Hannes Tschofenig Henning Schulzrinne M. Shanmugam Security Threats and Requirements for Emergency Calling draft-tschofenig-ecrit-security-threats Hannes Tschofenig Henning Schulzrinne M. Shanmugam ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Terminology Internet Access Provider (IAP) Emergency call routing support = routes calls (e.g., SIP proxy) Directory = maps location to PSAP address Asserted location information = somebody vouches for this information ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Framework location provider (DHCP, …) A(V)SP IAP configuration information directory PSAP ECRIT interim meeting - May 2005

Participant-visible threats Standard problems: eavesdropping (privacy, interference with law enforcement) modification of call content preventing service to single user (burglar-cutting-phone-wire) Since no direct monetary gain, threat model focuses on disruption of emergency service to legitimate users by causing infrastructure failure by tying up call takers by dispatching emergency responders Difference to most other systems PSAP doesn’t care who you are as long as you don’t lie about the location or nature of the emergency ECRIT interim meeting - May 2005

Layers of defense (DOS, crank calls) prevent or limit detect & filter prosecute ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Threats Denial-of-service (resource exhaustion) attacks entities affected: directory call routing infrastructure PSAP resources network bandwidth processing human resources (call takers, first responders) Call identity spoofing primarily to elude DOS attack prosecution ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Authentication Classical requirement: “must be able to place call without authentication” Really? ≠ anonymity! Probably really want place call without being a paying customer of IAP thus, may still be known to service provider former customer third-party cert (e.g., some government authority) device cert (“payphone on corner of Third and Main”) ECRIT interim meeting - May 2005

Details: security threat to one caller Confidentiality Modification to configuration information Modification of call information call signaling media PSAP impersonation ECRIT interim meeting - May 2005

Details: infrastructure threats denial-of-service attacks modification of configuration information ECRIT interim meeting - May 2005

Caller identity spoofing  authentication avoid delays during emergency call setups avoid multiple round-trip times define authentication independent of customer relationships e.g., might only need non-1918 IP address to determine port and customer ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Location spoofing End user provided location IAP provides assertion limited usefulness if wide coverage area Emergency call router inserts retrieved by V(A)SP from IAP must be based on some identifier IAP may sign Need to insert timestamp and identity prevent replay and copy-and-paste attacks identity may not be NAI IP address, MAC address primarily needed for traceability ECRIT interim meeting - May 2005

Location spoofing threat mediation prevent wide-area spoofing avoid global attacks; avoid international jurisdictional issues accountability reasonable chance that the person can be brought to justice future calls from the same person are considered suspect prevent local-area spoofing attacker can’t pretend to be in place X prevent local-area collusion attacker can’t get friend to give him location information for X prevent local-area time cloning attacker can’t pretend to be in X now if they were in X earlier ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Impersonating a PSAP Assurance of reaching an authorized or legitimate PSAP Attacker may intercept directory request or call routing request  Integrity-protect directory and signaling interactions Directory must be authoritative for information may be hard to prove ECRIT interim meeting - May 2005

ECRIT interim meeting - May 2005 Open issues Mixture of threat description and requirements Should requirements be merged into general requirements document (or remove security issues from general requirements document)? ECRIT interim meeting - May 2005