Subject: RE: [Ecrit] security threats and requirements

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Tue, 10 May 2005 10:11:07 -0400

Henning,

While you don't want to standardize business relationships, you do need
to operate in business environments where there might be adversarial
relationships.  What if two companies want to provide telephony service,
a local ISP and a remote SP.  The customer may choose the remote SP and
IPSEC or TLS tunnel to it.  Does the local ISP charge an exorbitant fee
to make the location determination, whereas that charge would be lower
if the customer had chosen to use it for telephony service in addition
to Internet access?  Would it be sufficient for E911 folks, if the user
can just register his location with the remote SP?  Could the home
network provider (super-small ISP) sign the location himself as a
capability of his consumer box?

Mike

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Henning Schulzrinne
> Sent: Monday, May 09, 2005 10:11 PM
> To: Brian Rosen
> Cc: [email-masked]
> Subject: Re: [Ecrit] security threats and requirements
> 
> While there are probably definitions that we can come up with 
> that cleanly differentiate AIP and ISP, I'm a bit worried 
> that this strays a bit too far into policy and business land 
> for a standard. What does it mean to "own" infrastructure? 
> Does leasing count? Do I have to lease it for 10 years to 
> count as owner?
> 
> I don't see a need to decide and get into business 
> classification. In most practical cases, both ISP and AIP 
> have a pretty reliable notion of where the customer gets 
> service and can provide the customer with a certificate to 
> that effect. The customer can choose which one(s) it uses and 
> would presumably have some interest in clearing up any 
> mistakes ahead of time. Ohio State University has staff to 
> deal with this and Archie Bunker has a single provider and 
> doesn't care about the difference between ISP and AIP.
> 
> Henning
> 
> Brian Rosen wrote:
> > Henning
> > 
> > Your responses seem very reasonable.  I'm not sure if we need more 
> > than two levels of hierarchy, but I suppose we might as 
> well make it 
> > general and allow for it.
> > 
> > One has to differentiate between an AIP and an ISP.  One 
> entity can be 
> > both, of course.  The difference is that the AIP actually owns the 
> > infrastructure, and actually can determine where you are.  
> The issue 
> > is, the AIP may not have any relationship with, and cannot 
> provide any path to the subscriber.
> > The ISP can.
> > 
> > The question becomes, do you just pass through the location 
> from the 
> > AIP to the ISP to the subscriber, or do you create a 
> transitive trust 
> > relationship so that the AIP tells the ISP and the ISP 
> tells the subscriber the location.
> > It's a question of who signs the location the subscriber 
> gets, the AIP 
> > or the ISP.
> > 
> > I like the former, because I really worry how we do the CA 
> chain.  The 
> > latter is more attractive to the ISP of course.
> > 
> 
> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ecrit
> 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 10 May 2005 10:25:40 -0400

I do think there's a real possibility for creating, inadvertently, a 
mechanism for price-gouging and anti-competitive behavior if we restrict 
the ability of who can certify locations. For that reason, we need to 
allow a variety of entities to vouch for location, including 
non-carriers. Why shouldn't my local Chamber of Commerce certify the 
location of my small business if I can't get the local carrier to 
cooperate? The business is unlikely to move frequently, so creating an 
elaborate dynamic mechanism designed to deal with moves on ten-minute 
intervals is neither necessary nor expedient.