The Challenges of Next Generation Networks
Security managers need to keep pace with the risks posed by the rapid evolution of telecommunications technology. By Malcolm Shore.
Telecommunications providers globally are responding to the multiple pressures of aging telephony network equipment, consumer demand for cheaper telephony, and the emergence of services such as high speed broadband and internet protocol TV(IPTV), by introducing what has become widely known as the next generation network (NGN).
In the NGN, all services are based on the internet protocol, and telephony is delivered through voice over IP (VoIP).
The evolution to NGNs poses a number of significant security challenges including the impact on emergency calling, the use of cryptographic equipment, and the potential for VoIP flooding and other attacks . This article addresses the challenge of maintaining emergency calling.
Emergency services
Whether telecommunications are provided by private or state-owned organisations, governments require them to maintain highly reliable access to emergency services. Not having access to emergency services at the instant it is required could have severe consequences, including loss of life. Typically, governments will impose some form of regulation detailing the requirements and scope of access to emergency services, and the penalties for non-compliance. With the high-reliability design of traditional carrier grade systems, and the fact that end user landline equipment is powered from the telephone line, this has not been problematic to date.
US Govt regulation on VoIP
On 3 June 2005, the US Federal Communications Commission(FCC) regulated that VoIP providers must supply an Enhanced 911 (E911) service to customers. The provision of the E911 service is limited to those VoIP services which involve real-time, two way voice communications and which allow users to receive calls from and terminate their calls on the PSTN.
Under these requirements, providers must maintain a last-registered location for those devices capable of operating from different locations, and the FCC has indicated that in future it intends to make fully automated location information mandatory. The FCC regulations acknowledge that a power outage may compromise the user’s ability to make a 911 call through a VoIP service and require providers to advise their customers accordingly. In Canada, the emergency calling regulations apply only to those VoIP services that use the PSTN numbering plan.
In July 2007, the UK Office of Communications Regulation issued a consultation document based on the European Union regulatory framework which proposes that VoIP providers have an auto-location service and notes for consideration the issue of emergency number access during a power outage. On 5 December the VoIP regulations were confirmed, with the scope being two-way VoIP services and VoIP-out services, with an implementation date of September 2008.
The New Zealand Ministry of Economic Development has issued to the industry’s telecommunications forum a set of considerations for an emergency call service code of practice which includes high reliability, auto-location information, and adaptability to cover changes in technology. .
As of 2 November 2007, the Australian Government regulated that providers of two-way VoIP services offering PSTN dial-in and dial-out must provide access to emergency numbers.
Scope of regulation
The first major issue is the scope of regulation. It has been argued that there are two classes of full VoIP service: a dedicated VoIP telephone unit on a residential gateway, replacing the PSTN telephone; and a broadband computer-based VoIP service
The second major issue is the difficulty associated with providing an auto-location feature. Typically, emergency calling systems support provision of fixed name and address information that can be verbally confirmed at the time of the call. Although a fixed-line VoIP user’s address may be registered at the time of installation, the equipment is likely to move as users move.
Consequently, there is less assurance that the system will be able to accurately auto-locate callers who are unable to speak. Auto-location may also be difficult when initiating a VoIP call from a laptop connected through cellular data channels, although this would be a rare situation.
The third issue raised by industry is that of power outages. While PSTN phones operate using line power, VoIP phones require local power supplies. Some industry responses to consultation have suggested that carrier provision of continuity of service in a power outage may be an outdated concept. Most proposed regulations have accepted that line power will not be provided for VoIP phones and that, unless UPS is used, access to emergency calling will be lost in the event of a power outage.
The emergence of VoIP services, and in particular the evolution to next generation networks, has implications for security. The issue of access to emergency numbers is one which is currently being addressed by governments through proposed (and in some cases enacted) regulation. However, accurate autolocation information provided in an emergency call data is difficult when customer premise equipment can be readily moved, and this issue is one which both government regulators and industry have yet to resolve.
About the author: Dr Malcolm Shore is a Technology Strategist with Telecom New Zealand and an Adjunct Senior Fellow at Canterbury University. His background includes a career in the RNZAF followed by service in the Government Communications Security Bureau as Director of Information Systems Security.