Subject: RE: [Speermint] Definition of "Peering"

From: "Stastny Richard" <[email-masked]>
Date: Fri, 31 Mar 2006 11:08:34 +0200

> The confusion is that from the operator's perspective, they should
> absolutely have the right to only allow specific users to join their
> collection of sip proxies/registrars/etc.  Just like a bank running a
web
> server has the right to only give their paying customers access to
their
> server.
> 
> The very concepts of SIP/HTTP challenge-response, or mutual-TLS, or
any > > such
> authentication mechanisms defined by IETF working groups tacitly
implies
> to
> me that the operator of the proxy/registrar has an IETF-sanctioned
right
> to
> reject unauthorized users from joining his collection of
> proxies/registrars.
> 
> Do we agree on that?

It is IMHO not so simple

Of course a proxy/registrar/provider may reject unauthorized users
i.e. non-subscribers from accessing his collection of proxies.

But we are talking in SPEERMINT about the right of rejecting
"unauthorized"
access BETWEEN providers.

There is an old problem of a difference between the Internet and
the PSTN lurking here in the background of the discussion: 
public and private.

On the PSTN, or better at the Telephony service as defined in ITU-T
E.105,
there is a clear distinction between public and private, which is
not existing on the Internet. On the PSTN there is the definition of
a User-Network-Interface (UNI) and an Network-Network-Interface (NNI).
On these interfaces even different protocols are used e.g. SS7/ISUP/R2
etc
and ISDN/D-Channel. The information transmitted differs, e.g. regarding 
Calling Line Identification.

The interface between the UA and the proxy may be mapped to a UNI, the
interface between providers may be mapped to a NNI. So spearmint
seems to deal with NNIs. This seems easy, but the is the problems of
enterprises. In the PSTN e.g. an enterprise PBX is ALWAYS connected via
an UNI and the appropriate protocol, on the Internet an enterprise may
also run a proxy and is within scope of spearmint. There is no
distinction
here.

There is an additional implication with public and private: if you
are providing a service for the public or not. And Telephony is
a very special public service. In all European Telecommunication
Laws there is the definition of a Public Available Telecommunicatios
Services (the infamous PATS), which implies some rights and obligations.
One of it is the obligation to interconnect (an other obligation is the 
Provision of emergency services, in some countries with PATS comes the
"right" to participate in NP).

And here we are with E.164 numbers: the obligation for interconnection
is for historical reasons only related to E.164 numbers, not for SIP
URIs. Of course private networks on the PSTN are not required to 
interconnect.

This implies that the status quo with all VoIP Providers is the
following, even if they provide PATS services:
they run their service related to SIP URIs like private networks,
because the PATS obligations relate only to E.164 numbers.

The obligation to interconnect with E.164 can easily be fulfilled
via taking the PSTN as default. If they are clever, they join a
private ENUM federation to add in ADDITION a peering with selected
partners, but the PSTN is always there as default for all other
numbers. This works, but only for E.164 numbers and PSTN-related
services (e.g. voice).

This causes some problems with spearmint:

1. E.164 numbers are out of scope in spearmint, so is the PSTN
2. Peering/interconnection is done only with SIP URIs (even
if these are derived via ENUM from E.164 numbers).
3. All potential SIP services apply, so again the PSTN is no
default option.

But: there is of course no equivalent to a PATS SIP service,
also no distinction between public and private,
and also no obligation to interconnect.

We should be a bit careful here:

Of course we could take it easy and say: who cares about PATS,
E.164 numbers and related obligations.

On the other hand, the (public) Internet is also, as the name
implies, a service for the public. If we ignore these issues,
we should consider the implications and eventual outcome:

1. All communications will sooner or later be based on IP technology
2. Laws and their obligations will also be around for some time
so if existing PSTN networks migrate to NGN (=IP based technology),
they will also have to take over some of these obligations.

One of these will be the obligation to interconnect via E.164 numbers.

Either we deal with these issues also on the public Internet
and with our native naming and addressing schemes (SIP URIs)
or we force the NGNs even more (they are bound to do this anyway)
to build their own "Internet" (e.g. the GSMA IPX) and also to use
E.164 numbers forever.

This is one reason why I would like to see a default peering
in spearmint for SIP URIs

The second reason is that we should also consider the customer
(end-user) expectations - and this is global reachability
with SIP URIs

Regards

Richard

> -----Original Message-----
> From: Hadriel Kaplan [mailto:[email-masked]]
> Sent: Friday, March 31, 2006 6:11 AM
> To: [email-masked]; 'Patrick Melampy'; 'Otmar Lendl'; 'Michael
Hammer
> (mhammer)'
> Cc: [email-masked]
> Subject: RE: [Speermint] Definition of "Peering"
> 
> Hi Henry,
> Comments inline...
> 
> > -----Original Message-----
> > From: Henry Sinnreich [mailto:[email-masked]]
> > Sent: Thursday, March 30, 2006 4:23 PM
> >
> > Users pay for Internet access service, which seems to be a booming
> > business.
> 
> Well I can't speak for it being a booming business or not, but I think
> what
> you said is exactly right about Internet access - and shows the
confusion
> caused by us using the same words but possibly meaning different
things.
> 
> It is absolutely true that people pay for "Internet Access", and
Internet
> access is what they should get for that payment.  If you want to
install a
> sip phone on your PC and make a point-to-point sip call to your friend
-
> that should be possible.  If you want to point your sip phone to the
proxy
> or registrar of your choosing, so long as the owner of the
registrar/proxy
> you choose agrees - then that should be possible.  As should
best-effort
> forwarding of any IP packets of any port numbers using any transport
layer
> of your choosing to anywhere routable/reachable in the Internet, so
long
> as
> the far-end IP-Address destination allows it... you get the idea.
> 
> The IETF is a completely inappropriate place to discuss NOT allowing
that.
> In my opinion, it MUST be the case that NO output of this WG describes
> blocking such best-effort "Internet Access" traffic, or blocking the
> ability
> to do that with your SIP UA.
> 
> So when you say "end-to-end" or "e2e" - is that what you mean?  Being
able
> to create sip sessions either directly from your PC to your friend's
PC?
> As
> well as through proxies of your choosing, so long as the proxies you
chose
> allow you to?  If so, I think we agree.
> 
> To some of us, the confusion comes about because the word "access" has
a
> special connotation for voip providers about customers joining and
> creating
> sip sessions through a specific collection of sip proxies/registrars.
The
> joining can be explicit through challenged registration means, or
implicit
> through static configuration, or whatever.
> 
> The confusion is that from the operator's perspective, they should
> absolutely have the right to only allow specific users to join their
> collection of sip proxies/registrars/etc.  Just like a bank running a
web
> server has the right to only give their paying customers access to
their
> server.
> 
> The very concepts of SIP/HTTP challenge-response, or mutual-TLS, or
any
> such
> authentication mechanisms defined by IETF working groups tacitly
implies
> to
> me that the operator of the proxy/registrar has an IETF-sanctioned
right
> to
> reject unauthorized users from joining his collection of
> proxies/registrars.
> 
> Do we agree on that?
> 
> -hadriel
> 
> 
> 
> _______________________________________________
> Speermint mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Hadriel Kaplan" <[email-masked]>
Date: Fri, 31 Mar 2006 09:35:55 -0500

Hi Richard,
Of course it isn't so simple, but I'm trying to walk there instead of
skipping straight to the meat - because I'm not sure we have a common ground
of understanding.  

I know SPEARMINT is for peering - but without defining peering of what and
whom and (most importantly) why, in a way that is acceptable to the IETF,
we'll never get anywhere, IMHO.

For example, one of the arguments I heard people raised at IETF 65 was "what
about this is the Internet?  The I in IETF is for Internet, so this group is
out of scope."  First, it is obviously untrue that the IETF only concerns
itself with the ip network transport layer, nor of routing protocols to
create an Internet.  One need only look at the areas and working groups to
see that.  It's not only layer 3 protocols being defined.  Second, there is
one area actually titled "Internet Area", yet even within that area are
groups who's entire existence in life is to define VPNs, at layers 2 and 3.

How are VPNs the Internet?  Extending that idea, there are IETF groups who
are (or were last time I was at the IETF) working to define how such VPNs
can work between providers, and bridge the VPNs together.  For me, if that
is acceptable work for the IETF, then there should also be a case for
allowing layer-5 VPNs to be bridged together.  And that's only if you look
at it one way (as L5 VPNs).  There are other ways to look at it that I think
make it acceptable as well.

-hadriel
p.s. note these are my views, and may not represent those of my employer
whatsoever.

> From: Stastny Richard [mailto:[email-masked]]
> Sent: Friday, March 31, 2006 4:09 AM
> To: Hadriel Kaplan; [email-masked]
> Cc: [email-masked]