Subject: Security Concerns with Emergency uses of Geo Location

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 13 Jul 2001 14:37:09 -0400

I am concerned at the strong language in the charter
about security concerns.  In general, I have no quarrel
with normal "commercial" use of geolocation, and the
need to have stringent controls.

However, geolocation is a very vital piece of information
in an emergency; it is REQUIRED information (legally in some
cases).  However, emergencies arise in circumstances where
authentication is not practical.

Consider walking up to a random sip phone (not yours), and making
a an emergency call (911/112/..).  You may not be "logged in" 
to that phone.  In fact no one may be logged in.  
Yet an emergency call must go through, and it must report 
location.  Furthermore, the device may be mobile, and roaming. 

Emergencies on sip devices involve several entities - the 
user agent in the phone, one of several proxy servers in the 
path of signalling the call and the user agent in the 
Public Service Access Point (PSAP). In some systems, the end 
device knows it's location. In this case, I propose that no 
authentication is needed when the device knows that it's an emergency and it
supplies the location with the call.

When the location is not known by the end device, either the 
end device user agent, or the PSAP user agent may have to 
ask for location.  If the end device asks, we may have a 
problem - it can't authenticate, and without authenticating 
it is hard to know who is asking.  If the PSAP asks, then 
IT can authenticate, but in this case it is authenticating a
s a PSAP, and must be given location of a third party (the 
one in distress).  This is much different from the normal 
authentication mechanisms you imagine, but can reasonably 
be made secure.

In terms of requirements:
1. entities which have location information and place
emergency calls where location is required to be reported must
be able to send such location without requiring user
identity or any other form of authentication not provisionable
in the end device itself.

2. PSAPs must be able to request location of any device
placing an emergency call from any service that has such
location.  The PSAP must authenticate itself as a PSAP.

3. End devices placing emergency calls must be able to request
its own location from any service that has such location without
requiring user identity of any other form of authentication
not provisionable in the end device itself.

4. Any privacy control mechanisms specified as required in
emergency calls must be able to be completed in an expeditious
manner, when conditions are far from ideal (consider disaster
situations, for example).  Thus the choice of mechanisms and
algorithms must take into account impaired networks, etc. 

Brian

---

From: [email-masked]
Date: Fri, 13 Jul 2001 11:56:44 -0700 (PDT)

> need to have stringent controls.

Your concerns are noted. However, the language in the charter was essential to
getting this working group approved. Numerous previous attempts charter a group
in this area without this sort of language were roundly rejected. In fact even
with in place I'd say we barely squeaked by. Without it this group didn't have
a snowball's chance in hell of ever being approved.

> authentication is not practical.

Then by all means contribute to the standardization work and make sure these
needs are taken care of.

> ...

> in the end device itself.

Nothing in the charter says that user identity will be required in all
cases.

> location.  The PSAP must authenticate itself as a PSAP.

Exactly. In this case authentication still occurs, it is just the callee
being authenticated, not the caller.

> not provisionable in the end device itself.

This is harder, but still not impossible. An end device in such a situation
has the credential provided to it by the emergency service it has contacted.
That credential could be designed in such a way that it could be used by
proxy to obtain location information from another service.

> algorithms must take into account impaired networks, etc.

In general privacy control mechanisms should be as light weight as possible.
So while I agree that this is something to consider, I don't see it as
a concern unless we seem to be getting into trouble.

				Ned