Subject: [stir] Call Center Implications

From: "Fernando Mousinho (fmousinh)" <[email-masked]>
Date: Mon, 16 Sep 2013 13:49:17 +0000

I'm catching up with the discussions in this working group, and am trying to understand some architecture implications in call centers (which is where my background is). It seems that many of the problems we are trying to fix are related to contact centers anyway, so it is probably a good idea to have everyone in the same page.

Forgive me if it is an obvious question, but which components in a "typical call center architecture" do you see signature and verification taking place? Such "typical" deployments have premises based equipment (PME), a session border controller (SBC) and of course a SIP service provider – all three could potentially be used throughout the authorization process. There are different ramifications depending on where your mind is at.

Fernando Mousinho
Cisco Systems

---

From: Brian Rosen <[email-masked]>
Date: Mon, 16 Sep 2013 10:02:08 -0400

I don't think it matters.  

I expect with call centers that serve multiple clients and need to use the outgoing number of their client, that the SIP proxy server or endpoint would do it, but the SBC could do it by having the credentials for each number that the call center used.  In that instance, I'd suspect the SIP SP wouldn't. 

Where a call center was dedicated to a single client, the CPE, SBC or SIP SP could reasonably sign.

Brian

On Sep 16, 2013, at 9:49 AM, "Fernando Mousinho (fmousinh)" <[email-masked]> wrote:

> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 16 Sep 2013 12:12:26 -0400

Any of them could do it.  My guess is service providers will do it for most call centers, although larger call centers might do it themselves... especially ones which have trunks from multiple providers and can source calls using the same number(s) out through multiple providers on a call-by-call basis.

-hadriel

---

From: "Fernando Mousinho (fmousinh)" <[email-masked]>
Date: Tue, 17 Sep 2013 12:46:19 +0000

I agree, Hadriel. While large call centers (including BPOs, which provide
services for other companies) may have special arrangements with SPs, the
majority (small to mid-size) will probably rely on the SPs to do provide
to vouch for their identity. This would probably be the case for the home
analog caller anyway. This would imply that the "originating" SP's
willingness to provide this signature is a critical success factor for the
proposal's adoption.

But back to the business process outsourcers (BPO) case - where a call
center is providing service on behalf of multiple companies. I can see the
value of them sending different numbers based on the clients they
represent. Wouldn't that create a billing issue though? This is not an
area I understand well, but I would suspect that SP 1 allowing one of its
subscribers to send an outbound call using a number registered to SP 2
could be a no-no. If this hypothesis is correct, then we are back to the
case where the SP is signing all calls, even for BPOs.

Or maybe this is another problem we are trying to fix in the working
group, in which case we perhaps should state as a goal or benefit:
"providing a reliable mechanism to let calls originated from one SP1 to
outpulse numbers that belong to another".

Fernando

On 9/16/13 12:12 PM, "Hadriel Kaplan" <[email-masked]> wrote:

>
>Any of them could do it.  My guess is service providers will do it for
>most call centers, although larger call centers might do it themselves...
>especially ones which have trunks from multiple providers and can source
>calls using the same number(s) out through multiple providers on a
>call-by-call basis.
>
>-hadriel
>
>
>> I'm catching up with the discussions in this working group, and am
>>trying to understand some architecture implications in call centers
>>(which is where my background is). It seems that many of the problems we
>>are trying to fix are related to contact centers anyway, so it is
>>probably a good idea to have everyone in the same page.
>> 
>> Forgive me if it is an obvious question, but which components in a
>>"typical call center architecture" do you see signature and verification
>>taking place? Such "typical" deployments have premises based equipment
>>(PME), a session border controller (SBC) and of course a SIP service
>>provider  all three could potentially be used throughout the
>>authorization process. There are different ramifications depending on
>>where your mind is at.
>> 
>> Fernando Mousinho
>> Cisco Systems
>

---

From: Brian Rosen <[email-masked]>
Date: Tue, 17 Sep 2013 09:44:12 -0400

We have a requirement to support the BPO use case.

The notion we had is that the company contracting the call center approves the use, and the call center, or the SP acting on its behalf, signs.
Think of this as another level of delegation.  An SP delegates numbers to the company.  The company "delegates" use of those numbers to the call center.  The call center calls, using that delegation.  The credentials of the call center would be different from those of the company, but would cover the same number.  Having multiple credentials covering the same number will be very common due to the way delegation happens.  In order to allow SPs to sign, without creating credential per TN, we allow credentials with ranges.  The ranges could overlap when delegation happens.  

Consider the following complex US case:
The North American Number Plan Administrator delegates 202-555-xxxx to the Pooling Administrator.  The PA now has a credential covering the entire 10K block.
The Pooling Administrator delegates 202-555-1xxx to SP A.  SP A has a credential for the entire 1K block
SP A resells 202-555-12xx to SP B .  SP B has a credential for a 100 TN block
SP B delegates 202-555-123x to Company C.  Company C has a credential for a 10 number block
Company C authorizes 202-555-1234 to BPO D.  BPO D has credential for a 1 number block

NANPA and the PA never are in a call path, so they would never sign a call.

However, SP A or SP B could sign a call from either Company C or BPO D using the credential they have.

The SP for the call center could acquire credentials from the BPO and sign on its behalf.  I suspect than many service providers would be reluctant to do so unless the numbers were from their own inventory (that is, the company got its numbers from the same SP as the call center).  Since that won't be the common case, the call center probably has to do the signing itself.

Brian

---

From: "Schumacher, Gregory [CTO]" <[email-masked]>
Date: Thu, 19 Sep 2013 19:22:32 +0000

There are some benefits from this approach, but also some scenarios that need clarification how they could function.

The benefit is that the credential represents both the company "responsible" for the sales campaign (the "company" in your scenario) and the company operating the sales campaign (the call center in your scenario).  For the use in forensics (after the fact analysis) such as pursuit of fraud investigation, we then can follow both paths.

However can you clarify the following -
- If a SP "signs" the call, is it attesting to the "responsible" party for the telemarketing call or the party executing the telemarketing campaign  or both?

- How is the SP supposed to know all the parties that it is attesting to - the responsible party and/or executing party?

-It seems likely that some of the numbers assigned to a company in your scenario will not be assigned to real telephones (or call center trunk) until a telemarketing campaign is initiated or a call center selected to execute the sales campaign, is it possible to have these unassigned or floating numbers when not in use for a telemarketing campaign?  Is it allowed under most national numbering regimes?

- How important is it to have a known or recognized phone number as the caller id as part of a telemarketing campaign?  I am assuming that not all campaigns care about having a number that is known or recognized.

-In other words for this last bit, if a call center (telemarketing campaign operator) is using their own set of numbers but serve multiple simultaneous telemarketing campaigns using the same originating numbers, what will they sign?  Will they just have a credential representing the call center alone, or a different credential per telemarketing campaign, or a different credential per responsible party (per client)?  This will affect what is possible for any forensic activity.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Rosen
Sent: Tuesday, September 17, 2013 9:44 AM
To: Fernando Mousinho
Cc: [email-masked]; Hadriel Kaplan
Subject: Re: [stir] Call Center Implications

Consider the following complex US case:
The North American Number Plan Administrator delegates 202-555-xxxx to the Pooling Administrator.  The PA now has a credential covering the entire 10K block.
The Pooling Administrator delegates 202-555-1xxx to SP A.  SP A has a credential for the entire 1K block SP A resells 202-555-12xx to SP B .  SP B has a credential for a 100 TN block SP B delegates 202-555-123x to Company C.  Company C has a credential for a 10 number block Company C authorizes 202-555-1234 to BPO D.  BPO D has credential for a 1 number block

Brian

On Sep 17, 2013, at 8:46 AM, Fernando Mousinho (fmousinh) <[email-masked]> wrote:

> I agree, Hadriel. While large call centers (including BPOs, which
> provide services for other companies) may have special arrangements
> with SPs, the majority (small to mid-size) will probably rely on the
> SPs to do provide to vouch for their identity. This would probably be
> the case for the home analog caller anyway. This would imply that the
> "originating" SP's willingness to provide this signature is a critical
> success factor for the proposal's adoption.
>
>
> center is providing service on behalf of multiple companies. I can see
> the value of them sending different numbers based on the clients they
> area I understand well, but I would suspect that SP 1 allowing one of
> its subscribers to send an outbound call using a number registered to
> SP 2 could be a no-no. If this hypothesis is correct, then we are back
> to the case where the SP is signing all calls, even for BPOs.
>
> "providing a reliable mechanism to let calls originated from one SP1
> to outpulse numbers that belong to another".
>
> Fernando
>
>
>
>
>
>
>> Any of them could do it.  My guess is service providers will do it
>> for most call centers, although larger call centers might do it themselves...
>> especially ones which have trunks from multiple providers and can
>> source calls using the same number(s) out through multiple providers
>> on a call-by-call basis.
>>
>> -hadriel
>>
>>
>>> (which is where my background is). It seems that many of the
>>> problems we are trying to fix are related to contact centers anyway,
>>> so it is probably a good idea to have everyone in the same page.
>>>
>>> "typical call center architecture" do you see signature and
>>> verification taking place? Such "typical" deployments have premises
>>> based equipment (PME), a session border controller (SBC) and of
>>> course a SIP service provider  all three could potentially be used
>>> throughout the authorization process. There are different
>>> ramifications depending on where your mind is at.
>>>
>>> Fernando Mousinho
>>> Cisco Systems
>>
>

________________________________

This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message.

---

From: "Fernando Mousinho (fmousinh)" <[email-masked]>
Date: Thu, 19 Sep 2013 19:59:34 +0000

I believe the scenario telemarketing here is when a client hires a BPO to
place outbound calls, but expect customers to return these calls to a
different place (say, their own and operated call center). This way, this
client is authorizing the BPO to use an identity that it (BPO) doesn't
own. These numbers in this scenario are always operational, just at a
different place.

The same telemarketing operator would then outpulse multiple numbers for
their multiple clients, none of these numbers belonging to the
telemarketer. BTW, we are using the term "telemarketing" in a very generic
sense - this could just as easily be a public service announcement,
fundraiser, etc.

If the telemarketer happens to own the inbound call center as well, it
very likely owns the number as well and this would necessarily be a
special case - it would fall under the same characteristics of any call
center.

On a different note, it would help a lot of we standardized terminology.
Telemarketing, BPO, call center, end customer, clientsŠ it may be hard for
others to follow the discussion later.

(generic term for any type of outbound calling, including public service
announcement, so don't think it's all about sales!)

On 9/19/13 3:22 PM, "Schumacher, Gregory [CTO]"
<[email-masked]> wrote:

>There are some benefits from this approach, but also some scenarios that
>need clarification how they could function.
>
>The benefit is that the credential represents both the company
>"responsible" for the sales campaign (the "company" in your scenario) and
>the company operating the sales campaign (the call center in your
>scenario).  For the use in forensics (after the fact analysis) such as
>pursuit of fraud investigation, we then can follow both paths.
>
>- If a SP "signs" the call, is it attesting to the "responsible" party
>for the telemarketing call or the party executing the telemarketing
>campaign  or both?
>
>- How is the SP supposed to know all the parties that it is attesting to
>- the responsible party and/or executing party?
>
>-It seems likely that some of the numbers assigned to a company in your
>scenario will not be assigned to real telephones (or call center trunk)
>until a telemarketing campaign is initiated or a call center selected to
>execute the sales campaign, is it possible to have these unassigned or
>floating numbers when not in use for a telemarketing campaign?  Is it
>allowed under most national numbering regimes?
>
>- How important is it to have a known or recognized phone number as the
>caller id as part of a telemarketing campaign?  I am assuming that not
>all campaigns care about having a number that is known or recognized.
>
>-In other words for this last bit, if a call center (telemarketing
>campaign operator) is using their own set of numbers but serve multiple
>simultaneous telemarketing campaigns using the same originating numbers,
>what will they sign?  Will they just have a credential representing the
>call center alone, or a different credential per telemarketing campaign,
>or a different credential per responsible party (per client)?  This will
>affect what is possible for any forensic activity.
>
>The notion we had is that the company contracting the call center
>approves the use, and the call center, or the SP acting on its behalf,
>signs.
>Think of this as another level of delegation.  An SP delegates numbers to
>the company.  The company "delegates" use of those numbers to the call
>center.  The call center calls, using that delegation.  The credentials
>of the call center would be different from those of the company, but
>would cover the same number.  Having multiple credentials covering the
>same number will be very common due to the way delegation happens.  In
>order to allow SPs to sign, without creating credential per TN, we allow
>credentials with ranges.  The ranges could overlap when delegation
>happens.
>
>The North American Number Plan Administrator delegates 202-555-xxxx to
>the Pooling Administrator.  The PA now has a credential covering the
>entire 10K block.
>The Pooling Administrator delegates 202-555-1xxx to SP A.  SP A has a
>credential for the entire 1K block SP A resells 202-555-12xx to SP B .
>SP B has a credential for a 100 TN block SP B delegates 202-555-123x to
>Company C.  Company C has a credential for a 10 number block Company C
>authorizes 202-555-1234 to BPO D.  BPO D has credential for a 1 number
>block
>
>The SP for the call center could acquire credentials from the BPO and
>sign on its behalf.  I suspect than many service providers would be
>reluctant to do so unless the numbers were from their own inventory (that
>is, the company got its numbers from the same SP as the call center).
>Since that won't be the common case, the call center probably has to do
>the signing itself.
>
>Brian
>
>This e-mail may contain Sprint proprietary information intended for the
>sole use of the recipient(s). Any use by others is prohibited. If you are
>not the intended recipient, please contact the sender and delete all
>copies of the message.
>

---

From: Michael Hammer <[email-masked]>
Date: Thu, 19 Sep 2013 20:34:24 +0000

Don't we still want to know the true originator of the call, 
even when we have some token that says "Doctor so and so approved this
message."

Originating number, display number, and call-back number could be 3
different things.
Should all of them be verifiable?

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Fernando Mousinho (fmousinh)
Sent: Thursday, September 19, 2013 4:00 PM
To: Schumacher, Gregory [CTO]; Brian Rosen
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

I believe the scenario telemarketing here is when a client hires a BPO to
place outbound calls, but expect customers to return these calls to a
different place (say, their own and operated call center). This way, this
client is authorizing the BPO to use an identity that it (BPO) doesn't own.
These numbers in this scenario are always operational, just at a different
place.

The same telemarketing operator would then outpulse multiple numbers for
their multiple clients, none of these numbers belonging to the telemarketer.
BTW, we are using the term "telemarketing" in a very generic sense - this
could just as easily be a public service announcement, fundraiser, etc.

If the telemarketer happens to own the inbound call center as well, it very
likely owns the number as well and this would necessarily be a special case
- it would fall under the same characteristics of any call center.

On 9/19/13 3:22 PM, "Schumacher, Gregory [CTO]"
<[email-masked]> wrote:

>There are some benefits from this approach, but also some scenarios 
>that need clarification how they could function.
>
>"responsible" for the sales campaign (the "company" in your scenario) 
>and the company operating the sales campaign (the call center in your 
>until a telemarketing campaign is initiated or a call center selected 
>to execute the sales campaign, is it possible to have these unassigned 
>or floating numbers when not in use for a telemarketing campaign?  Is 
>it allowed under most national numbering regimes?
>
>simultaneous telemarketing campaigns using the same originating 
>numbers, what will they sign?  Will they just have a credential 
>representing the call center alone, or a different credential per 
>telemarketing campaign, or a different credential per responsible party 
>(per client)?  This will affect what is possible for any forensic activity.
>
>Think of this as another level of delegation.  An SP delegates numbers 
>to the company.  The company "delegates" use of those numbers to the 
>call center.  The call center calls, using that delegation.  The 
>credentials of the call center would be different from those of the 
>company, but would cover the same number.  Having multiple credentials 
>covering the same number will be very common due to the way delegation 
>happens.  In order to allow SPs to sign, without creating credential 
>per TN, we allow credentials with ranges.  The ranges could overlap 
>when delegation happens.
>
>reluctant to do so unless the numbers were from their own inventory 
>(that is, the company got its numbers from the same SP as the call center).
>> "originating" SP's willingness to provide this signature is a 
>> critical success factor for the proposal's adoption.
>>
>>
>> But back to the business process outsourcers (BPO) case - where a 
>> call center is providing service on behalf of multiple companies. I 
>> can see the value of them sending different numbers based on the 
>> clients they represent. Wouldn't that create a billing issue though? 
>> This is not an area I understand well, but I would suspect that SP 1 
>> allowing one of its subscribers to send an outbound call using a 
>> number registered to SP 2 could be a no-no. If this hypothesis is 
>> correct, then we are back to the case where the SP is signing all calls,
even for BPOs.
>>>> problems we are trying to fix are related to contact centers 
>>>> anyway, so it is probably a good idea to have everyone in the same
page.
>sole use of the recipient(s). Any use by others is prohibited. If you 
>are not the intended recipient, please contact the sender and delete 
>all copies of the message.
>

---

From: Travis Russell <[email-masked]>
Date: Thu, 19 Sep 2013 13:42:28 -0700 (PDT)

The callback number absolutely should be verified, as well as originating number. IRSF is already a big issue today, and we don't want to introduce the opportunity of forwarding a spoofed unverified callback number to a PRS number.

-----Original Message-----
From: Michael Hammer [mailto:[email-masked]] 
Sent: Thursday, September 19, 2013 4:34 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

Don't we still want to know the true originator of the call, even when we have some token that says "Doctor so and so approved this message."

Originating number, display number, and call-back number could be 3 different things.
Should all of them be verifiable?

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Fernando Mousinho (fmousinh)
Sent: Thursday, September 19, 2013 4:00 PM
To: Schumacher, Gregory [CTO]; Brian Rosen
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

I believe the scenario telemarketing here is when a client hires a BPO to place outbound calls, but expect customers to return these calls to a different place (say, their own and operated call center). This way, this client is authorizing the BPO to use an identity that it (BPO) doesn't own.
These numbers in this scenario are always operational, just at a different place.

The same telemarketing operator would then outpulse multiple numbers for their multiple clients, none of these numbers belonging to the telemarketer.
BTW, we are using the term "telemarketing" in a very generic sense - this could just as easily be a public service announcement, fundraiser, etc.

If the telemarketer happens to own the inbound call center as well, it very likely owns the number as well and this would necessarily be a special case
- it would fall under the same characteristics of any call center.

On a different note, it would help a lot of we standardized terminology.
Telemarketing, BPO, call center, end customer, clientsŠ it may be hard for others to follow the discussion later.

(generic term for any type of outbound calling, including public service announcement, so don't think it's all about sales!)

On 9/19/13 3:22 PM, "Schumacher, Gregory [CTO]"
<[email-masked]> wrote:

>Brian Rosen
even for BPOs.
page.

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 19 Sep 2013 17:18:53 -0400

You won't be able to do that if it is a 800 number that is because the
authority running the 800 number space SMS 800 is  <fill in the blank>  this
is a critical flaw in the NANP number management scheme that only the
regulator can address. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Travis Russell
Sent: Thursday, September 19, 2013 4:42 PM
To: Michael Hammer; [email-masked]; [email-masked];
[email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

The callback number absolutely should be verified, as well as originating
number. IRSF is already a big issue today, and we don't want to introduce
the opportunity of forwarding a spoofed unverified callback number to a PRS
number.

-----Original Message-----
From: Michael Hammer [mailto:[email-masked]]
Sent: Thursday, September 19, 2013 4:34 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

Don't we still want to know the true originator of the call, even when we
have some token that says "Doctor so and so approved this message."

Mike

-----Original Message-----

even for BPOs.
page.

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 19 Sep 2013 21:24:08 +0000

I see no reason not to allow signing any number-related field in the SIP request. (Signing may well be done by different parties.)

As far as I know, callback numbers (SIP Reply-To) aren't conveyable in legacy systems, however, so this may be of somewhat limited use for a while.

________________________________________
From: [email-masked] [[email-masked]] on behalf of Michael Hammer [[email-masked]]
Sent: Thursday, September 19, 2013 4:34 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

Mike

-----Original Message-----

even for BPOs.
page.

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 19 Sep 2013 21:29:15 +0000

That's more of a legal than engineering question, I think. There are very particular rules (apparently, not uncontested) as to when somebody is considered an "agent" of another company, e.g., for TCPA purposes. For my non-lawyer mind, this isn't dissimilar to allowing some other party to use your letterhead or logo. The implications may well differ by jurisdiction and subject matter. (For example, the contracting entity may not be responsible if the BPO outfit pollutes the nearby waterway or molests cute kittens, but may well be for other purposes.)

________________________________________
From: [email-masked] [[email-masked]] on behalf of Schumacher, Gregory [CTO] [[email-masked]]
Sent: Thursday, September 19, 2013 3:22 PM
To: Brian Rosen
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Rosen
Sent: Tuesday, September 17, 2013 9:44 AM
To: Fernando Mousinho
Cc: [email-masked]; Hadriel Kaplan
Subject: Re: [stir] Call Center Implications

Brian

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 19 Sep 2013 17:33:41 -0400

Agreed..  oh BTW someone might be able to produce some very useful work by
taking a long look at the CALL-INFO header for some type of advanced CNAM
capability for display in advanced UA's.  Something other than 15 ASCII
characters.  Doctors office logo address etc.  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Henning Schulzrinne
Sent: Thursday, September 19, 2013 5:24 PM
To: Michael Hammer; [email-masked]; [email-masked];
[email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

I see no reason not to allow signing any number-related field in the SIP
request. (Signing may well be done by different parties.)

As far as I know, callback numbers (SIP Reply-To) aren't conveyable in
legacy systems, however, so this may be of somewhat limited use for a while.

________________________________________
From: [email-masked] [[email-masked]] on behalf of Michael
Hammer [[email-masked]]
Sent: Thursday, September 19, 2013 4:34 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

Mike

-----Original Message-----

even for BPOs.
page.

---

From: Alex Bobotek <[email-masked]>
Date: Thu, 19 Sep 2013 14:27:20 -0700

+1
I've assumed that we are headed towards a "sign whatever extras you wish, and indicate what your signature covers" mechanism.  

Based on this, standards would need to identify only a minimal subset of what shall/should be signed, and ensure that any required group of signed items survives transit intact.  

Best signing practices may be needed to complement the standard, and an appropriate place for all but the most basic 'what to sign' recommendations.  

Regards,

Alex

> Sent: Thursday, September 19, 2013 2:24 PM
> To: Michael Hammer; [email-masked];
> [email-masked]; [email-masked]
> Cc: [email-masked]
> As far as I know, callback numbers (SIP Reply-To) aren't conveyable in legacy
> systems, however, so this may be of somewhat limited use for a while.
> 
> I believe the scenario telemarketing here is when a client hires a BPO to place
> outbound calls, but expect customers to return these calls to a different
> place (say, their own and operated call center). This way, this client is
> authorizing the BPO to use an identity that it (BPO) doesn't own.

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 19 Sep 2013 17:39:40 -0400

Excellent point a profile or BCP to complement the work.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alex
Bobotek
Sent: Thursday, September 19, 2013 5:27 PM
To: Henning Schulzrinne; Michael Hammer; [email-masked];
[email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Call Center Implications

+1
I've assumed that we are headed towards a "sign whatever extras you wish,
and indicate what your signature covers" mechanism.  

Based on this, standards would need to identify only a minimal subset of
what shall/should be signed, and ensure that any required group of signed
items survives transit intact.  

Best signing practices may be needed to complement the standard, and an
appropriate place for all but the most basic 'what to sign' recommendations.

Regards,

Alex

> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Henning Schulzrinne
> I see no reason not to allow signing any number-related field in the 
> SIP request. (Signing may well be done by different parties.)
> 
> From: [email-masked] [[email-masked]] on behalf of 
> Michael Hammer [[email-masked]]
> Don't we still want to know the true originator of the call, even when 
> we have some token that says "Doctor so and so approved this message."
> 
> I believe the scenario telemarketing here is when a client hires a BPO 
> to place outbound calls, but expect customers to return these calls to 
> a different place (say, their own and operated call center). This way, 
> this client is authorizing the BPO to use an identity that it (BPO)
doesn't own.
> The same telemarketing operator would then outpulse multiple numbers 
> for their multiple clients, none of these numbers belonging to the
telemarketer.
> BTW, we are using the term "telemarketing" in a very generic sense - 
> this could just as easily be a public service announcement, fundraiser,
etc.
> special case
> Telemarketing, BPO, call center, end customer, clientsŠ it may be hard 
> for others to follow the discussion later.
> 
> 
> 
> (generic term for any type of outbound calling, including public 
> service announcement, so don't think it's all about sales!)
> 
> 
> >scenario).  For the use in forensics (after the fact analysis) such 
> >as pursuit of fraud investigation, we then can follow both paths.
> >
> >- If a SP "signs" the call, is it attesting to the "responsible" 
> >party for the telemarketing call or the party executing the 
> >telemarketing campaign  or both?
> >
> >-It seems likely that some of the numbers assigned to a company in 
> >your scenario will not be assigned to real telephones (or call center 
> >trunk) until a telemarketing campaign is initiated or a call center 
> >selected to execute the sales campaign, is it possible to have these 
> >unassigned or floating numbers when not in use for a telemarketing 
> >campaign?  Is it allowed under most national numbering regimes?
> >
> >- How important is it to have a known or recognized phone number as 
> >the caller id as part of a telemarketing campaign?  I am assuming 
> >that not all campaigns care about having a number that is known or
recognized.
> >campaign operator) is using their own set of numbers but serve 
> >multiple simultaneous telemarketing campaigns using the same 
> >originating numbers, what will they sign?  Will they just have a 
> >credential representing the call center alone, or a different 
> >credential per telemarketing campaign, or a different credential per 
> >responsible party (per client)?  This will affect what is possible for
any forensic activity.
> >approves the use, and the call center, or the SP acting on its 
> >behalf, signs.
> >Think of this as another level of delegation.  An SP delegates 
> >numbers to the company.  The company "delegates" use of those numbers 
> >to the call center.  The call center calls, using that delegation.  
> >The credentials of the call center would be different from those of 
> >the company, but would cover the same number.  Having multiple 
> >credentials covering the same number will be very common due to the 
> >way delegation happens.  In order to allow SPs to sign, without 
> >creating credential per TN, we allow credentials with ranges.  The 
> >ranges could overlap when delegation happens.
> >
> >The North American Number Plan Administrator delegates 202-555-xxxx 
> >to the Pooling Administrator.  The PA now has a credential covering 
> >the entire 10K block.
> >SP B has a credential for a 100 TN block SP B delegates 202-555-123x 
> >to Company C.  Company C has a credential for a 10 number block 
> >Since that won't be the common case, the call center probably has to 
> >do the signing itself.
> >
> >Brian
> >
> >> with SPs, the majority (small to mid-size) will probably rely on 
> >> the SPs to do provide to vouch for their identity. This would 
> >> probably be the case for the home analog caller anyway. This would 
> >> imply that the "originating" SP's willingness to provide this 
> >> signature is a critical success factor for the proposal's adoption.
> >>
> >>
> >> This is not an area I understand well, but I would suspect that SP 
> >> 1 allowing one of its subscribers to send an outbound call using a 
> >> Or maybe this is another problem we are trying to fix in the 
> >> working group, in which case we perhaps should state as a goal or
benefit:
> >> "providing a reliable mechanism to let calls originated from one 
> >> SP1 to outpulse numbers that belong to another".
> >>
> >> Fernando
> >>
> >>
> >>
> >>
> >>
> >>
> >>>source calls using the same number(s) out through multiple 
> >>>providers on a call-by-call basis.
> >>>
> >>> -hadriel
> >>>
> >>>
> >>>> I'm catching up with the discussions in this working group, and 
> >>>> am trying to understand some architecture implications in call 
> >>>> centers (which is where my background is). It seems that many of 
> >>>> the problems we are trying to fix are related to contact centers 
> >>>> Forgive me if it is an obvious question, but which components in 
> >>>> a "typical call center architecture" do you see signature and 
> >>>> verification taking place? Such "typical" deployments have 
> >>>> premises based equipment (PME), a session border controller (SBC) 
> >>>> and of course a SIP service provider  all three could potentially 
> >>>> be used throughout the authorization process. There are different 
> >This e-mail may contain Sprint proprietary information intended for 
> >the sole use of the recipient(s). Any use by others is prohibited. If 
> >you are not the intended recipient, please contact the sender and 
> >delete all copies of the message.
> >

---

From: Brian Rosen <[email-masked]>
Date: Thu, 19 Sep 2013 20:32:29 -0400

Another point to make is that when the client authorizes the BPO to call on it's behalf, the credential assigned to the BPO will have the "provenance" of the authorization.  Think of this as a chain of delegations rooted in the national number authority.  When the BPO sends a call with that number as CallerId, and signs it, we know how it got permission to use the number = some SP delegated it to the client, and the client delegated use of it to the BPO.  The credential authority (CA or whatever) knows the chain and can tell authorities how it came to be that the BPO was able  to place a verifiable call using that number.

If an SP signs the call, it presumably needs to receive something that informs it of the authorization.  There are many ways this could happen.  One of them is that the client could request that the credential authority inform the SP of the authorization. 

Brian

---

From: "Fernando Mousinho (fmousinh)" <[email-masked]>
Date: Fri, 20 Sep 2013 01:14:36 +0000

Could a signed PAI be a potential solution to the BPO use case? "From" identifies the BPO, "PAI" the company hiring the BPO - based on the delegation process Rosen mentions. PAI's use is widespread, and it's main limitation is being spoofable - but this is exactly the problem we are trying to solve anyway. 

> On Sep 19, 2013, at 5:39 PM, "Richard Shockey" <[email-masked]> wrote:
> 
>> Of Fernando Mousinho (fmousinh)
>>> Of Brian Rosen

---

From: Brian Rosen <[email-masked]>
Date: Thu, 19 Sep 2013 21:43:35 -0400

Don't think that would work without related changes in the networks.  In some networks, PAI is used for called id.  They would have to change to use From (if signed maybe).  It also doesn't fit the definition of PAI.

Brian

---

From: Stephen Kent <[email-masked]>
Date: Mon, 30 Sep 2013 15:35:51 -0400

Alex,

> I've assumed that we are headed towards a "sign whatever extras you wish, and indicate what your signature covers" mechanism.
Signing "extras" may create problems. Experience suggests that a 
recipient of signed
"extra" data will be tempted to believe that data, even though the 
signer is not authorized
to assert it (based on the authorization model used to manage the 
signing keys). While
one could the public key to identify the signer and thus pursue them for 
signing misleading
data, that may not be enough to deter such behavior.

Steve

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Mon, 30 Sep 2013 19:54:08 +0000

Not clear to me, but are we signaling information on who does the authentication and signing?
Also, indication of authentication assurance?

Thanks

Martin Dolly
Lead Member of Technical Staff
Core Network & Gov't/Regulatory Standards  
AT&T Labs - Network Technology
+1-609-903-3360
[email-masked]

> On Sep 30, 2013, at 3:36 PM, "Stephen Kent" <[email-masked]> wrote:
> 
> Alex,
> 
>> +1
> Signing "extras" may create problems. Experience suggests that a recipient of signed
> "extra" data will be tempted to believe that data, even though the signer is not authorized
> to assert it (based on the authorization model used to manage the signing keys). While
> one could the public key to identify the signer and thus pursue them for signing misleading

---

From: Brian Rosen <[email-masked]>
Date: Mon, 30 Sep 2013 16:00:12 -0400

Don't think so.  

I think we're just signaling the signed material and the signature.  One of the proposals has a URI to the credential optionally signaled.  The other uses a TN based discovery of the credential.

Jon proposed something like what Alex was suggesting.  He wanted to be able to include an SDP digest.  The idea was that the digest was sent as a separate item covered by the signature.  It would need to be passed through, but if the digest didn't check, the signature would pass, but the endpoint would know the SDP had been munged.

Brian

---

From: Stephen Kent <[email-masked]>
Date: Mon, 30 Sep 2013 16:20:59 -0400

Martin,

In principle the issuer of the cert (or maintainer of a DNSSEC-protected 
DANE entry)
knows to whom it was issued. Thus if the signer does something bad, by 
signing
"extra" stuff, one has recourse. I worry that, in practice, this 
recourse will
not be easy to pursue. Thus I strongly recommend that one not use the 
signed data
to do anything other than verify the caller's right to assert a phone #.

(If other credentials are issued to callers, one might imagine them 
being used
to verify other info about a caller. But, that seems out of scope for 
now, so let's
not get ahead of ourselves.)

Steve

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Mon, 30 Sep 2013 20:22:18 +0000

If you do not know who authenticated and signed, what is it worth?

Martin Dolly

> On Sep 30, 2013, at 4:00 PM, "Brian Rosen" <[email-masked]> wrote:
> 
> Don't think so.  
>

---

From: Brian Rosen <[email-masked]>
Date: Mon, 30 Sep 2013 16:34:58 -0400

There are two ways proposed.

One is to use X.509 certs, or something like them.   The cert has the public key of the signing authority, and that cert is signed by the national database operator's well known key.

The other is the national database operator has a database that is queried by TN and yields one or more public keys.

So the key represents the entity who has been delegated the number, and the database maintains, in one way or another, the keys associated with that number.

Brian