Subject: AW: [Sipping-tispan] TISPAN requirements, first requiements

From: "Jesske, R" <[email-masked]>
Date: Wed, 24 Aug 2005 06:49:16 +0200

Paul,
With regard to this feature it must be based on trust relationship as defined within RFC3325 for the P-Asserted-Identity.
So the indication that this is a authorised user is included by a network entity like it is done for the P-Asserted-Identiy.
So the network entity knows it via a database that this registered user is a authorised one.

With regard to the PSTN/ISDN this was solved via a indication that the Calling Party Number is restricted by the network. The network included this indication in three cases:
1. The call was originated within a network that cannot provide a originating number (e.G.) analogue.
2. The call has no originated number due to interworking with international networks
3. The call was send from a authorised user (e.G. police). This indication was then set by the network. This feature is especially used in UK.

So with the requirement proposed by Miguel we hope to find a solution to cover the 3 above mentioned cases.

With regard to trust we want to have such a indication bind to a trust relationship as it is described within RFC3325.
So trust for interconnection to an other network is based on bilateral agreement.

Best Regards

Roland

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von Paul Kyzivat
> Gesendet: Mittwoch, 24. August 2005 05:07
> An: Miguel Garcia
> Cc: [email-masked]; Alexeitsev, Denis
> Betreff: Re: [Sipping-tispan] TISPAN requirements, first requiements
> 
> 
> 
> 
> Miguel Garcia wrote:
> > Folks:
> > 
> > Since we are tasked to re-draft the TISPAN requirements 
> adding as much 
> > clarifications as possible, we would like to start checking 
> with you if 
> > the requirements related to the Annonymous Communication 
> Rejection (ACR) 
> > service is OK and understandable by everyone.
> > 
> > So please take a look at the first version of the (much 
> incomplete and 
> > short) draft in either text or HTML:
> > 
> > 
> http://people.nokia.net/~miguel/drafts/pre/draft-jesske-sippin
g-tispan-requirements-02a.txt 
> 
> http://people.nokia.net/~miguel/drafts/pre/draft-jesske-sipping-tispan-requirements-02a.html 
> 
> 
> The document is fairly short at the moment. Please post your comments here.

Regarding REQ-ACR-2:

>    REQ-ACR-2: It must be possible that authorized callers are not
>               subject to the ACR service, thus, allowing the callee to
>               receive anonymous requests from authorized callers.  This
>               effectively requires a mechanism to override the ACR
>               service depending on the identity and authorization of the
>               caller.  This is needed, e.g., when a police officer or
>               any other authority is anonymously calling to a user
>               having the ACR simulation service activated.

How is a caller authorized? Is the mechanism for determining and 
conveying this authorization in scope for this service? There is mention 
specifically of Police Officers, among others, as being authorized. Are 
there a list of attributes like that which must be used to characterize 
a caller and that are used to determine the authorization?

How is this affected by peering and PSTN interconnect? Is an 
authorization on one side to be conveyed to the other side and then 
trusted their?

	Thanks,
	Paul

_______________________________________________
Sipping-tispan mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sipping-tispan

_______________________________________________
Sipping-tispan mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sipping-tispan

---

From: Miguel Garcia <[email-masked]>
Date: Wed, 24 Aug 2005 12:48:48 +0300

Paul, once Roland has explained the issue, what is your proposal for 
clarification of the existing text? Do you think something is missing?

/Miguel

-- 
Miguel A. Garcia           tel:+358-50-4804586
sip:[email-masked]
Nokia Research Center      Helsinki, Finland

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 24 Aug 2005 23:31:25 -0400

> So the network entity knows it via a database that this registered user is a authorised one.

Either I don't understand you, or you don't understand me.

RFC3325 is a way for some trusted element of the network that knows the 
source of the request to assert a trusted identity for the source of the 
message. It doesn't provide any authorization for anything.

Ultimately, the ACR service must be implemented near and on behalf of 
the recipient of the message. It isn't until there that it is known that 
there is any service to authorize. At that point, the P-Asserted-ID 
header may be present, but that just says who the caller is, not what 
role the caller is playing. It seems that you want to do role based 
authorization, where the role is "entitled-to-override-ACR".

So how is this role determined? Surely the recipient can't have a DB of 
all values of P-Asserted-ID that are authorized. The alternative seems 
to be that the source inserts not just a simple P-Asserted-ID with a 
name, but rather also inserts some kind of role identification.

I'm looking for more indication of what the expectations are in this 
regard. Is it the expectation that the source will annotate every call 
with an indication that the caller is permitted to override ACR? Or with 
some other more generic categorization of caller type? Or what?

> 3. The call was send from a authorised user (e.G. police). This indication was then set by the network. This feature is especially used in UK.

So you are looking for some kind of enhancement to Privacy, that 
indicates *why* privacy is requested?

	Paul

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 26 Aug 2005 01:02:34 -0400

Miguel,

Yes, I think something is missing, having to do with how callers 
entitled to override of ACR are determined. But I still don't know what 
that requirement should say.

	Paul

Miguel Garcia wrote:
>> With regard to this feature it must be based on trust relationship as 
>> defined within RFC3325 for the P-Asserted-Identity.
>> So the indication that this is a authorised user is included by a 
>> network entity like it is done for the P-Asserted-Identiy.
>> With regard to the PSTN/ISDN this was solved via a indication that the 
>> Calling Party Number is restricted by the network. The network 
>> included this indication in three cases:
>> 3. The call was send from a authorised user (e.G. police). This 
>> indication was then set by the network. This feature is especially 
>> used in UK.
>>
>> With regard to trust we want to have such a indication bind to a trust 
>> relationship as it is described within RFC3325.
>> conveying this authorization in scope for this service? There is 
>> mention specifically of Police Officers, among others, as being 
>> authorized. Are there a list of attributes like that which must be 
>> used to characterize a caller and that are used to determine the 
>> authorization?
>>