DESCRIPTION
Title of Invention
PRIVACY ISSUES IN M2M
Technical Field
[0001]
The present invention relates to security and privacy issue in machine-to-machine
communication (M2M).
Background Art
[0002]
Privacy issue has been considered in 3GPP (Third Generation Partnership Project).
NPL 3 discloses "Privacy breach due to (unnecessary) collection of location information of an
MTC (Machine-Type-Communication) Device that can be linked to an individual" (see Clause
5.7.2).
[0003]
The requirement described in NPL 3 is "It should be possible to prevent tracking of
location information for some types of MTC Device" (see Clause 5.73).
[0004]
Therefore a mechanism of securely providing location information from MTC device to
network and MTC server is necessary in M2M system.
[0005]
Note that service requirements and system improvements for MTC are disclosed by
NPL 1 and 2, respectively.
Citation List
Non Patent Literature
[0006]
NPL 1: 3GPP TR 22.368, "Service requirements for Machine-Type Communications
(MTC); (Release 11)", VI 1.3.0, 2011-09, clause 7.2.11, pp. 16-17
NPL 2 : 3GPP TR 23.888, "System Improvements for Machine-Type Communications;
(Release 11)", Vl.5.0, 2011-10, clause 4, pp. 7-17
NPL 3: 3GPP TR 33.868, "Security aspects of Machine-Type Communications (Release
11)", VO.6.0, 2011-11, clauses 5.7 and 7.6, pp. 17-18 and 29
Summary of Invention
[0007]
As location information is important and related to privacy, it should only be provided
securely to authenticated and authorized MTC server when it is necessary.
[0008]
The issue can be broken down as below:
[1]. Location information should not be exposed to unauthorized MTC server to prevent
attack.
[2]. MTC device can provide location information according to network and/or MTC
server request.
[3]. Unnecessary location information should not be sent especially continuously to
create more traffic load.
[4]. Location information should be available and secured in emergency case.
[0009]
NPL 3 has not provided any solution for the above mentioned issues. To achieve them,
interfaces T5a/T5b and MTCsp should be enhanced.
[0010]
In this invention, privacy data is considered with focus on location information as
described in NPL 3. The invention is applicable for other privacy data as well.
[0011]
It is described in NPL 3 that MTC Devices may be detached from the network when not
communicating to prevent unnecessary collection of location information by the network.
However, MTC device may need keep connected and cannot be detached only for location
information purpose.
[0012]
It is also proposed in NPL 3 that "The MTC Device may need to provide an ability to
transmit location tracking information in emergency case". To which a solution is provided in
this invention.
Advantageous Effects of Invention
[0013]
According to the present invention, it is possible to achieve at least one of the following
effects 1 to 4.
[0014]
1. Location information is only provided to authorized MTC server from a MTC device
with the feature, when it is necessary according to network and/or MTC server requirement.
2. Location information is protected while being sent to network and MTC server to
prevent attack.
3. Location information provision function can be switched-off so that unnecessary
location information will not be provided; MTC device can still connect to network; reduce
traffic load.
4. Location information can be securely provided in emergency case.
Brief Description of Drawings
[0015]
[Fig. 1]
Fig. 1 is a block diagram showing a configuration example of a system according to an
exemplary embodiment of the present invention.
[Fig. 2]
Fig. 2 is a sequence diagram showing an operation example of a system according to an
exemplary embodiment of the present invention.
[Fig. 3]
Fig. 3 is a block diagram showing a configuration example of an MTC device according
to an exemplary embodiment of the present invention.
[Fig. 4]
Fig. 4 is a block diagram showing a configuration example of a node according to an
exemplary embodiment of the present invention.
Description of Embodiments
[0016]
Hereinafter, an exemplary embodiment of the present invention will be described with
reference to Figs. 1 to 4.
[0017]
As shown in Fig. 1, a system according to this exemplary embodiment includes a UE
(User Equipment) serving as an MTC device 10, a network, and an MTC server 20. The MTC
device 10 is connected to the network via a RAN (Radio Access Network). The network
includes an MME (Mobility Management Entity) 30, an HSS (Home Subscriber Server), an
MTC-IWF (Interworking Function) 40, S-GW (Serving Gateway), P-GW (PDN (Packet Data
Network) Gateway), and the like. The MME 30 is connected to the MTC server 20 via the
MTC IWF 40 or S-GW/P-GW
[0018]
The inventors of this application have found that in such a system, there are the
following threats regarding privacy issue.
[0019]

Privacy breach due to (unnecessary) collection of location information of an MTC
Device that can be linked to an individual.
[0020]
Privacy sensitive information sent by a MTC device which is not allowed to do so, or
towards a MTC server which is not allowed to receive it. Note that in the context of MTC,
identity information and location information can be considered as privacy sensitive information.
[0021]
In order to address these threats, the following security requirements apply.
[0022]

- Network should be able to verify whether a message contains any privacy sensitive
information.
- Network should be able to perform access control for MTC device which is sending
privacy sensitive information and MTC server which requests and is receiving the privacy
information.
- Privacy sensitive information transmitted to MTC server via network should be
protected.
[0023]
There are described solutions which meet these security requirements.
[0024]

When the MTC device needs to connect with network, it should be able to switch-off
the functionality of provisioning location information, such that it still can communicate with the
network.
[0025]
A field should be added in a given message to indicate whether the message contains
privacy sensitive information, such that the network can verify.
[0026]
Further, in order to achieve privacy issues in emergency case, the following security
requirements may apply.
[0027]

- MTC device should be able to securely provide location information and other privacy
sensitive information in emergency case.
- Network should be able to perform access control of MTC device which is sending
privacy sensitive information in emergency message.
[0028]
There are described solutions which meet these security requirements.
[0029]

A field can be added in a given emergency message to indicate whether it is an
emergency-use MTC device. Network verifies whether the MTC device can be used/activated
in emergency case.
[0030]
Security protection can be provided by NAS security context if they are valid, or an
optional solution is to deploy an emergency-use USIM in MTC device.
[0031]
Next, there will be described details of the above-mentioned solutions with reference to
Fig. 2.
[0032]
A few assumptions are made as below:
i . Network and MTC server 20 has mutual authentication;
ii. MTC device 10 and network has mutual authentication;
iii. MTC device 10 and MTC server 20 has mutual authentication.
[0033]
Network should be aware of location information is being sent to MTC server, and it
should perform authorization to verify if the information can be sent to a specific MTC server.
[0034]
Operations to achieve the above-mentioned issue [1] (Location information should not
be exposed to unauthorized MTC server to prevent attack) are as follows.
a) Special field to indicate that the message includes location information is used in b) to d)
below.
b) The location information should be protected by secure communication between MTC
device 10 and MTC server 20.
c) Network performs authorization for MTC device 10 (Step S 5), by verifying:
(cl) whether the MTC device 10 has the feature of providing location information;
(c2) whether the MTC device 10 is allowed to send the location information to the given
MTC server 20.
d) Network performs authorization for MTC server 20 (Step S 5), by verifying:
(dl) whether MTC server 20 is allowed to request location information from the given
MTC device 10.
[0035]
Operations to achieve the above-mentioned issue [2] (MTC device can provide location
information according to network and/or MTC server request) are as follows.
a) In Attach procedure, MTC device 10 is given location information related parameter such as
allowed MTC server, functionality switch on/off (Steps SI and S2). And it should send
location information every time soon after it is attached to the network (Steps S3 to SI4). It is
the same for TAU (Tracking Area Update)
b) The MTC device 10 can be triggered to send location information with:
(bl) Timer for location report (which can be periodic, or fixed time for next time only)
(Steps S5 to S7);
(b2) Trigger message from authorized MTC server 20 with a request (Steps S8 to S10);
(b3) Emergency case (Steps SI3 and SI ); or
(b4) Location change, depend on the agreement with network/MTC server 20. This
can be in TAU procedure (Steps S 1 and S12).
[0036]
Operations to achieve the above-mentioned issue [3] (Unnecessary location information
should not be sent especially continuously to prevent network load) are as follows.
a) MTC device 10 should be able to switch off the functionality to provide location information,
to be tracked or monitored, while MTC device 10 needs to be connected to the network for other
communication (Step SI 7).
b) The switch off timing can be indicated by the MTC server 20 when it is necessary or
dependent on a configured condition, e.g. event trigger of every time after the location
information is provided.
[0037]
Operations to achieve the above-mentioned issue [4] (Location information should be
available and secured in emergency case) are as follows.
a) On emergency (Step SI 8), the MTC Device 10 starts communication via MME 30 thus
sending control message to MTC server 20 (Step S21).
b) MME 30 can identify that the MTC device 10 is an emergency device due to special field in
IMEI (International Mobile Equipment Identity) (Step S22). MME 30 can be informed by HSS
that the MTC device/UE is an emergency device. There could be other ways to identify a
device as a MTC device, e.g. a new field in the packet sent from the MTC device 10.
c) MME 30 signals b) to MTC Server 20 via the MTC IWF 40 or S-GW/P-GW.
d) Deploy unique emergency USIMs (Universal Subscriber Identity Modules). This can be
done by registering USIMs sold to e.g. car companies as emergency MTC USIMs or simple
having special USIMs with special IMSI (International Mobile Subscriber Identity) that relate to
emergency MTC devices.
e) Security of the privacy data (location information) transmission can be transmitted (Step
S20), in one of the following ways:
(el) The emergency-use USIM can provide security context to protect privacy data
(location information) (Step SI 9);
(e2) NAS (Non-Access Stratum) security between MTC device 10 and MME 30
followed by security between MTC IWF 40 and MTC server 20; or
(e3) End-to-end security between MTC device 10 and MTC server 20.
f) Emergency content of the message could be the novel part: MTC device identifier indicating
it is an emergency device, —message path: MTC device 10 ® MME 30 ® MTC IWF 40 ®
MTC Server 20.
[0038]
Next, configuration examples of the MTC device 10 and the MME 30 according to
above-mentioned exemplary embodiments will be subsequently described with reference to Figs.
3 and 4.
[0039]
As shown in Fig. 3, the MTC device 10 includes an including unit 11, a sending unit 12,
and a switch-off unit 13. The including unit 11 includes, in the message, the field mentioned in
the operations regarding the issue [1]. The sending unit 12 sends the message to the MTC
server 20 through the MME 30, and the MTC-IWF 40 or the S-GW/P-GW. As mentioned in
the operations regarding the issue [2], the sending unit 12 may send out the privacy sensitive
information by using, as a trigger, expiry of the timer, a trigger message received from the MTC
server 20, or change in location of the MTC device. As mentioned in the operations regarding
the issue [3], the switch-off unit 3 switches off the functionality to provide the privacy sensitive
information, while maintaining the connection with the MME 30, and the MTC-IWF 40 or the
S-GW/P-GW. In the emergency case, the including unit 1 includes, in the message or the
IMEI in the message, the field mentioned in the operations regarding the issue [4]. At this time,
the sending unit 12 may protect the privacy sensitive information with the security context stored
in the above-mentioned emergency-use USIM (not shown). Note that the units 11 to 13 are
mutually connected with each other thorough a bus or the like. These units 11 to 13 can be
configured by, for example, a transceiver which conducts communication with the MME 30 and
the like through the RAN, and a controller which controls this transceiver to execute the
processes shown in Fig. 2 or processes equivalent thereto.
[0040]
Further, as shown in Fig. 4, the MME 30, which is one of node forming the network,
includes a receiving unit 31, a verifying unit 32, an authorizing unit 33, a protecting unit 34, and
an identifying unit 35. The receiving unit 31 receives, from the MTC device 10, the message
including the field mentioned in the operations regarding the issue [1]. The verifying unit 32
verifies, based on this field, whether the message contains the privacy sensitive information.
The authorizing unit 33 authorizes the MTC device 0 by verifying whether the MTC device 0
is allowed to send the privacy sensitive information to the MTC server 20. Also, the
authorizing unit 33 authorizes the MTC server 20 by verifying whether the MTC server 20 is
allowed to request or receive the privacy sensitive information from the MTC device 10. The
protecting unit 34 securely protects the privacy sensitive information upon transferring the
message from the MTC device 10 to the MTC server 20. In the emergency case, the receiving
unit 3 1 receives, from the MTC device 10, the message including the field mentioned in the
operations regarding the issue [4]. The identifying unit 35 identifies, based on this field, the
MTC device 10 as the emergency device. Note that the units 3 1 to 35 are mutually connected
with each other thorough a bus or the like. These units 3 1 to 35 can be configured by, for
example, a transceiver which conducts communication with the MTC device 10 through the
RAN, a transceiver which conducts communication with the MTC server 20 through the
MTC-IWF 40 or the P-GW, and a controller which controls these transceivers to execute the
processes shown in Fig. 2 or processes equivalent thereto.
[0041]
Note that the present invention is not limited to the above-mentioned exemplary
embodiment, and it is obvious that various modifications can be made by those of ordinary skill
in the art based on the recitation of the claims.
[0042]
This application is based upon and claims the benefit of priority from Japanese patent
application No. 2012-015576, filed on January 27, 2012, the disclosure of which is incorporated
herein in its entirety by reference.
[0043]
The whole or part of the exemplary embodiments disclosed above can be described as,
but not limited to, the following supplementary notes.
[0044]
(Supplementary note 1)
Special field to indicate the message includes privacy data (i.e., location information).
[0045]
(Supplementary note 2)
Special field to indicate the MTC device can active in emergency.
[0046]
(Supplementary note 3)
Access control for MTC device which intends to provide privacy data to a given MTC
server.
[0047]
(Supplementary note 4)
Access control for MTC server which intends to request privacy data to a given MTC
device.
[0048]
(Supplementary note 5)
Trigger to request MTC device providing location information or other privacy sensitive
information according to network and/or MTC server requirement, can be timer, trigger message,
location change.
[0049]
(Supplementary note 6)
Privacy data including location information can be securely provided in emergency
case.
[0050]
(Supplementary note 7)
Secure communication between MTC device and MTC server is provided, options are
unique USIM for emergency use; NAS security followed by security between MTC IWF and
MTC server; end-to-end security between MTC device and MTC server.
[0051]
(Supplementary note 8)
MTC device can switch-off the functionality which sends location information, e.g.,
location report, monitoring, tracking while the MTC device can still be connected to network.
[0052]
(Supplementary note 9)
Emergency content in the message indicates it is an emergency use MTC device.
Reference Signs List
[0053]
10 MTC DEVICE
11 INCLUDING UNIT
12 SENDING UNIT
13 SWITCH-OFF UNIT
20 MTC SERVER
30 MME
3 1 RECEIVING UNIT
32 VERIFYING UNIT
33 AUTHORIZING UNIT
34 PROTECTING UNIT
35 IDENTIFYING UNIT
40 MTC-IWF
CLAIMS
[Claim 1]
A system comprising:
an MTC (Machine-Type-Communication) device;
an MTC server; and
a network that relays traffic between the MTC device and the MTC server,
wherein the MTC device includes, in a message to be transmitted to the MTC server, a
field to indicate whether the message contains privacy sensitive information, and
wherein the network is configured to verify, based on the field, whether the message
contains the privacy sensitive information.
[Claim 2]
The system according to Claim 1, wherein the network is further configured to authorize
the MTC device by verifying whether the MTC device is allowed to send the privacy sensitive
information to the MTC server.
[Claim 3]
The system according to Claim 1 or 2, wherein the network is further configured to
authorize the MTC server by verifying whether the MTC server is allowed to request or receive
the privacy sensitive information from the MTC device.
[Claim 4]
The system according to any one of Claims 1 to 3, wherein the network is further
configured to securely protect the privacy sensitive information upon transferring the messag
from the MTC device to the MTC server.
[Claim 5]
The system according to any one of Claims 1 to 4, wherein the privacy sensitive
information includes location information of the MTC device.
[Claim 6]
An MTC device that communicates with an MTC server through a network, the MTC
device comprising:
an including means for including, in a message to be transmitted to the MTC server, a
field to indicate whether the message contains privacy sensitive information; and
a sending means for sending the message to the MTC server through the network.
[Claim 7]
A node forming a network that relays traffic between an MTC device and an MTC
server, the node comprising:
a receiving means for receiving from the MTC device a message to be transmitted to the
MTC server, the message including a field to indicate whether the message contains privacy
sensitive information; and
a verifying means for verifying, based on the field, whether the message contains the
privacy sensitive information.
[Claim 8]
The node according to Claim 7, further comprising:
an authorizing means for authorizing the MTC device by verifying whether the MTC
device is allowed to send the privacy sensitive information to the MTC server.
[Claim 9]
The node according to Claim 8, wherein the authorizing means is configured to further
authorize the MTC server by verifying whether the MTC server is allowed to request or receive
the privacy sensitive information from the MTC device.
[Claim 10]
The node according to any one of Claims 7 to 9, further comprising:
a protecting means for securely protecting the privacy sensitive information upon
transferring the message from the MTC device to the MTC server.
[Claim 11]
A method of controlling operations in an MTC device that communicates with an MTC
server through a network, the method comprising:
including, in a message to be transmitted to the MTC server, a field to indicate whether
the message contains privacy sensitive information; and
sending the message to the MTC server through the network.
[Claim 12]
A method of controlling operations in a node forming a network that relays traffic
between an MTC device and an MTC server, the method comprising:
receiving from the MTC device a message to be transmitted to the MTC server, the
message including a field to indicate whether the message contains privacy sensitive
information; and
verifying, based on the field, whether the message contains the privacy sensitive
information.
[Claim 13]
A system comprising:
an MTC device;
an MTC server; and
a network that relays traffic between the MTC device and the MTC server,
wherein the MTC device sends out privacy sensitive information by using, as a trigger,
expiry of a timer, a trigger message received from the MTC server, or change in location of the
MTC device.
[Claim 14]
The system according to Claim 13, wherein the MTC device sends out, as the privacy
sensitive information, location information of the MTC device.
[Claim 15]
An MTC device that communicates with an MTC server through a network, the MTC
device comprising:
a sending means for sending out privacy sensitive information by using, as a trigger,
expiry of a timer, a trigger message received from the MTC server, or change in location of the
MTC device.
[Claim 16]
A method of controlling operations in an MTC device that communicates with an MTC
server through a network, the method comprising:
sending out privacy sensitive information by using, as a trigger, expiry of a timer, a
trigger message received from the MTC server, or change in location of the MTC device.
[Claim 17]
A system comprising:
an MTC device;
an MTC server; and
a network that relays traffic between the MTC device and the MTC server,
wherein the MTC device switches off a function of providing privacy sensitive
information, while maintaining connection with the network.
[Claim 18]
The system according to Claim 17, wherein a timing for the switch-off is indicated by
the MTC server, or depends on a preconfigured condition.
[Claim 19]
The system according to Claim 17 or 18, wherein the function is configured to provide,
as the privacy sensitive information, location information of the MTC device.
[Claim 20]
An MTC device that communicates with an MTC server through a network, the MTC
device comprising:
a switch-off means for switching off a function of providing privacy sensitive
information, while maintaining connection with the network.
[Claim 21]
A method of controlling operations in an MTC device that communicates with an MTC
server through a network, the method comprising:
switching off a function of providing privacy sensitive information, while maintaining
connection with the network.
[Claim 22]
A system comprising:
an MTC device;
an MTC server; and
a network that relays traffic between the MTC device and the MTC server,
wherein the MTC device includes, in a message to be transmitted to the MTC server or
an identifier of the MTC device in the message, a field to indicate that the MTC device is a
device used in an emergency case, the message containing privacy sensitive information, and
wherein the network is configured to identify, based on the field, the MTC device as the
device used in the emergency case.
[Claim 23]
The system according to Claim 22, wherein the identifier including the field is stored in
a SIM (Subscriber Identity Module) mounted on the MTC device.
[Claim 24]
The system according to Claim 23,
wherein the SIM further stores security context, and
wherein the MTC device protects the privacy sensitive information with the security
context.
[Claim 25]
The system according to Claim 22 or 23, wherein the network is further configured to
securely protect the privacy sensitive information upon transferring the message from the MTC
device to the MTC server.
[Claim 26]
The system according to any one of Claims 22 to 25, wherein the privacy sensitive
information includes location information of the MTC device.
[Claim 27]
An MTC device that communicates with an MTC server through a network, the MTC
device comprising:
an including means for including, in a message to be transmitted to the MTC server or
an identifier of the MTC device in the message, a field to indicate that the MTC device is a
device used in an emergency case, the message containing privacy sensitive information; and
a sending means for sending the message to the MTC server through the network.
[Claim 28]
The MTC device according to Claim 27, further comprising:
a SIM that stores the identifier including the field.
[Claim 29]
The MTC device according to Claim 28,
wherein the SIM further stores security context, and
wherein the sending means is configured to protect the privacy sensitive information
with the security context.
[Claim 30]
A node forming a network that relays traffic between an MTC device and an MTC
server, the node comprising:
a receiving means for receiving from the MTC device a message to be transmitted to the
MTC server, the message or an identifier of the MTC device in the message including a field to
indicate that the MTC device is a device used in an emergency case, the message containing
privacy sensitive information; and
an identifying means for identifying, based on the field, the MTC device as the device
used in the emergency case.
[Claim 31]
The node according to Claim 30, further comprising:
a protecting means for securely protecting the privacy sensitive information upon
transferring the message to the MTC server.
[Claim 32]
A method of controlling operations in an MTC device that communicates with an MTC
server through a network, the method comprising:
including, in a message to be transmitted to the MTC server or an identifier of the MTC
device in the message, a field to indicate that the MTC device is a device used in an emergency
case, the message containing privacy sensitive information; and
sending the message to the MTC server through the network.
[Claim 33]
A method of controlling operations in a node forming a network that relays traffic
between an MTC device and an MTC server, the method comprising:
receiving from the MTC device a message to be transmitted to the MTC server, the
message or an identifier of the MTC device in the message including a field to indicate that the
MTC device is a device used in an emergency case, the message containing privacy sensitive
information; and
identifying, based on the field, the MTC device as the device used in the emergency
case.