{"id":54348,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-arhitekturu-bezopasnosti-5g-nfv-klyuchi-i-2-autentifikatsii","title":{"rendered":"Hyrje n\u00eb arkitektur\u00ebn e siguris\u00eb 5G: NFV, \u00e7el\u00ebsat dhe 2 autentifikimet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Hyrje<\/a><\/noindex><\/p>\n

Evident, taking on the development of a new communication standard without considering security mechanisms is an extraordinarily questionable and useless endeavor.<\/p>\n

Arkitektur\u00ebn e Siguris\u00eb 5G<\/u> \u2014 nj\u00eb kombim mekanizmash dhe procedurash sigurie, t\u00eb realizuara n\u00eb rrjetet e gjenerat\u00ebs s\u00eb pest\u00eb<\/a><\/noindex> dhe q\u00eb p\u00ebrfshijn\u00eb t\u00eb gjitha komponent\u00ebt e rrjetit, duke filluar nga b\u00ebrthama dhe duke p\u00ebrfunduar me nd\u00ebrfaqet radio. <\/p>\n

Rrjetet e gjenerat\u00ebs s\u00eb pest\u00eb jan\u00eb, n\u00eb thelb, nj\u00eb evolucion i rrjeteve t\u00eb gjenerat\u00ebs s\u00eb kat\u00ebrt LTE.<\/a><\/noindex>. Ndryshimet m\u00eb t\u00eb r\u00ebnd\u00ebsishme ndodh\u00ebn n\u00eb teknologjit\u00eb e qasjes radio. Nj\u00eb RAT<\/a><\/noindex> (Teknologjia e Qasjes Radio) \u2014 5G New Radio<\/a><\/noindex>. Sa i p\u00ebrket b\u00ebrtham\u00ebs s\u00eb rrjetit, ajo ka kaluar n\u00ebp\u00ebr nd\u00ebrrime jo aq t\u00eb r\u00ebnd\u00ebsishme. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, arkitektura e siguris\u00eb s\u00eb rrjeteve 5G u zhvillua me theks t\u00eb ve\u00e7ant\u00eb n\u00eb rip\u00ebrdorimin e teknologjive p\u00ebrkat\u00ebse, t\u00eb pranuara n\u00eb standardin 4G LTE.<\/p>\n

Megjithat\u00eb, vlen t\u00eb theksohet se rishikimi i k\u00ebrc\u00ebnimeve t\u00eb njohura si sulmet n\u00eb nd\u00ebrfaqet radio dhe nivelin e sinjalizimit (signalling<\/a><\/noindex> plane), sulmet DDOS, sulmet Man-In-The-Middle dhe t\u00eb tjera, ka nxitur operator\u00ebt e komunikimit t\u00eb zhvillojn\u00eb standarde t\u00eb reja dhe t\u00eb integrojn\u00eb mekanizma t\u00eb rinj sigurie n\u00eb rrjetet e gjenerat\u00ebs s\u00eb pest\u00eb.
\n<\/a><\/noindex>
\n\"Hyrje<\/p>\n

Parakushtet<\/h1>\n

\nN\u00eb vitin 2015, Bashkimi Nd\u00ebrkomb\u00ebtar i Telekomunikacioneve p\u00ebrgatiti planin e par\u00eb global p\u00ebr zhvillimin e rrjeteve t\u00eb gjenerat\u00ebs s\u00eb pest\u00eb, p\u00ebr shkak t\u00eb t\u00eb cilit \u00e7\u00ebshtja e zhvillimit t\u00eb mekanizmave dhe procedurave t\u00eb siguris\u00eb n\u00eb rrjetet 5G u b\u00eb ve\u00e7an\u00ebrisht urgjente. <\/p>\n

Teknologjia e re ofronte shpejt\u00ebsi t\u00eb v\u00ebrteta mbres\u00ebl\u00ebn\u00ebse t\u00eb transferimit t\u00eb t\u00eb dh\u00ebnave (m\u00eb shum\u00eb se 1 Gbit\/s), vonesa m\u00eb pak se 1 ms dhe mund\u00ebsin\u00eb p\u00ebr t'u lidhur me nj\u00eb num\u00ebr rreth 1 milion pajisjesh brenda nj\u00eb rrethi prej 1 km2. K\u00ebto k\u00ebrkesa tep\u00ebr t\u00eb larta q\u00eb i'u bashkuan rrjeteve t\u00eb gjenerat\u00ebs s\u00eb pest\u00eb ndikuan gjithashtu n\u00eb principet e organizimit t\u00eb tyre.<\/p>\n

E r\u00ebnd\u00ebsishme ishte decetralizimi, i cili p\u00ebrfshinte vendosjen e nj\u00eb numri t\u00eb madh t\u00eb bazave t\u00eb dh\u00ebnash lokale dhe qendrave t\u00eb p\u00ebrpunimit n\u00eb periferin\u00eb e rrjetit. Kjo lejonte minimizimin e vonesave n\u00eb M2M<\/a><\/noindex>-komunikimeve dhe t\u00eb leht\u00ebsoj\u00eb b\u00ebrtham\u00ebn e rrjetit p\u00ebr shkak t\u00eb sh\u00ebrbimit t\u00eb nj\u00eb numri t\u00eb madh t\u00eb pajisjeve IoT. K\u00ebshtu, kufiri i rrjeteve t\u00eb gjenerat\u00ebs s\u00eb re \u00ebsht\u00eb zgjeruar deri n\u00eb stacionet baz\u00eb, duke lejuar krijimin e qendrave lokale t\u00eb komunikimit dhe ofrimin e sh\u00ebrbimeve n\u00eb re pa rrezikun e vonesave kritike ose mossh\u00ebrbimit. Natyrisht, qasja e ndryshuar p\u00ebr organizimin e rrjeteve dhe sh\u00ebrbimin ndaj klient\u00ebve ka t\u00ebrhequr interesin e keqb\u00ebr\u00ebsve, pasi ka hapur mund\u00ebsi t\u00eb reja p\u00ebr sulme ndaj informacionit t\u00eb ndjesh\u00ebm t\u00eb p\u00ebrdoruesve, si dhe ndaj komponenteve t\u00eb vet\u00eb rrjetit me q\u00ebllim p\u00ebr t\u00eb shkaktuar mossh\u00ebrbim ose p\u00ebr t\u00eb kapur burimet kompjuterike t\u00eb operatorit.<\/p>\n

Vulnerabilitetet kryesore t\u00eb rrjeteve t\u00eb gjenerat\u00ebs s\u00eb 5-t\u00eb<\/h2>\n

<\/p>\n

Sip\u00ebrfaqja e madhe e sulmit<\/h3>\n

\nM\u00eb shum\u00eb<\/b>Kur nd\u00ebrtojn\u00eb rrjete telekomunikacionesh t\u00eb gjenerat\u00ebs s\u00eb 3-t\u00eb dhe 4-t\u00eb, operator\u00ebt e komunikimit zakonisht kufizoheshin n\u00eb pun\u00ebn me nj\u00eb ose disa furnizues, t\u00eb cil\u00ebt menj\u00ebher\u00eb ofronin nj\u00eb kompleks t\u00eb pajisjeve harduerike dhe softuerike. K\u00ebshtu, gjith\u00e7ka mund t\u00eb funksiononte, si\u00e7 quhet, \"nga kutia\" \u2014 mjaftonte t\u00eb instalohej dhe konfigurohej pajisja e bler\u00eb nga furnizuesi; n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, nuk kishte nevoj\u00eb t\u00eb z\u00ebvend\u00ebsohej ose t\u00eb plot\u00ebsohej softueri pronar. Tendencat moderne shkojn\u00eb n\u00eb kund\u00ebrshtim me k\u00ebt\u00eb qasje \"klasike\" dhe jan\u00eb t\u00eb orientuara drejt virtualizimit t\u00eb rrjeteve, qasjes multi-furnizues n\u00eb nd\u00ebrtimin e tyre dhe diversitetit t\u00eb softuerit. Teknologjit\u00eb si SDN<\/a><\/noindex> (angl. Software Defined Network) dhe NFV<\/a><\/noindex> (angl. Network Functions Virtualization), \u00e7ojn\u00eb n\u00eb p\u00ebrfshirjen e nj\u00eb numri t\u00eb madh softueresh t\u00eb nd\u00ebrtuara n\u00eb baz\u00eb t\u00eb kodit t\u00eb hapur n\u00eb proceset dhe funksionet e menaxhimit t\u00eb rrjeteve t\u00eb komunikimit. Kjo u jep keqb\u00ebr\u00ebsve mund\u00ebsi t\u00eb studiuar m\u00eb mir\u00eb rrjetin e operatorit dhe t\u00eb identifikojn\u00eb nj\u00eb num\u00ebr m\u00eb t\u00eb madh vulnerabilitetesh, q\u00eb nga ana e saj rrit sip\u00ebrfaqen e sulmit t\u00eb rrjeteve t\u00eb gjenerat\u00ebs s\u00eb re krahasuar me aktualit.<\/p>\n

Numri i madh i pajisjeve IoT<\/h3>\n

\nM\u00eb shum\u00eb<\/b>Deri n\u00eb vitin 2021, rreth 57% e pajisjeve q\u00eb jan\u00eb t\u00eb lidhura me rrjetet 5G do t\u00eb p\u00ebrb\u00ebhen nga pajisje IoT. Kjo do t\u00eb thot\u00eb se shumica e host\u00ebve do t\u00eb ken\u00eb kapacitete t\u00eb kufizuara kriptografike (shih pik\u00ebn 2) dhe, p\u00ebr pasoj\u00eb, do t\u00eb jen\u00eb t\u00eb ndjesh\u00ebm ndaj sulmeve. Nj\u00eb num\u00ebr jasht\u00ebzakonisht i madh i k\u00ebtyre pajisjeve do t\u00eb rris\u00eb rrezikun e p\u00ebrhapjes s\u00eb botnet\u00ebve dhe do t\u00eb mund\u00ebsoj\u00eb realizimin e sulmeve DDoS edhe m\u00eb t\u00eb fuqishme dhe t\u00eb shp\u00ebrndara.<\/p>\n

Kapacitetet e kufizuara kriptografike t\u00eb pajisjeve IoT<\/h3>\n

\nM\u00eb shum\u00eb<\/b>Si\u00e7 u p\u00ebrmend tashm\u00eb, rrjetet e brezit t\u00eb pest\u00eb angazhojn\u00eb aktivisht pajisje periferike, t\u00eb cilat lejojn\u00eb q\u00eb nj\u00eb pjes\u00eb e ngarkes\u00ebs t\u00eb hiqet nga b\u00ebrthama e rrjetit dhe k\u00ebshtu t\u00eb reduktohet vonesa. Kjo \u00ebsht\u00eb e nevojshme p\u00ebr sh\u00ebrbime shum\u00eb t\u00eb r\u00ebnd\u00ebsishme si menaxhimi i automjeteve autonom\u00eb, sistemi i alarmit t\u00eb emergjencave IMS<\/a><\/noindex> e t\u00eb tjer\u00eb, p\u00ebr t\u00eb cilat sigurimi i vones\u00ebs minimale \u00ebsht\u00eb kritik, pasi nga kjo varen jet\u00ebt e njer\u00ebzve. Duke pasur parasysh lidhjen e numrit t\u00eb madh t\u00eb pajisjeve IoT, t\u00eb cilat, p\u00ebr shkak t\u00eb p\u00ebrmasave t\u00eb tyre t\u00eb vogla dhe konsumit t\u00eb ul\u00ebt t\u00eb energjis\u00eb, kan\u00eb burime shum\u00eb t\u00eb kufizuara kompjuterike, rrjetet 5G b\u00ebhen t\u00eb ndjeshme ndaj sulmeve q\u00eb synojn\u00eb t\u00eb kapin kontrollin dhe t\u00eb manipulojn\u00eb k\u00ebto pajisje. P\u00ebr shembull, jan\u00eb t\u00eb mundshme skenar\u00eb infektimi t\u00eb pajisjeve IoT q\u00eb jan\u00eb pjes\u00eb e sistemit \"sht\u00ebpia e men\u00e7ur<\/a><\/noindex>\", me lloje t\u00eb tilla t\u00eb softuerit t\u00eb d\u00ebmsh\u00ebm si Ransomware dhe programet k\u00ebrkuese<\/a><\/noindex>. Gjithashtu jan\u00eb t\u00eb mundshme skenar\u00eb t\u00eb kapjes s\u00eb kontrollit t\u00eb automjeteve autonom\u00eb, t\u00eb cilat marrin komandat dhe informacionin e navigimit p\u00ebrmes \"retheve\". Formalisht, kjo ndjeshm\u00ebri \u00ebsht\u00eb e shkaktuar nga decentralizimi i rrjeteve t\u00eb brezit t\u00eb ri, por pika e ardhshme do t\u00eb sakt\u00ebsoj\u00eb problemin e decentralizimit m\u00eb qart\u00eb.<\/p>\n

Decentralizimi dhe zgj\u00ebrimi i kufijve t\u00eb rrjetit<\/h3>\n

\nM\u00eb shum\u00eb<\/b>Dispositivat periferik q\u00eb luajn\u00eb rolin e nyjeve lokale n\u00eb rrjet, kryejn\u00eb rutarizimin e trafikut t\u00eb p\u00ebrdoruesit, p\u00ebrpunimin e k\u00ebrkesave, si dhe ruajtjen dhe memorizimin lokal t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve. K\u00ebshtu, kufijt\u00eb e rrjeteve t\u00eb gjenerat\u00ebs s\u00eb 5-t\u00eb shtrihen jo vet\u00ebm n\u00eb b\u00ebrtham\u00eb, por edhe n\u00eb periferi, duke p\u00ebrfshir\u00eb bazat lokale t\u00eb t\u00eb dh\u00ebnave dhe nd\u00ebrfaqet radio 5G-NR (5G New Radio). Kjo krijon mund\u00ebsi p\u00ebr sulm ndaj burimeve kompjuterike t\u00eb pajisjeve lokale, t\u00eb cilat p\u00ebr nga natyra mbrohen m\u00eb dob\u00ebt se nyjet qendrore t\u00eb b\u00ebrtham\u00ebs s\u00eb rrjetit, me q\u00ebllim p\u00ebr t\u00eb shkaktuar nj\u00eb nd\u00ebrprese t\u00eb sh\u00ebrbimit. Kjo mund t\u00eb \u00e7oj\u00eb n\u00eb ndalimin eaksesit n\u00eb internet t\u00eb t\u00ebr\u00eb zonave, funksionimin e pasakt\u00eb t\u00eb pajisjeve IoT (p.sh., n\u00eb sistemin \"smart home\"), si dhe pamund\u00ebsin\u00eb e sh\u00ebrbimeve t\u00eb njoftimit t\u00eb urgjencave IMS.<\/p>\n

\"Hyrje
\n
\nMegjithat\u00eb, n\u00eb k\u00ebt\u00eb moment ETSI dhe 3GPP kan\u00eb publikuar m\u00eb shum\u00eb se 10 standarde q\u00eb prekin aspekte t\u00eb ndryshme t\u00eb siguris\u00eb s\u00eb rrjeteve 5G. Shumica d\u00ebrrmuese e mekanizmave t\u00eb p\u00ebrshkruar aty jan\u00eb t\u00eb orientuar n\u00eb mbrojtjen nga dob\u00ebsit\u00eb (p\u00ebrfshir\u00eb ato t\u00eb p\u00ebrmendura m\u00eb lart). Nj\u00eb nga standardet kryesore \u00ebsht\u00eb TS 23.501 versioni 15.6.0<\/a><\/noindex>, i cili p\u00ebrshkruan arkitektur\u00ebn e siguris\u00eb p\u00ebr rrjetet e gjenerat\u00ebs s\u00eb 5-t\u00eb.<\/p>\n

Arkitektura 5G<\/h1>\n

\n\"Hyrje
\nP\u00ebr t\u00eb filluar, le t\u00eb shqyrtojm\u00eb parimet ky\u00e7e t\u00eb arkitektur\u00ebs s\u00eb rrjeteve 5G, t\u00eb cilat do t\u00eb lejojn\u00eb q\u00eb m\u00eb tej t\u00eb zhvillojm\u00eb plot\u00ebsisht kuptimin dhe fushat e p\u00ebrgjegj\u00ebsis\u00eb s\u00eb \u00e7do moduli softueror dhe \u00e7do funksioni t\u00eb siguris\u00eb 5G.<\/p>\n