Subject: Re: [Fwd: Re: [Ecrit] Hum for "Security Threats and Requirements for Emergency Call Marking and Mapping"]

From: Shida Schubert <[email-masked]>
Date: Thu, 16 Mar 2006 14:54:33 -0800

Large hum to adopt this as a WG item.

 This might had been discussed but, after glancing through the draft, it 
occurred to
me that with the emergency marking defined with the new Service-URN draft, 
malicious UA can send INVITE with Accept-Contact  header value of
"service:urn:sos" and anticipate a priority treatment of the call as if 
it was an
emergency call.
 
 Before as I understand the call was understood to be emergency call when
request-URI was a URI of emergency URI([email-masked] or service:urn)
which at the same time was used as a marking for an emergency call.
 This property also enforced the whole mapping procedure to take place
which at the same time prevented call being made to non-psap entity
with emergency marking.

 But because this URI is translated after the mapping to PSAP uri which is
unidentifiable as an emergency URI, it was agreed to add a marking
so entity receiving the emergency call after the mapping(which has
no emergency URI) can identity the call as an emergency call.

 But this new marking method allows malicious user to set this value
and have the call seen as an emergency call.

 Also if you have the emergency URI in To: and Request URI would
you still need the marking? To:'s URI will stay as an emergency URI
until it reaches the PSAP right?

 BTW using To as an emergency identifier does not solve the problem
either unless mapping is enforced every time, and redirecting the psap
uri to UAC is not allowed(Which disallow direct emergency mapping
from UAC).
 Dilemma of resource-priority header revisited, actually with 
resource-priority
the call is treated differently only if the server understands the 
resource-priority
value but this is a generic value which we anticipate all servers to 
understand..
 ..Scary..

 Regards
  Shida Schubert

Hannes Tschofenig wrote:
>
> Do you guys also have an opinion about this draft?
> It might be good to hear your thoughts.
>
>
> -------- Original Message --------
> Subject: Re: [Ecrit] Hum for "Security Threats and Requirements for 
> Emergency  Call Marking and Mapping"
> Date: Fri, 10 Mar 2006 13:58:17 -0800
> From: Ted Hardie <[email-masked]>
> To: Hannes Tschofenig <[email-masked]>, [email-masked],   
> Marc Linser <[email-masked]>
> References: 
> <[email-masked]> 
> <[email-masked]>
>
> At 3:53 PM +0100 3/10/06, Hannes Tschofenig wrote:
>>
>> Please speak for or against making
>> draft-taylor-ecrit-security-threats-03.txt a working group item for the
>> ECRIT working group.
>>
>> Deadline for responding to this hum is the 17th March 2006.
>>
>
> I believe it is appropriate for this to be  working group item.
>            
>             Ted Hardie
>
>
>
>
>

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit