Subject: [dispatch] VIPR - proposed charter version 2

From: Cullen Jennings <[email-masked]>
Date: Tue, 15 Jun 2010 11:24:51 -0600

Thanks for all the comments on the list. Here is a revised version:

(PS. If anyone else wants to edit, this is in SVN and glad to get anyone write permission)

========================================

ViPR Charter Proposal (Version 2)

WG Name:  Verification Involving PSTN Reachability (VIPR)

There are two globally deployed address spaces for communications that
more than a billion people use on a daily basis. They are phone numbers
and DNS rooted address such as web servers and email addresses. The
inter-domain signaling design of SIP is primarily designed for email
style addresses yet a large percentage of SIP deployments mostly use
phone numbers for identifying users. The goal of this working group is
to enable inter-domains communications over the the internet, using
protocol such as SIP, while still allowing people to use phone numbers
to identify the person they wish to communicate with.

The VIPR WG will address this problem by developing a peer to peer based
approach to finding domains that claim to be responsible for a given
phone number and validation protocols to ensure a reasonable likelihood
that a given domain actually is responsible for the phone number. In
this context, we use "responsible" to mean an administrative domain
would would be at least one of the administrative domains that a PSTN
call to this phone number would be routed to. Once the domain
responsible for the phone number is found, existing protocols such as
SIP and XMPP can be used for inter-domain communications.

Some validation protocols may be based on knowledge gathered around a
SIP call, for example, the ability to prove a call was received over the
PSTN based on start and stop times. Other validation schemes, such as
examining fingerprints or watermarking of PSTN media, to show that a
domain received a particular PSTN phone call may also be considered by
the working group. The WG will select and standardize at least one
validation scheme.

To help mitigate SPAM issues when using SIP between domains, the WG will
define a mechanisms to enable one domain to check that incoming SIP
messages from a different domain are coming from a domain that
successfully validated a phone number. The working group will define new
SIP headers and option tags to enable this.

The essential characteristic of ViPR is establishing authentication by
PSTN reachability when it is not possible to use a direct reference to
ENUM databases or other direct assertions of PSTN number
ownership. Elements such as public ENUM easily coexist with VIPR but no
direct interaction with ENUM will be required.

The problem statement and some possible starting points for solutions
are further discussed in the following internet drafts which shall form
the bases of the WG documents:

draft-rosenberg-dispatch-vipr-overview
draft-rosenberg-dispatch-vipr-reload-usage
draft-rosenberg-dispatch-vipr-pvp
draft-rosenberg-dispatch-vipr-sip-antispam

The working group will carefully coordinate with the security area, O&M
area, as well as the appropriate RAI WG including sipcore and p2psip.

---

From: Roni Even <[email-masked]>
Date: Wed, 16 Jun 2010 09:22:52 +0300

Hi,
I read the charter and the listed drafts. I have no problem with the first
two paragraph of the charter

"There are two globally deployed address spaces for communications that more
than a billion people use on a daily basis. They are phone numbers and DNS
rooted address such as web servers and email addresses. The inter-domain
signaling design of SIP is primarily designed for email style addresses yet
a large percentage of SIP deployments mostly use phone numbers for
identifying users. The goal of this working group is to enable inter-domains
communications over the internet, using protocol such as SIP, while still
allowing people to use phone numbers to identify the person they wish to
communicate with.

The VIPR WG will address this problem by developing a peer to peer based
approach to finding domains that claim to be responsible for a given phone
number and validation protocols to ensure a reasonable likelihood that a
given domain actually is responsible for the phone number."

I have a concern about using PSTN infrastructure for the reachability. My
understanding so far was that SIP is trying to provide a new way for end to
end communication that will replace the existing circuit switch
infrastructure. This proposal says that the way to achieve end to end
connectivity requires to have an end to end PSTN frastructure.

The third paragraph is talking about validation using PSTN calls. I think
that we can look at validation of number ownership but should say that
requiring PSTN calls to do it is not the recommended approach. This will
allow managing of PSTN numbers not in the scope of PSTN infrastructure. Even
the PSTN network is using external protocol like SS7 to route calls using
databases for achieving reachability so why not say we can use similar
infrastructure that will be IP based.

I can understand this as a temporary solution but not as a standard
developed by the IETF.

 Thanks

Roni Even

---

From: Peter Musgrave <[email-masked]>
Date: Wed, 16 Jun 2010 07:53:16 -0400

Hi,

I think the use of PSTN reachability is central to ViPR and it's
value. I agree there will be other ways of authenticating and that
over time they may displace ViPR but I think PSTN reachability will be
around for a long time. I think it is the lowest-common denominator
and avoids things like trying to interface to databases of PSTN
numbers and all the assorted standards and security issues that
entails.

I see this as a temporary solution in the same way that NAT traversal
is a temporary solution :-)

Perhaps we should make it clear in the charter that the work requires
that a node using ViPR have the ability to make and receive PSTN calls
(or interface to something that does)?

I think general authentication without using PSTN reachability is a
great idea - but I think that is a far larger and more complex issue.
IIUC ViPR exists to circumvent that issue and provide a shorter term,
standards-based, pragmatic solution. I think the more general problem
would need a charter unto itself.

Peter Musgrave

On Wed, Jun 16, 2010 at 2:22 AM, Roni Even <[email-masked]> wrote:
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 16 Jun 2010 08:52:01 -0400

> I can understand this as a temporary solution but not as a standard

I have had similar concerns for some time - this strategy is not an "end 
game".

BUT, at the moment there is nothing better for most phone numbers.
That will probably be true for quite some time. So I think it must be 
*part* of the solution. It is a way to bootstrap the process.

Note that this is compatible with using SIP for "PSTN" calls. Many SPs 
now have SIP Trunks, and calls over these can be used for ViPR validation.

Eventually there should be some other mechanism that doesn't depend on 
PSTN calls. Maybe ViPR will motivate the deployment of Public ENUM. Or 
maybe there will be something else.  But in any case having *something* 
in place should kickstart the process.

	Thanks,
	Paul

---

From: "Elwell, John" <[email-masked]>
Date: Thu, 17 Jun 2010 18:24:30 +0200

"The VIPR WG will address this problem by developing a peer to peer based
approach to finding domains that claim to be responsible for a given
phone number..."
Does it necessarily have to be a peer-to-peer based approach? The ENUM/DNS approach is still a good approach for querying, but the issue is that with public ENUM the database simply doesn't get populated. So the key issue is finding a secure and attractive way of populating the database. Does the charter really need to include the words "peer to peer based", or should that be left as a matter for discussion at the solution stage?

John

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Cullen Jennings
> Sent: 15 June 2010 18:25
> To: DISPATCH list
> Subject: [dispatch] VIPR - proposed charter version 2
> 
>

---

From: "WORLEY, Dale R (Dale)" <[email-masked]>
Date: Thu, 17 Jun 2010 14:59:02 -0400

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Elwell, John [[email-masked]]

Does it necessarily have to be a peer-to-peer based approach?
_______________________________________________

I'd say the essence of VIPR is that it's peer-to-peer.  Or rather, that it enables the originator to succeed without the existence of a central or reliable database.  (A peer-to-peer structure is used as a way for terminators to advertise their claimed addresses.)  If we want to develop a database-centered approach, it would be disjoint from the design effort for VIPR.

Dale

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 17 Jun 2010 14:02:34 -0600

In general I think we should make charters  as specific as possible  but still broad enough to encompass the various types of solutions we want to consider for the problem. I think that helps things get done sooner. 

So if someone had a proposal on the table to solve this in some non peer to peer way, it would be easier to decide if we should do it in the same WG or something different. But we been talking about ideas for this for 6 months now and no one has put together a proposal for some non peer to peer approach. I've heard lots of proposal to variations of the basic vipr scheme but they all leverages to peer to peer approach. I don't want a charter that is so vague that it is a research project. If someone has a specific approach that they think we should consider, then I'd certainly want to talk about that and adjust the proposed charter accordingly but, lacking that, I prefer a charter that makes it pretty clear what the WG is going to go do and not an exploratory type charter. 

As far as solving the problem with a centralized database, I think the DRINKS/SPEERMINT folks are pretty much doing the standardization works that would be needed for that approach. For the places that will work, it's an easier approach than VIPR which is looking for an approach for the places that does not make business sense. 

Cullen

PS - I know what you mean by peer to peer here but don't even get me going about the difficulties of trying to define if something is peer to peer or not :-) 

> > get anyone write permission)

Cullen Jennings
For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 17 Jun 2010 14:54:45 -0600

I'm having a real hard time actually understand what you are objecting too. More  inline ...

> connectivity requires to have an end to end PSTN frastructure.

No this proposal says one of the way we can make PSTN address usable in inter domain SIP is this. Clearly this approach would no longer be valid when the PSTN was gone but by that point, presumably people would be using more internet style address in SIP. Keep in mind the only thing this work is trying to solve is mapping a PSTN address to a internet address. When the PSTN is gone, that problem goes with it. However the PSTN is far from gone - if I had to bet, I would guess that phone numbers were around longer than v6 addresses (and than email style address outlive them both). The issue is phone numbers are used by humans which makes them very hard to transition off of while things like v6 addresses are easier to transition off of as they are come and go with the technologies that use them. My point being all these addresses are around for a long time and the IETF works on standards to help transition and interwork between them. The Telegram service was emulated on top of other technologies long after it had been supplanted by fax - the PSTN will be similar. 

> infrastructure that will be IP based.

We did standardize and IP based database approach - it's called public ENUM. However, from a practical point of view the only people that could do the validations for ENUM are the carriers that have every business incentive to not do it. Regulators do not have the right incentives to regulate it into existence. VIPR on the other hand only requires carriers to route calls. Routing calls is something they do today, it is in their business interest so they will likely continue doing it, and the regulation around common carriage often require them to route calls. Both the existing regulations and economics favor that the carriers will do what is needed to enable a solution that leverages the PSTN for validation. 

> I can understand this as a temporary solution but not as a standard

How temporary do you think the PSTN is? How many years?  Do you think we should not be doing standards for WG like MARTINI that only WG document limited itself to phone numbers? Should we not have standards about SIP / PSTN interoperability? I don't hear you objecting to any of the other work we do hat is "temporary" in the sense it is only useful as long as the PSTN is around.

Seriously, I read this and just feel like you are grasping at straws for something to objet to since this proposal came from Cisco.

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 17 Jun 2010 14:54:53 -0600

> (or interface to something that does)?

That seems like a very pragmatic and good approach. I'm always a fan of charters having truth in advertising.

> great idea 

Well, I think it might be more accurate to say it is "great problem". We don't really have any ideas yet on how to solve it other than public ENUM which is less successful than one might have hoped.

---

From: Roni Even <[email-masked]>
Date: Fri, 18 Jun 2010 01:44:50 +0300

Hi Cullen,
I am sorry that you feel this way about me but I do not take this personally
since I am used to being blamed on lots of things.

Maybe I was not clear about my view.
Section 5.1 of the vipr overview provides the key properties that the
solution requires and I think it is a very good summary of the requirements.
I also think that dialing using E.164 numbers is better in many deployments.
(My background in H.323 has led me to it and BTW I believe that any such
solution can be applicable to H.323)

>From this point the vipr overview suggests a solution that is hinted in the
charter.

The question I have is if basing the validation of ownership of the PSTN
number can only be based on an actual PSTN call or does the charter allow
also other ways to validate the ownership of an E.164 number and can this
number be only the PSTN phone number or can it be other E.164 allocated
without an attached PSTN capability. 

The proposed charter as I read it limits the scope to the case where the
same number is used as the PSTN and SIP number. Did I understand correctly?

Roni Even

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Cullen Jennings
> Sent: Thursday, June 17, 2010 11:55 PM
> To: Roni Even
> Cc: 'DISPATCH list'
> Subject: Re: [dispatch] VIPR - proposed charter version 2 - PSTN?
> 
> 
> phone
> No this proposal says one of the way we can make PSTN address usable in
> inter domain SIP is this. Clearly this approach would no longer be
> valid when the PSTN was gone but by that point, presumably people would
> be using more internet style address in SIP. Keep in mind the only
> thing this work is trying to solve is mapping a PSTN address to a
> internet address. When the PSTN is gone, that problem goes with it.
> However the PSTN is far from gone - if I had to bet, I would guess that
> phone numbers were around longer than v6 addresses (and than email
> style address outlive them both). The issue is phone numbers are used
> by humans which makes them very hard to transition off of while things
> like v6 addresses are easier to transition off of as they are come and
> go with the technologies that use them. My point being all these
> addresses are around for a long time and the IETF works on standards to
> help transition and interwork between them. The Telegram service was
> emulated on top of ot
>  her technologies long after it had been supplanted by fax - the PSTN
> will be similar.
> 
> >
> We did standardize and IP based database approach - it's called public
> ENUM. However, from a practical point of view the only people that
> could do the validations for ENUM are the carriers that have every
> business incentive to not do it. Regulators do not have the right
> incentives to regulate it into existence. VIPR on the other hand only
> requires carriers to route calls. Routing calls is something they do
> today, it is in their business interest so they will likely continue
> doing it, and the regulation around common carriage often require them
> to route calls. Both the existing regulations and economics favor that
> the carriers will do what is needed to enable a solution that leverages
> the PSTN for validation.
> 
> >
> How temporary do you think the PSTN is? How many years?  Do you think
> we should not be doing standards for WG like MARTINI that only WG
> document limited itself to phone numbers? Should we not have standards
> about SIP / PSTN interoperability? I don't hear you objecting to any of
> the other work we do hat is "temporary" in the sense it is only useful
> as long as the PSTN is around.
> 
> Seriously, I read this and just feel like you are grasping at straws
> for something to objet to since this proposal came from Cisco.
> 
> 
> >
> >
> > Thanks
> >
> > Roni Even
> >
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 17 Jun 2010 21:08:47 -0400

Roni,

The key requirement of the solution is that:

1. it be possible to validate the mapping of phone number to a domain 
which is "responsible" for that number, based on the definition Cullen 
has provided, and that

2. such validation be possible using only access to publicly available 
open interfaces to the PSTN, so that the validation can be performed by 
any domain wishing to participate.

At the moment, the only publicly open interface to the PSTN is the 
ability to make a call. If you are aware of other open and publicly 
available interfaces by which we can perform validation, I'd love to 
hear about them :)

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   SkypeID: jdrosen
Chief Technology Strategist                    Mobile: +1 (732) 766-2496
Skype                                          SkypeIn: +1 (408) 465-0361
[email-masked]                              http://www.skype.com
[email-masked]                            http://www.jdrosen.net

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 17 Jun 2010 21:16:39 -0400

Cullen,

This looks good. My major comment is that I do think we should include 
VAP. There are applications for VAP which are interdomain. Furthermore, 
even for the intra-domain case, this will be a common protocol for 
communicating between products made from disparate vendors. For example, 
PBX from vendor A talks to the ViPR server from vendor B.

Other minor comments:

> to enable inter-domains communications over the the internet, using

s/inter-domains/inter-domain

> protocol such as SIP, while still allowing people to use phone numbers

s/protocol/protocols

> would would be at least one of the administrative domains that a PSTN

double woulds.

> SIP and XMPP can be used for inter-domain communications.

XMPP? really? does it support phone number addressing?

> SIP call, for example, the ability to prove a call was received over the

I think you mean PSTN call, and not a SIP call.

> define a mechanisms to enable one domain to check that incoming SIP

s/a mechanisms/a mechanism

> SIP headers and option tags to enable this.

The key characteristic is not actually that validation had occurred, but 
rather, that the calling domain had previously placed a PSTN call to the 
number in question.

> direct interaction with ENUM will be required.

I'd like to get a clear statement in here about the fact that ViPR is 
incrementally deployable using only existing interfaces to the PSTN. No 
change to PSTN capabilities, or new access to its databases, or support 
from PSTN providers, is required in any way.

> draft-rosenberg-dispatch-vipr-sip-antispam

Add VAP.

Thanks,
Jonathan R.

---

From: "Milinski, Alexander (NSN - DE/Munich)" <[email-masked]>
Date: Fri, 18 Jun 2010 08:37:14 +0200

Cullen, Jonathan,

how is the PSTN defined in the sense of the charter?

Does it include the SIP networks existing today, which are
interconnected to the PSTN in the common sense (S= "switched"...) and
you can reach by dialling a phone number?

Regards,
Alex

> [mailto:[email-masked]] On Behalf Of ext Jonathan Rosenberg
> Sent: Friday, June 18, 2010 3:09 AM
> To: Roni Even
> Cc: 'DISPATCH list'
> >> I'm having a real hard time actually understand what you 
> are objecting
> >> too. More  inline ...
> >>
> >>> I read the charter and the listed drafts. I have no 
> problem with the
> >> first
> >>> identifying users. The goal of this working group is to 
> enable inter-
> >> domains
> >>> communications over the internet, using protocol such as 
> SIP, while
> >> still
> >>> allowing people to use phone numbers to identify the 
> person they wish
> >> to
> >>> communicate with.
> >>>
> >>> understanding so far was that SIP is trying to provide a 
> new way for
> >> end to
> >>> The third paragraph is talking about validation using 
> PSTN calls. I
> >> think
> >>> the PSTN network is using external protocol like SS7 to 
> route calls
> >> using

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 18 Jun 2010 09:52:46 -0400

PSTN refers to the network which is the authoritative source of routing 
for calls made to E.164 numbers. Whether it uses SIP internally, or 
whether it provides SIP interfaces (aka SIP trunking), changes nothing.

-Jonathan R.