1. Hannes Tschofenig Henning Schulzrinne M. Shanmugam
Security Threats and Requirements for Emergency Calling draft-tschofenig-ecrit-security-threats
Hannes Tschofenig
Henning Schulzrinne
M. Shanmugam
ECRIT interim meeting - May 2005

2. ECRIT interim meeting - May 2005
Terminology
Internet Access Provider (IAP)
Emergency call routing support = routes calls (e.g., SIP proxy)
Directory = maps location to PSAP address
Asserted location information = somebody vouches for this information
ECRIT interim meeting - May 2005

3. ECRIT interim meeting - May 2005
Framework
location provider
(DHCP, …)
A(V)SP
IAP
configuration
information
directory
PSAP
ECRIT interim meeting - May 2005

4. Participant-visible threats
Standard problems:
eavesdropping (privacy, interference with law enforcement)
modification of call content
preventing service to single user (burglar-cutting-phone-wire)
Since no direct monetary gain, threat model focuses on disruption of emergency service to legitimate users
by causing infrastructure failure
by tying up call takers
by dispatching emergency responders
Difference to most other systems
PSAP doesn’t care who you are as long as you don’t lie about the location or nature of the emergency
ECRIT interim meeting - May 2005

5. Layers of defense (DOS, crank calls)
prevent or limit
detect & filter
prosecute
ECRIT interim meeting - May 2005

6. ECRIT interim meeting - May 2005
Threats
Denial-of-service (resource exhaustion) attacks
entities affected:
directory
call routing infrastructure
PSAP
resources
network bandwidth
processing
human resources (call takers, first responders)
Call identity spoofing
primarily to elude DOS attack prosecution
ECRIT interim meeting - May 2005

7. ECRIT interim meeting - May 2005
Authentication
Classical requirement: “must be able to place call without authentication”
Really?
≠ anonymity!
Probably really want
place call without being a paying customer of IAP
thus, may still be known to service provider
former customer
third-party cert (e.g., some government authority)
device cert (“payphone on corner of Third and Main”)
ECRIT interim meeting - May 2005

8. Details: security threat to one caller
Confidentiality
Modification to configuration information
Modification of call information
call signaling
media
PSAP impersonation
ECRIT interim meeting - May 2005

9. Details: infrastructure threats
denial-of-service attacks
modification of configuration information
ECRIT interim meeting - May 2005

10. Caller identity spoofing
 authentication
avoid delays during emergency call setups
avoid multiple round-trip times
define authentication independent of customer relationships
e.g., might only need non-1918 IP address to determine port and customer
ECRIT interim meeting - May 2005

11. ECRIT interim meeting - May 2005
Location spoofing
End user provided location
IAP provides assertion
limited usefulness if wide coverage area
Emergency call router inserts
retrieved by V(A)SP from IAP
must be based on some identifier
IAP may sign
Need to insert timestamp and identity
prevent replay and copy-and-paste attacks
identity may not be NAI
IP address, MAC address
primarily needed for traceability
ECRIT interim meeting - May 2005

12. Location spoofing threat mediation
prevent wide-area spoofing
avoid global attacks; avoid international jurisdictional issues
accountability
reasonable chance that the person can be brought to justice
future calls from the same person are considered suspect
prevent local-area spoofing
attacker can’t pretend to be in place X
prevent local-area collusion
attacker can’t get friend to give him location information for X
prevent local-area time cloning
attacker can’t pretend to be in X now if they were in X earlier
ECRIT interim meeting - May 2005

13. ECRIT interim meeting - May 2005
Impersonating a PSAP
Assurance of reaching an authorized or legitimate PSAP
Attacker may intercept directory request or call routing request
 Integrity-protect directory and signaling interactions
Directory must be authoritative for information
may be hard to prove
ECRIT interim meeting - May 2005

14. ECRIT interim meeting - May 2005
Open issues
Mixture of threat description and requirements
Should requirements be merged into general requirements document (or remove security issues from general requirements document)?
ECRIT interim meeting - May 2005