Subject: [drinks] Confirmation of WG Consensus on adoption usecases 02 as WG item.

From: "Richard Shockey" <[email-masked]>
Date: Thu, 9 Apr 2009 16:15:30 -0400

I just want to get WG consensus on the hum that we took in SF that the
following document is a WG document and formally replaces the original
DRINKS requirements document. Silence is considered consent. 

I'll post a note in a few days opening the discussion on creating a DRINKS
Protocol Design team as we discussed in SF.

We need to continue to refine the use cases and requirements but we also
need to start protocol design in parallel.

Sound right?

DRINKS use cases / requirements (Sumanth Channabasappa, 60m)
          
        Title      : DRINKS Use cases and Protocol Requirements
        Author(s)  : S. Channabasappa
        Filename   : draft-channabasappa-drinks-usecases-requirements-02.txt
        Pages      : 22
        Date       : 2009-02-03
          
        This document captures the use cases and associated requirements for
        interfaces to provision session establishment data into SIP Service
Provider
        components that aid with session routing.  Specifically, the current
version
        of this document focuses on the provisioning of one such element,
termed the
        registry.
          
        A URL for this Internet-Draft is:
 
http://www.ietf.org/internet-drafts/draft-channabasappa-drinks-usecases-requ
irements-02.txt

Richard Shockey
PSTN Mobile: +1 703.593.2683
<mailto:richard(at)shockey.us>
skype: rshockey101 

LinkedIn : www.linkedin.com/in/rshockey101

---

From: "Richard Shockey" <[email-masked]>
Date: Mon, 20 Apr 2009 10:56:19 -0400

I'm assuming silence is consent and the document is question is a WG
document.

>  -----Original Message-----
>  From: [email-masked] [mailto:[email-masked]] On
>  Behalf Of Richard Shockey
>  Sent: Thursday, April 09, 2009 4:16 PM
>  To: 'IETF DRINKS WG'
>  Subject: [drinks] Confirmation of WG Consensus on adoption usecases 02
>  as WG item.
>  
>  _______________________________________________
>  drinks mailing list
>  [email-masked]
>  https://www.ietf.org/mailman/listinfo/drinks

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Apr 2009 14:18:05 -0400

Hi Rich,
>    Public Identity:   A generic term that refers to a telephone number
>       (TN), an email address, or other identity as deemed appropriate,
>       such as a globally routable URI of a user address (e.g.,
>       mailto:[email-masked]).
The use of "public identity" in this draft creates a new term that seems
both unnecessary and out of sync with the concepts being followed in the
Identity Management community.  It is not clear why the term "public"
is needed, and can give rise to substantial confusion.  Additionally,
what is defined in the draft is customarily known as an "identifier,"
rather than an identity. 

The potential confusion arises, for example, in Use Case #6 where
reference is make to taking a public identity "out of service," as
well as Freq 4, where reference is made to a "carrier of record for
a public identity." 

>From the context of this work, you might want to consider alternatively
a term like "signalling endpoint identifier" or "call routing identifier."

Hope this is useful.  I've copied both some of the folks involved
with international identity management terminology and specifications.

best
--tony

-- 
Tony Rutkowski | Netmagic Associates LLC | Ashburn VA | mob: +1 703.999.8270

---

From: "Cartwright, Kenneth" <[email-masked]>
Date: Mon, 20 Apr 2009 15:05:26 -0700

Hi Tony,

Thanks for the feedback.

In think the term Public Identity was chosen, in part, because of its
familiarity from a similar concept in 3GPP, "Public User Identity", and
its nice contrast with the sister term "Private User Identity".  In
general, the word "Public" means that "this is the identity you tell
people to use to contact you".  This contrasts with the word "Private"
in "Private User Identity", which means "this is the identity you (or
the underlying system) can use to authenticate yourself".

There was much discussion about other terms that contained "endpoint"
and variations.  But none seemed to fit quite as well, while also not
stepping on other terms.  More specifically, the term "end point" was
discussed and thought to refer too often to a physical device that may
be somewhere in the call routing flow (not necessarily the end device
the user was using), as apposed to the logical identity of a "person".
And the term "call routing identifier" could refer to any logical or
physical entity involved in the call routing or even to the entire call
routing flow of a given call.

Ken

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Tony Rutkowski
Sent: Monday, April 20, 2009 2:18 PM
To: Richard Shockey
Cc: 'IETF DRINKS WG'; Richard Brackney; Mike Hird
Subject: Re: [drinks] Confirmation of WG Consensus on adoption usecases
02 as WG item.

Hi Rich,

The potential confusion arises, for example, in Use Case #6 where
reference is make to taking a public identity "out of service," as well
as Freq 4, where reference is made to a "carrier of record for a public
identity." 

>From the context of this work, you might want to consider alternatively
a term like "signalling endpoint identifier" or "call routing
identifier."

Hope this is useful.  I've copied both some of the folks involved with
international identity management terminology and specifications.

best
--tony

--
Tony Rutkowski | Netmagic Associates LLC | Ashburn VA | mob: +1
703.999.8270

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Apr 2009 20:44:27 -0400

Hi Ken,
> the underlying system) can use to authenticate yourself".
In fact, "public" implies in communications law an implementation pursuant
to a regulatory requirement.  The use of the term "Public User Identity" in
3GPP standards is done to meet those requirements - that notably include
government to user, and user to government messaging requirements.  As
used in those standards, it implies additional proofing that makes the
string
an *identity* rather than an *identifier.*  You can see the extensive
use of
the term in this context by using ETSI's TEDDI term discovery service at: 
http://webapp.etsi.org/Teddi/

In the DRINKS draft, you've taken the 3GPP/ETSI term and redefined
it quite differently - in fact as you note - as an open-ended generic
identifier for any kind of SIP purpose, devoid of any proofing.  The
approach here potentially creates security vulnerabilities that
deserve mention.

If you're really wedded to the term and notion, you should either
include some sense of proofing other that mere self-asserted
"routability," or else use the term "identifier."

If you want to check the significance of the use of these concepts
and terms, you can reference ITU-T Rec. X.1250 (Baseline capabilities
for enhanced global identity management trust and interoperability).

--tony (X.1250 editor)

---

From: "Cartwright, Kenneth" <[email-masked]>
Date: Tue, 21 Apr 2009 08:06:45 -0700

Hi Tony,

Thanks for this background on the legal connotation that can underlie
the word "public".  In think this is certainly worth considering as the
drinks work moves forward and may have important implications for the
drinks use cases and requirements.  However, I think you've taken some
liberties with what I said.  I did not say that we've "taken the
3GPP/ETSI term and redefined it quite differently".  We've definitely
not even *attempted* to re-define the 3GPP term, we've not even quite
used the same term, much less attempted to redefine it.  Nor did I say
that we've defined it "as an open-ended generic identifier for any kind
of SIP purpose, devoid of any proofing".  I'm not sure what you mean by
"any kind of purpose".  I certainly would not suggest such a definition
for our use of the term "Public Identity" in the use case document.  Now
the idea of proofing is certainly an important one.  And as the drinks
requirements work moves forward it will be important to clarify the role
that proofing should play.  And I'm certainly not apposed to the use of
a term different from "Public Identity".

Lastly, in addition to the legal connotation behind the word "public"
that you explain, here is a quote from two of the designers of 3GPP as
co-authors of the book "The 3G IP Multimedia Subsystem" from Wiley:

"3.5.1 Public User Identities

In the IMS there is also a deterministic way to identify users.  An IMS
user is allocated with one or more Public User Identities.  The home
operator is responsible for allocating these Public User Identities to
each IMS subscriber.  A Public User Identity is a SIP URI [snip] or a
Tel URI [snip].  Public User Identities are used as contact information
on business cards."

So I do not see how my informal statement, "this is the identity you
tell people to use to contact you", conflicts with the above.  And just
to be clear, drinks is certainly not attempting to create the 3GPP IMS.

Also from "The 3G IP Multimedia Subsystem":

"3.5.2 Private User Identities

Each IMS subscriber is  assigned a Private User Identity.  [snip] Unlike
Public User Identities, Private User Identities are not used for routing
SIP requests; instead, they are used for subscription identification and
authentication purposes."

Ken

-----Original Message-----
From: Tony Rutkowski [mailto:[email-masked]] 
Sent: Monday, April 20, 2009 8:44 PM
To: Cartwright, Kenneth
Cc: Richard Shockey; IETF DRINKS WG; Richard Brackney; Mike Hird
Subject: Re: [drinks] Confirmation of WG Consensus on adoption usecases
02 as WG item.

Hi Ken,
> familiarity from a similar concept in 3GPP, "Public User Identity", 
> and its nice contrast with the sister term "Private User Identity".  
> In general, the word "Public" means that "this is the identity you 
> tell people to use to contact you".  This contrasts with the word
"Private"
> the underlying system) can use to authenticate yourself".
In fact, "public" implies in communications law an implementation
pursuant to a regulatory requirement.  The use of the term "Public User
Identity" in 3GPP standards is done to meet those requirements - that
notably include government to user, and user to government messaging
requirements.  As used in those standards, it implies additional
proofing that makes the string an *identity* rather than an
*identifier.*  You can see the extensive use of the term in this context
by using ETSI's TEDDI term discovery service at: 
http://webapp.etsi.org/Teddi/

In the DRINKS draft, you've taken the 3GPP/ETSI term and redefined it
quite differently - in fact as you note - as an open-ended generic
identifier for any kind of SIP purpose, devoid of any proofing.  The
approach here potentially creates security vulnerabilities that deserve
mention.

If you want to check the significance of the use of these concepts and
terms, you can reference ITU-T Rec. X.1250 (Baseline capabilities for
enhanced global identity management trust and interoperability).

--tony (X.1250 editor)

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 21 Apr 2009 11:24:54 -0400

Hi Ken,

When I used the term "you," it was meant in the plural.
Sorry for the confusion.  I should have said "DRINKS."

Hopefully the discussion has been useful.  It is one that
is occurring in an enormous number of Identity Management
and related venues worldwide.  The choice of some variant
of "identifier" as Mike Hird notes, would be a good one
for the reasons he provided, and help DRINKS harmonization
within the prevailing ontology. 

best,
tony