7/11/2005ECRIT Security Considerations1 ECRIT Security Considerations draft-taylor-ecrit-security-threats-00.txt Henning Schulzrinne, Raj Shanmugam, Hannes Tschofenig, Tom Taylor IETF 64

7/11/2005ECRIT Security Considerations2 Emergency Call Routing Attack Points ??? ?? Call router Mapping client Mapping server PSAPPSAP Location provider Emergency responders Impersonation DOS Interception Modification Database corruption Threats: - disclosure - targeted DOS - mass DOS Impersonation - malicious dispatch Configuration corruption

7/11/2005ECRIT Security Considerations3 Architecture Determines Threat Perception If mapping is done at user client configuration time –lowers likelihood that attacks on mapping server are effective –raises likelihood that attack on user client itself would be effective If mapping is done at call time, and mapping client is a proxy –raises likelihood that attacks on mapping server would be effective –attack on user client itself less likely to be effective

7/11/2005ECRIT Security Considerations4 Authentication Issues Is it worth authenticating the mapping server? –if mapping is done at user agent configuration time? –if mapping is done by user agent at call time? –if mapping client is a proxy on the call path?

7/11/2005ECRIT Security Considerations5 Backup

7/11/2005ECRIT Security Considerations6 Current Draft Scope Threats –integrity and privacy –PSAP DOS –PSAP impersonation –mapping server DOS –mapping server impersonation Discussion of potential counter-measures Constraints on counter-measures –cost in terms of performance –deployment issues –regulatory and legal requirements Derived requirements

7/11/2005ECRIT Security Considerations7 Points Raised in List Discussion Performance burden of proposed measures –channel security –object signing What does user do if authentication fails? Need for security distinction between location by value and by reference Proposed DOS detection at mapping server doesn't work –all requests are anonymous –multiple requests from same IP address can be a valid condition Proposed countermeasures make impractical assumptions regarding trust anchors –depending on what responsibilities are given to the user client Object signing not enough to prevent replay

7/11/2005ECRIT Security Considerations8 More Points... Section 5.5 (Distributed Directory Security) out of scope Section 5.6 (Query-Response Verification) probably expendable Need security discussion of two more topics –location delivery –PSAP boundaries