ECRIT interim meeting - May Security Threats and Requirements for Emergency Calling draft-tschofenig-ecrit-security-threats Hannes Tschofenig Henning Schulzrinne M. Shanmugam

ECRIT interim meeting - May Terminology Internet Access Provider (IAP) Emergency call routing support = routes calls (e.g., SIP proxy) Directory = maps location to PSAP address Asserted location information = somebody vouches for this information

ECRIT interim meeting - May Framework A(V)SP directory location provider (DHCP, …) IAP PSAP configuration information

ECRIT interim meeting - May Participant-visible threats Standard problems: –eavesdropping (privacy, interference with law enforcement) –modification of call content –preventing service to single user (burglar-cutting-phone-wire) Since no direct monetary gain, threat model focuses on disruption of emergency service to legitimate users –by causing infrastructure failure –by tying up call takers –by dispatching emergency responders Difference to most other systems –PSAP doesn’t care who you are as long as you don’t lie about the location or nature of the emergency

ECRIT interim meeting - May Layers of defense (DOS, crank calls) prevent or limit detect & filter prosecute

ECRIT interim meeting - May Threats Denial-of-service (resource exhaustion) attacks –entities affected: directory call routing infrastructure PSAP –resources network bandwidth processing human resources (call takers, first responders) Call identity spoofing –primarily to elude DOS attack prosecution

ECRIT interim meeting - May Authentication Classical requirement: “must be able to place call without authentication” Really? ≠ anonymity! Probably really want –place call without being a paying customer of IAP –thus, may still be known to service provider former customer third-party cert (e.g., some government authority) device cert (“payphone on corner of Third and Main”)

ECRIT interim meeting - May Details: security threat to one caller Confidentiality Modification to configuration information Modification of call information –call signaling –media PSAP impersonation

ECRIT interim meeting - May Details: infrastructure threats denial-of-service attacks modification of configuration information

ECRIT interim meeting - May Caller identity spoofing  authentication avoid delays during emergency call setups –avoid multiple round-trip times define authentication independent of customer relationships –e.g., might only need non-1918 IP address to determine port and customer

ECRIT interim meeting - May Location spoofing End user provided location –IAP provides assertion –limited usefulness if wide coverage area Emergency call router inserts –retrieved by V(A)SP from IAP –must be based on some identifier –IAP may sign Need to insert timestamp and identity –prevent replay and copy-and-paste attacks –identity may not be NAI IP address, MAC address primarily needed for traceability

ECRIT interim meeting - May Location spoofing threat mediation prevent wide-area spoofingavoid global attacks; avoid international jurisdictional issues accountability reasonable chance that the person can be brought to justice future calls from the same person are considered suspect prevent local-area spoofingattacker can’t pretend to be in place X prevent local-area collusionattacker can’t get friend to give him location information for X prevent local-area time cloning attacker can’t pretend to be in X now if they were in X earlier

ECRIT interim meeting - May Impersonating a PSAP Assurance of reaching an authorized or legitimate PSAP Attacker may intercept directory request or call routing request  Integrity-protect directory and signaling interactions Directory must be authoritative for information –may be hard to prove

ECRIT interim meeting - May Open issues Mixture of threat description and requirements Should requirements be merged into general requirements document (or remove security issues from general requirements document)?