Subject: [e2md] Is part of the SPID "metadata" and if so, what are the security properties?

From: Dean Willis <[email-masked]>
Date: Fri, 5 Mar 2010 14:40:06 -0600

Please pardon the fumbling; I'm still trying to wrap my head around  
the fundamental problem of e2md.

In the North American ISDN world, we have this thing called called a  
SPID:

http://en.wikipedia.org/wiki/Service_Profile_Identifier

This is a sequence of digits that identifies  an ISDN circuit (a B  
channel). The SPID includes the E.164 number associated with the B  
channel, and it its most recent incarnation two digits of Terminal  
Identifier and 2 digits of Sharing terminal identifier. All in all,  
the SPID is basically the AOR+GRUU of ISDN.

The service provider's provisioning database includes all sorts of  
things about the B-channel identified by the SPID, like whether its  
set up to handle voice calls or data transport, whether it is actually  
assigned to a switch right now,  etc. These are relatively permanent  
aspects of the B-channel. For example, the database doesn't include  
the channel's DND status indicator, it's current hook status, or who  
it is in session with.

It's been suggested to me that most of this "provisioning database"  
stuff associated with a SPID is what we're calling "metadata" in the  
current context. It's data about a "name" (aka, phone number) that  
might need to be known elsewhere before deciding whether or not a call  
should be placed to that name. For example, an originating mode might  
note that the targeted name is currently not-in-service, and therefore  
give an error message to the user without having to try an actually  
call set-up (INVITE).

Does this SPID-related stuff seem like metadata? If it is, what are  
its security properties? Does it hurt if "the world" knows that for  
+19725199190 that the number is "in service" and that it is currently  
serviced by Verizon Dallas, without having to actually call the number  
and find out?

If we put this data into ENUM/DNS, what are the risks associated with  
cache-poisoning attack like? is it any worse for an attacker to be  
able to convince my callers that my number has been disconnected than  
it is for the attacker to simply divert my calls elsewhere (including  
including into a black hole)?

What about other sorts of data connected to that identifier, like my  
billing name and address? If my number were "unlisted", I certainly  
wouldn' want somebody to be able to do a  DNS tree-walk and mine out  
my phone number. What about my address, registered bank account, etc.?  
Even touchier.

--
Dean

---

From: "Richard Shockey" <[email-masked]>
Date: Fri, 5 Mar 2010 16:40:31 -0500

The usage of SPID in the private ENUM context is to find the service
provider of record. And all of this data is private usage as I point out in
my previous note. SPID in this context is a North Americian PSTN thing.

In addition there is work being undertaken in the ITU for a "global SIPD"
for the purpose of facilitating global intercarrier interconnection.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dean
Willis
Sent: Friday, March 05, 2010 3:40 PM
To: [email-masked]
Subject: [e2md] Is part of the SPID "metadata" and if so, what are the
security properties?

--
Dean

_______________________________________________
e2md mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/e2md