3GPP TSG-T2 #12
Beverly Hills, USA
February 12th  - February 16th 2001	T2-010078 	

Agenda Item: MExE	

Source: Nokia	

Title: Terminal behaviour on Power up event	

Document for: Description of the CR T2-010080	

___________________________________________________________________________

This paper is intended to highlight the problems which are currently present in the logic of verifying the ORPK at the time of power up. Also every branch of the figure 7 in MExE specification is examined separately in connection with the proposed by CR T2-010000 changes

Problem statement as per the view on the current Figure 7 of MExE specification:

1.	If SIM is not inserted, there is still a chance that ORPK is in ME and therefore there is a chance to verify if the application is trusted or not. This check is not present at the moment. One could assume that if there is no SIM inserted there is no need to verify previously installed applications, because nothing new can be downloaded over the air. However it has to be taken into account that an application can still be downloaded e.g. via PC connectivity. 

2.	If SIM is inserted and OPRK is on the SIM one should take into account that ME also can have ORPK, therefore such a check is needed. This check also handles multiple subscription case. This issue is currently not addressed in the Figure.

3.	If SIM is present and does not contain ORPK, but the ME has  ORPK, how non existent SIM ORPK ID can be verified against  ME ORPK ID?

Description of each branch of Figure 7 of MExE spec with proposed changes.

SIM present? -> NO -> ORPK in ME? -> NO -> operator application is untrusted

SIM present? -> NO -> ORPK in ME? -> YES -> depending on whether ORPK ID is the same as app ID, the application is trusted or untrusted

SIM present? -> YES -> ORPK in SIM? -> YES -> ORPK in ME? -> YES -> (we have two ORPKs, which one is valid?) store SIM ORPK  ID in ME and verify it against application PK ID to determine whether application is trusted or untrusted. ORPKs in ME remain inactive and can not be compared with application PK ID (In this situation if you have multiple subscription and you want to execute an application which belongs to the operator who is not the owner of inserted SIM, you should be able to execute it in untrusted domain) Operator domain is enabled here.

SIM present? -> YES -> ORPK in SIM? -> YES -> ORPK in ME? -> NO -> store SIM ORPK  ID in ME enable operator domain and verify SIM ORPK ID against application PK ID to determine whether application is trusted or untrusted.

SIM present? -> YES -> ORPK in SIM? -> NO -> ORPK in ME -> NO -> no proof of identity and hence operator domain is disabled

SIM present? -> YES -> ORPK in SIM? -> NO -> ORPK in ME -> YES -> (we have one ORPK here which is in ME so we can't verify its ID against SIM ORPK ID) -> operator domain is enabled and need to verify OPRK ID against application PK ID to determine whether the application is trusted or untrusted.