Application of EN18031 Logging Mechanism (LGM) in 4G Wireless Routers

EN18031 Logging Mechanism (LGM) Overview

The Logging mechanism (LGM) is an equipment functionality to log internal activities, specifically those internal activities (events) that are relevant to privacy assets and their protection. Its primary purpose is to provide event information to help identify, for example, potential unusual equipment behaviour, security/data breaches, and so on.

The Logging Mechanism (LGM) is a key security requirement defined in the European Standard EN 18031-2:2024, aimed at improving the ability of radio equipment to protect its network assets and privacy assets. It applies to internet-connected radio equipment and radio equipment processing personal data, traffic data or location data, also covering network equipment. Therefore, as a type of internet-connected radio equipment and network equipment, a 4G wireless router’s logging mechanism should comply with LGM requirements.

▶ Application of Logging Mechanism (LGM) in 4G Wireless Routers

1. LGM-1: Applicability of logging mechanisms

Requirement: The equipment shall use logging mechanisms for internal activities (events) that are relevant to privacy assets and their protection, except for internal activities where a legal obligation prohibits logging.

Rationale: Log information can be of support to help identify, for example, potential unusual equipment behaviour, security/data breaches. The manufacturer determines the purpose (and audience) for which logs might be created, what data might be collected and logged, and any log-specific requirements for protecting and handling the log data, e.g., provide the data to a SIEM (Security information and event management) system. Typical examples of events to be logged include: successful and rejected system access events; changes to personal data, traffic data or location data; files accessed and the type of access, including deletion of important data files. Tamper logging is essential.

Application in 4G Wireless Routers:

Connection Events: Log attempts (success or failure) by users or devices to connect to the router, including Wi-Fi and cellular network connections.
Configuration Changes: Log all changes to router settings, such as password changes, firewall rule modifications, port forwarding settings, etc.
Data Flow Events: Log abnormal network traffic patterns, indications of potential Denial of Service (DoS) attacks, and any data processing activities related to privacy functions.
Firmware Updates: Log the start, success, or failure of firmware updates.
Equipment State: Log device startup, shutdown, or restart events.
Privacy Data Access: If the router stores or processes users’ personal data (e.g., connection history, location information), it needs to log attempts to access and modify these privacy assets.

2. LGM-2: Persistent storage of log data

Requirement: Logging mechanisms that are required per LGM-1 shall store log data for related events in the equipment’s persistent storage, except for events where related log data is stored outside the equipment.

Rationale: Event logs have to be persistent after power cycling of the equipment to prevent their accidental or deliberate erasure.

Application in 4G Wireless Routers:

Internal Storage: 4G routers should typically store logs in the equipment’s persistent storage to ensure logs are not lost after reboot. This is crucial for post-incident analysis and troubleshooting.
External Storage (Optional): If the router supports external logging functionality (e.g., sending logs to a cloud log server), it may be exempt from the obligation to persistently store certain logs internally on the device. However, this typically requires user configuration, and the security of external storage also needs to be ensured.

3. LGM-3: Minimum number of persistently stored events

Requirement: All log data stored in the equipment’s persistent storage by logging mechanisms that are required per LGM-1 shall always include a minimum number of the latest events.

Rationale: A minimum number of events to be retained is required to ensure that sufficient audit trail exists for investigations to be carried out effectively.

Application in 4G Wireless Routers:

Storage Capacity Management: Given that routers typically have limited storage capacity, it is necessary to reasonably define and implement a cyclic writing mechanism for log data to ensure that the latest and a sufficient number of logs are always retained.
Configuration Options: User documentation should describe the minimum number of latest events that can be persistently stored.
Priority: Logs of critical security events (e.g., intrusion attempts, authentication failures) should have higher priority than logs of normal operational events.

4. LGM-4: Time-related information of persistently stored log data

Requirement: All log data stored in the equipment’s persistent storage by logging mechanisms that are required per LGM-1 shall include a timestamp (if the equipment can have real time information available), or time-related information (if the equipment cannot have real time information reliably available).

Rationale: Including the timestamp or time-related information of event occurrence helps investigations to understand the chronological order of events and compare them with logs on other devices.

Application in 4G Wireless Routers:

Real Time Clock (RTC): Most modern 4G routers include an RTC, and therefore should record precise timestamps (year, month, day, hour, minute, second). These timestamps are crucial for correlating events across multiple devices and for forensic analysis.
Time Synchronization: Routers should support mechanisms such as Network Time Protocol (NTP) to ensure their real time clock is synchronized with a standard time source, avoiding time drift that could lead to inaccurate log times.
No Real Time Clock Scenario: If a router does not have a real time clock, it can record the number of seconds since device startup or an event sequence number as time-related information. While less useful than precise timestamps, this can still provide the relative order of events.

In summary, LGM requires 4G wireless router products not only to log key events related to security and privacy, but also to ensure the persistence, sufficient quantity, and accurate time-related information of these log data. This is crucial for protecting user privacy, enhancing equipment network resilience, and conducting effective investigations in the event of security incidents.

▶ Synergy of Logging Mechanism (LGM) with Other Security Mechanisms

Logging Mechanism (LGM) is closely associated with multiple other security mechanisms, collectively forming a comprehensive security and privacy protection system for the equipment. These associations involve both direct functional dependencies and mutual support under broader security objectives.

Secure Storage Mechanism (SSM)

Direct Association: LGM requires that logged data needs persistent storage, unless this data is stored outside the equipment. One of the core requirements of SSM is to protect security assets and privacy assets persistently stored on the equipment. Since log data is usually related to privacy assets and their protection, it is logical that the persistent storage of log data generated by LGM (as a type of sensitive privacy asset) should be protected by SSM.
Implementation Details: SSM ensures the integrity and confidentiality of stored data against tampering or leakage by providing integrity protection (e.g., digital signatures, access control, one-time programmable memory, or hardware protection) and confidentiality protection (e.g., encryption, access control, or hardware protection). This means that the integrity and confidentiality of stored logs will be guaranteed by the various requirements of SSM.

Access Control Mechanism (ACM)

Event Recording: LGM guidance mentions that typical log events include “successful and rejected system access events” and “files accessed and the type of access“. These are directly related to users’ or entities’ attempts and results of accessing equipment resources (including security assets and privacy assets), which are managed and controlled by ACM. Therefore, LGM records ACM activities to provide an audit trail.

Authentication Mechanism (AUM)

Event Recording: Similar to ACM, LGM logs include “successful and rejected system access events” and may include “user ID” for log events, all of which directly relate to the authentication process of users or entities. AUM is responsible for verifying the authenticity of an entity’s identity. By recording these authentication attempts and results, LGM can help identify unauthorized access attempts or brute force attacks (relevant to AUM-6).

Deletion Mechanism (DLM)

Event Recording: LGM guidance explicitly mentions logging “deletion of important data files“. This is related to the requirements of DLM, which aims to allow users to delete their personal data and sensitive security parameters stored on the equipment to prevent data exposure upon equipment disposal or replacement. LGM records deletion events to assist with auditing and ensuring compliance with data deletion requirements.

Secure Communication Mechanism (SCM)

External Log Storage: If log data is not stored internally on the equipment but rather externally (e.g., sent to a remote log server), then this log data needs to be protected during transmission via SCM. SCM ensures the integrity, authenticity, confidentiality, and replay protection of communication.
Network Activity Logging: LGM logs may contain information such as “network addresses and protocols,” which are core elements of the communication activities handled by SCM.

Confidential Cryptographic Keys (CCK) and Cryptography (CRY)

Underlying Security Assurance: Although LGM itself does not directly manage keys or cryptographic algorithms, the associated SSM and SCM often rely on CCK and CRY to provide strong protection. For example, SSM-3 requires confidentiality protection for confidential personal information, confidential privacy function configuration, and confidential security parameters stored persistently, which is typically achieved through encryption. SSM-2’s integrity protection may also involve digital signatures. These encryption and signing operations are inseparable from the best practices of CCK (confidential cryptographic keys) and CRY (cryptography mechanism). LGM guidance also mentions that the manufacturer should determine “log data protection and processing requirements”, which involves using encryption.

User Notification Mechanism (UNM)

Indirect Association: UNM is designed to inform users of changes affecting the protection or privacy of personal information. While LGM is responsible for logging internal activities to detect issues, if these activities (e.g., significant changes to logging settings, which affect the protection of personal information) change to an extent that requires user attention, UNM may be triggered to notify the user. In the STRIDE threat model, both UNM and LGM fall under the “Detect” category, and UNM can help mitigate the threat of “Information disclosure“, while LGM can be used to detect “Tampering” and “Information disclosure“.

These mechanisms collectively ensure the equipment’s security, data privacy, and the ability to conduct effective tracing and analysis in the event of security incidents. LGM, as the core of event recording, provides critical information for the effective operation and auditing of other mechanisms.