Security Threats and Requirements for Emergency Calling draft-tschofenig-ecrit-security-threats-01.txt Hannes Tschofenig, Henning Schulzrinne, Murugaraj Shanmugam IETF#63, Paris August 2, 2005

Current Status -00 version at the ECRIT/GEOPRIV interim meeting Provided document as discussion input -01 update for IETF#63

Content (1/2) Terminology, Actors 5. Security Threats 5.1 Denial of Service Attacks 5.2 Call Identity Spoofing 5.3 Location Spoofing 5.4 Impersonating a PSAP 5.5 Signaling Message Modification 5.6 Modification of the Emergency Call 5.7 Loss of confidentiality 5.8 Replay Attack 5.9 Corrupting Configuration Information 5.10 Corrupting Database Information

Content (2/2) Section on security requirements. Most attacks lead to a Denial-of-service (resource exhaustion): –entities affected: directory call routing infrastructure PSAP –resources network bandwidth processing human resources (call takers, first responders) More detailed interim meeting presentation slides can be found at:

Next Steps Problem of this document similar to the -00 version of the requirements draft: –Many threats & requirements are relevant for the big picture of emergency handling but are outside the scope of ECRIT Primary focus should be: –Security threats related to the interaction with the Location->URI lookup mechanism Possible solution: –More detailed treatment of ECRIT specific aspects –Move many parts of the document to a separate document (BCP) Document editor?