Subject: Re: [Ecrit] security threats and requirements

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 09 May 2005 22:10:53 -0400

While there are probably definitions that we can come up with that 
cleanly differentiate AIP and ISP, I'm a bit worried that this strays a 
bit too far into policy and business land for a standard. What does it 
mean to "own" infrastructure? Does leasing count? Do I have to lease it 
for 10 years to count as owner?

I don't see a need to decide and get into business classification. In 
most practical cases, both ISP and AIP have a pretty reliable notion of 
where the customer gets service and can provide the customer with a 
certificate to that effect. The customer can choose which one(s) it uses 
and would presumably have some interest in clearing up any mistakes 
ahead of time. Ohio State University has staff to deal with this and 
Archie Bunker has a single provider and doesn't care about the 
difference between ISP and AIP.

Henning

Brian Rosen wrote:
> Henning
> 
> Your responses seem very reasonable.  I'm not sure if we need more than two
> levels of hierarchy, but I suppose we might as well make it general and
> allow for it.
> 
> One has to differentiate between an AIP and an ISP.  One entity can be both,
> of course.  The difference is that the AIP actually owns the infrastructure,
> and actually can determine where you are.  The issue is, the AIP may not
> have any relationship with, and cannot provide any path to the subscriber.
> The ISP can.
> 
> The question becomes, do you just pass through the location from the AIP to
> the ISP to the subscriber, or do you create a transitive trust relationship
> so that the AIP tells the ISP and the ISP tells the subscriber the location.
> It's a question of who signs the location the subscriber gets, the AIP or
> the ISP.
> 
> I like the former, because I really worry how we do the CA chain.  The
> latter is more attractive to the ISP of course.
> 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 10 May 2005 07:41:12 -0400

I agree we don't have to be very careful about differentiating.  The
essential difference really becomes who really does know where the wire
ends?  In most cases, this is obvious; it's the entity that terminates layer
2.

I think that in the end, the local emergency calling authorities will sign
the cert that the entity that really determines location uses to sign the
location object.  I think the text of the document need only state that the
entity providing location has to have the ability to effectively determine
the actual source of the packets by, for example, determining the wire pair
or circuit ID or cable modem, etc they came from. 

Brian

> -----Original Message-----
> From: Henning Schulzrinne [mailto:[email-masked]]
> Sent: Monday, May 09, 2005 10:11 PM
> To: Brian Rosen
> Cc: 'Tschofenig Hannes'; [email-masked]
> Subject: Re: [Ecrit] security threats and requirements
>