SIST EN 301 002-1:2000

• Abstract:

  definition of the DSS1 protocol for the PIN security tool as defined by NA1

• Status: Published
• Publication Date: 30-Nov-2000
• ICS: 33.080 - Integrated Services Digital Network (ISDN)
• Technical Committee: SPS - Signalling protocols and switching
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-Dec-2000
• Due Date: 01-Dec-2000
• Completion Date: 01-Dec-2000
• Ref Project: ETSI EN 301 002-1 V1.2.4 (1998-10) - Integrated Services Digital Network (ISDN); Security tools (SET) procedures; Digital Subscriber Signalling System No. one (DSS1) protocol; Part 1: Protocol specification

SIST EN 301 002-1:2000 is the Slovenian adoption of EN 301 002-1 V1.2.4, an ETSI standard for the Digital Subscriber Signalling System No. one (DSS1) protocol used by Security tools (SET) procedures in Integrated Services Digital Network (ISDN). It specifies the stage 3 protocol behaviour for PIN-based SET procedures, so implementers can see how the user side and network side exchange signalling at the T reference point or coincident S and T reference point.

What does SIST EN 301 002-1:2000 specify?

SIST EN 301 002-1:2000 specifies the DSS1 protocol for the PIN security tool defined by NA1. The scope covers protocol procedures and switching functions for SET in public ISDN, and it also gives the protocol requirements when the service is provided through an intermediate private ISDN at the T reference point.

The document is organized into clauses for scope, references, definitions, abbreviations, description, operational requirements, coding requirements, state definitions, signalling procedures, interworking with private ISDNs, interaction with other networks, interaction with other supplementary services, timer values, and SDL diagrams. Annex A gives signalling flows, and Annex B assigns object identifier values.

Annex	What it covers
Annex A	Signalling flows for PIN registration
Annex B	Assignment of object identifier values

What are the key requirements of SIST EN 301 002-1:2000?

SIST EN 301 002-1:2000 centers on PIN registration, PIN use during telecommunication service access, and the signalling needed to support those actions. In practice, it tells the implementer what message to send, what the network returns, what errors can happen, and how long the user waits for a response.

PIN registration and change control

• Clause 6 says the SET procedures are provided together with certain telecommunication services and begin with initial PIN registration by the network provider after the served user selects the PIN. This matters because the PIN is not just a local setting - it is a network-managed security value.
• The PIN is linked either to an ISDN number or to an access or set of accesses, depending on how the service is provided. For implementation, that decides whether a PIN follows a single number or the whole access.
• The PIN must be at least 4 alphanumeric characters and may be up to 12 characters, with the exact upper limit treated as a network option. This sets the data validation rules for terminals and network nodes.
• The served user can change the PIN after initial provision by using the ModifyPin invoke component. The network replaces the existing PIN with the new one after a successful request.

Signalling, coding and error handling

• Clause 7 requires all invoke, return result, return error and reject components to be carried in a Facility information element. That tells the implementer where the SET data sits in DSS1 messages.
• The protocol uses ASN.1 with OPERATION and ERROR definitions for ModifyPin, PossibleFraudulentUse and the related error values. Annex B assigns the object identifier values used for those operations and errors.
• Clause 9.3.2 defines the main ModifyPin error values, including invalidServedUserNr, PinNotProvided, UserControlBlocked, InvalidPin, InvalidNewPin, PrimitivePin and NewPinIsOldPin. This is the core of interoperability: systems must map each failure condition to the right error.
• When the network cannot complete registration, it returns a ModifyPin return error and goes back to Idle. When registration succeeds, it returns a ModifyPin return result and the served user stops timer T-REGISTRATE.

State handling, timers and exceptional cases

• Clause 8 defines the request states used for PIN registration on the user side and the network side. The state model matters because the protocol is transaction-based and both sides must know when a request is active.
• Clause 13 defines timer T-REGISTRATE with a 4-second timeout. The user starts the timer when sending ModifyPin and returns to Idle if no response arrives in time.
• If a reject component arrives, the user stops T-REGISTRATE and returns to the prior state. If a DL-RELEASE-INDICATION arrives during the request, registration is aborted without informing the other side.

Fraud notification and private ISDN handling

• Clause 6 and clause 9.7 make notification of possible fraudulent use a network option. When enabled, the network sends PossibleFraudulentUse after invalid PIN attempts below the blocking limit N, or in the specific reinitialization case described by the standard.
• Clause 10 adapts the procedure for private ISDNs. For registration at the T reference point, the request applies to the whole private ISDN access, and servedUserNr is ignored.
• For some private ISDN cases, the network includes a Called party number information element in the FACILITY message when sending the fraudulent-use notification. That gives the receiving side the number context needed for the alert.

What terms does SIST EN 301 002-1:2000 define?

SIST EN 301 002-1:2000 defines the key protocol and service terms used in SET signalling.

• Integrated Services Digital Network (ISDN) - The ISDN defined by ITU-T Recommendation I.112 and used as the service environment for this protocol.
• ISDN number - A number that follows the numbering plan and structure of ITU-T Recommendation E.164.
• security tool - The SET function described in EN 301 132, used to provide security for a telecommunication service.
• served user - The user who receives the SET procedures together with a telecommunication service.
• user - The DSS1 protocol entity on the user side of the user-network interface.
• network - The DSS1 protocol entity on the network side of the user-network interface.
• Personal Identification Number (PIN) - The alphanumeric security value used by the served user when accessing the telecommunication service.
• Operation And Maintenance (OAM) - The network maintenance activity used here for marking an existing PIN as expired.

Who uses SIST EN 301 002-1:2000?

SIST EN 301 002-1:2000 is used by equipment designers, network operators, and service providers that implement PIN-based security for ISDN services. It is also relevant to test laboratories and conformance teams because the foreword says later parts of the series define the PICS, TSS&TP, ATS and PIXIT material used for testing.

In practice, a network vendor uses it to implement the DSS1 procedures for registration, error reporting and fraudulent-use notification. A terminal or access-device vendor uses it to build the user-side behaviour at the T reference point or coincident S and T reference point. A buyer or quality manager uses it to check whether equipment supports the SET procedures needed for a given ISDN service.

Which standards are used with SIST EN 301 002-1:2000?

SIST EN 301 002-1:2000 depends on several standards for reference configurations, encoding, remote operations and signalling description.

• EN 300 196-1 - Provides the generic functional protocol for supplementary services and the common DSS1 component handling used by SET.
• ITU-T Recommendation I.411 - Defines the ISDN user-network reference configurations used for the T reference point and coincident S and T reference point.
• CCITT Recommendation X.208 - Provides ASN.1, which is used for the formal operation and error definitions.
• CCITT Recommendation X.219 - Provides the remote operations model, notation and service definition used for the operation and error macros.
• ITU-T Recommendation Z.100 - Provides SDL, which is used for the dynamic description diagrams.
• EN 301 132 - Supplies the service-level description of SET for telecommunication services and is the companion part referenced in the definitions and foreword.

What does the SIST EN 301 002-1:2000 document contain?

SIST EN 301 002-1:2000 contains the protocol specification for SET PIN handling, plus the supporting formal models and diagrams needed to implement it. Clause 7 gives the ASN.1 definitions for operations, errors and object identifiers, while clause 13 gives the timer value for PIN registration.

The document also contains state definitions for PIN registration, detailed signalling procedures for activation, deactivation, registration, erasure, interrogation, invocation and notification, and SDL diagrams showing user-side and network-side behaviour. Annex A provides a signalling flow for PIN registration, and Annex B lists the object identifier assignments used by the protocol.

SLOVENSKI STANDARD
3SIST EN 301 002-1:
01-december-
'LJLWDOQRRPUHåMH]LQWHJULUDQLPLVWRULWYDPL,6'13RVWRSNLYDURYDOQHJDRURGMD
6(73URWRNROGLJLWDOQHQDURþQLãNHVLJQDOL]DFLMHãW'66GHO
6SHFLILNDFLMDSURWRNROD
Integrated Services Digital Network (ISDN); Security tools (SET) procedures; Digital
Subscriber Signalling System No. one (DSS1) protocol; Part 1: Protocol specification
Ta slovenski standard je istoveten z: EN 301 002-1 V1.2.4
ICS:
33.080 Digitalno omrežje z Integrated Services Digital
integriranimi storitvami Network (ISDN)
(ISDN)
3SIST EN 301 002-1: en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN 301 002-1 V1.2.4 (1998-10)
European Standard (Telecommunications series)
Integrated Services Digital Network (ISDN);
Security tools (SET) procedures;
Digital Subscriber Signalling System No. one (DSS1) protocol;
Part 1: Protocol specification

2 EN 301 002-1 V1.2.4 (1998-10)
Reference
DEN/SPS-05123-1 (9a090iqo.PDF)
Keywords
ISDN, DSS1, security, protocol
ETSI
Postal address
F-06921 Sophia Antipolis Cedex - FRANCE
Office address
650 Route des Lucioles - Sophia Antipolis
Valbonne - FRANCE
Tel.: [phone]  Fax: [phone]
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Internet
[e-mail]
http://www.etsi.org
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 1998.
All rights reserved.
ETSI
3 EN 301 002-1 V1.2.4 (1998-10)
Contents
Intellectual Property Rights.4
Foreword .4
1 Scope.6
2 References.6
2.1 Normative references. 6
2.2 Informative references . 7
3 Definitions.7
4 Abbreviations.7
5 Description.8
6 Operational requirements.8
6.1 Provision and withdrawal. 8
6.2 Requirements on the originating network side. 8
6.3 Requirements on the destination network side. 8
7 Coding requirements .9
7.1 Coding of the Facility information element components . 9
7.2 Coding of the information elements. 10
8 State definitions .10
9 Signalling procedures at the coincident S and T reference point .10
9.1 Activation . 10
9.2 Deactivation. 11
9.3 Registration. 11
9.3.1 Normal operation . 11
9.3.2 Exceptional procedures . 12
9.4 Erasure. 12
9.5 Interrogation . 12
9.6 Invocation and operation . 13
9.6.1 Normal operation . 13
9.6.2 Exceptional procedures . 13
9.7 Notification of possible fraudulent use . 13
10 Procedures for interworking with private ISDNs .13
11 Interaction with other networks .14
12 Interaction with other supplementary services.14
13 Parameter values (timers).14
14 Dynamic description (SDL diagrams) .14
Annex A (informative): Signalling flows.19
Annex B (informative): Assignment of object identifier values.20
History.21
ETSI
4 EN 301 002-1 V1.2.4 (1998-10)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect
of ETSI standards", which is available free of charge from the ETSI Secretariat. Latest updates are available on the
ETSI Web server (http://www.etsi.org/ipr).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in SR 000 314 (or the updates on the ETSI Web server)
which are, or may be, or may become, essential to the present document.
Foreword
This European Standard (Telecommunications series) has been produced by ETSI Technical Committee Signalling
Protocols and Switching (SPS).
The present document is part 1 of a multi-part standard covering the Digital Subscriber Signalling System No. one
(DSS1) protocol specification for the Integrated Services Digital Network (ISDN) Security tools (SET) procedures, as
described below:
Part 1: "Protocol specification";
Part 2: "Protocol Implementation Conformance Statement (PICS) proforma specification";
Part 3: "Test Suite Structure and Test Purposes (TSS&TP) specification for the user";
Part 4: "Abstract Test Suite (ATS) and partial Protocol Implementation eXtra Information for Testing (PIXIT)
proforma specification for the user";
Part 5: "Test Suite Structure and Test Purposes (TSS&TP) specification for the network";
Part 6: "Abstract Test Suite (ATS) and partial Protocol Implementation eXtra Information for Testing (PIXIT)
proforma specification for the network".
In accordance with CCITT Recommendation I.130, the following three level structure is used to describe the
supplementary telecommunication services as provided by European public telecommunications operators under the
pan-European ISDN:
- Stage 1: is an overall service description, from the user's standpoint;
- Stage 2: identifies the functional capabilities and information flows needed to support the service described in
stage 1; and
- Stage 3: defines the signalling system protocols and switching functions needed to implement the service
described in stage 1.
The present document details the stage 3 aspects (signalling system protocols and switching functions) needed to
support the SET procedures. The stage 1 aspects are detailed in EN 301 132.
NOTE: Currently no stage 2 document exists.
ETSI
5 EN 301 002-1 V1.2.4 (1998-10)
National transposition dates
Date of adoption of this EN: 30 October 1998
Date of latest announcement of this EN (doa): 31 January 1999
Date of latest publication of new National Standard
or endorsement of this EN (dop/e): 31 July 1999
Date of withdrawal of any conflicting National Standard (dow): 31 July 1999
ETSI
6 EN 301 002-1 V1.2.4 (1998-10)
1 Scope
This first part of EN 301 002 specifies the stage three of the Security tools (SET) procedures for the pan-European
Integrated Services Digital Network (ISDN) as provided by the European public telecommunications operators at the
T reference point or coincident S and T reference point (as defined in ITU-T Recommendation I.411 [2]) by means of
the Digital Subscriber Signalling System No. one (DSS1) protocol. Stage three identifies the protocol procedures and
switching functions needed to support a telecommunications service (see CCITT Recommendation I.130 [10]).
In addition, the present document specifies the protocol requirements at the T reference point where the service is
provided to the user via an intermediate private ISDN.
The present document does not specify the additional protocol requirements where the service is provided to the user via
a telecommunications network that is not an ISDN.
The SET procedures are a means of providing an appropriate level of security and protection to the user of a given
telecommunication service.
Further parts of the present document specify the method of testing required to identify conformance to the present
document.
The present document is applicable to equipment supporting the SET procedures, to be attached at either side of a
T reference point or coincident S and T reference point when used as an access to the public ISDN.
2 References
References may be made to:
a) specific versions of publications (identified by date of publication, edition number, version number, etc.), in
which case, subsequent revisions to the referenced document do not apply; or
b) all versions up to and including the identified version (identified by "up to and including" before the version
identity); or
c) all versions subsequent to and including the identified version (identified by "onwards" following the version
identity); or
d) publications without mention of a specific version, in which case the latest version applies.
A non-specific reference to an ETS shall also be taken to refer to later versions published as an EN with the same
number.
2.1 Normative references
[1] EN 300 196-1: "Integrated Services Digital Network (ISDN); Generic functional protocol for the
support of supplementary services; Digital Subscriber Signalling System No. one (DSS1) protocol;
Part 1: Protocol specification".
[2] ITU-T Recommendation I.411 (1993): "ISDN user-network interfaces; Reference configurations".
[3] CCITT Recommendation X.208 (1988): "Specification of Abstract Syntax Notation One
(ASN.1)".
[4] CCITT Recommendation X.219 (1988): "Remote operations: Model, notation and service
definition".
[5] ITU-T Recommendation Z.100 (1993): "Specification and Description Language (SDL)".
ETSI
7 EN 301 002-1 V1.2.4 (1998-10)
2.2 Informative references
[6] EN 301 132: "Integrated Services Digital Network (ISDN); Security tools (SET) for use within
telecommunication services".
[7] ETR 232 (1995): "Security Techniques Advisory Group (STAG); Glossary of security
terminology".
[8] ITU-T Recommendation E.164 (1997): "The international public telecommunications numbering
plan".
[9] ITU-T Recommendation I.112 (1993): "Vocabulary of terms for ISDNs".
[10] CCITT Recommendation I.130 (1988): "Method for the characterization of telecommunication
services supported by an ISDN and network capabilities of an ISDN".
[11] ITU-T Recommendation I.210 (1993): "Principles of telecommunication services supported by an
ISDN and the means used to describe them".
3 Definitions
For the purposes of the present document, the following definitions apply:
Integrated Services Digital Network (ISDN): See ITU-T Recommendation I.112 [9], definition 308.
ISDN number: A number conforming to the numbering plan and structure specified in ITU-T Recommendation
E.164 [8].
invoke component: See EN 300 196-1 [1], subclause 8.2.2.1. Where reference is made to a "xxxx" invoke component,
an invoke component is meant with its operation value set to the value of the operation "xxxx".
network: The DSS1 protocol entity at the network side of the user-network interface.
Personal Identification Number (PIN): See ETR 232 [7].
reject component: See EN 300 196-1 [1], subclause 8.2.2.4.
return error component: See EN 300 196-1 [1], subclause 8.2.2.3. Where reference is made to a "xxxx" return error
component, a return error component is meant which is related to a "xxxx" invoke component.
return result component: See EN 300 196-1 [1], subclause 8.2.2.2. Where reference is made to a "xxxx" return result
component, a return result component is meant which is related to a "xxxx" invoke component.
security tool: See EN 301 132 [6], clause 3.
served user: The user to whom the SET procedures are provided in combination with a telecommunication service.
service; telecommunication service: See ITU-T Recommendation I.112 [9], definition 201.
supplementary service: See ITU-T Recommendation I.210 [11], subclause 2.4.
user: The DSS1 protocol entity at the user side of the user-network interface.
4 Abbreviations
For the purposes of the present document, the following abbreviations apply:
ASN.1 Abstract Syntax Notation one
DSS1 Digital Subscriber Signalling System No. one
ISDN Integrated Services Digital Network
OAM Operation And Maintenance
ETSI
8 EN 301 002-1 V1.2.4 (1998-10)
PIN Personal Identification Number
SDL Specification and Description Language
SET Security Tools
5 Description
The SET procedures allow a served user to be provided with a PIN. The PIN is used when accessing a
telecommunication service to ensure that this service is used with an appropriate level of security. The served user can
change the PIN at any time after initial provision.
6 Operational requirements
6.1 Provision and withdrawal
The SET procedures shall be provided in connection with the provision of certain telecommunication services, and shall
consists of the initial registration of the PIN. This initial registration is performed by the network provider, after
selection of the PIN by the served user. The PIN shall either be related to an ISDN number, or to an access or set of
accesses, depending on how the telecommunication service using the PIN, is provided. The PIN shall consist of a
minimum of 4 alphanumeric characters. The maximum number of characters is a network option, but shall not exceed 12
alphanumeric characters.
Withdrawal of the SET procedures is outside the scope of the present document.
The served user may, as a network option , be notified when one or more attempts (but less than the blocking limit N
whereby all procedures using the PIN are blocked) have been made to use an invalid PIN, either during the operation of
a telecommunication service using the PIN, or during the PIN registration procedure. The blocking limit N whereby all
procedures using the PIN are blocked, is also a network option.
The network options are summarized in table 1.
Table 1: Network options for the SET procedures
Network option Value
Notification of possible fraudulent use no
yes
Maximum number of PIN characters 4 to 12
Blocking limit N‡ 3
6.2 Requirements on the originating network side
Not applicable.
6.3 Requirements on the destination network side
Not applicable.
ETSI
9 EN 301 002-1 V1.2.4 (1998-10)
7 Coding requirements
7.1 Coding of the Facility information element components
Table 2 shows the definitions of the operations and errors required for the SET procedures using ASN.1 as specified in
CCITT Recommendation X.208 [3] and using the OPERATION and ERROR macro as defined in figure 4 of
CCITT Recommendation X.219 [4].
The formal definition of the component types to encode these operations and errors is provided in clause D.1 of
EN 300 196-1 [1].
The
...

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Integrated Services Digital Network (ISDN); Security tools (SET) procedures; Digital Subscriber Signalling System No. one (DSS1) protocol; Part 1: Protocol specification33.080Digitalno omrežje z integriranimi storitvami (ISDN)Integrated Services Digital Network (ISDN)ICS:Ta slovenski standard je istoveten z:EN 301 002-1 Version 1.2.4SIST EN 301 002-1:2000en01-december-2000SIST EN 301 002-1:2000SLOVENSKI
STANDARD
EN 301 002-1 V1.2.4 (1998-10)European Standard (Telecommunications series)Integrated Services Digital Network (ISDN);Security tools (SET) procedures;Digital Subscriber Signalling System No. one (DSS1) protocol;Part 1: Protocol specificationSIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)2ReferenceDEN/SPS-05123-1 (9a090iqo.PDF)KeywordsISDN, DSS1, security, protocolETSIPostal addressF-06921 Sophia Antipolis Cedex - FRANCEOffice address650 Route des Lucioles - Sophia AntipolisValbonne - FRANCETel.: [phone]
Fax: [phone]Siret N° 348 623 562 00017 - NAF 742 CAssociation à but non lucratif enregistrée à laSous-Préfecture de Grasse (06) N° 7803/[e-mail]://www.etsi.orgCopyright NotificationNo part may be reproduced except as authorized by written permission.The copyright and the foregoing restriction extend to reproduction in all media.© European Telecommunications Standards Institute 1998.All rights reserved.SIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)3ContentsIntellectual Property Rights.4Foreword.41Scope.62References.62.1Normative references.62.2Informative references.73Definitions.74Abbreviations.75Description.86Operational requirements.86.1Provision and withdrawal.86.2Requirements on the originating network side.86.3Requirements on the destination network side.87Coding requirements.97.1Coding of the Facility information element components.97.2Coding of the information elements.108State definitions.109Signalling procedures at the coincident S and T reference point.109.1Activation.109.2Deactivation.119.3Registration.119.3.1Normal operation.119.3.2Exceptional procedures.129.4Erasure.129.5Interrogation.129.6Invocation and operation.139.6.1Normal operation.139.6.2Exceptional procedures.139.7Notification of possible fraudulent use.1310Procedures for interworking with private ISDNs.1311Interaction with other networks.1412Interaction with other supplementary services.1413Parameter values (timers).1414Dynamic description (SDL diagrams).14Annex A (informative):Signalling flows.19Annex B (informative):Assignment of object identifier values.20History.21SIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)4Intellectual Property RightsIPRs essential or potentially essential to the present document may have been declared to ETSI. The informationpertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be foundin SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respectof ETSI standards", which is available free of charge from the ETSI Secretariat. Latest updates are available on theETSI Web server (http://www.etsi.org/ipr).Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guaranteecan be given as to the existence of other IPRs not referenced in SR 000 314 (or the updates on the ETSI Web server)which are, or may be, or may become, essential to the present document.ForewordThis European Standard (Telecommunications series) has been produced by ETSI Technical Committee SignallingProtocols and Switching (SPS).The present document is part 1 of a multi-part standard covering the Digital Subscriber Signalling System No. one(DSS1) protocol specification for the Integrated Services Digital Network (ISDN) Security tools (SET) procedures, asdescribed below:Part 1:"Protocol specification";Part 2:"Protocol Implementation Conformance Statement (PICS) proforma specification";Part 3:"Test Suite Structure and Test Purposes (TSS&TP) specification for the user";Part 4:"Abstract Test Suite (ATS) and partial Protocol Implementation eXtra Information for Testing (PIXIT)proforma specification for the user";Part 5:"Test Suite Structure and Test Purposes (TSS&TP) specification for the network";Part 6:"Abstract Test Suite (ATS) and partial Protocol Implementation eXtra Information for Testing (PIXIT)proforma specification for the network".In accordance with CCITT Recommendation I.130, the following three level structure is used to describe thesupplementary telecommunication services as provided by European public telecommunications operators under thepan-European ISDN:-Stage 1: is an overall service description, from the user's standpoint;-Stage 2: identifies the functional capabilities and information flows needed to support the service described instage 1; and-Stage 3: defines the signalling system protocols and switching functions needed to implement the servicedescribed in stage 1.The present document details the stage 3 aspects (signalling system protocols and switching functions) needed tosupport the SET procedures. The stage 1 aspects are detailed in EN 301 132.NOTE:Currently no stage 2 document exists.SIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)5National transposition datesDate of adoption of this EN: 30 October 1998Date of latest announcement of this EN (doa): 31 January 1999Date of latest publication of new National Standardor endorsement of this EN (dop/e): 31 July 1999Date of withdrawal of any conflicting National Standard (dow): 31 July 1999SIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)61ScopeThis first part of EN 301 002 specifies the stage three of the Security tools (SET) procedures for the pan-EuropeanIntegrated Services Digital Network (ISDN) as provided by the European public telecommunications operators at theT reference point or coincident S and T reference point (as defined in ITU-T Recommendation I.411 [2]) by means ofthe Digital Subscriber Signalling System No. one (DSS1) protocol. Stage three identifies the protocol procedures andswitching functions needed to support a telecommunications service (see CCITT Recommendation I.130 [10]).In addition, the present document specifies the protocol requirements at the T reference point where the service isprovided to the user via an intermediate private ISDN.The present document does not specify the additional protocol requirements where the service is provided to the user viaa telecommunications network that is not an ISDN.The SET procedures are a means of providing an appropriate level of security and protection to the user of a giventelecommunication service.Further parts of the present document specify the method of testing required to identify conformance to the presentdocument.The present document is applicable to equipment supporting the SET procedures, to be attached at either side of aT reference point or coincident S and T reference point when used as an access to the public ISDN.2ReferencesReferences may be made to:a)specific versions of publications (identified by date of publication, edition number, version number, etc.), inwhich case, subsequent revisions to the referenced document do not apply; orb)all versions up to and including the identified version (identified by "up to and including" before the versionidentity); orc)all versions subsequent to and including the identified version (identified by "onwards" following the versionidentity); ord)publications without mention of a specific version, in which case the latest version applies.A non-specific reference to an ETS shall also be taken to refer to later versions published as an EN with the samenumber.2.1Normative references[1]EN 300 196-1: "Integrated Services Digital Network (ISDN); Generic functional protocol for thesupport of supplementary services; Digital Subscriber Signalling System No. one (DSS1) protocol;Part 1: Protocol specification".[2]ITU-T Recommendation I.411 (1993): "ISDN user-network interfaces; Reference configurations".[3]CCITT Recommendation X.208 (1988): "Specification of Abstract Syntax Notation One(ASN.1)".[4]CCITT Recommendation X.219 (1988): "Remote operations: Model, notation and servicedefinition".[5]ITU-T Recommendation Z.100 (1993): "Specification and Description Language (SDL)".SIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)72.2Informative references[6]EN 301 132: "Integrated Services Digital Network (ISDN); Security tools (SET) for use withintelecommunication services".[7]ETR 232 (1995): "Security Techniques Advisory Group (STAG); Glossary of securityterminology".[8]ITU-T Recommendation E.164 (1997): "The international public telecommunications numberingplan".[9]ITU-T Recommendation I.112 (1993): "Vocabulary of terms for ISDNs".[10]CCITT Recommendation I.130 (1988): "Method for the characterization of telecommunicationservices supported by an ISDN and network capabilities of an ISDN".[11]ITU-T Recommendation I.210 (1993): "Principles of telecommunication services supported by anISDN and the means used to describe them".3DefinitionsFor the purposes of the present document, the following definitions apply:Integrated Services Digital Network (ISDN): See ITU-T Recommendation I.112 [9], definition 308.ISDN number: A number conforming to the numbering plan and structure specified in ITU-T RecommendationE.164 [8].invoke component: See EN 300 196-1 [1], subclause 8.2.2.1. Where reference is made to a "xxxx" invoke component,an invoke component is meant with its operation value set to the value of the operation "xxxx".network: The DSS1 protocol entity at the network side of the user-network interface.Personal Identification Number (PIN): See ETR 232 [7].reject component: See EN 300 196-1 [1], subclause 8.2.2.4.return error component: See EN 300 196-1 [1], subclause 8.2.2.3. Where reference is made to a "xxxx" return errorcomponent, a return error component is meant which is related to a "xxxx" invoke component.return result component: See EN 300 196-1 [1], subclause 8.2.2.2. Where reference is made to a "xxxx" return resultcomponent, a return result component is meant which is related to a "xxxx" invoke component.security tool: See EN 301 132 [6], clause 3.served user: The user to whom the SET procedures are provided in combination with a telecommunication service.service; telecommunication service: See ITU-T Recommendation I.112 [9], definition 201.supplementary service: See ITU-T Recommendation I.210 [11], subclause 2.4.user: The DSS1 protocol entity at the user side of the user-network interface.4AbbreviationsFor the purposes of the present document, the following abbreviations apply:ASN.1Abstract Syntax Notation oneDSS1Digital Subscriber Signalling System No. oneISDNIntegrated Services Digital NetworkOAMOperation And MaintenanceSIST EN 301 002-1:2000

ETSIEN 301 002-1 V1.2.4 (1998-10)8PINPersonal Identification NumberSDLSpecification and Description LanguageSETSecurity Tools5DescriptionThe SET procedures allow a served user to be provided with a PIN. The PIN is used when accessing atelecommunication service to ensure that this service is used with an appropriate level of security. The served user canchange the PIN at any time after initial provision.6Operational requirements6.1Provision and withdrawalThe SET procedures shall be provided in connection with the provision of certain telecommunication services, and shallconsists of the initial registration of the PIN. This initial registration is performed by the network provider, afterselection of the PIN by the served user. The PIN shall either be related to an ISDN number, or to an access or set ofaccesses, depending on how the telecommunication service using the PIN, is provided. The PIN shall consist of aminimum of 4 alphanumeric characters. The maximum number of characters is a network option, but shall not exceed 12alphanumeric characters.Withdrawal of the SET procedures is outside the scope of the present document.The served user may, as a network option , be notified when one or more attempts (but less than the blocking limit Nwhereby all procedures using the PIN are blocked) have been made to use an invalid PIN, either during the operation ofa telecommunication service using the PIN, or during the PIN registration procedure. The blocking limit N whereby allprocedures using the PIN are blocked, is also a network option.The network options are summarized in table 1.Table 1: Network options for the SET proceduresNetwork optionValueNotification of possible fraudulent usenoyesMaximum number of PIN characters4 to 12Blocking limit N³ 36.2Requirements on the originating network sideNot applicable.6.3Requirements on the destination network sideNot applicable.SIST EN 301 002-1:2000
...