Subject: [dispatch] VIPR - proposed charter version 3

From: Mary Barnes <[email-masked]>
Date: Mon, 28 Jun 2010 12:38:28 -0500

Hi all,

Below, please find version 3 of the VIPR proposed charter. It's been
updated to reflect ML feedback, in particular VAP has been added and
clarifications have been made with regards to impacts (i.e., none) on
existing PSTN interfaces.

Regards,
Mary
(DISPATCH WG co-chair)

============================================
VIPR Charter Proposal (Version 3)

WG Name:  Verification Involving PSTN Reachability (VIPR)

There are two globally deployed address spaces for communications used
by more than a billion people daily - phone numbers and DNS rooted
address such as web servers and email addresses. The inter-domain
signaling design of SIP is primarily designed for email style addresses
yet a large percentage of SIP deployments mostly use phone numbers for
identifying users. The goal of this working group is to enable
inter-domain communications over the the Internet, using protocols such
as SIP, while still allowing people to use phone numbers to identify the
person with whom they wish to communicate.

The VIPR WG will address this problem by developing a peer to peer based
approach to finding domains that claim to be responsible for a given
phone number and validation protocols to ensure a reasonable likelihood
that a given domain actually is responsible for the phone number. In
this context, "responsible" means an administrative domain, which is at
least one of the domains, to which a PSTN call to this phone number
would be routed. Once the domain responsible for the phone number is
found, existing protocols, such as SIP, can be used for inter-domain
communications.

Some validation protocols may be based on knowledge gathered around a
PSTN call; for example, the ability to prove a call was received over
the PSTN based on start and stop times. Other validation schemes, such
as examining fingerprints or watermarking of PSTN media to show that a
domain received a particular PSTN phone call, may also be considered by
the working group. This validation will be accomplished using publicly
available open interfaces to the PSTN, so the validation can be
performed by any domain wishing to participate.  The WG will select and
standardize at least one validation scheme.

The validation mechanism requires a domain to gather and maintain
information related to PSTN calls.  This information is used by call
agents such as phones, SBCs and IP PBXs to route calls.  The WG will
define a client-server protocol between these call agents and the entity
within a domain that maintains the information.

To help mitigate SPAM issues when using SIP between domains, the WG will
define a mechanism to enable one domain to check that incoming SIP
messages are coming from a validated phone number.  A phone number is
considered validated if it is coming from a domain to which the calling
domain had previously successfully placed a PSTN call.  The working
group will define new SIP headers and option tags, as necessary, to
enable this.

The essential characteristic of VIPR is establishing authentication by
PSTN reachability when it is not possible to use a direct reference to
ENUM databases or other direct assertions of PSTN number
ownership. Elements such as public ENUM easily coexist with VIPR but no
direct interaction with ENUM will be required.  The solution set defined
by this WG will be incrementally deployable using only existing
interfaces to the PSTN.  No changes will be required to existing PSTN
capabilities, no new database access is needed nor is any new support
from PSTN service providers required.

The problem statement and some possible starting points for solutions
are further discussed in the following internet drafts which shall form
the bases of the WG documents:

draft-rosenberg-dispatch-vipr-overview
draft-rosenberg-dispatch-vipr-reload-usage
draft-rosenberg-dispatch-vipr-pvp
draft-rosenberg-dispatch-vipr-sip-antispam
draft-rosenberg-dispatch-vipr-vap

The working group will carefully coordinate with the security area, O&M
area, as well as the appropriate RAI WGs such as sipcore and p2psip.

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Mon, 28 Jun 2010 19:43:05 +0200

I have a major issue with including "which shall form the bases of the WG documents" into the charter. To me this is confusing the charter discussion with the working group that might eventually result deciding what its deliverables, and their contents, shall be.

regards

Keith 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Mary Barnes
> Sent: Monday, June 28, 2010 6:38 PM
> To: DISPATCH
> Subject: [dispatch] VIPR - proposed charter version 3
> 
> Hi all,
> 
> Below, please find version 3 of the VIPR proposed charter. 
> It's been updated to reflect ML feedback, in particular VAP 
> has been added and clarifications have been made with regards 
> to impacts (i.e., none) on existing PSTN interfaces.
> 
> Regards,
> Mary
> (DISPATCH WG co-chair)
> 
> There are two globally deployed address spaces for 
> communications used by more than a billion people daily - 
> phone numbers and DNS rooted address such as web servers and 
> email addresses. The inter-domain signaling design of SIP is 
> primarily designed for email style addresses yet a large 
> percentage of SIP deployments mostly use phone numbers for 
> identifying users. The goal of this working group is to 
> enable inter-domain communications over the the Internet, 
> using protocols such as SIP, while still allowing people to 
> use phone numbers to identify the person with whom they wish 
> to communicate.
> 
> The VIPR WG will address this problem by developing a peer to 
> peer based approach to finding domains that claim to be 
> responsible for a given phone number and validation protocols 
> to ensure a reasonable likelihood that a given domain 
> actually is responsible for the phone number. In this 
> context, "responsible" means an administrative domain, which 
> is at least one of the domains, to which a PSTN call to this 
> phone number would be routed. Once the domain responsible for 
> the phone number is found, existing protocols, such as SIP, 
> can be used for inter-domain communications.
> 
> Some validation protocols may be based on knowledge gathered 
> around a PSTN call; for example, the ability to prove a call 
> was received over the PSTN based on start and stop times. 
> Other validation schemes, such as examining fingerprints or 
> watermarking of PSTN media to show that a domain received a 
> particular PSTN phone call, may also be considered by the 
> working group. This validation will be accomplished using 
> publicly available open interfaces to the PSTN, so the 
> validation can be performed by any domain wishing to 
> participate.  The WG will select and standardize at least one 
> validation scheme.
> 
> The validation mechanism requires a domain to gather and 
> maintain information related to PSTN calls.  This information 
> is used by call agents such as phones, SBCs and IP PBXs to 
> route calls.  The WG will define a client-server protocol 
> between these call agents and the entity within a domain that 
> maintains the information.
> 
> To help mitigate SPAM issues when using SIP between domains, 
> the WG will define a mechanism to enable one domain to check 
> that incoming SIP messages are coming from a validated phone 
> number.  A phone number is considered validated if it is 
> coming from a domain to which the calling domain had 
> previously successfully placed a PSTN call.  The working 
> group will define new SIP headers and option tags, as 
> necessary, to enable this.
> 
> The essential characteristic of VIPR is establishing 
> authentication by PSTN reachability when it is not possible 
> to use a direct reference to ENUM databases or other direct 
> assertions of PSTN number ownership. Elements such as public 
> ENUM easily coexist with VIPR but no direct interaction with 
> ENUM will be required.  The solution set defined by this WG 
> will be incrementally deployable using only existing 
> interfaces to the PSTN.  No changes will be required to 
> existing PSTN capabilities, no new database access is needed 
> nor is any new support from PSTN service providers required.
> 
> The problem statement and some possible starting points for 
> solutions are further discussed in the following internet 
> drafts which shall form the bases of the WG documents:
> 
> The working group will carefully coordinate with the security 
> area, O&M area, as well as the appropriate RAI WGs such as 
> sipcore and p2psip.
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: Mary Barnes <[email-masked]>
Date: Mon, 28 Jun 2010 13:00:06 -0500

Hi Keith,

That's a valid concern and we can rewrite the deliverables as
functional descriptions as we have done for other WG charters even in
cases where documents existed (e.g., overload).  The current text is
trying to say that these documents map to deliverables and can be used
as WG documents, although as it notes these should be considered
starting points (i.e., it's understood the proposed WG has change
control), but certainly the current text is somewhat misleading.

Thanks,
Mary.

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 29 Jun 2010 15:09:53 +0200

Hi,

The second paragraph says: "The VIPR WG will address this problem..." 

What problem?

The charter does say that the problem statement is described in the referenced drafts. But, shouldn't it be described in the charter? Now it seems that we first have to adopt the drafts in order to agree what the problem is...

I also agree with Keith's comment regarding the usage of "shall be based on this and that draft" wording.

Regards,

Christer

> Sent: 28. kesäkuuta 2010 21:00
> To: DRAGE, Keith (Keith)
> Cc: DISPATCH
> Subject: Re: [dispatch] VIPR - proposed charter version 3
> 
> Hi Keith,
> 
> functional descriptions as we have done for other WG charters 
> even in cases where documents existed (e.g., overload).  The 
> current text is trying to say that these documents map to 
> deliverables and can be used as WG documents, although as it 
> notes these should be considered starting points (i.e., it's 
> understood the proposed WG has change control), but certainly 
> the current text is somewhat misleading.
> 
> Thanks,
> Mary.
> 
> > I have a major issue with including "which shall form the 
> bases of the WG documents" into the charter. To me this is 
> confusing the charter discussion with the working group that 
> might eventually result deciding what its deliverables, and 
> their contents, shall be.
> >
> > regards
> >
> > Keith
> >
> >> It's been updated to reflect ML feedback, in particular 
> VAP has been 
> >> added and clarifications have been made with regards to impacts 
> >> (i.e., none) on existing PSTN interfaces.
> >>
> >> Regards,
> >> Mary
> >> (DISPATCH WG co-chair)
> >>
> >> There are two globally deployed address spaces for communications 
> >> used by more than a billion people daily - phone numbers and DNS 
> >> rooted address such as web servers and email addresses. The 
> >> inter-domain signaling design of SIP is primarily designed 
> for email 
> >> style addresses yet a large percentage of SIP deployments 
> mostly use 
> >> phone numbers for identifying users. The goal of this 
> working group 
> >> is to enable inter-domain communications over the the 
> Internet, using 
> >> protocols such as SIP, while still allowing people to use phone 
> >> numbers to identify the person with whom they wish to communicate.
> >>
> >> The VIPR WG will address this problem by developing a peer to peer 
> >> based approach to finding domains that claim to be 
> responsible for a 
> >> given phone number and validation protocols to ensure a reasonable 
> >> likelihood that a given domain actually is responsible for 
> the phone 
> >> number. In this context, "responsible" means an administrative 
> >> domain, which is at least one of the domains, to which a 
> PSTN call to 
> >> this phone number would be routed. Once the domain responsible for 
> >> the phone number is found, existing protocols, such as SIP, can be 
> >> used for inter-domain communications.
> >>
> >> the PSTN based on start and stop times.
> >> particular PSTN phone call, may also be considered by the working 
> >> group. This validation will be accomplished using publicly 
> available 
> >> open interfaces to the PSTN, so the validation can be performed by 
> >> any domain wishing to participate.  The WG will select and 
> >> define a client-server protocol between these call agents and the 
> >> entity within a domain that maintains the information.
> >>
> >> To help mitigate SPAM issues when using SIP between 
> domains, the WG 
> >> will define a mechanism to enable one domain to check that 
> incoming 
> >> SIP messages are coming from a validated phone number.  A phone 
> >> number is considered validated if it is coming from a 
> domain to which 
> >> the calling domain had previously successfully placed a 
> PSTN call.  
> >> The working group will define new SIP headers and option tags, as 
> authentication 
> >> by PSTN reachability when it is not possible to use a direct 
> >> reference to ENUM databases or other direct assertions of 
> PSTN number 
> >> ownership. Elements such as public ENUM easily coexist 
> with VIPR but 
> >> no direct interaction with ENUM will be required.  The 
> solution set 
> >> defined by this WG will be incrementally deployable using only 
> >> existing interfaces to the PSTN.  No changes will be required to 
> >> existing PSTN capabilities, no new database access is 
> needed nor is 
> >> any new support from PSTN service providers required.
> >>
> >> are further discussed in the following internet drafts which shall 
> >> form the bases of the WG documents:
> >>
> >> The working group will carefully coordinate with the 
> security area, 
> >> O&M area, as well as the appropriate RAI WGs such as sipcore and 
> >> p2psip.

---

From: "PFAUTZ, PENN L (ATTCORP)" <[email-masked]>
Date: Tue, 29 Jun 2010 09:30:55 -0400

I'd like to understand precisely what is meant by "A phone number is
considered validated if it is coming from a domain to which the calling
domain had previously successfully placed a PSTN call."
More importantly, I think the WG should discuss what the criteria for
validation should be. 
  
Penn Pfautz
AT&T Access Management
+1-732-420-4962

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Mary Barnes
Sent: Monday, June 28, 2010 1:38 PM
To: DISPATCH
Subject: [dispatch] VIPR - proposed charter version 3

Hi all,

Regards,
Mary
(DISPATCH WG co-chair)

---

From: Mary Barnes <[email-masked]>
Date: Tue, 29 Jun 2010 11:11:33 -0500

Hi Christer,

"this problem" refers to that stated in the previous paragraph, which
is stated fairly clearly.  Would rewording the first sentence in the
second paragraph to something like the following make it more clear to
you?

" The VIPR WG will develop a peer to peer based
approach to finding domains that claim to be responsible for a given
phone number along with validation protocols to ensure a reasonable
likelihood that a given domain actually is responsible for the phone
number."

The intent is not at all that the drafts MUST be adopted in order to
agree the problem statement.  The charter should be standalone and as
I responded to Keith, we can generalize the deliverables (to match the
work items that are described in the body of the charter).  Certainly,
having such detailed documents at the outset can be misleading in
terms of the intent of the WG, however, as with any documents that
might be adopted or used as a starting point for the WG documents,
change control belongs to the WG. We have lots of examples of similar
situations (within RAI) that have resulted in a significantly
different WG document (even as early as a -00) as compared to the
individual document that was the starting point for the WG document.

Thanks,
Mary.

---

From: Mary Barnes <[email-masked]>
Date: Tue, 29 Jun 2010 11:17:37 -0500

Hi Penn,

Absolutely, the WG would discuss the criteria for validation - the
last sentence in the 3rd paragraph discusses this and notes:
" The WG will select and standardize at least one validation scheme."

The sentence you are asking about is in the SPAM section which is
something that happens on top of the validation - i.e., if phone
numbers associated with a specific domain have been validated, this
validation criteria is applicable to other numbers from the same
domain.

Thanks,
Mary.

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 29 Jun 2010 18:33:59 +0200

Hi Mary, 

>"this problem" refers to that stated in the previous 
>paragraph, which is stated fairly clearly.  Would rewording 
>the first sentence in the second paragraph to something like 
>the following make it more clear to you?
> 
>" The VIPR WG will develop a peer to peer based approach to 
>finding domains that claim to be responsible for a given 
>phone number along with validation protocols to ensure a 
>reasonable likelihood that a given domain actually is 
>responsible for the phone number."

The text explains what the WG will do. But, as far as I understand, the claimed PROBLEM is that there are existing mechanisms that for various reasons can't be used.

Also, the charter currently DOES say that the problem statement is described in the drafts. So, I think it should be moved to the charter, so that we can agree on it as part of agreeing the charter.

Regards,

Christer

>The intent is not at all that the drafts MUST be adopted in 
>order to agree the problem statement.  The charter should be 
>standalone and as I responded to Keith, we can generalize the 
>deliverables (to match the work items that are described in 
>the body of the charter).  Certainly, having such detailed 
>documents at the outset can be misleading in terms of the 
>intent of the WG, however, as with any documents that might 
>be adopted or used as a starting point for the WG documents, 
>change control belongs to the WG. We have lots of examples of 
>similar situations (within RAI) that have resulted in a 
>significantly different WG document (even as early as a -00) 
>as compared to the individual document that was the starting 
>point for the WG document.
> 
> Thanks,
> Mary.
> 
> 
> > The charter does say that the problem statement is 
> described in the referenced drafts. But, shouldn't it be 
> described in the charter? Now it seems that we first have to 
> adopt the drafts in order to agree what the problem is...
> >
> > I also agree with Keith's comment regarding the usage of 
> "shall be based on this and that draft" wording.
> >
> > Regards,
> >
> > Christer
> >
> >
> >
> >
> >> trying to say that these documents map to deliverables and can be 
> >> used as WG documents, although as it notes these should be 
> considered 
> confusing 
> >> the charter discussion with the working group that might 
> eventually 
> >> result deciding what its deliverables, and their contents, 
> shall be.
> >> >
> >> > regards
> >> >
> >> > Keith
> >> >
> communications

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 30 Jun 2010 12:42:54 +0200

> actually is responsible for the phone number. 

Hi,

Clarification question. What exactly means 'peer to peer based approach'
and what kind of approaches are excluded by having this in the charter.
Does 'approach' mean solution? If so why does a specific type of
solution need to be agreed in the charter, while all we have at hand at
this point are individual contribution I-Ds that describe the 'problem
statement and some possible starting points for solutions'?

Thanks and Regards,

Dan

> Sent: Monday, June 28, 2010 8:38 PM
> To: DISPATCH

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 30 Jun 2010 12:47:57 +0200

Hi Mary,

I also think that listing the deliverables should be independent from mentioning the existing initial contributions. The existing contributions could be listed as well, but they should not preclude other contributions on the same items after the WG is formed. 

Regards,

Dan

> Sent: Monday, June 28, 2010 9:00 PM
> To: DRAGE, Keith (Keith)
> Cc: DISPATCH

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 30 Jun 2010 13:57:32 +0200

It is not clear whether you are proposing a rewrite that removes the names of the deliverables, and therefore removes the problem that way, or not. Without seeing words, I cannot comment on the specifics of that.

In any case, the minimum change to me is to remove the words indicated.

regards

Keith

> Sent: Monday, June 28, 2010 7:00 PM
> To: DRAGE, Keith (Keith)
> Cc: DISPATCH

---

From: Mary Barnes <[email-masked]>
Date: Wed, 30 Jun 2010 10:24:01 -0500

Hi Dan,

The term peer to peer is intended to exclude mechanisms that would use
a central repository for the information:  This was discussed in an
earlier thread:
http://www.ietf.org/mail-archive/web/dispatch/current/msg02027.html

In one sense it is a solution, however, in another sense it is reusing
SIP related functionality defined in RAI and thus is in a similar vein
as specifying the use of SIP in a charter.

Thanks,
Mary.

---

From: Mary Barnes <[email-masked]>
Date: Wed, 30 Jun 2010 10:24:51 -0500

Agreed - I will make that change in the version 4 of the charter.

Thanks,
Mary.

---

From: Mary Barnes <[email-masked]>
Date: Wed, 30 Jun 2010 10:30:00 -0500

I will remove both the list of draft names and the paragraph that
introduces those and replace it with text describing deliverables as
is typically done for charters.  At this point, I think everyone is
well aware of the related documents.

Thanks,
Mary.

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 30 Jun 2010 17:33:24 +0200

It looks to me that one can imagine 'centralized' solutions which are
also based on reusing SIP related functionality developed in RAI. I
would rather not close such an option and allow the WG a window of
opportunity in which alternate solutions that could meet the same goals
can be presented.  

Dan

> From: Mary Barnes [mailto:[email-masked]] 
> Sent: Wednesday, June 30, 2010 6:24 PM
> To: Romascanu, Dan (Dan)
> Cc: DISPATCH; IETF-Discussion list
> The term peer to peer is intended to exclude mechanisms that 
> would use a central repository for the information:  This was 
> discussed in an earlier thread:
> In one sense it is a solution, however, in another sense it 
> is reusing SIP related functionality defined in RAI and thus 
> is in a similar vein as specifying the use of SIP in a charter.
> 
> Thanks,
> Mary.
> 
> >> number.
> > solution need to be agreed in the charter, while all we 
> have at hand 
> > at this point are individual contribution I-Ds that describe the 
> > 'problem statement and some possible starting points for solutions'?
> >
> > Thanks and Regards,
> >
> > Dan
> >
> >

---

From: Mary Barnes <[email-masked]>
Date: Wed, 30 Jun 2010 10:47:15 -0500

Hi Dan,

One of the starting points for this work is that more centralized
solutions to this problem have been defined (and implemented), yet
they have not been successful.  Per one of Christer's earllier
comments, we will add some text with reference to such and thus
substantiate why this group is focusing on a p2p based solution.

Thanks,
Mary.

---

From: "Roni Even" <[email-masked]>
Date: Wed, 30 Jun 2010 19:03:59 +0300

Mary,
When I read the charter it is not clear why from the first paragraph you
deduct the second paragraph.
If the first paragraph will say
" The goal of this working group is to enable inter-domain communications
over the Internet, using protocols such as SIP, while still allowing people
to use the called person assigned circuit switch phone number for
identifying the person with whom they wish to communicate. " 
It may look clearer.

Still this is based on the assumption that using other ways to assign and
authenticate SIP phone numbers using central databases is not catching up
because the carriers object to implement it and not due to any other reason
like preferences of enterprises IT to use PSTN for calls because of better
quality of service and manageability.

Roni Even

---

From: Mary Barnes <[email-masked]>
Date: Wed, 30 Jun 2010 11:21:22 -0500

Hi Roni,

Comments inline below and some snipping of the thread.

Thanks,
Mary.

> identifying the person with whom they wish to communicate. "
[MB] We could change "phone number" to "called person assigned circuit switch
phone number for identifying the person", but I think that "phone
number" is well
understood to be exactly what you want to describe it as.  [/MB]

> quality of service and manageability.
[MB] I'm not certain (personally) that the latter preferences you note
are as prevalent as you might suggest. I would still contend that the
larger issue is the former. However, if other folks share this
concern, we can certainly add that as well - it reflects equally as
being a non-technical reason for widespread implementation [/MB]