1. Update on Security Analysis for Location Phil Hawkes phawkes@qualcomm.com

2. Goal: Specify Security mechanisms Identify threats (bad outcomes) Determine high-risk attacks......these will dictate countermeasure requirements...... Which will in turn dictate security measures for X.P0024

3. Questions What are the threats? –TSG-S WG4 can answer this! What are the high-risk attacks? –Consideration of threats by Operators

4. A Tale of Two Analyses Haphazard analysis –Brainstormed attacks –Found some good attacks Rigorous analysis –Haphazard wasn’t sure to cover all the holes –Difficult to describe the security problems –Had to develop formal method (taken time) –WE WANT TO DO THIS PROPERLY

5. Call flows define acceptable system paths 1.Call flows require Interactions 2.Interactions require delegating capabilities –Delegating capabilities allows acceptable system paths 3.Delegating capabilities also allows unacceptable system paths –Threats = unacceptable system paths –Attacks: how you get system onto these paths 4.Attacks dictate countermeasure requirements

6. Where are we with LOC Analysis is not yet complete –Have not done “formal analysis” of Periodic request modes –Single request modes almost complete –Analysis gives QC perspective only Going Forward –“Formal analysis” of Periodic request modes –Review by other companies –Consideration by LOC

7. What does the analysis seem to be saying? Any message without –Authentication Replay protection Integrity protection –Authorization –Encryption –Closing session... can be a point of attack. Each communication session with MS should involve fresh keys generated in UIM (like AKA).