Use cases for Device Binding 3GPP2 TSG-S WG4 S Source: Qualcomm Incorporated Contact(s): Anand Palanigounder, Aram Perez, Recommendation: For Discussion & Decision 1 Notice QUALCOMM Incorporated grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partners name any Organizational Partners standards publication even though it may include all or portions of this contribution; and at the Organizational Partners sole discretion to permit others to reproduce in whole or in part such contribution or the resulting Organizational Partners standards publication. QUALCOMM Incorporated is also willing to grant licenses under such contributor copyrights to third parties on reasonable, non- discriminatory terms and conditions for purpose of practicing an Organizational Partners standard which incorporates this contribution. This document has been prepared by QUALCOMM Incorporated to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on QUALCOMM Incorporated. QUALCOMM Incorporated specifically reserves the right to amend or modify the material contained herein and nothing herein shall be construed as conferring or offering licenses or rights with respect to any intellectual property of QUALCOMM Incorporated other than provided in the copyright statement above.

Introduction M2M SRD (S.P0146-0) has the following requirement SEC-04: cdma2000 networks shall support a mechanism to restrict the use of a cdma2000 M2M access subscription to a specific cdma2000 device or a group of devices A work item 3GPP2-0314, Binding of Access Subscription with Device(s) was agreed at the last TSG-S meeting The scope is to study, identify and specify the needed security enhancements to cdma2000 systems to support the requirement to bind a cdma2000 access subscription with specific cdma2000 device(s) In this contribution, we identify usage scenarios for device binding 2

Scenario for Device Binding An example scenario is a smart meter connected to the utility companys server via a cellular network If the subscription (e.g., on UICC) is not bound to the smart meter Device, the subscription could be moved from the smart meter and put into a different type of device (a smart phone or datacard), giving unauthorized use of the service or a free service – These should be prevented The binding between the device and the subscription may not be known a priori Can happen anytime during lifecycle of the UICC/Device Binding association may change at any time based on business agreement between the utility company and the operator 3

Usage Scenario: M-N binding A group of subscriptions (say M) given to a utility company is restricted to work with a group (N) of smart meters belonging to that utility – E.g., M subscriptions on UICC1, …, UICCm can be used with any of the N smart meters (MEID1, …, MEIDn) Note that the subscription and device identities may not be consecutive The group members and the value N/M may be dynamic during the lifecycle of the devices/UICCs – i.e., the group of devices and/or the group of subscriptions belonging to the utility may change at any time Other usage scenarios such as 1-1, 1-N, M-1 device bindings are sub-cases of this use case 4

Proposal Agree on the proposed usage scenario as the basis for further work on device binding 5