Method and apparatus for securing location information and access control using the location information

(54) Title: METHOD AND APPLIANCE FOR SECURITY OF LOCATION INFORMATION SECURITY AND ACCESS CONTROL USING LOCATION INFORMATION (30) Unionist Priority: 26/01/2007 us 60 / 886,822 (73) Owner (s): interdigital Technology Corporation (72) Inventor (s): chunxuan ye, inhyok cha, yogendra c. SHAH (74) Attorney (s): Advocacia Pietro Ariboni S / C (86) International Request: pct US2008000972 of 25/01/2008 (87) International Publication: wo 2008 / 094452de 07/08/2008 (57) Abstract: method and device to guarantee LOCATION INFORMATION SECURITY AND ACCESS CONTROL USING LOCATION INFORMATION. A method and apparatus for securing location information and access control using location information is described. A wireless transmission and reception unit (WTRU) includes a location verification entity and a subscriber identity module (SIM). The location verification entity generates location information from the WTRU and the location information is embedded in a message on a SIM. A reliable processing module in the WTRU checks the integrity of the location information. The trusted processing module can be on the SIM. Location information can be physical location information or information regarding contextual location. The trusted processing module is configured to cryptographically secure and merge location information with the WTRU and verify an external entity's trust measures before granting access to location information or accepting information from the external entity. The trusted processing module can be a trusted computing group (TCG) trusted platform module (TPM) or mobile trusted module (MTM). Location information can be used for authentication or access control purposes. Location information can be combined with weather information.

there

<img file="BRPI0806197A2_D0001.tif" />

1/21

ΡΙ0806197-1

Method and apparatus for ensuring secure location information and access control using location information

FIELD OF INVENTION

The present invention is related to wireless communication.

HISTORIC

Local based services (LBS), is an emerging class of services that are provided based on the location of the wireless transmission / reception units (WTRUs) and their users. Various wireless communications standards, such as the third generation partnership project (3 GPP) and 3GPP2, define the network architectures to support LBS in application and service level architecture. Other groups, such as the Open Mobile Alliance (OMA) location technical specification group, also define the service level for LBS architectures.

Figure 1 illustrates the list of location services (LCS) clients and servers in the basic network, with the GSM EDGE radio access network (GERAN) 120 and universal terrestrial radio access network (UTRAN) 130 access networks. The basic network includes a centrally located mobile portal (GMLC), (a required GMLC (R-GMLC) 142, home GMLC (H-GMLC) 144, visited GMLC (V-GMLC) 146), a profile privacy register (PPR) 148, and other nodes in the network. [0007] An LCS is a location-based network server, an entity that serves a client and LCS enforces access control and security policies in terms of service location. In the 3GPP centric architecture of Figure 1, the various GMLCs correspond to the location of services, as previously defined. As part of the service or operation, an LCS customer, or one that resides inside, that is associated with them, or embedded within a WTRU 110 (an internal LCS 115 customer), or one that resides outside the W TRU 110 (a customer external LCS 150), can request location information from WTRUs 110 to an LCS server, (ie GMLC). There may be more than one internal LCS 115 client, more than one external LCS 150 client and more than one LCS server. A GMLC 142, 144, 146 contains functionality needed to support LCS. On a public mobile network (PLMN) site, there may be more than one GMLC. A GMLC is the first node in an internal LCS 115 client or an external LCS 150 client in a PLMN.

After performing registration authorization, the GMLC placement sends requests for mobile switching either to a center (MSC), serving support node GPRS (SGSN) or MSC server, and receives final location estimates from the corresponding entity. The information required for authorization, location and location of services requested information can be communicated between GMLCs, located on the same or different PLMN

RGMLC 142 6 is a GMLC that receives an order from an LCS customer. The HGMLC 144 is the GMLC residing in the home's WTRU target

2/21

PLMN, which is responsible for controlling the privacy verification of the WTRU goal. VGMLC 146 is the GMLC that is associated with the node serving the WTRU objective.

The PPR 148 Stores privacy Information of the WTRU 110. The PPR 148 executes privacy checks and sends the privacy check results to other network nodes. The PPR 148 is considered as an entity that is separate from, but supportive of, a 'location server' that is defined above, in that the PPR 148 provides the privacy (and access control or policy-related) Information about the WTRUs for whom location Services are sought.

Conventional methods of authentication and access control to a wireless network and / or applications and data on a WTRU and network servers have relied on techniques such as user authentication by single or multi-factor evidence, cryptographic message encryption and decryption, rule and behavior- based access control to network resources and / or device applications, and trust Processing techniques that verify the applications and operating systerrfs code integrity. Conventional methods have not considered the concepts and use of physical (geographical) and logical location Information as a decision variable for access control and authentication.

Newer WTRUs have location and positioning capabilities as provided by technologies, such as a global positioning system (GPS), assisted GPS (AGPS), or a wide area augmentation system (WAAS)). Various industry organizations, such as the 3GPP and GSM association (GSMA), have considered the use of LBS and specified requirements for such Services. However, the prior art work have limited its focus on providing Services that can be summarized as navigation systems, finding and tracking users, (eg, tracking of fleets or children), objects, (eg, nearest Stores or restaurants), or resources, (eg, Phone Service centers or nearest WiFi hot-spots). In other words, the location Information has been used as a factor of service-enablers but not as Service iimiters or Service controllers. Accordingly, the prior art has not considered the usage of location Information as a decision variable in access control and authentication.

In addition, in prior art, the location Information is limited to the physical location of a WTRU. The prior art has not considered a more expanded definition of location Information, such as proximity, enclosure, exclusion, referencing to trusted locations of known objects or entities.

Further, conventional methods have not considered how location- related components and Information can be tied to the architectures of network Services, devices, content and applications in a trusted manner. For example, locationreporting software for a GPS device attached to a WTRU may be compromised and may furnish false Information about the physical location of the WTRU to a Service provider. The Service provider may then be spoofed to allow specific Services that the WTRU

3/21 should not have been allowed to have an access to if the WTRU had reported real, uncompromised location. Securing the measuring, reporting, storing, and Processing of location Information needs careful consideration.

Further, conventional methods have not sufficiently considered the use of location Information in various mobile application processing, including digital rights management (DRM) and mobile payment, or the like, despite the fact that the location of the mobile device which wishes to conduct certain processing for network-based Service application could become a valuable source of Information that can be used to authenticate and securitize the application processing, if such Information can be trusted and securely handled. For example, in conventional mobile DRM application protocols, (such as the OMA DRM 2.0 protocol), the use of secure location Information as part of the device profile Information or as part of the rights objects acquisition protocol (ROAP), has not been considered .

SUMMARY

A method and apparatus for securing location Information and access control using the location Information are disclosed. The WTRU includes a location sensing entity and a subscriber identity module (SIM). The location sensing entity generates location Information of the WTRU and the location Information is stored in the secure area of ​​the SIM. A trusted processing module in the WTRU verifies integrity of the location Information. The trusted processing module may be on the SIM. The location Information may be physical location Information or contextual location-related Information. The trusted processing module is configured to cryptographically secure and bind the location Information to the WTRU, and verify trust metrics of an external entity prior to granting an access to the location Information or accepting Information from the external entity. The trusted processing module may be a trusted computing group (TCG) trusted platform module (TPM) or mobile trusted module (MTM). The location Information may be used for an authentication purpose or access control. The location Information may be combined with time Information.

BRIEF DESCRIPTION OF THE DRAWINGS

A more detailed understanding may be had from the following description, given by way of example and to be understood in conjunction with the accompanying drawings wherein:

Figure 1 illustrates the relation of LCS clients and servers in the core network with the GERAN and UTRAN access networks;

Figure 2 is a block diagram of a WTRU including an expanded SIM;

Figure 3 is a flow diagram of an example process for providing the secured location Information of the WTRU;

4/21

Figure 4 is a flow diagram of an example process for providing a secured location (with or without time) stamp of an event of interest by theWTRU; and Figure 5 is a block diagram of an example location server.

DETAILED DESCRIPTION

When referred to hereafter, the terminology WTRU includes but is not limited to a user equipment (UE), a mobile station, a fixed or mobile subscriber unit, a pager, a cellular telephone, a personal digital assistant (PDA), a Computer, or any other type of user device capable of operating in a wireless environment. When referred to hereafter, the terminology base station includes but is not limited to a Node-B, a site controller, an access point (AP), or any other type of interfacing device capable of operating in a wireless environment.

Figure 2 is a block diagram of a WTRU 200 including an expanded SIM 210. The WTRU 200 computes and reports an estimate of the current location Information of the WTRU 200 in a secure, non-tampered way, upon request for such Information from an LCS Client, internai or externai to the WTRU 200. The WTRU 200 includes an SIM 210 (or a universal SIM (USIM), hereinafter collectively as SIM), a micro processing unit (MPU) / application processor 220, a location sensing entity 230, a Communications processor 240, and a radio frequency ( RF) unit 250. Application programs (not shown in Figure 2) such as those for the internai LCS Client 115 are running on the MPU / appiication processor 220. There are also lower-level software (not shown in Figure 2) running on the WTRU 200 to support the various hardware and application-layer software for the various entities on the WTRU 200 including but not limited to the MPU / appiication processor 220, the location sensing entity 230, the communication processor 240, the RF unit 250, and the SIM (or USIM) 210. The received signals are processed by the RF unit 250 and the communication processor 240. The location sensing entity 230 may be a hardware and / or software entity for sensing the location of the WTRU 200. For example, the location sensing entity 230 may be a GPS receiver and associated software.

The location sensing entity 230 may estimate, either on its own or by using assistance or direction from a network, physical or contextual location Information of the WTRU 200. The physical location Information is Information about the WTRU's physical or geographical location, (eg, measured in latitude and longitude, or address Information, with or without altitude Information, or the like). The contextual location Information is logical or contextual Information regarding the WTRU's physical location. For example, perimeter or boundary Information in reference to another entity having geographical or contextual location Information, (eg, WTRU X is inside the boundary of a shopping ma !!, and WTRU Y is cutside the büüridãry of â buiiding). The contextual location Information may be directional and / or distance relationship in

5/21 reference to another entity having location Information, (eg, WTRU X is located 100 meters from WTRU Y, and WTRU Z is located 1 mile south-east of a base station W). The location Information may be combined with secure time Information to provide an additional parameter for control of access.

The SIM 210 holds a master secret used to identify the WTRU 200 and to provide authentication Services to support the establishment of a secure channel between the WTRU 200 and a network. A root identity is held securely within the device and never disclosed outside of the secure or trusted domain of the SIM 210.

The SIM 210 includes an SIM processor 212, a trusted platform module (TPM) 214 (or mobile trusted module (MTM)) (optional), a secure storage 216, and a real time clock (RTC) 218 ​​(optional). The SIM processor 212 performs conventional SIM functions and may be extended to perform security related functions. The location sensing entity 230 processes signals from the Communications processor 240 and outputs location Information to the MPU / appIication processor 220. The location Information is sent to the SIM 210. The SIM 210 also performs location stamping to messages, (eg, authentication messages used for authentication procedures), and events or data, (eg, data stored for applications that the SIM 210 may work on including DRM applications). The RTC 218 may output time Information, and the time Information may be combined with the location Information. Alternatively, the RTC 218 may reside outside of the SIM 210 but may provide the same functionality as when it was inside the SIM 210. The location Information or combined location-time Information may be stored in the secure storage 216. Since the location Information is embedded in the SIM, whích is the most secure component in the WTRU, the location Information may be considered to be secure, and may be used for access control, authentication, or other purposes, which will be explained in detail below. Alternatively, the location Information may be stored outside of the SIM 210 but still under cryptographic protection by the TPM 214 that may reside either inside the SIM 210 or outside of the SIM 210.

The SIM 210 may also be implemented in software that runs on the MPU / appIication processor 220. In this case, the TPM 214 protects the integrity and authenticity of the whole or parts of the WTRU 200 such as the SIM 210 and its associated software, the MPU / appIication processor 220 and its associated software, and the like.

The TPM 214, (more generally trusted Processing module) measures and assesses the integrity and trustworthiness of the platform and software of the WTRU 200 and may also assess the integrity and trustworthiness of external clients or their requirements to the WTRU 200 for iccaíion Services. The TPM 214 aiso protects the security of the location Information held either within the SIM 210 or outside of it but inside

6/21 the WTRU 200. The TPM 214 and components for secure location (and time) and conventional SIM functional units may be integrated within one integrated Circuit card (ICC). Alternatively, the TPM 214 may be located outside the SIM 210 within the WTRU 200 but may provide the same functionality as when it was inside the SIM 210.

The TPM 214 protects and provides the core root of trust for location functionality and trust measurement capability. The TPM 214 may work with, or under supervision of, the operating system and / or an application running on the MPU / AppIication processor 220 to verify trust metrics from an entity that requests the location Information from the WTRU 200, and grant and control access to the location Information only after verification of the requestor's trust metrics. The TPM 214 may work with, or under supervision of, the operating system and / or an application running on the MPU / AppIication processor 220 to request, collect, and verify trust metrics for the location sensing entity 230 prior to accepting the location Information supplied by the location sensing entity 230. The TPM 214 may work with, or under supervision of, the operating system and / or an application running on the MPU / AppIication processor 220 to generate and maintain a secure audit log. Upon inspection of the secure audit log, an LBS operator may eàsily determine whether the security of the components on the WTRU 200 may be trusted continuously.

Figure 3 is a flow diagram of an example process 300 for providing the secured location Information of the WTRU 200. Either upon request by an external entity or upon fetch from the WTRU 200 to the external entity, the WTRU 200 may first attest (to either self or remotely to an external entity such as a location server) at least one of the trust State of the WTRU 200 platform, the trust State of the location sensing entity, and / or the trust State of the internai LCS Client 115 (step 302 ), etc. Then the location Information is generated by the location sensing entity 230 and is buffered in secure storage (step 304). Optionally, current date / time, device serial number, and other parameters may be combined with the location Information (step 306). The location Information, along with the optional Information, is cryptographically bound to the WTRU 200 with a digital signature or through encryption, where the encryption key used is protected within the WTRU. The location Information as well as the optional other Information and parameters may also be encrypted for confidentiality protection using a private key of the WTRU or a symmetric key held within the WTRU (step 308). The generation, storage, retrieval, and / or use of the location Information may also be bound to the integrity of the whole platform and / or any part of the WTRU 200 by use of trusted computing technologies, (ie, by use of the TPM 214). A cryptographic one-way hash, (such as SHA-I, MD5, SHA-256, etc.), is generated from the (optionally encrypted) location Information and any optional Information (step 310). The hash is signed, (ie, encrypted using a private key held within the WTRU 200, preferably stored within, or

7/21 otherwise protected cryptographically by, the SIM 210 or a TPM 214), to yield a digital signature of the location Information and optional other Information (step 312). The hash operation is preferably performed within a secure execution environment such as within the SIM 210 or the TPM 214. Alternatively, such operation may also be performed by the MPU / appIication processor 220. A location certificate is generated by appending the signed digital hash, (ie, the digital signature), to the (optionally encrypted) location Information, (or the location Information combined with other Information) (step 314). [0034] Alternatively, the location Information may be provided during authentication procedures carried out to authenticate the WTRU to the Network. The location Information is incorporated within the authentication messages, where it is protected by the message integrity check (MIC) of the authentication protocol. In this case, a digital certificate may not be required.

An external entity may verify the location certificate using the WTRLTs public key. If the signature does not match, the location certificate is deemed invalid. The signature is verified by calculating a new hash from the location Information extracted from the location Information certificate. If the two hash values ​​do not match, the externai entity may assume that either the location certificate does not belong to that particular data record, or the data record has been altered. In either case, the externai entity must deem the location certificate as being invalid. If verification succeeds then the location Information is read from the location certificate and assumed to be trustworthy. The signed location certificate may be used as an undeniable proof of the location, that the data was notarized, and by the specific device used to generate the location certificate as identified by its unique serial number, or the like. [0036] The use of hashing and digital signatures for the location certificate helps to secure the communication of the location Information. The secure location component itself may be secure, but its output, (ie, the location certificate that contains the location information), may be not once the location certificate is handled outside the secure location component. For example, the location certificate may be altered by an insecure program or tampered whilst stored in an insecure memory. Therefore, use of hashing and digital signing secures the location Information in a verifiable way after the location Information is provided by the secure location component.

The location sensing entity 230 and the location Information may be calibrated and re-calibrated in accordance with a reliable, secure externai location reference such as those provided by a network-based location server. For example, this may be carried out by enhancing the authentication procedure that is carried out securely within the SIM 210, or by implementing separate procedures within the SIM 210.

The WTRU 200 can also stamp a description of an event of interest to it or a part of it (such as the MPU / appIication processor 220) with location

8/21

Information where such a stamping of the event takes place. Such location stamping of an event may also include Information of time when such location stamping takes place. In this case the stamping would be considered as location- time stamping.

Figure 4 is a flow diagram of an example process 400 for providing a secured location (with or without time) stamp of an event of interest by the WTRU 200 of Figure 2. Either upon request by an externai entíty or upon fetch from the WTRU 200 or a part of it (such as the MPU / appIication processor 220) to the externai entity and / or upon decision by the WTRU 200 or a part of it (such as the MPU / appIication processor 220) to log an event of interest, the WTRU 200 may first attest (to either self or remotely to an external entity such as a location server) at least one of the trust State of the WTRU 200 platform, the trust State of the location sensing entity, and / or the trust State of the internai LCS Client 115, etc. (step 402). Then, a description of the event of interest is generated by the WTRU 200 or a part of it (such as the MPU / appIication processor 220) to be presented to an application or an external entity and is buffered in storage (step 404). Location Information is freshly obtained from the location sensing entity 230 and is buffered in storage (step 406). The location Information is combined with the description of the event of interest and optional other Information including date / time or device serial number (step 408). If confidentiality protection is important, the description of the event, the location Information, and any other optional parameters or descriptions, (such as date / time, serial numbers, etc.), may also be encrypted for confidentiality protection. Either an asymmetric private key or a symmetric key may be used for such encryption. Such encryption is preferably performed within the SIM 210 or the TPM 214. It may, however, also be performed by the MPU / appIication processor 220 (still in step 408). A cryptographic one-way hash of the (optionally encrypted) location-stamped description of the event of interest and optional other information is generated (step 410). The hash is signed by a key stored within the WTRU 200, generating a digital signature (step 412). Preferably such a key is preferably protected within the SIM 210 or within or outside cryptographically by the TPM 214. The hash operation is preferably performed within a secure execution environment such as within the SIM 210 or the TPM 214. Alternatively, such operation may also be performed by the MPU / appIication processor 220. Either a symmetric key or a public-private key pair may be used for the signing, although it is preferred to use a private key for such signing. A location-stamped certificate of a description of an event of interest is generated by appending the signed digital hash, (ie, the digital signature), to the (optionally encrypted) location-stamped description of the event and presented as a combined output ( step 414). Such output is called the locationstamped certificate of a description of an event. The location-stamped certificate of a description of an event may also either include within itself, or be accompanied by, a certificate that includes a public key that can be used for decrypting the signed signature,

9/21 which is then appended to the location certificate.

Alternatively, the location Information may be provided during the procedure for authentication of the WTRU to a cellular network. The location Information is incorporated within the authentication messages, where it is protected by the message integrity check (MIC) of the authentication protocol. ln this case, a digital certificate may not be required.

The WTRU 200 or an external network entity such as location server may also store and track a number of last locations where successful authentication takes place. Such history of the locations of successful authentication may be used by some applications on the WTRU 200 or on the location server.

An external entity may verify the location certificate using the WTRU's public key. If the signature does not match, the location certificate is deemed invalid. The digital signature appended in the signed location certificate is verified by calculating a new hash from the location Information certificate. If the two hash values ​​do not match, the externai entity may assume that either the location certificate does not belong to that particular data file, or the data file has been altered. ln either case, the externai entity must deem the location certificate as being invalid. If both verifications succeed, the location Information is read from the location certificate and assumed to be trustworthy. The signed location certificate may be used as an undeniable proof of the location, that the data was notarized, and the specific device used to generate the location certificate as identified by its unique serial number, or the like.

The use of hashing and digital signatures for the location certificate secures the location Information. The secure location component itself may be secure, but its output, (ie, the location certificate that contains the location information), may be not once the location certificate is handled outside the secure location component. For example, the location certificate may be altered by an insecure program or tampered whilst stored in an insecure memory. Therefore, use of hashing and digital signing secures the location Information in a verifiable way after the location Information is provided by the secure location component.

Fields may optionally be included with the location Information to indicate the last time when the accuracy of the location measurement from the location sensing entity was checked with a trusted third party, (eg, secure location server), and the last time when the location sensing entity was recalibrated. These fields may be used by the applications to trigger re-calibration procedures, alert to the tamper condition, or the like.

Some of the conventional techniques may be used in conjunction with the security mechanism disclosed above to strengthen the security of the operations. Cryptographic digital signature algorithms, (such as digital signature standard

10/21 (DSS), RSA, NTRU, or the like), may be used so that each device has its own unique private key used to sign the certificates. A tamper - resistance mechanism may also be used to detect and prevent external signal probing, sniffing, power analysis, etc. in order to discover the internai operations and keys or to attempt modification of the functionality. Secure storage or E- Fuse boxes may be used to securely store the device ID, device serial number, device-specific secret keys, and other secret Information in protected hardware thus providing for cryptographic device Identification.

Hardware-protected keys may also be used. A deviceunique key used for location certificate signing is generated within the tamper resistant hardware and never exposed externally. Thus, no unauthorized entity may ever decipher the value of the private key without defeating the hardware tamper resistance features.

A software-protection mechanism may also be used. If the key is generated by software running on general purpose hardware (without hardware tamper resistance), then the key may be protected via a combination of portable crypto devices, (smart cards, dongles, etc.), software tamper resistance, and / or code obfuscation with embedded split-keys (to ensure that the entire private key is never completely exposed in memory at any time).

A cryptographic random number generator (RNG) may also be used to generate an anti re-play nonce to append to the data input, to generate cryptographically harder-to-crack hash outputs, to counter attacks such as a replay attack, birthday attack, and dictionary attacks.

Secure authentication of the public key (that is used to verify the signature) may also be performed so that a forged public key that may have been distributed cannot perform a fake verification of forged location certificates.

Once the location Information of the WTRU or a locationstamped description of an event of interest is provided to a network, in a secure manner, the location Information or location-stamped description of an event of interest may be used to control authentication of the WTRU 200 (and / or the user) and to control access to certain applications, Service, data, functions, etc. of the WTRU 200 or the network to which the WTRU 200 is connected.

A secure location server, (eg, GMLC), is a network-based server. that, upon request by a Client on the network, securely provides a reference location to the requesting Client over the network. The secure location server may use a secure network-based location synchronization protocol. The location server is a trustworthy network component which maintains location Information. The PPR 148 is another network-based server that provides Information about the privacy and access control for the WTRU's and / or policies about handling this Information and other securityrelated Information. The location server enforces any privacy or security policies it obtains

11/21 from the PPR 148.

Figure 5 is a block diagram of an example location server 500. The location server includes a receiving unit 502, a processor 504, and a trusted Processing module 506 (optional). The receiving unit 502 receives trusted location Information of the WTRU 200. The processor 504 performs numerous functions disclosed below including authentication and access control based on the location Information. The trusted processing module measures the integrity and trust of the platform and software.

The processor 504 may correlate the location Information to a set of contextual location Information. The contextual location Information may be an indicator whether the WTRlTs current position is within or near (and how near) the location of a known object, where the location of such an object is considered as trusted and such trust relationship is recognized by both the WTRU 200, the location server, and the PPR 148. The contextual location Information may be an indicator where the WTRU's future position may be, at a user or network- designated future time, either as an absolute geographical location or as a relative location to known objects or reference points.

The processor 504 may have capabilities and functions to generate, securely store, update, and propagate to WTRUs a policy which, having originated from the PPR 148 and been obtained by the location server for enforcement and / or transit, that governs how location-based Information can be used intemally by the WTRU 200 or its internai LCS Client 115 to govern certain access rights, (eg, access, on both an access-grant / deny basis and also a graded- access-grant basis, by an application on the WTRU 200, to access certain data, memory areas, or other applications, or access, on both granted / denied basis and a grading basis, by the human user, to certain applications on the WTRU 200 or provided by the network). The location server also has capabilities and functions to enforce such a policy. The location server may directly enforce the policy, or indicate to the WTRU 200 to self-regulate such access control.

The processor 504 may have capabilities and functions to govern the QoS I took from Services provided to each WTRU 200 based (either wholly or partially) on its location in a multicast situation.

The processor 504 and / or the trusted processing module 506 may have capabilities and functions to assess the trustworthiness (integrity and confidentiality) of location Information. The verification may be performed by crosschecking with the PPR 148 in the network. The PPR 148 may have capabilities and functions to receive, from a location server, Information on geographical location and contextual location Information about the WTRU 200, and verify the integrity and accuracy of such data, and report the verification results back to the location server in a secure manner. The verification of the trustworthiness of the location Information may alternatively be checked by the location server 500 itself.

12/21

The processor 504 may have capabilities and functions to verify, upon receipt of the Iocation Information from the WTRU 200, its true Iocation by a supplemental location-measurement method that is independent of the WTRU's own mechanism of Iocation determination and reporting. For example, a method of using three or more distance-measuring wireless access points for determining a WTRU's Iocation in an independent way that is disclosed in US patent application serial No. 11 / 283,017 entitled Method and System for Securing Wireless Communications, which is incorporated by reference as if fully set forth, which may be used for this purpose.

The trusted processing module 506 may have capabilities and functions to verify the attestation sent by a WTRU 200 of its credibility, measured in terms of the integrity of certain Information where such Information cryptographically binds the WTRU's Iocation Information to the integrity of its software, operating system , or secret data. The trusted processing module 506 may be capable of conducting trust-computing processing, for example, by use of Trusted Computing Group (TCG) Trusted NetWork Connect (TNC) technologies.

The processor 504 and / or the trusted processing module 506 may also have capabilities and functions to securely communicate the Iocation Information with WTRU (s), other Iocation server (s), and PPR (s), where security is ensured at both transport led and application I took.

The processor 504 may also have capabilities and functions to provide Service such as location-based access control (including authentication), location-based network routing and transport control, location-based Service control (including Service access control), and provisioning WTRUs with Iocation - based access control policies.

The processor 504 may also have capabilities and functions for location-time-stamping. For example, the processor 504 may furnish to WTRUs, other Iocation servers, or PPRs 148 secure data that comprises a location-time-stamp of particular events or data of interest. The processor 504 may verify, upon receipt, the integrity and accuracy of Iocation time stamp data.

The processor 504 may also have capabilities and functions to securely manage cryptographic keys that are used in location-based access control procedures and policy management processes.

As stated above, the Iocation Information, (physical and contextual), of the WTRU 200 may be used to allow, disallow, or control access to data or applications by the WTRU's operation system or applications, its human user, peer mobile devices (that may try to access a particular WTRU's applications in a cooperative network setting), or entities on the network, (eg, remote application provider or other Service providers). For example, access to DRM content may be allowed only when a WTRU 200

13/21 is within a certain region. An access to corporate networks may be allowed on! Y when a WTRU 200 is within a secure environment determined by the location Information.

The location Information may also be used to estimate velocity or speed dynamics of the WTRU 200 so as to extract additional parameters which may be used to guide the control of Information in the WTRU200. For example, access to a localized hot spot Service may be allowed when a WTRU 200 is in the vicinity of the hot spot. In this case, the location and speed of the WTRU 200 may be used to prepare for the hot spot Service provisioning between the WTRU 200 and the network. The location sensing entity on the WTRU 200 and the location Information generated by the location sensing entity are secure, and thus any velocity or directional Information generated from that can be considered secure.

In an ad hoc network or mesh network, the location Information may be used as a means for an efficient network routing decision. In a highly mobile network, (such as the localized wireless networks used for vehicular Communications), the location Information may be used to provide for dynamic routing decisions since the network may be continually morphing as vehicles enter and exit the local network at a high frequency . This may be used for vehicular safety Systems when Communications take place not only between vehicles but also with fixed nodes, such as traffic lights at a road intersection, etc.

The trusted location Information of WTRUs may be integrated to trusted location Information of known objects and location-based Services may be provided based on this Information. This method may be called trusted location object tagging (TLOT). If a database of a larger number of objects is available to LBS network operators, the database may be used by the LBS network operator to provide various location-based Services. The locations of the objects in the database may be fixed or mobile but only on a very slow and recognizable basis. The location of such objects may be tracked over time, and geographic location attributes, (eg, longitude, latitude, and altitude Information), and contextual location attributes, (eg, this is a federal security complex, this is a nonsmoking cafeteria, etc. .), are mutually cross-correlated in both directions, (ie, geo-mapping and inverse-geo-mapping is supported in the database). Examples of the known objects may be buildings, landmarks, or any other geographic objects, (eg, rivers, ponds, mountains, deserts, roads, dams, etc.).

For example, when the position of a WTRU 200 is determined to be close to a building with known WiFi security vulnerabilities, the operator may provide an access control Service to disapprove WiFi access to the WTRU 200 unless the WTRU 200 or its user can provide appropriate authentication and other security proofs.

Additionally, the WTRU 200 may also store and use the

14/21

TLOT Information. For example, when the WTRU 200 may use its current knowledge of its location (obtained, for example, from the location sensing entity 230) to exercise access control or to initiate or request certain location-based Service after it correlates its current location to any known or expected TLOT Information of objects whose location is tagged in trusted ways.

Routing of data based on the location is possible. For example, if a WTRU 200 is determined to be within a building that is known to have certain different classes of routing capability, the WTRU 200 may be directed to use particular (wireless) routers but not others for its wireless Communications within the building.

Many mobile applications, such as DRM or mobile payment, may benefit in terms of further security in the application protocol by use of secure location Information in the protocols. For example, in OMA DRM, a DRM device, (eg, the WTRU), uses a local measurement of location from its internai LCS Client in all of the rights object acquisition protocol (ROAP) request sub-protocols. Upon receipt of the device location, the network DRM Service provider uses the location Information to determine the validity and appropriateness of such a request

The trusted location Information enabled by the methods disclosed above or location-time Information may be included in the protocol messages. The recipient of such Information is able to use such Information to further the accuracy of the verification of the appropriateness of processing requested or performed by the WTRU 200.

Table 1 shows a ROAP rights object (RO) request message format including location Information, (and optionally time Information). The ROAP RO request message is sent by a DRM device, (eg, WTRU), to a DRM rights issuer (RI) in order to request an RO for a DRM content that the DRM device wishes to consume. The conventional ROAP RO request message does not contain location Information (or time Information) of the WTRU 200 that is requesting the RO. In the modified ROAP RO request message, the location Information of the current location of the WTRU 200 (and optionally time Information) is included (shown in bold in Table 1), and the location Information may be used at the rights issuer to assess whether and how to grant issuance of a RO to the requesting WTRU 200.

i

15/21

<td>Parameter</td><td>Ry mandate / Optional</td><td>Notes</td>

<td>Device ID</td><td>M</td><td>Identifies requesting Device</td>

<td>Domain ID</td><td>O</td><td>When present, identifies the Domain</td>

<td>RI ID</td><td>M</td><td>Authorizing RI ID. Same value as in Registration Response</td>

<td>Device Nonce</td><td>M</td><td>Nonce chosen by Device.</td>

<td>Request Team</td><td>M</td><td>Secure DRM Time, as fumished by the Secure Time Component (STC) onboard the mobile DRM device</td>

<td>RO Info</td><td>M</td><td>Id's of the requested RO ('s), also optional hash of DCF</td>

<td>Current Location</td><td>M</td><td>Current location of the RO&gt; requesting mobile DRM device, as furnished by the Secure Location Component (SLC) onboard the mobile DRM device</td>

<td>Certificate Chain</td><td>O</td><td>Sent unless RI Context indicates Dev has necessary certificate Information. Must include Dev Certificate</td>

<td>Extensions</td><td>O</td><td>Peer Key Identifier; OCSP Response; OCSP Responder Key Identifier; Transaction ID</td>

<td>Signature</td><td>M</td><td>SHA-1 signature of (RO request message Signature element)</td>

The current location Information presented by the WTRU 200 to a RI may be assessed by the RI to verify the validity of the claimed location of the

WTRU 200 through a third-party verifier, such as the previously described location server, and / or to use the location Information for making decisions on whether and how grants to the RO should be made for the WTRU 200.

Similar modifications may be made for other ROAP-related messages including, but not limited to, Device Hello, RI Hello, Registration Request,

Registration Response, RO Response, Join Domain Request, Join Domain Response, Leave Domain Request, and Leave Domain response messages, in order to enable location information-based control of DRM usage. Similar modifications of conventional protocols and related message formats are also possible to allow use of the location Information for authentication of devices in other DRM use cases, such as storage of DRM contents from the WTRU 200 to an off-device storage device, or super- distribution of content between peer mobile DRM devices.

The location Information may be used to supplement conventional authentication procedures for the WTRU 200 by augmenting conventional authentication procedures with location Information for other applications, such as single sign on (SSO) and federated ID applications.

16/21

The trusted location Information of WTRUs available at a base station, other network nodes such as wireless local area network (WLAN) access points, or a location server, is useful in a cooperative network. In a cooperative network, some WTRUs may serve as helpers to transmit data to other WTRUs for the base station, or transmit data to the base station for other WTRUs. This operation makes full use of spatial diversity to improve the network performance. Another advantage of the cooperative network is to extend coverage. With the knowledge of WTRUs' locations in a secure manner, the base station, (or the location server or any other network entity), may identify the WTRUs in the appropriate locations, and ask for the help from those WTRUs in the data transmissions, as well as in other functionalities.

Another application of the location Information is multicast. Where a base station provides a Service to multiple WTRUs, some WTRUs staying far from the base station are not expected to receive a high quality of Service (QoS). Based on WTRU's locations (as well as other channels Information), the base station may decide the led of QoS for each WTRU. This may save network bandwidth. For example, the base station may decide not to retransmit some data to a remote WTRU, which has not received that data, if the base station knows based on trusted location Information of the WTRU that with a high probability the WTRU will miss the data again due to its location. [0078] In the above two examples, (ie, formation of co-operative networks, and determining light QoS in a multicast situation), the wireless network may have access to Information or measurements that may have more direct relevance as a determining metric other than the location Information. For example, if a base station has a direct twoway communication link to all WTRUs in its cell, the base station would normally have access to all the RF channel link quality metrics, (eg, signal to noise ratio (SNR)), with all the WTRUs within the cell. Such measures may be more directly useful than just location Information as a determinant for formation of cooperative networks or multi-cast lightweight QoS. However, where a base station does not have the bandwidth to maintain a twoway link with all WTRUs within the cell, but can maintain a two-way link with one of the WTRUs which can also act as a collector and sender of location Information about several other WTRUs, the base station may use the location Information about all the WTRUs from the collector and sender WTRU in determining multicast light QoS or the boundary of a cooperative network.

EMBODIMENTS.

1. A WTRU comprising a location sensing entity configured to generate location Information of the WTRU.

2. The WTRU of embodiment 1 comprising an SIM.

3. The WTRU as in any one of embodiments 1-2, comprising a trusted Processing module configured to ensure integrity of the location Information and trust of platform, the location

17/21 sensing entity and software.

4. The WTRU of embodiment 3, wherein the trusted Processing module is configured to bind the location Information to certain data using a certificate and output the certificate to a component outside of the WTRU.

5. The WTRU as in any one of embodiments 3-4, wherein the trusted Processing module is configured to bind the location Information to platform integrity data.

6. The WTRU as in any one of embodiments 3-5, wherein the trusted Processing module is configured to bind the location Information to application integrity data.

7. The WTRU as in any one of embodiments 3-6, wherein the trusted processing module is configured to bind the location Information to a message with a message integrity check.

8. The WTRU as in any one of embodiments 3-7, wherein the trusted processing module is one of a TCG TPM and MTM.

9. The WTRU as in any one of embodiments 3-8, wherein the trusted processing module is configured to verify trust metrics of an externai entity intended to receive the location Information prior to granting the externai entity an access to the location Information or accepting Information from the externai entity.

10. The WTRU as in any one of embodiments 3-9, wherein the trusted processing module is embedded in the SIM.

11. The WTRU as in any one of embodiments 2-10, wherein the SIM is implemented in software whose integrity is protected and verified by the trusted processing module.

12. The WTRU as in any one of embodiments 1-11, wherein the location sensing entity is bound to the SIM by the trusted processing module.

13. The WTRU as in any one of embodiments 1-12, wherein the location Information is provided to a network for an authentication purpose.

14. The WTRU of embodiment 13, wherein the SIM is configured to include the location Information in a message with a message integrity check and sent during an authentication procedure.

15. The WTRU as in any one of embodiments 1-14, wherein the location sensing entity is calibrated in accordance with reference provided by a secure, trustworthy third party.

16. The WTRU as in any one of embodiments 1-15, wherein the location Information is used by one of a DRM application and mobile payment application.

17. The WTRU as in any one of embodiments 1-16, wherein the location Information is included in a DRM data exchange protocol message.

18. The WTRU as in any one of embodiments 1-17, further comprising an RTC for outputting time Information, wherein the time Information is combined with the location Information.

19. A method for securing location Information.

18/21

20. The method of embodiment 19 comprising verifying integrity of a location sensing component and trust of platform and software in a WTRU.

21. The method of embodiment 20 comprising generating location Information of the WTRU if the integrity and the trust are verified.

22. The method of embodiment 21 further comprising embedding the location Information in a message.

23. The method of embodiment 22 further comprising transmitting the message.

24. The method as in any one of embodiments 20-23, wherein the integrity is verified using one of a TCG TPM and MTM.

25. The method as in any one of embodiments 21-24, further comprising performing an access control based on the location Information.

26. The method as in any one of embodiments 23-25, wherein the message is sent during an authentication procedure.

27. The method as in any one of embodiments 20-26, further comprising calibrating a location sensing component in accordance with reference provided by a secure, trustworthy third party.

28. The method as in any one of embodiments 21-27, further comprising verifying trust metrics of an externai entity intended to receive the location Information prior to granting the externai entity an access to the location Information or accepting Information from the externai entity.

29. The method as in any one of embodiments 22-28, wherein the message is a DRM data exchange protocol message.

30. The method as in any one of embodiments 21-29, wherein the location Information is used by a mobile payment application.

31. The method as in any one of embodiments 21-30, further comprising generating time Information.

32. The method of embodiment 31, comprising combining the time Information with the location Information.

33. A method of utilizing secured location Information of a WTRU.

34. The method of embodiment 33 comprising obtaining location Information of a WTRU, integrity of a location sensing component and trust of platform and software in the WTRU being verified before the location Information is generated and obtained.

35. The method of embodiment 34 comprising providing a Service based on the location Information.

36. The method of embodiment 35, wherein an access control on the WTRU applications and resources is performed based on the location Information.

37. The method as in any one of embodiments 35-36, wherein an access control for data

19/21 and Services from a network is performed based on the location Information.

38. The method as in any one of embodiments 34-37, wherein a trust State of the WTRU is validated locally before making a location measurement and performing location based processes.

39. The method as in any one of embodiments 34-38, wherein a trust State of the WTRU is validated remotely before making a location measurement and performing location based processes.

40. The method as in any one of embodiments 34-39, wherein the integrity and trust are verified by using one of a TCG TPM and MTM.

41. The method as in any one of embodiments 35-40, further comprising performing authentication of the WTRU using the location Information.

- -42. The method as in any one of embodiments 35-41, further comprising estimating a speed of the WTRU using the location Information, wherein the speed is used as a parameter for the access control policy.

43. The method as in any one of embodiments 35-42, wherein a routing decision for the WTRU is made based on the location Information.

44. A location server for supporting location-based Service.

45. The location server of embodiment 44 comprising a receiving unit for obtaining location Information of a WTRU, integrity of a location sensing component and trust of platform and software in the WTRU being verified before the location Information is generated and obtained.

46. The location server of embodiment 45 comprising a processor for providing a Service based on the location Information.

47. The location server of embodiment 46 wherein an access control on the WTRU applications and resources is performed based on the location Information.

48. The location server as in any one of embodiments 46-47, wherein an access control for data and Services from a network is performed based on the location Information.

49. The location server as in any one of embodiments 46-48, wherein the processor performs authentication of the WTRU using the location Information.

50. The location server as in any one of embodiments 46-49, wherein the processor estimates a speed of the WTRU using the location Information, wherein the speed is used as a parameter for the access control.

51. The location server as in any one of embodiments 46-50, wherein the processor makes a routing decision for the WTRU based on the location Information.

52. The location server as in any one of embodiments 46-51, wherein the processor is configured to control a QoS led provided to the WTRU based on the location Information.

53. The location server as in any one of embodiments 46-52, wherein the processor is

20/21 configured to verify attestation sent by the WTRU of its credibility.

54. The location server as in any one of embodiments 46-53, wherein the credibility is measured in terms of integrity of certain Information that cryptographically binds the location Information to the integrity of at least one of software, operating system, and secret data.

55. The location server as in any one of embodiments 46-54, wherein the processor is configured to instruct the WTRU to forward data to a designated entity for cooperative distribution based on the location Information.

56. A method for generating a location Information certificate.

57. The method of embodiment 56 comprising generating location Information of a WTRU.

58. The method of embodiment 57 comprising generating a cryptographic one-way hash of the location Information.

59. The method of embodiment 58 comprising digitally signing the cryptographic one-way hash with a private key held within the WTRU.

60. The method of embodiment 59 comprising generating a location certificate by appending the digitally signed hash to the location Information.

61. The method as in any one of embodiments 57-60, further comprising encrypting the location Information for confidentiality protection.

62. The method as in any one of embodiments 57-61, further comprising attesting at least one of a trust state of the WTRU platform, a trust state of a location sensing entity of the WTRU, and a trust state of an internai LCS Client.

63. The method as in any one of embodiments 57-62, wherein a description of event of interest is combined with the location Information.

64. The WTRU for generating a location Information certificate.

65. The WTRU of embodiment 64 comprising a location sensing entity for generating location Information of the WTRU.

66. The WTRU of embodiment 65 comprising a trusted processing module for generating a cryptographic one-way hash of the location Information, digitally signing the cryptographic one-way hash with a private key held within the WTRU, and generating a location certificate by appending the digitally signed hash to the location Information.

67. The WTRU as in any one of embodiments 65-66, wherein the location Information is encrypted for confidentiality protection.

68. The WTRU as in any one of embodiments 66-67, wherein the trusted processing module attests at least one of a trust state of the WTRU platform, a trust state of a location sensing entity of the WTRU, and a trust state of an internai LCS Client.

69. The WTRU as in any one of embodiments 66-68, wherein credibility is measured in terms of integrity of certain Information that cryptographically binds the location Information to an integrity of at least one of software, operating system, and secret data.

21/21

70. The WTRU as in any one of embodiments 65-69, wherein a description of event of interest is combined with the location Information.

Although the features and elements of the present invention are described in the preferred embodiments in particular combinations, each feature or element can be used alone without the other features and elements of the preferred embodiments or in various combinations with or without other features and elements of the present invention. The methods or flow charts provided in the present invention may be implemented in a Computer program, software, or firmware tangibly embodied in a computer-readable storage medium for execution by a general purpose Computer or a processor. Examples of Computer- readable storage mediums include a read only memory (ROM), a random access memory (RAM), a register, cache memory, semiconductor memory devices, magnetic media such as internai hard disks and removable disks, magneto-optical media, and optical media such as CD-ROM disks, and digital versatile disks (DVDs).

Suitable processors include, by way of example, a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more micro process rs in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) circuits, any other type of integrated Circuit (IC), and / or a State machine. [00152] A processor in association with software may be used to implement a radio frequency transceiver for use in a wireless transmit receive unit (WTRU), user equipment (WTRU), terminal, base station, radio network controller (RNC), or any Computer host. The WTRU may be used in conjunction with modules, implemented in hardware and / or software, such as a camera, a video camera module, a videophone, a speakerphone, a vibration device, a speaker, a microphone, a television transceiver, a hands free headset, a keyboard, a Bluetooth® module, a frequency modulated (FM) radio unit, a liquid crystal display (LCD) display unit, an organic light-emitting diode (OLED) display unit, a digital music player, a media player , a video game player module, an Internet browser, and / or any wireless local area network (WLAN) module.

1/5