Subject: Re: [dispatch] Charter Proposal: Verification Involving PSTNReachability (VIPR)

From: Cullen Jennings <[email-masked]>
Date: Wed, 7 Jul 2010 13:56:44 -0600

On Jun 15, 2010, at 4:23 PM, Roni Even wrote:

> Hi Cullen,
> I think that other standard body should be consulted like ITU.

What would you like to ask the ITU about? 

> The reason is
> that I see that one assumption is to use the PSTN numbering plan using also
> the caller id.
> My experience is that this is not information that can be
> reliable when going between PSTN service providers and it gets worse on
> international calls.

Yes, caller-id is often missing and is trival to spoof. That is why none of vipr drafts uses calling name or number. I'm not really sure what you are getting at here. 

> Roni Even
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On
> > Behalf Of Cullen Jennings
> > Sent: Tuesday, June 01, 2010 7:55 PM
> > To: DISPATCH list
> > Subject: [dispatch] Charter Proposal: Verification Involving PSTN
> > Reachability (VIPR)
> >
> >
> > I've been talking to a lot of people about the VIPR drafts  - here is a
> > first cut of a proposal for a WG that could do this. I'm sure the
> > charter proposal needs a bunch of work but I wanted to get the
> > discussion rolling on the list.
> >
> > Thanks, Cullen
> >
> > (PS - this is sent in my individual contributor role. Take all my posts
> > about VIPR to be in my individual role not my co-chair role)
> >
> > -------------------------------------------------------
> >
> > ViPR Charter Proposal (Version 0)
> >
> > WG Name:  Verification Involving PSTN Reachability (VIPR)
> >
> > There are two globally deployed address spaces for communications that
> > more than a billion people use on a daily basis. They are phone numbers
> > and DNS rooted address such as web servers and email addresses. The
> > federation design of SIP is primarily designed for email style
> > addresses yet a large percentage of SIP deployments primarily use phone
> > numbers for identifying users. The goal of this working group is to
> > allows people to use SIP to federate over the the internet while still
> > using phone numbers to identify the person they wish to communicate
> > with.
> >
> > The VIPR WG will address this problem by developing a peer to peer
> > based approach to finding SIP domains that claim to be responsible for
> > a given phone number and the WG will design validation protocols to
> > ensure a reasonable likelihood that a given domain actually is
> > responsible for the phone number. One initial validation protocol will
> > be based on a domain being able to prove it received a particular phone
> > call over the PSTN based on both sides knowing the start and stop times
> > of that call. Other validation schemes, such as examining fingerprints
> > or watermarking of PSTN media, to show that a domain received a
> > particular PSTN phone call may be considered by the working group. To
> > help mitigate SPAM over SIP issues, the WG will define an token based
> > authorization scheme so that domain using SIP to federate can choose to
> > check that incoming SIP calls are from a domain that successfully
> > validated a phone number.
> >
> > The problem statement and some possible starting points for solutions
> > are further desired in the following internet drafts which shall form
> > the bases of the WG documents:
> > draft-rosenberg-dispatch-vipr-overview
> > draft-rosenberg-dispatch-vipr-reload-usage
> > draft-rosenberg-dispatch-vipr-pvp
> > draft-rosenberg-dispatch-vipr-sip-antispam
> >
> > The working group will carefully coordinate with the security area, O&M
> > area, as well as the appropriate RAI WG including sipcore and p2psip.
> >
> >
> > _______________________________________________
> > dispatch mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/dispatch
> 
> 

Cullen Jennings
For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html

---

From: Roni Even <[email-masked]>
Date: Wed, 07 Jul 2010 23:34:52 +0300

Cullen,
I am not talking about the vipr drafts but about the charter, I thought we
are discussion a charter and not a solution.
"One initial validation protocol will be based on a domain being able to
prove it received a particular phone call over the PSTN based on both sides
knowing the start and stop times of that call"
What do you mean by "received a particular phone call" - my understanding
from reading the sentence is that it is based on the caller ID; the start
and stop time may not be unique, so my reading is that the charter means
caller-id and start and stop time.

Roni Even

> From: Cullen Jennings [mailto:[email-masked]]
> Sent: Wednesday, July 07, 2010 10:57 PM
> To: Roni Even
> Cc: DISPATCH list
> Subject: Re: [dispatch] Charter Proposal: Verification Involving
> PSTNReachability (VIPR)
> 
> 
> Yes, caller-id is often missing and is trival to spoof. That is why
> none of vipr drafts uses calling name or number. I'm not really sure
> what you are getting at here.
> 
> 
> > Roni Even
> >

---

From: "Mohammad Al-Taraireh (maltarai)" <[email-masked]>
Date: Wed, 7 Jul 2010 15:44:17 -0500

It is really the key parameters about the pstn call that both sides can
agree on. Of course the start, and stop time of the call assuming NTP is
being used with some delta error margin should be acceptable. The caller
ID should not be a mandatory key since it might not be present in all
cases, however, the called number must be required, and must be the same
on both VCRs. 

Mo A 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Roni Even
Sent: Wednesday, July 07, 2010 4:35 PM
To: Cullen Jennings (fluffy)
Cc: 'DISPATCH list'
Subject: Re: [dispatch] Charter Proposal: Verification Involving
PSTNReachability (VIPR)

Cullen,
I am not talking about the vipr drafts but about the charter, I thought
we are discussion a charter and not a solution.
"One initial validation protocol will be based on a domain being able to
prove it received a particular phone call over the PSTN based on both
sides knowing the start and stop times of that call"
What do you mean by "received a particular phone call" - my
understanding from reading the sentence is that it is based on the
caller ID; the start and stop time may not be unique, so my reading is
that the charter means caller-id and start and stop time.

Roni Even

> > My experience is that this is not information that can be reliable 
> > when going between PSTN service providers and it gets worse
> on
> > international calls.
> 
> > > and DNS rooted address such as web servers and email addresses. 
> > > The federation design of SIP is primarily designed for email style

> > > numbers for identifying users. The goal of this working group is 
> > > to allows people to use SIP to federate over the the internet 
> > > while
> still
> > > using phone numbers to identify the person they wish to 
> > > communicate with.
> > >

> > > a given phone number and the WG will design validation protocols 
> > > to ensure a reasonable likelihood that a given domain actually is 
> > > The working group will carefully coordinate with the security 
> > > area,
> O&M

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 7 Jul 2010 22:56:37 -0600

> caller-id and start and stop time.

By "particular call" I think the charter is trying to get at it is the same call. There nothing mentioned anywhere about caller id in the charter. Caller id + time would not be a very good identifer of a call since many enterprises set all the caller of all outbound calls to the same main number for the company. Any suggestions on how to make this clearer in the charter? 

Cullen Jennings

---

From: Roni Even <[email-masked]>
Date: Thu, 08 Jul 2010 08:10:51 +0300

Cullen,
Version 4 of the charter fixed it
Roni

> Sent: Thursday, July 08, 2010 7:57 AM
> To: Roni Even
> Cc: 'DISPATCH list'
> sides
> understanding
> By "particular call" I think the charter is trying to get at it is the
> same call. There nothing mentioned anywhere about caller id in the
> charter. Caller id + time would not be a very good identifer of a call
> since many enterprises set all the caller of all outbound calls to the
> same main number for the company. Any suggestions on how to make this
> clearer in the charter?
> 
> >
> > Roni Even
> >
> >>> reliable when going between PSTN service providers and it gets
> worse
> >> on
> >>> international calls.
> >>
> The
> to
> communicate
> to