Subject: [Sipping] Authentication issues with emergency and other services

From: "James Hamlin" <[email-masked]>
Date: Fri, 20 Dec 2002 16:30:41 -0000

Hi

The sos draft says: "It appears unlikely that classical
authentication mechanisms can be required by emergency call centers,
but SIP proxy servers may be able to add identifying information."
This is very much in line with existing emergency services. However
access to the existing services is generally over networks that have
good means of tracing the geographic location of a caller. The
Internet does not really have this. I'm concerned that without any way
for verification of the user's location, an emergency service on the
Internet would be open to attack from people who reside outside the
area of jurisdiction in which the emergency service operates.  To
avoid this it would be better if emergency services gave priority to
callers who's location was verifiable. Prioritising would still ensure
that all calls were accepted but that calls from authenticated users
could not be "swamped" by malicious calls from outside the geographic
area of the service.

This leads to the question of what type of authentication to
use. Digest authentication would not be adequate as one couldn't
expect every user or proxy to have its own user-name and password for
the emergency service. A user or a proxy needs to sign the permanent
parts of the message header, including a certificate that proves their
geographic location.

Can SIP fully support this? From what I've read so far, the inclusion
of an SMIME encoded copy of the header could be added by a proxy or a
user agent or both so as to verify the identity of the user as well as
geographic location.

Can anyone comment on the practicalities of this? In particular are
there any difficulties with both the user agent and a proxy putting in
separate authentication with separate certificates?

Another reason for being interested in this type of authentication is
that for the purposes of billing for trans-coding, PSTN breakout and
other services, a user must authenticate themselves. Again users (or
rather user agents) should not be required to hold separate user-names
and passwords for each service, they need one standard way to
authenticate themselves to anyone they call so that each service can
charge their account seamlessly.

James Hamlin
RNID
[email-masked]

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Michael Hammer <[email-masked]>
Date: Fri, 20 Dec 2002 14:48:37 -0500

James,

I suspect that each user would need to have an identity and certificate 
issued by their service provider, be that a public SP or an enterprise 
SP.  The government PSAP would likely be issued similar from the state in 
which they operate.

I am not sure about other countries, but the US Federal Government has a 
number of initiatives along these lines.

Mike