Subject: Re: [Ecrit] [ecrit] #14: Security Considerations

From: "ecrit issue tracker" <[email-masked]>
Date: Tue, 12 Mar 2013 20:04:50 -0000

#14: Security Considerations

Comment (by [email-masked]):

 This issue is now addressed in Section 2.  The proposed text is as
 follows:

 2.  Threats

    While previous IETF documents have analyzed aspects of the security
    of emergency services or threats to geographic location privacy,
    those documents do not cover the threats arising from unreliable
    location information.

    A threat analysis of the emergency services system is provided in
    "Security Threats and Requirements for Emergency Call Marking and
    Mapping" [RFC5069]. RFC 5069 describes attacks on the emergency
    services system, such as attempting to deny system services to all
    users in a given area, to gain fraudulent use of services and to
    divert emergency calls to non-emergency sites.  [RFC5069] also
    describes attacks against individuals, including attempts to prevent
    an individual from receiving aid, or to gain information about an
    emergency.  "Threat Analysis of the Geopriv Protocol" [RFC3694]
    describes threats against geographic location privacy, including
    protocol threats, threats resulting from the storage of geographic
    location data, and threats posed by the abuse of information.

    This document focuses on threats from attackers providing false
    location information within emergency calls.  Since we do not focus
    on attackers gaining control of infrastructure elements (e.g.,
    location servers, call route servers) or the emergency services IP
    network, the threats are derived from the introduction of
    untrustworthy location information by end hosts.  In addition to
    threats arising from the intentional forging of location information,
    end hosts may be induced to provide untrustworthy location
    information.  For example, end hosts may obtain location from
    civilian GPS, which is vulnerable to spoofing [GPSCounter] or from
    third party Location Service Providers (LSPs) which may be vulnerable
    to attack or may not warrant the use of their services for emergency
    purposes.

    To provide a structured analysis we distinguish between three
    adversary models:

    External adversary model:  The end host, e.g., an emergency caller
       whose location is going to be communicated, is honest and the
       adversary may be located between the end host and the location
       server or between the end host and the PSAP.  None of the
       emergency service infrastructure elements act maliciously.

    Malicious infrastructure adversary model:  The emergency call routing
       elements, such as the LIS, the LoST infrastructure, used for
       mapping locations to PSAP address, or call routing elements, may
       act maliciously.

    Malicious end host adversary model:  The end host itself acts
       maliciously, whether the owner is aware of this or whether it is
       acting as a bot.

    In this document, we focus only on the malicious end host adversary
    model.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:  draft-ietf-ecrit-
  [email-masked]          |  [email-masked]
     Type:  defect                   |      Status:  new
 Priority:  major                    |   Milestone:  milestone1
Component:  trustworthy-location     |     Version:  1.0
 Severity:  Active WG Document       |  Resolution:
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/ecrit/trac/ticket/14#comment:1>
ecrit <http://tools.ietf.org/ecrit/>