Subject: Re: [Ecrit] issues in draft-ietf-ecrit-data-only-ea-06 and draft-rosen-ecrit-addldata-subnot-00 (was RE: Question to draft-ietf-ecrit-data-only-ea-05)

From: Ivo Sedlacek <[email-masked]>
Date: Wed, 11 Sep 2013 11:49:10 +0000

Hello Brian,

you stated below that you were going to note the limitations in ISSUE 1 and ISSUE 2 in the next edition of the draft.

Has this already been done? Thanks for clarification.

Kind regards

Ivo Sedlacek

This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer 

-----Original Message-----
From: Brian Rosen [mailto:[email-masked]] 
Sent: 18. července 2013 14:51
To: Ivo Sedlacek
Cc: [email-masked]
Subject: Re: issues in draft-ietf-ecrit-data-only-ea-06 and draft-rosen-ecrit-addldata-subnot-00 (was RE: [Ecrit] Question to draft-ietf-ecrit-data-only-ea-05)

Hi Ivo

I will note this limitations in the next edition of the draft.

The working group can decide if they think they are more important than I think they are.  I will raise the issue when I discuss the draft in Berlin.

Brian

On Jul 18, 2013, at 3:12 AM, Ivo Sedlacek <[email-masked]> wrote:

> Hello Brian,
> 
> my conclusions of the discussion:
> 
> ISSUE 1:
> --------------------------
> if the UA and the PSAP wish to provide updates, the solution in the drafts requires UA to provide a URI which  PSAP uses to send out-of-dialog SUBSCRIBE request to the UA. This URI needs to be a globally routable URI. 
> Since UAs are normally behind SBG/firewall and do not have globally routable URI, this requires UA to be registered to get a globally routable URI. 
> If the UA does not have valid credentials, the registration will fail.
> 
> In contrast, INFO based solution would not suffer from this problem as everything is sent within dialog of emergency call.
> --------------------------	
> 
> PROPOSAL 1:
> --------------------------
> Record in the drafts that if the UA and the PSAP wish to provide updates, when the UA does not have a globally routable URI (e.g. due to not having valid credentials which would enable registration providing GRUU to the UA), then solution in the drafts does not work.
> --------------------------
> 
> 
> ISSUE 2:
> --------------------------
> The drafts do not solve how the UA is able to detect whether the subscriber is an authorized entity or man-in-the-middle intercepting the MESSAGE or the previous SUBSCRIBE. Roaming UAs (e.g. in cars) are not aware of identities of PSAPs or responders in visited country.
> 
> In contrast, INFO based solution would not suffer from this problem as everything is sent within dialog of emergency call.
> --------------------------	
> 
> PROPOSAL 2:
> --------------------------
> Record this security issue in the drafts.
> --------------------------
> 
> 
> On:
> 
>> What I'm proposing doesn't require trust between networks, it requires trust between the device that sent the alert and the PSAP or responders that get it. 
> 
> The UA, particularly UA roaming to a different country (common for UAs in cars), does not know the PSAP or responder identity.
> 
>> And will INFO pass through IMS networks? Or will it be blocked by those SBCs?
> 
> INFO is an in-dialog request. Moreover, it would be sent within an emergency call. It would be passed.
> 
>> SUBSCRIBE is like any other SIP transaction.  If you want to send them all the way through the same path, you can.  
>> I think that is more fragile, but you can do it.  
>> The PSAP sends the SUBSCRIBE to the visited network that sent it the alert, which sends it to any transit networks enroute to the home network that originated the alert.
> 
> The visited network does not provide globally routable URI to the UA. It is the registrar in the home network which provides GRUU during registration.
> 
> So, the SUBSCRIBE from PSAP will traverse: PSAP (African country) - network serving PSAP (African country) - transit network (any country) - home operator (US) - visited network (African country) - UA. 
> 
> In comparison, emergency requests sent by UA or exchanged in the 
> emergency dialogs initiated by UA will traverse: UA - visited network 
> (African country) - PSAP (African country)
> 
> In the latter case, it is much easier to ensure trust for the "this-is-sent-by-PSAP" information or resource priority as one regulatory body governs the whole signalling path. 
> 
> Kind regards
> 
> Ivo Sedlacek
> 
> This Communication is Confidential. We only send and receive email on 
> the basis of the terms set out at www.ericsson.com/email_disclaimer
> 
> 
> -----Original Message-----
> From: Brian Rosen [mailto:[email-masked]]
> Sent: 17. července 2013 20:21
> To: Ivo Sedlacek
> Cc: [email-masked]
> Subject: Re: [Ecrit] Question to draft-ietf-ecrit-data-only-ea-05
> 
> Hi Ivo
> 
> See inline.
> 
> On Jul 17, 2013, at 11:13 AM, Ivo Sedlacek <[email-masked]> wrote:
> 
>> please see below. Kind regards Ivo Sedlacek
>> 
>> This Communication is Confidential. We only send and receive email on 
>> the basis of the terms set out at www.ericsson.com/email_disclaimer
>> 
>>>>>> Issue 1: If SUBSCRIBE/NOTIFY mechanism is used, the PSAP is the subscriber and the UA is the notifier, this would require reachability of UA for initial request for dialog (i.e. SUBSCRIBE). However, when the UA is not registered e.g. due to missing credentials, the UA is normally not reachable for SIP requests other than those sent within the dialog of the emergency call.
>>>>> 
>>>>> I think the combination of missing credentials, and data updates is so unlikely that the problem of PSAP control of updates dwarfs it.
>> 
>> The issue above was related to UA not being reachable for incoming requests due to __UA__ not having its credentials. 
>> 
>> Networks (like 3GPP IMS) enable UA without valid credentials to only send emergency requests and requests sent within dialogs created by emergency request. 
>> To receive requests sent outside of dialog created by emergency requests, the UA needs to be registered.
>> To be registered, the UA needs to have valid credentials.
> I misunderstood
>> 
>> Note that some countries require UAs to be able to make voice emergency call even if the UA does not valid credentials. 
> Yeah, but none of them require devices to be able to send data updates if they are not registered.
> 
>> 
>> Why should that be not be required as well for data only emergency requests?
> Personal opinion - because it's a DDoS attack opening towards a PSAP.  I would prohibit it.  All the PSAPs I am in discussion with are afraid of such problems.    As an example, in the U.S., in most cases, alarm systems are not permitted to connect directly to a PSAP - they must connect through a "Central Alarm Monitoring" service.  We hope to change that, but only if we can guarantee that the PSAP is protected, and they believe they are protected.
> 
>> 
>>> Because PSAPs will have credentials, and most sensor based devices where it's the device making the call don't update fast enough to be interesting.  I also think in most cases, devices will publish to a server, and the server will send the alert.
>> 
>> The above describes some particular architecture where SIP and non SIP signalling is mixed, or perhaps server acts as SIP B2BUA, not sure. Which entity is the SIP UA - the "server" or the "device" or both?
> The above assumes the device is registered to a service that aids it.  Most devices that have this kind of capability do that, but not all.
> If there is a service, the service has a server, the UA publishes updates to the server, the PSAP subscribes to the server.
> 
> If there is no service, the device UA is the server, and the PSAP subscribes to it.
> 
>> 
>> Why would the UA not be able to provide updates fast enough? Even if the UAs are not able to do it today, why shouldn't they be able to do it in future?
> Not a matter of able to, it's just that the data on such devices doesn't change enough over the course of a call to be interesting.  Once a car crashes, it has crash data, but it doesn't change.  If a fire starts, the fire could go out on it's own, but usually the fire brigade goes out anyway - updates aren't interesting.
> 
> Same with burglar alarms.
> 
> It's only a device like a heart monitor that would have updates that would be interesting, but in my experience, such devices have services that interpret the raw data from the sensor into more useful data for responders.
> 
> 
>> 
>>>> If PSAP accepts unauthenticated one short emergency requests, the PSAP will likely be interested in any data updates which the UA is able to provide. E.g. fire detection sensor could provide updates of the temperature in the building.
>>> Poor example.  The way we intend to determine temperatures in a building is the "additional location data" mechanism, which would probably (no details have been worked out yet) have a portal access to the building control system.
>> 
>> Abstract of draft-ietf-ecrit-data-only-ea-06 states: 
>> 
>> Examples of such environments include a  __temperature sensors 
>> issuing alerts__, or vehicles sending crash data.
> I can change the example.  Issuing the alert is one thing, monitoring the HVAC system is another.
> 
>> 
>> Is the Abstract is wrong?
> It's just that a typical building has a wide variety of sensors and actuators that are of interest to a responder.  A good example is the state of the water system or the air handing equipment, the elevators and the door sensors.  None of those are the ones that trigger the alert.  We're thinking about a portal to the building monitoring system that let's a responder connect to the portal and get all the data, and maybe even control aspects of it, if building management lets them.
> 
> You also typically have more than one call about an incident, and you need the same data whether you got a data-only alert or a telephone call.
> 
>> 
>>> The usual case where it is a device that has updates is that it uses the credentials of the PSAP to allow subscription.  Since the URL is something it supplies, it can include a token, good for a small window around the MESSAGE it sends.  
>> 
>> The UA normally do not know the identity of the PSAP and cannot authenticate PSAP. This was discussed quite a lot in draft-ietf-ecrit-psap-callback. The result is that just indication is provided and UA needs to rely on network to assert it. 
>> 
>>> We want to ALLOW direct from the device messages, and we have a way to do that.  A way the PSAP controls, which I think is important.
>> 
>> I understand the PSAP control is wished. This could be provided in INFO package mechanism as well.
>> 
>>> If the UA doesn't intend to provide updates, it doesn't offer a SUBSCRIBE URI.  If one is offered, and the PSAP wants updates, it will subscribe.
>> 
>> The point is that UA may be able and may want to allow PSAP to request the updates in every single request. 
>> Similarly, PSAP may want to decide that it wants the updates for every single request. 
>> If this is the most common case, the MESSAGE + SUBSCRIBE/NOTIFY is suboptimal.
> First of all, I think this is an uncommon case.  The common cases I know about have a service and it's not the device that the emergency authorities connect to.
> 
> Second of all, the MESSAGE goes to the PSAP, which usually only cares about dispatching a responder.  It is the responder who cares about the data after that.  Updates nearly always are of interest to responders and not PSAPs.  By sending a URI, we allow the responder to subscribe, not just the PSAP.  If we create a session, it's with the PSAP, not the responder.  We would have to transfer the session to the responder.
> 
>> 
>>> For one thing devices that do this tend to move.  MESSAGE does not create a session.  Sending updates requires a session where the routing wouldn't change within the session.  You can't send individual MESSAGE transactions, because each one may route differently.  That means we would need for the initial alert to be in an INVITE, create a session with no media, then send INFOs.  Not a whole lot different.
>> 
>> Updates sent using subscription will require dialog as well so there is really no difference related to UE movement.
> Agree, no difference.  But we have a mechanism much better suited to asynchronous notification in SUB/NOT vs INVITE/INFO.
> 
>> 
>> IMO, the solution using INVITE (containing the 1st shot) followed by INFOs would be simpler and (in comparision to MESSAGE+SUBSCRIBE/NOTIFY solution):
>> 1) would enable updates sent by UA without credentials
>> 2) would not need to rely on trust between networks to preserve information that SUBSCRIBE is sent by PSAP.
> As above, I don't think allowing devices without credentials to send alerts is a good idea at all.  I would prohibit it.
> What I'm proposing doesn't require trust between networks, it requires trust between the device that sent the alert and the PSAP or responders that get it.  MITM is an issue if the signaling is observable however.
> 
>> 
>> 
>>>> Thus the risk of missing trust between the networks is high - e.g. when UA with US subscription is an african country, sends emergency request to african PSAP, will the US home network of the UA trust the african network claiming that SUBSCRIBE comes from PSAP?
>>> No network is involved.  The question you are asking is will a US device visiting Africa trust an African PSAP.  When the MESSAGE is sent the URI for the subscribe is that of the device, not the home or visited network of the device.
>> 
>> 1) In normal SIP environment (like 3GPP IMS), PSAP will need to involve some network to reach UA. If UA includes IP address and port in the URI included in the MESSAGE, and PSAP sends SUBSCRIBE directly to that IP address and port, the SUBSCRIBE will likely be blocked by a firewall/SBC.
> And will INFO pass through IMS networks? Or will it be blocked by those SBCs?
> 
>> 
>> 2) US device trusts that the emergency message/call is delivered to african PSAP since the UA set the Request-URI to the emergency URN. But when SUBSCRIBE is received, how does the UA know that that SUBSCRIBE was really sent by PSAP and not by malicious UE? Normally, the UA trusts its home network to assert this, and its home network trusts the transit networks, and the transit networks checks that message comes from PSAP. So, there is chain of trust which is however difficult to achive if several countries are involved.
> SUBSCRIBE is like any other SIP transaction.  If you want to send them all the way through the same path, you can.  I think that is more fragile, but you can do it.  The PSAP sends the SUBSCRIBE to the visited network that sent it the alert, which sends it to any transit networks enroute to the home network that originated the alert.
> 
>> 
>>> So you propose to recreate RFC6446 and 6447 in an INFO package?
>> 
>> Not sure if all of that is needed, but possibly. 
> It would be necessary I think.
> 
>