TIA Update on Security and Lawful Intercept Document No: GSC17-PLEN-46 Source: TIA Contact: Jane Brownley (jane.brownley@tiaonline.org) GSC Session: Plenary Agenda Item: 6.3 TIA Update on Security and Lawful Intercept Jane Brownley Chair TR-45 Alcatel-Lucent

Security

Current Activities - Security TIA Committee TR-45 supports security standards development for US TDMA (TIA-136) and CDMA (TIA-2000 and TIA-856) Most of TR-45’s work involves transposition of specifications developed by 3GPP2 TSG-S WG4 Current efforts: A Security Framework for Binding of Access Subscription with Device(s) Advanced Security Framework for HRPD, eHRPD and xHRPD Security for cdma2000® 1x

Current Activities - Security Air-Interface Application Layer Security Equipment Numbering Identifier security is discussed during Global Numbering Joint Expert Meetings (JEM) moderated by TR-45 EUMAG chair and hosted both by GSMA – IMEI (GDA) Global Decimal Administrator and TIA – MEID (GHA) Global Hexadecimal Administrator Equipment Numbering Identifier fraud issues are coordinated between the GHA (TIA) and GDA (GSMA), including Equipment Identity Register activity

Strategic Direction TIA expects its TR-45 security work to continue to be driven by 3GPP2, with input from IETF and 3GPP Security for Machine-to-machine communications will be addressed TR-45 EUMAG Chair moderates periodic calls coordinating GHA - (TIA) and GDA - (GSMA) Administration of multimode equipment identifier assignments and security issues

Challenges Inconsistent implementation of security in the networks Security is perceived as preventing fraud adequately, therefore may lead to complacency in some systems Cost and complexity are usually cited as reasons for not using authentication Global implementation of MEID and EUIMID continues to be imperative as ESN and UIMID (ESN based) resources have been exhausted

Next Steps / Actions TIA plans to continue to monitor the security environment faced by operators and users Any issues identified that are not addressed by 3GPP or 3GPP2 will be studied by TR-45 TR-8, TR-34, TR-50 and other TIA Engineering Committees will continue to work on Security requirements in their respective standards scope TIA is in the final development of the new TIA MEID db and Alpha testing of Phase 1

Next Steps / Actions TR-45 EUMAG (ESN,UIM,MEID Ad hoc Group) continues to support the MEID/EUIMID activity and maintain updates to the MEID Numbering Administration guidelines. TR-45 continues active participation during 3GPP2 SC Workshop Ad-Hoc activities related to numbering.

Lawful Intercept (LI)

Current Activities – Lawful Intercept TR-45.8 Lawful Intercept Group (LIG) cdma2000® Femtocell Lawful Interception Implementation Guide is on hold and may be considered in the TIA PN-4986 “LAES for cdma2000® Femtocells” development. TR-45.8 Lawful Intercept Group (LIG) continues to address contributions received regarding cdma2000® LI. TR-45 and ATIS reaffirmed ANSI/J-STD-025-B LAES joint standard along with addendums 1 and 2. “ANSI/J-STD-025-B-3 LAES Addendum 3 - Support for BSID or Subnet“ joint standard has been published.

Strategic Direction TR-45 continues collaboration and coordination with LI development in groups such as ATIS WTSC and PTSC and 3GPP SA3 LI. TR-45 maintains the J-STD-025 LAES series of joint standards as the lead SDO. TR-45 co-ordinates LAES Object IDentifier (OID) administration under the “TIA” OID tree branch for ASN.1 modules related to LI.

Challenges Keeping pace with the ongoing introduction of new features and services to support LI capabilities while maintaining LI standards already implemented Consideration of the unique issues presented with access to the Internet e.g., Local Breakout Communications protocols involved in technology areas such as “Smart Grid” or “Cloud Computing”

Next Steps/Actions TR45.8 LIG work on TIA PN-4986 “LAES for cdma2000® Femtocells” in support of LI for Femtocells based on the LIG V1.0 Femto LAES study Potential TR45.8 LIG work in support of new CDMA features and services May study the impact on CALEA services when the LEA targeted service is deployed in a cloud operating environment “cloudification”