Subject: [Geopriv] VPNs and other exception conditions

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 16 May 2005 22:51:55 -0400

Brian had noted that the number of access networks within the service 
area for a location-based service (PSAP, Domino's, AAA) is likely to be 
small and probably smaller than the number of voice service providers.

However, it may not be possible to make definitive use of that fact if 
we allow calls from VPNs. A call placed from the GEOPRIV interim meeting 
taking place at Columbia via a VPN connection to Siemens would appear to 
come from an 'access provider' in Germany.

In general, in the case of overload, there are probably only two approaches:

- The "search grandma" approach to airline security: pick calls 
randomly, with the high likelihood that one only answers bogus calls and 
people die;

- The "try estimating likelihood of bogosity" approach, where one 
guesses at calls likely to be legitimate, but at the distinct risk of 
discriminating against certain types of legitimate callers, such as 
those calling from VPNs, that are harder to distinguish from bogus 
calls, thus inviting the law suits Ted threatened.

Henning

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: John Morris <[email-masked]>
Date: Tue, 17 May 2005 06:39:21 -0400

At 10:51 PM -0400 5/16/05, Henning Schulzrinne wrote:
>Brian had noted that the number of access networks within the 
>service area for a location-based service (PSAP, Domino's, AAA) is 
>likely to be small and probably smaller than the number of voice 
>service providers.

Hmm...  The count of access networks presumably would include some 
colleges & universities in the area, as well as state or regional 
networks of libraries.  The FBI is taking the position that each of 
those networks have separate CALEA (wiretapping) obligations -- many 
of them peer to each other, and connect to the broader Internet 
through very large pipes to providers on the backbone.  Moreover, how 
do you count the networks of large interstate or international 
corporations?  I'm not sure what the "number of voice service 
providers" comes to but I not sure that access providers would be as 
low (although I agree that it would not be a huge, unmanagable 
number).

John

---

From: John Morris <[email-masked]>
Date: Tue, 17 May 2005 06:39:21 -0400

John

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 17 May 2005 07:33:14 -0400

VPNs don't cause problems.

The location you want is the location of the actual access network, not the
VPN.  The location provided by the Columbia University access network is the
one reported to the NYC PSAP.

This is what makes a signed location object work, but an interaction between
the access network and the voice service provider not work.

If Columbia supplied a signed location via DHCP to a laptop running a VPN
tunnel to a Siemens corporate IP-PBX, a 9-1-1 call from the meeting would be
directed to the NYC PSAP, which would have signed Columbia's cert, because
Columbia is local to NYC.

OTOH, it's hard for Siemens to talk to Columbia, especially through the
laptop; most VPN tunnel's, once established, will not permit traffic to go
to the "outer" network unless its tunnel traffic.  So it's hard for Siemens
to get Columbia to sign an object containing a Siemen's ID.  The laptop
cannot contact Columbia once it has its tunnel established, except through
the main Siemens Internet connection, using a tunnel assigned IP address.
Columbia's location signer would not see a Columbia IP address in the packet
headers; Siemens would have de-encapsulated the VPN before sending the
packet to Columbia.

Brian

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Henning Schulzrinne
> Sent: Monday, May 16, 2005 10:52 PM
> To: [email-masked]
> Subject: [Geopriv] VPNs and other exception conditions
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 17 May 2005 09:04:47 -0400

What matters is the number of unique network prefixes (very roughly,  
the number of AS).  That number is about
60,000 total. I'm guessing (wild guess, no more) that there are about  
30,000 in the US, so this translates, on average, to 5 per PSAP (US  
has 6000 PSAPs). Obviously, NYC will have more than North Dakota, but  
this should give a back-of-the-envelope estimate.

On May 17, 2005, at 6:39 AM, John Morris wrote:

> those networks have separate CALEA (wiretapping) obligations --  
> many of them peer to each other, and connect to the broader  
> Internet through very large pipes to providers on the backbone.   
> Moreover, how do you count the networks of large interstate or  
> international corporations?  I'm not sure what the "number of voice  
> service providers" comes to but I not sure that access providers  
> would be as low (although I agree that it would not be a huge,  
> unmanagable number).
>
> John
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 17 May 2005 21:26:05 -0400

Makes sense, but still fairly manageable. Tangentially, I wonder how 
well services like http://www.quova.com/ or 
http://www.geobytes.com/IpLocator.htm work in practice, as they seem to 
have mapped addresses to (city-level) locations.

Ted Hardie wrote:
> At 9:04 AM -0400 5/17/05, Henning Schulzrinne wrote:
> 
> The number of network prefixes would map directly to ASes only in the
> case of perfect aggregation, which is not where we are operationally.
> I suggest you take a quick look at the route views project for
> more data:  http://www.route-views.org/ .  A better number for
> routes in the table as seen in the default-free zone is 120k.
> It's not a perfect number, since the real question is always "what
> routes do you see" and never "how many routes are there total".
> Even the 120k number may high a piece of the pie, though, as there are
> access networks which are separate but have been aggregated to
> a single announcement in the default free zone.
>             regards,
>                 Ted Hardie

---

From: Ted Hardie <[email-masked]>
Date: Tue, 17 May 2005 18:12:40 -0700

At 9:04 AM -0400 5/17/05, Henning Schulzrinne wrote:
>60,000 total. I'm guessing (wild guess, no more) that there are 
>about 30,000 in the US, so this translates, on average, to 5 per 
>PSAP (US has 6000 PSAPs). Obviously, NYC will have more than North 
>Dakota, but this should give a back-of-the-envelope estimate.

---

From: Andrew Newton <[email-masked]>
Date: Tue, 17 May 2005 21:33:10 -0400

On May 17, 2005, at 7:33 AM, Brian Rosen wrote:
> to the "outer" network unless its tunnel traffic.

I've heard this said 2 or 3 times now, but every VPN I've had to deal 
with has had this draconian approach as an option if it did it at all.

You seem to be saying we need: IAP-ID, LCI, sig.  However, you've only 
demonstrated what the IAP-ID and LCI are being used for.  Why is the 
signature necessary?  What property of it are you using that you would 
not get just by simply using the IAP-ID?

-andy

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 17 May 2005 21:38:50 -0400

> with has had this draconian approach as an option if it did it at all.

I agree. The Cisco VPN client that Columbia distributes only routes 
Columbia-destined prefixes via the tunnel. The prefixes are 
user-configurable.

---

From: Andrew Newton <[email-masked]>
Date: Tue, 17 May 2005 22:01:53 -0400

On May 17, 2005, at 9:26 PM, Henning Schulzrinne wrote:

> http://www.geobytes.com/IpLocator.htm work in practice, as they seem 
> to have mapped addresses to (city-level) locations.

We've used services like these (though I can't say which ones) and the 
quality varies.  Some of the tricks they use to do this are parsing of 
reverse DNS PTR target names and whois lookups (which reflect where the 
company is headquartered, not where the IP is used).

-andy

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 17 May 2005 22:42:22 -0400

> with has had this draconian approach as an option if it did it at all.
I'm not an expert here.  I think what you are describing is called "split
tunnel".  Some clients have it, some don't.  Of the last couple of clients I
worked with one had split tunnel, the other two didn't (at least I didn't
know how to configure it).  The Microsoft L2TP client, for example, does not
have a split tunnel feature, and has no configuration for routes (it allows
static routes to be established I believe).  The one that I had which did
split tunnel had to be configured for prefixes NOT sent to the tunnel.  The
default was everything went to the tunnel.  Most of the time, that's what
you want.

> not get just by simply using the IAP-ID?
We want to protect against forging of a location.  We accept that it's hard
to avoid some kinds of replay attack.  The basic concept is to have the
access network provide the location signed, with a timestamp.  Of course,
you will know the identity of the signer.  With DHCP, you get a lease which
expires; you periodically renew your lease.  You would get a new
timestamp/signature when you renewed the lease.  We aren't going to assume
any specific lease time; it is what it is.

The access network is local to the service area of the PSAP.  The PSAP, or
some agency delegated by it, can reasonably sign the cert of the access
network.  As you said in a prior message, we COULD make this work with
shared secrets between the access network and the PSAP.  The level of
protection provided is not very high, so the requirements of the crypto are
not very high.  All the signature schemes I know of are public key based,
but it should be possible to make one based on shared secrets.

When the location arrives at the PSAP, the signature is checked.  If the
signature does not check, or the time is "unusual" (i.e. does not match the
historical data for that access provider) it will be denoted as "suspicious"
to the call taker.  While the PSAP may have internal routing decisions which
can be based on that suspicion, I really doubt anyone will use them except
if the PSAP comes under deliberate attack.  

Brian