Subject: [Geopriv] On signing

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 13 Mar 2007 11:46:42 -0400

I'd like to take a step back, as we seem to be conflating  
requirements with solutions, and thus probably narrowing the solution  
space.

Leaving out many of the details and caveats, the goal appears to be  
to deal with two threats:

(1) individual human crank callers, with two sub-cases
(1a) crank caller far away from claimed incident location
(1b) crank caller in vicinity of claimed incident

(2) large-scale non-human DOS attacks (bot nets)

(1b) is the typical pay phone call. Location signing does very little  
for that, as the location is not spoofed.

Addressing (2) partially relies on restricting the number of possible  
attackers, by making sure that each bot only gets to make one call  
and that out-of-area attacks are more difficult.

However, what's been missing in this discussion is accountability.  
The major reason that crank calls are a nuisance, rather than a major  
issue today, is that there is a traceback to the phone subscriber, so  
that the caller has to figure that there's a non-zero chance of  
having his rear end hauled into court. (Anybody who's been in a  
dormitory or university knows that pulling fire alarms is a popular  
pastime; there is no uncertainty about their location; cameras are a  
far more effective means of stopping these pranks.)

Thus, I think the missing ingredient is accountability. If the caller  
knows that the PSAP knows their name, they are rather unlikely to run  
the risk of a false report citation. In that case, whether location  
information is signed or not is somewhat secondary.

In other words, focusing only on location signing misses that there  
may be other, easier to deploy, tools that may in some cases be more  
effective.

As a practical example, if a customer of a well-known VSP calls and  
the VSP says "yes, I know this subscriber", even if the call  
delivered to the PSAP is anonymous, there is a low chance that this  
will be a crank call. Accountability addresses both (1a) and (1b).

Also, there are other, non-signing mechanisms that accomplish (2), at  
least with high probability.

(I'm not arguing that location signing is never useful, just that we  
need to look at what we want to accomplish, rather than just one  
particular mechanism.)

Henning

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "Dawson, Martin" <[email-masked]>
Date: Tue, 13 Mar 2007 18:10:19 -0500

I'd suggest that stepping even further back is a good idea. Because the
discussion below conflates requirements with policy and we don't really
need to spend time categorizing types of emergency callers and
discussing how they should be dealt with.

The requirements, as they have been listed many times are that the
provided location information:

* Can be attributed to a recognized source
* Has not been tampered with since generated at that source
* Is applicable to a specific target identity
* Is applicable at a particular point in time

One of the uses is to be able to distinguish between calls for which the
location information is vouched for by a recognized source. That
information could be used to prioritize calls in cases of PSAP
congestion where it's quite possible that the cause of the congestion is
some individual sending multiple calls from some foreign location.

Another use is to identify when calls appear to be coming from the same
physical device from the perspective of the access network. Again, this
may be used as the basis for a policy on call treatment under congestion
conditions.

Yet another use is to be able to assess just how long ago the location
information appears to have been obtained from the access network. This
also provides a mechanism against which call treatment policies may be
formulated.

Yet another use is to be able to look at a call as part of some root
cause analysis, identify the source of the location information, and
close the loop with the provider of the location information to address
some root problem with location determination.

The list goes on - but the fundamental requirements are the simple list
above and the stakeholders who defined the requirements have their own
thoughts on what the policy underpinnings for those requirements are.

The choice is - tell them it's impossible to satisfy their requirements
(maybe the world should stick to switched circuit telephony) or to
provide the best state of the art solution that we can. I think KPI is
the state of the art but I'm happy to hear a counter-proposal.

Cheers,
Martin

-----Original Message-----
From: Henning Schulzrinne [mailto:[email-masked]] 
Sent: Wednesday, 14 March 2007 2:47 AM
To: GEOPRIV
Subject: [Geopriv] On signing

Henning

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 14 Mar 2007 08:49:45 +0100

Hi Martin,

please find a short comment below:

> the state of the art but I'm happy to hear a counter-proposal.
Here are some counterproposal's:
* Location by Reference, for example, fulfills these requirements.
* The usage of SIP location conveyance with a location-by-reference 
inserted by the SIP proxy together with P-Asserted-ID or SIP Identity 
fulfills these use cases.

I am not objecting location signing in theory but I do have a hard time 
seeing where it would be used.

Ciao
Hannes