The rapid growth of online education, propelled by the COVID-19 pandemic, highlights the importance of ensuring fairness in assessments. Existing research explores software solutions and security concerns in online proctoring, where specialized software monitors digital assessments remotely. However, there remains a gap in research concerning specific security requirements. Our research aims to bridge this gap by identifying essential security requirements for robust online proctoring. Using three research methods—threat analysis, examination of university documents, and inspection of major proctoring software—we distill five pivotal security requirements for higher education related to student authentication, verification of work authenticity, prevention of prior access to exam materials, the protection of students' personal data, and availability of the exam. This study serves as a guide for educational institutions seeking or adapting proctoring systems as well as software development entities specializing in proctoring systems. By delineating these security requirements, we provide foundational support to strengthen online education while upholding academic integrity.

IMSI catching is a problem on all generations of mobile telecommunication networks, i.e., 2G (GSM, GPRS), 3G (HDSPA, EDGE, UMTS) and 4G (LTE, LTE+). Currently, the SIM card of a mobile phone has to reveal its identity over an insecure plaintext transmission, before encryption is enabled. This identifier (the IMSI) can be intercepted by adversaries that mount a passive or active attack. Such identity exposure attacks are commonly referred to as 'IMSI catching'. Since the IMSI is uniquely identifying, unauthorized exposure can lead to various location privacy attacks. We propose a solution, which essentially replaces the IMSIs with changing pseudonyms that are only identifiable by the home network of the SIM's own network provider. Consequently, these pseudonyms are unlinkable by intermediate network providers and malicious adversaries, and therefore mitigate both passive and active attacks, which we also formally verified using ProVerif. Our solution is compatible with the current specifications of the mobile standards and therefore requires no change in the infrastructure or any of the already massively deployed network equipment. The proposed method only requires limited changes to the SIM and the authentication server, both of which are under control of the user's network provider. Therefore, any individual (virtual) provider that distributes SIM cards and controls its own authentication server can deploy a more privacy friendly mobile network that is resilient against IMSI catching attacks.