Location Subscriber Authorization Function

Description

The Location Subscriber Authorization Function (LSAF) is a critical security and privacy component within the 3GPP mobile location service (LCS) architecture. It acts as the policy decision point for location requests, ensuring that every attempt to locate a User Equipment (UE) complies with the subscriber's privacy settings, network policies, and applicable legal regulations. The LSAF is typically implemented as a logical function within the Gateway Mobile Location Centre (GMLC) or as a standalone node interfacing with it. When a Location Service (LCS) client—which could be an external application, a value-added service, or an internal network entity like a MSC for emergency calls—sends a location request to the GMLC, the GMLC invokes the LSAF.

The authorization process involves several key checks. First, the LSAF validates the identity and credentials of the LCS client making the request. It then retrieves the target subscriber's location privacy profile from the Home Subscriber Server (HSS) or Home Location Register (HLR). This profile, defined by the subscriber, specifies which clients are allowed to request their location, under what conditions (e.g., time of day), and what level of location accuracy is permitted. The LSAF evaluates the current request against this profile. Furthermore, the LSAF enforces network-wide policies and legal requirements, such as mandates for emergency service location (e.g., E112 in Europe) which may override normal privacy settings.

If the request is authorized, the LSAF returns a positive authorization result to the GMLC, which then proceeds to initiate the positioning procedure with the radio access and core network. If the request is denied, the LSAF instructs the GMLC to reject it with an appropriate error code. The LSAF also plays a role in notification and verification procedures, where the network may be required to notify the subscriber that their location is being requested and obtain their consent. By centralizing this authorization logic, the LSAF provides a consistent and auditable security layer, protecting subscriber privacy while enabling legitimate location-based services to function.

Purpose & Motivation

The LSAF was created to address the fundamental privacy and security challenges inherent in determining and disclosing a mobile subscriber's geographical location. As location-based services emerged, there was a clear risk of unauthorized tracking and misuse of highly sensitive personal data. Early systems lacked a standardized, robust mechanism to control who could request a location and under what circumstances. The LSAF was introduced to establish a formal, standardized authorization gateway within the network architecture.

Its purpose is to solve the problem of uncontrolled location access, ensuring compliance with growing data protection regulations (like the EU's Data Protection Directive) and building user trust. It provides the technical means to implement a subscriber's privacy choices, translating high-level privacy rules into enforceable network decisions. Without the LSAF, operators would struggle to offer commercial location services to third parties while maintaining regulatory compliance and protecting their subscribers. It thus enabled the commercial ecosystem for location-based services by providing the necessary privacy safeguards, making it legally and ethically feasible for operators to expose location capabilities to external application providers.

Key Features

• Authorizes all location service requests for a target mobile subscriber
• Evaluates requests against the subscriber's privacy profile from HSS/HLR
• Validates the identity and rights of the requesting LCS Client
• Enforces network operator policies and legal/regulatory mandates
• Supports notification and verification procedures for subscriber consent
• Integrates with the Gateway Mobile Location Centre (GMLC) in the LCS architecture

Evolution Across Releases

Defining Specifications