u00e1rn\u00ed software. Sou\u010dasn\u00e9 tendence jdou proti takov\u00e9mu 'klasick\u00e9mu' p\u0159\u00edstupu a sm\u011b\u0159uj\u00ed k virtualizaci s\u00edt\u00ed, multivendorov\u00e9mu p\u0159\u00edstupu k jejich v\u00fdstavb\u011b a r\u016fznorodosti softwaru. St\u00e1vaj\u00ed se st\u00e1le popul\u00e1rn\u011bj\u0161\u00edmi technologie jako SDN<\/a><\/noindex> (angl. Software Defined Network) a NFV<\/a><\/noindex> (angl. Network Functions Virtualization), co\u017e vede k za\u010dlen\u011bn\u00ed obrovsk\u00e9ho mno\u017estv\u00ed softwaru, postaven\u00e9ho na z\u00e1klad\u011b otev\u0159en\u00fdch zdrojov\u00fdch k\u00f3d\u016f, do proces\u016f a funkc\u00ed spr\u00e1vy komunika\u010dn\u00edch s\u00edt\u00ed. To d\u00e1v\u00e1 \u00fato\u010dn\u00edk\u016fm mo\u017enost l\u00e9pe studovat s\u00ed\u0165 oper\u00e1tora a odhalit v\u00edce zranitelnost\u00ed, co\u017e na opl\u00e1tku zvy\u0161uje \u00fato\u010dnou plochu s\u00edt\u00ed nov\u00e9 generace v porovn\u00e1n\u00ed s t\u011bmi sou\u010dasn\u00fdmi.<\/p>\n

Velk\u00e9 mno\u017estv\u00ed IoT za\u0159\u00edzen\u00ed<\/h3>\n

\nV\u00edce informac\u00ed<\/b>Do roku 2021 bude p\u0159ibli\u017en\u011b 57 % za\u0159\u00edzen\u00ed p\u0159ipojen\u00fdch k 5G s\u00edt\u00edm tvo\u0159it IoT za\u0159\u00edzen\u00ed. To znamen\u00e1, \u017ee v\u011bt\u0161ina hostitel\u016f bude m\u00edt omezen\u00e9 kryptografick\u00e9 mo\u017enosti (viz bod 2), a tud\u00ed\u017e budou zraniteln\u00ed v\u016f\u010di \u00fatok\u016fm. Obrovsk\u00e9 mno\u017estv\u00ed takov\u00fdch za\u0159\u00edzen\u00ed zv\u00fd\u0161\u00ed riziko \u0161\u00ed\u0159en\u00ed botnet\u016f a umo\u017en\u00ed prov\u00e1d\u011bt je\u0161t\u011b mocn\u011bj\u0161\u00ed a distribuovan\u00e9 DDoS \u00fatoky.<\/p>\n

Omezen\u00e9 kryptografick\u00e9 mo\u017enosti IoT za\u0159\u00edzen\u00ed<\/h3>\n

\nV\u00edce informac\u00ed<\/b>Jak ji\u017e bylo \u0159e\u010deno, s\u00edt\u011b 5. generace aktivn\u011b vyu\u017e\u00edvaj\u00ed perifern\u00ed za\u0159\u00edzen\u00ed, kter\u00e1 umo\u017e\u0148uj\u00ed odleh\u010dit z\u00e1t\u011b\u017e z j\u00e1dra s\u00edt\u011b a t\u00edm sn\u00ed\u017eit latenci. To je nezbytn\u00e9 pro tak d\u016fle\u017eit\u00e9 slu\u017eby, jako je \u0159\u00edzen\u00ed autonomn\u00edch vozidel, syst\u00e9m nal\u00e9hav\u00e9ho upozorn\u011bn\u00ed IMS<\/a><\/noindex> a dal\u0161\u00ed, pro kter\u00e9 je zaji\u0161t\u011bn\u00ed minim\u00e1ln\u00ed latence kritick\u00e9, nebo\u0165 od toho z\u00e1vis\u00ed lidsk\u00e9 \u017eivoty. Vzhledem k p\u0159ipojen\u00ed velk\u00e9ho mno\u017estv\u00ed IoT za\u0159\u00edzen\u00ed, kter\u00e1 maj\u00ed d\u00edky sv\u00fdm mal\u00fdm rozm\u011br\u016fm a n\u00edzk\u00e9 spot\u0159eb\u011b energie velmi omezen\u00e9 v\u00fdpo\u010detn\u00ed zdroje, se s\u00edt\u011b 5G st\u00e1vaj\u00ed zraniteln\u00fdmi v\u016f\u010di \u00fatok\u016fm zam\u011b\u0159en\u00fdm na p\u0159evzet\u00ed kontroly a n\u00e1slednou manipulaci s t\u011bmito za\u0159\u00edzen\u00edmi. Nap\u0159\u00edklad jsou mo\u017en\u00e9 sc\u00e9n\u00e1\u0159e napaden\u00ed IoT za\u0159\u00edzen\u00ed, kter\u00e1 jsou sou\u010d\u00e1st\u00ed syst\u00e9mu \u201echytr\u00e1 dom\u00e1cnost<\/a><\/noindex>\u201c, takov\u00fdmi typy \u0161kodliv\u00e9ho softwaru, jako jsou Ransomware a programy-vym\u00e1ha\u010de<\/a><\/noindex>. Tak\u00e9 jsou mo\u017en\u00e9 sc\u00e9n\u00e1\u0159e p\u0159evzet\u00ed kontroly nad autonomn\u00edmi vozidly, kter\u00e1 z\u00edsk\u00e1vaj\u00ed pokyny a naviga\u010dn\u00ed informace prost\u0159ednictv\u00edm \u201ecloudu\u201c. Form\u00e1ln\u011b je tato zranitelnost zp\u016fsobena decentralizac\u00ed s\u00edt\u00ed nov\u00e9 generace, ale n\u00e1sleduj\u00edc\u00ed bod jasn\u011bji uk\u00e1\u017ee probl\u00e9m decentralizace.<\/p>\n

Decentralizace a roz\u0161i\u0159ov\u00e1n\u00ed hranic s\u00edt\u011b<\/h3>\n

\nV\u00edce informac\u00ed<\/b>Perifern\u00ed za\u0159\u00edzen\u00ed, kter\u00e1 hraj\u00ed roli m\u00edstn\u00edch jader s\u00edt\u011b, \u0159\u00edd\u00ed u\u017eivatelsk\u00fd provoz, zpracov\u00e1vaj\u00ed po\u017eadavky a tak\u00e9 prov\u00e1d\u011bj\u00ed m\u00edstn\u00ed ukl\u00e1d\u00e1n\u00ed a uchov\u00e1v\u00e1n\u00ed u\u017eivatelsk\u00fdch dat. T\u00edm se hranice s\u00edt\u00ed 5. generace roz\u0161i\u0159uj\u00ed, krom\u011b j\u00e1dra, na periferii, v\u010detn\u011b m\u00edstn\u00edch datab\u00e1z\u00ed a r\u00e1diov\u00fdch rozhran\u00ed 5G-NR (angl. 5G New Radio). To vytv\u00e1\u0159\u00ed mo\u017enost \u00fatoku na v\u00fdpo\u010detn\u00ed zdroje m\u00edstn\u00edch za\u0159\u00edzen\u00ed, kter\u00e9 jsou z principu slab\u011bji chr\u00e1n\u011bn\u00e9 ne\u017e centr\u00e1ln\u00ed uzly j\u00e1dra s\u00edt\u011b, aby vyvolaly selh\u00e1n\u00ed slu\u017eby. To m\u016f\u017ee m\u00edt za n\u00e1sledek v\u00fdpadek p\u0159\u00edstupu k internetu v cel\u00fdch oblastech, nespr\u00e1vn\u00e9 fungov\u00e1n\u00ed za\u0159\u00edzen\u00ed IoT (nap\u0159\u00edklad v syst\u00e9mu \u201echytr\u00e1 dom\u00e1cnost\u201c) a tak\u00e9 nedostupnost slu\u017eby nouzov\u00fdch upozorn\u011bn\u00ed IMS.<\/p>\n

\"\u00davod
\n
\nNicm\u00e9n\u011b v sou\u010dasnosti ETSI a 3GPP publikovaly ji\u017e v\u00edce ne\u017e 10 standard\u016f, kter\u00e9 se t\u00fdkaj\u00ed r\u016fzn\u00fdch aspekt\u016f bezpe\u010dnosti 5G s\u00edt\u00ed. Drtiv\u00e1 v\u011bt\u0161ina mechanism\u016f popsan\u00fdch tam je zam\u011b\u0159ena na ochranu p\u0159ed zranitelnostmi (v\u010detn\u011b t\u011bch, kter\u00e9 byly zm\u00edn\u011bny v\u00fd\u0161e). Jedn\u00edm z hlavn\u00edch je standard TS 23.501 verze 15.6.0<\/a><\/noindex>, kter\u00fd popisuje architekturu bezpe\u010dnosti s\u00edt\u00ed 5. generace.<\/p>\n

Architektura 5G<\/h1>\n

\n\"\u00davod
\nNejprve se zam\u011b\u0159\u00edme na kl\u00ed\u010dov\u00e9 principy architektury 5G s\u00edt\u00ed, kter\u00e9 umo\u017en\u00ed d\u00e1le pln\u011b objasnit smysl a oblasti odpov\u011bdnosti ka\u017ed\u00e9ho softwarov\u00e9ho modulu a ka\u017ed\u00e9 funkce bezpe\u010dnosti 5G.<\/p>\n