3GPP TSG-T2 #7 / ETSI SMG4
Ystad, SWEDEN, 22-26 November 1999	TSGT2#7(99)946	

Source:	Nokia

Title: 	Notes from MExE discussions at 3GPP TSG SA WG3 #8 meeting 
	Sofia Antipolis 17.11.1999

Document for:	for information 
___________________________________________________________________________
In the S3-MExE session there were three persons from the MExE group, 
Mark Cataldo (Motorola)
Tim Wright (Vodafone)
Vesa Tervo (Nokia)

Even though the security group was invited to send contributions to MExE security via the email reflector, there was no discussion what so ever except for the Colin Blanchard's invitation of discussion.
This document describes the discussions which sprang up from the MExE security presentation (Tdoc S3-99446) by Tim Wright and from the Mark Cataldo's "Comments from the MExE Chairman" (Tdoc S3-99442).

The reason of having an administrator was questioned. As an example, one could need it to protect oneself from a badly behaving CA, which is signing software from a corrupt software house. It was also explained to S3 that the admin can't revoke nor delete any certificate, only turn them on and off.

A question was raised if WAP can be implemented in phone without MExE. The answer is yes.

A possible scenario was raised: There is a hypothetical country where the human rights are not respected. In the country the government runs also the operator business. This operator wants to be the administrator, could he use the MExE device in this case as a bugging device to spy on its customers / citizens. The answer is yes, but only with the user permission.

The security table was found to be complex by a number of delegates. Also the status of actions, that are not listed in the table, were not clear to all participants. There was a suggestion that the security table should only list the forbidden actions. This would make it more readable. 

Discussion about the external port access led to the conclusion that the user must be warned about a potential risk for example when a GPS is inserted to the external port. Also there are foreseeable use cases such as "putting yourself on a map" which need this kind of information, so the user is to be trusted to make the decision.

There was a discussion on stealing the display and key input to another program. For example a long-lived Trojan horse could track PIN codes or record credit card numbers. The answer to this question was that the input from the keyboard or other input device goes to the program, which is active or has the focus.

The discussion wound on prompting the user for rights to do certain actions. For example a program wants to make a phone call to premium rate phone number, but asks permission for something else. The answer in this case is that even though the program asks something it does not get the right to do it as the MExE environment (or the operating system of the phone) as a part of the phone functionality asks the question from the user when the MExE executable wants to do the action.

There was a question about possibility of having a "Blanket No" as a user-defined permission. For example to prevent automatic downloading of software and having to answer NO every time as program is offered. This is not needed, as there is no push without a pull. The user must initiate the download first.

Question was raised if it is possible to close the whole MExE functionality in a phone. This might be difficult in some cases as closing MExE could prevent the phone from functioning. So it is an implementation dependent issue.

The administrator flow diagram was also found to be complex by some members in S3. It is almost impossible to read and follow for example when an operator wants to become an administrator.

There was a question if running trusted and untrusted applications at the same time should be disallowed. This could lead to difficulties in implementation. One possible case is that some trusted programs need to run all the time e.g. a calendar program. And it should be possible to run untrusted applications at the same time. For example one might want to play Tetris while waiting the calendar to alert. 

A point was raised that the user should know if the application that is running is trusted or untrusted. This is of course an implementation issue of the terminal.

The journaling of MExE was explained to the S3.