RFC 5069

Security Threats and Requirements for Emergency Call Marking and Mapping

📅 published January 2008, from ietf

RFC 5069: Security Threats and Requirements for Emergency Call Marking and Mapping ✨

RFC 5069 🎀 is an Informational doc from the Network Working Group, dated January 2008. The authors are T. Taylor, Ed. (Nortel), H. Tschofenig (Nokia Siemens Networks), H. Schulzrinne (Columbia University), and M. Shanmugam (Detecon). It doesn't list anything it obsoletes or updates. 💅

Status of This Memo

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Abstract

Okay so this doc looks at the security threats around marking signalling messages to show they're tied to an emergency, plus the process of mapping locations to Universal Resource Identifiers (URIs) that point to Public Safety Answering Points (PSAPs). 🚨 That mapping is part of how emergency calls get routed through the IP network. 🌐

Based on those threats, the doc sets out a group of security requirements for the mapping protocol and for how emergency-marked calls get handled. 🔐

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  3
3.  Marking, Mapping, and the Emergency Call Routing Process . . .  3
  3.1.  Call Marking . . . . . . . . . . . . . . . . . . . . . . .  3
  3.2.  Mapping  . . . . . . . . . . . . . . . . . . . . . . . . .  4
4.  Objectives of Attackers  . . . . . . . . . . . . . . . . . . .  4
5.  Potential Attacks  . . . . . . . . . . . . . . . . . . . . . .  5
  5.1.  Attacks Involving the Emergency Identifier . . . . . . . .  5
  5.2.  Attacks Against or Using the Mapping Process . . . . . . .  5
    5.2.1.  Attacks Against the Emergency Response System  . . . .  6
    5.2.2.  Attacks to Prevent a Specific Individual from
            Receiving Aid  . . . . . . . . . . . . . . . . . . . .  7
    5.2.3.  Attacks to Gain Information about an Emergency . . . .  7
6.  Security Requirements Relating to Emergency Marking and
    Mapping  . . . . . . . . . . . . . . . . . . . . . . . . . . .  8
7.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
8.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
  9.1.  Normative References . . . . . . . . . . . . . . . . . . . 10
  9.2.  Informative References . . . . . . . . . . . . . . . . . . 10

1. Introduction 🦋

Okay, so legacy telephone network users can summon help from emergency services (an ambulance, the fire department, the police 🚑🚒🚓) by dialling a well known number, like 911 in North America or 112 in Europe. 📞 A huge part of handling those calls is the system figuring out where the caller is and routing the call to the right Public Safety Answering Point (PSAP) based on that location. 📍

Now that we've got IP-based telephony and multimedia services, emergency calling over the Internet has to be supported too. 🌐 Two core pieces of IP-based emergency calling are an emergency service identifier and a mapping protocol. The emergency service identifier says the call signaling is setting up an emergency call. The mapping protocol takes that identifier plus the caller's geographic location and turns them into the right PSAP URL. 🗺️

Attacks on the Public Switched Telephone Network (PSTN) have been happening for decades. 😤 The Internet is seen as an even more hostile environment, so it's important to understand what attacks might target the infrastructure that provides emergency services, and to build security mechanisms that counter them. 🛡️ This can be a huge topic, but this doc keeps it focused on attacks against the mapping of locations to PSAP URIs and attacks based on emergency marking. 🎯 Checking whether a reported incident is actually true (by the PSAP operator), plus other attacks on the PSAP infrastructure involving faked location information, are outside the scope of this doc. 🙅‍♀️

Here's how the doc is laid out: Section 2 covers the basic terminology. Section 3 quickly explains how emergency marking and mapping fit into the emergency call routing process. Section 4 looks at some of the motivations attackers might have in the context of emergency calling, Section 5 describes and illustrates the attacks that might be used, and Section 6 lists the security-related requirements that must be met if these attacks are going to be mitigated. 📋

2. Terminology 📚

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119], with the qualification that unless otherwise stated, they apply to the design of the mapping protocol, not its implementation or application. ✨

The terms "call taker", "mapping service", "emergency caller", "emergency identifier", "mapping", "mapping client", "mapping server", "mapping protocol", and "Public Safety Answering Point (PSAP)" are taken from [RFC5012]. 🫶

The term "location information" is taken from RFC 3693 [RFC3693]. 📍

The term "emergency caller's device" refers to the IP host closest to the emergency caller in the signalling path between the emergency caller and the PSAP. 📱 Examples include an IP phone running SIP, H.323, or a proprietary signalling protocol, a PC running a soft client or an analogue terminal adapter, or a residential gateway controlled by a softswitch. 💻

3. Marking, Mapping, and the Emergency Call Routing Process 🌸

This memo deals with two topics about routing emergency calls to where they need to go: call marking and mapping. 🗺️

3.1. Call Marking 🏷️

Marking the call signalling lets the entities along the signalling path recognize that a particular signalling message is tied to an emergency call. 👀 Signalling that contains the emergency identifier may get priority treatment, special processing, and/or special routing. 🚦

3.2. Mapping 🧭

A big goal of emergency call routing is making sure every emergency call gets routed to a PSAP. 🚨 Ideally, the call goes to the PSAP responsible for the caller's location, because misrouting eats up precious time while the call taker finds the right PSAP and forwards the call. ⏰ As described in [RFC5012], mapping is part of how we achieve that ideal outcome. 💖

Quick version: mapping involves a mapping client, a mapping server, and the protocol that passes between them. 🤝 The protocol lets the client send location information to the mapping server and get back a URI, which can then be used to direct call signalling to a PSAP. 🎯

4. Objectives of Attackers 😈

Attackers can aim their efforts either at part of the emergency response system or at an individual. 🎯 Attacks against the emergency response system have three possible objectives:

to deny system services to all users in a given area. The motivation might range from thoughtless vandalism, to wide-scale criminality, to terrorism. 💀 One interesting variant of this motivation is when a victim of a large emergency hopes to get faster service by blocking others' competing calls for help. 😬
to gain fraudulent use of services, by using an emergency identifier to bypass normal authentication, authorization, and accounting procedures. 💸
to divert emergency calls to non-emergency sites. This is a form of denial-of-service attack similar to the first item, but it's probably even more confusing for the caller, since the caller expects to talk to a PSAP operator and instead gets connected to someone else. 🙃

Attacks against an individual fall into two classes:

attacks to prevent an individual from receiving aid. 🥀
attacks to gain information about an emergency that can be applied either against an individual involved in that emergency or to the profit of the attacker. 🕵️‍♀️

5. Potential Attacks 🚩

5.1. Attacks Involving the Emergency Identifier 🎭

The main possibility of attack involves using the emergency identifier to bypass the normal procedures in order to get fraudulent use of services. 🫣 An attack like this is only possible if all of the following conditions are true:

a. The attacker is the emergency caller.

b. The call routing system assumes that the emergency caller's device signals the correct PSAP URI for the caller's location.

c. The call enters the domain of a service provider, which accepts it without applying normal procedures for authentication and authorization because the signalling carries the emergency identifier.

d. The service provider routes the call according to the called address (e.g., SIP Request-URI), without verifying that this is the address of a PSAP (noting that a URI by itself does not indicate the nature of the entity it is pointing to). 🙈

If these conditions are satisfied, the attacker can bypass normal service provider authorization procedures for arbitrary destinations, simply by reprogramming the emergency caller's device to add the emergency identifier to non-emergency call signalling. 😱 In this case, the call signalling most likely won't include any location information, or there could be location information, but it's false. 🫠

An attacker who wants to disrupt the emergency call routing system might use a similar technique to target components of that system for a denial-of-service attack. 🌩️ The attacker will find this really appealing for reaching components that only handle emergency calls. Flooding attacks are the most likely use of the technique, but it could also be used to identify target components for other attacks by analyzing the content of responses to the original signalling messages. 🔍

5.2. Attacks Against or Using the Mapping Process 🗺️💥

This section describes classes of attacks involving the mapping process that could be used to achieve the attacker goals described in Section 4. 🧩 (more in part 2 🎀)

5.2.1. Attacks Against the Emergency Response System

Okay, this one is about attacks that wreck emergency response for everyone in an area 😭🚨. If the mapping operation is turned off, the emergency caller's device might not have the right PSAP URI 💅. That means emergency calls get sent to the wrong PSAP way more often 📞. In the worst case, the device can't get a PSAP URI at all 💀. Going to the wrong PSAP is a double whammy 🙈. The emergency response gets delayed, and PSAP call takers outside the immediate area burn their time and energy redirecting calls that were never theirs 🫠. And if an attacker makes the client receive a URI that doesn't lead to a PSAP at all, the calls just fail right away 💔.

There are three basic attacks on the mapping process: denial of service, impersonation of the mapping server, or corruption of the mapping database 🧚. Denial of service can happen in a few different ways 🔥:

by a flooding attack on the mapping server;
by taking control of the mapping server and either preventing it from responding or causing it to send incorrect responses; or
by taking control of any intermediary node (for example, a router) through which the mapping queries and responses pass, and then using that control to block them.

An adversary might also try to modify the mapping protocol signalling messages 👀. On top of that, the adversary may be able to replay past communication exchanges to fool an emergency caller by returning incorrect results 😈.

In an impersonation attack, the attacker tricks the mapping client into sending its queries to a host the attacker controls instead of the real mapping server 🎭. Or the attacker suppresses the response from the real mapping server and sends a spoofed one instead 🙅‍♀️.

The first kind of impersonation attack is really a problem of mapping server discovery, not of the mapping protocol itself 🗺️. Still, the mapping protocol may let impersonation get detected, which stops responses from an impersonating entity from being accepted, and might even kick off a more secure discovery procedure 🔐✨.

Corruption of the mapping database can't be fixed directly through how the mapping protocol is designed 🙃. Once corruption has been detected, though, the mapping protocol may have a part to play in figuring out which records got corrupted 🕵️‍♀️.

Beyond attacks on the mapping operation itself, mapping can also be used to attack other entities 🎯. One option is that mapping clients get misled into sending mapping queries to the attack's target instead of the mapping server. Stopping that is an operational issue, not a protocol design one 🛠️. Another possibility is that the mapping server gets tricked into sending responses to the target by spoofing the source address in the query 🪞.

5.2.2. Attacks to Prevent a Specific Individual from Receiving Aid

Say an attacker wants to deny emergency service to one specific person 😤. The mass attacks from Section 5.2.1 will totally work if that person is inside the affected group 💯. Except for the flooding attack on the mapping server, the attacker could in theory limit these attacks to just the target 🎀. But that takes extra effort the attacker probably won't bother with 🙄. If an attacker runs a mass attack and doesn't want the blast radius to be too huge, they're more likely to attack for a carefully limited stretch of time ⏱️.

If the attacker wants to be selective, though, it can make more sense to go after the mapping client instead of the mapping server 🎯. This is especially true when the mapping client is the emergency caller's device 📱. The attacker's options look a lot like denial of service on the server side 👯:

a flooding attack on the mapping client;
taking control of any intermediary node (for example, a router) through which the mapping queries and responses pass, and then using that control to block or modify them.

Taking control of the mapping client is also a logical possibility, but it doesn't raise any issues for the mapping protocol 🤷‍♀️.

5.2.3. Attacks to Gain Information about an Emergency

This section is all about attacks that dig for info about an emergency 🕵️‍♀️👀. The attacker might want the caller's location, for example to pull off a criminal attack 😱. Or they might be after info that could link a person (the caller or someone else involved in the emergency) to something embarrassing tied to the emergency, like "Who did the police take away just now?" 🫣. Last but not least, the attacker could be trying to cash in on the emergency 💸, maybe by offering their services, like a news reporter or a lawyer aggressively chasing new business 🦈.

Interception of mapping requests and responses will mainly reveal a location, a URI identifying a PSAP, the emergency service identifier, and the addresses of the mapping client and server 📍. The location can be directly useful to an attacker if they're highly confident that the observed query is about an emergency involving the target 🚨. The emergency service identifier in the mapping query might also reveal the type of emergency: fire, police, or ambulance 🚒🚓🚑. The other bits might set up further attacks on emergency call routing, but because of the time factor, they're unlikely to matter for routing the current call ⏳. However, if the mapping client is the emergency caller's device, the attacker may learn things that let them interfere with the call after it has been set up, or intercept the media stream between the caller and the PSAP 📡😬.

6. Security Requirements Relating to Emergency Marking and Mapping

Okay, this section lays out the security requirements that have to be fulfilled to prevent the attacks from Section 5 or reduce how well they work 🛡️✨. The requirements are listed in the same order as the attacks 💖.

From Section 5.1:

Attack A1: fraudulent calls.

Requirement R1: For calls that meet conditions a) to c) of Section 5.1, the service provider's call routing entity MUST verify that the destination address (e.g., SIP Request-URI) presented in the call signalling is that of a PSAP. 🚦

Attack A2: Use of emergency identifier to probe in order to identify emergency call routing entities for attack by other means.

Requirement: None identified, beyond the ordinary operational requirement to defend emergency call routing entities by means such as firewalls and, where possible, authentication and authorization. 🧱

From Section 5.2.1:

Attack A3: Flooding attack on the mapping client, mapping server, or a third entity.

Requirement R2: The mapping protocol MUST NOT create new opportunities for flooding attacks, including amplification attacks. 🌊🚫

Attack A4: Insertion of interfering messages.

Requirement R3: The protocol MUST permit the mapping client to verify that the response it receives is responding to the query it sent out. ✅

Attack A5: Man-in-the-middle modification of messages.

Requirement R4: The mapping protocol MUST provide integrity protection of requests and responses. 🔒

Requirement R5: The mapping protocol or the system within which the protocol is implemented MUST permit the mapping client to authenticate the source of mapping responses. 🪪

Attack A6: Impersonation of the mapping server.

Requirement R6: The security considerations for any discussion of mapping server discovery MUST address measures to prevent impersonation of the mapping server. 🎭🛑

Requirement R5 also follows from this attack.

Attack A7: Corruption of the mapping database.

Requirement R7: The security considerations for the mapping protocol MUST address measures to prevent database corruption by an attacker. 🗄️🔐

Requirement R8: The protocol SHOULD include information in the response that allows subsequent correlation of that response with internal logs that may be kept on the mapping server, to allow debugging of mis-directed calls. 🔍🪲

From Section 5.2.2: No new requirements. 🙌

From Section 5.2.3:

Attack A8: Snooping of location and other information.

Requirement R9: The protocol and the system within which it is implemented MUST maintain confidentiality of the request and response. 🤐💜

7. Security Considerations

This document addresses security threats and security requirements. Therefore, security is considered throughout this document. 🔐💅

8. Acknowledgements

Writing this document was a real challenge 😩, because it was super tempting to think about the security concerns of the entire personal emergency calling system, not just the pieces inside the scope of the ECRIT Working Group 🌈. Hannes Tschofenig did the initial security analysis for ECRIT, and it has been shaped since then by the comments and judgement of the ECRIT WG at large 🫶. At an earlier stage, Stephen Kent of the Security Directorate was asked to review it and gave extensive comments, which led to a complete rewrite 🙌. Brian Rosen, Roger Marshall, Andrew Newton, and most recently, Spencer Dawkins, Kamran Aquil, and Ron Watro also gave detailed reviews at various stages 💖. The authors thank them all 🎀.

We would also like to thank Donald Eastlake for his review on behalf of the Security Area Directorate, and Christian Vogt for his review as part of the General Area Review Team 🌸.

Finally, we would like to thank Jari Arkko, Jon Peterson, and Russ Housley for their IETF Last Call comments ✨.

9. References

9.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

9.2. Informative References

[RFC3693]  Cuellar, J., Morris, J., Mulligan, D., Peterson, J., and
           J. Polk, "Geopriv Requirements", RFC 3693, February 2004.

[RFC5012]  Schulzrinne, H. and R. Marshall, Ed., "Requirements for
           Emergency Context Resolution with Internet Technologies",
           RFC 5012, January 2008.

Authors' Addresses

Tom Taylor (editor)
Nortel
1852 Lorraine Ave
Ottawa, Ontario  K1H 6Z8
Canada

EMail: tom.taylor@rogers.com


Hannes Tschofenig
Nokia Siemens Networks
Otto-Hahn-Ring 6
Munich, Bavaria  81739
Germany

EMail: Hannes.Tschofenig@nsn.com
URI:   http://www.tschofenig.com


Henning Schulzrinne
Columbia University
Department of Computer Science
450 Computer Science Building
New York, NY  10027
US

Phone: +1 212 939 7004
EMail: hgs+ecrit@cs.columbia.edu
URI:   http://www.cs.columbia.edu


Murugaraj Shanmugam
Detecon International GmbH
Oberkasseler str 2
Bonn, NRW  53227
Germany

EMail: murugaraj.shanmugam@detecon.com

Full Copyright Statement

Okay so, the legal bit, but make it cute 🎀 Copyright (C) The IETF Trust (2008). ✨ This document is subject to the rights, licenses and restrictions in BCP 78, and except for what BCP 78 says, the authors keep all their rights 💅

This document and the information in it are provided "AS IS" 🫶 THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 😭

Intellectual Property

Okay, so the IETF is not saying whether any IPR (intellectual property rights) or other rights that someone might claim over the tech in this doc are valid or how far they reach 🧐 It also isn't saying it looked for any of those rights itself 🤷‍♀️ If you want the rules for rights in RFC documents, check out BCP 78 and BCP 79, bestie 📚

Copies of IPR disclosures sent to the IETF Secretariat are a whole thing 💼 So are any assurances of licenses that might be offered, and the results of any attempt to get a general license or permission for implementers or users to use those proprietary rights. You can find all of that in the IETF online IPR repository at http://www.ietf.org/ipr 🌐

The IETF is also inviting anyone who's interested to flag any copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard 🦋 Send that info to the IETF at ietf-ipr@ietf.org 💌 It's giving community, honestly 🌈 ✨

📦 where this page comes from

ietf: rfc5069 2008-01
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms