Subject: RE: [P2PSIP] IETF solution for pairing cellular hosts

From: <[email-masked]>
Date: Thu, 27 Sep 2007 17:27:41 +0300

Hi Pars,
 
I was working on solutions for this problem. One solution is presented
in the following paper: "Contacter: an enhanced contact application for
easy update and recovery of contacts using the Session Initiation
Protocol (SIP)"
http://ieeexplore.ieee.org/iel5/4216894/4216895/04216904.pdf
 
Best regards,
Marcin Matuszewski

________________________________

	From: ext Pars Mutaf [mailto:[email-masked]] 
	Sent: 27 September, 2007 16:49
	To: [email-masked]; [email-masked]
	Subject: [P2PSIP] IETF solution for pairing cellular hosts

	[sorry for cross posting. this is an invitation]

	Pairing Cellular Hosts
	
	https://www1.ietf.org/mailman/listinfo/humanresolvers 
	
	Currently there are two approaches for obtaining contact
information for a 
	target cell phone: (i) consulting a phonebook, (ii) manually
exchanging 
	phone numbers upon face-to-face user contact. Both approaches
have 
	their own limitations. 
	
	The following is a new abstract solution, a third alternative, a
protocol
	for "pairing" two cellular hosts:
	
	Model of operation
	
	1. The querier user types the target user's "human name" (as if
he were 
	   consulting a phonebook), or a pseudoynm.
	2. The pairing request is forwarded to the target phone.
	3. The query, along with the querier user's name, are displayed
on the 
	   target phone's screen.
	4. The target user approves the request in real-time by pushing
on the YES
	   button of the phone.
	5. The two phones exchange their Mobile IPv6 home addresses, SIP
URIs, and
	   establish an IPsec security association (using IKEv2). 
	
	The target user does not need to publish his/her private SIP URI
and home 
	address (as recommended in [1] in SIP context). Cell phone users
do not
	publish their phone numbers today.
	
	The users do not need to manually exchange their SIP URIs and
home 
	addresses which are too long (an IPv6 address is 16 bytes long
and random 
	looking, a SIP URI can be very long e.g. up to 30 characters and
even more 
	with a random part for privacy). 
	
	The protocol also works in the absence of user contact, for
example when 
	the target user's SIP URI is lost (loss of state, new phone), or
this is 
	the user's first phone, and hence his/her contact list is
initially empty.
	Thousands of cell phones are sold everyday..
	
	[1] Peterson, J., "A Privacy Mechanism for the Session
Initiation Protocol", 
	    RFC3323, November 2002.

	=======================
	
	Interested folks could you please subscribe to the mailing list
created
	for this discussion:
	
	https://www1.ietf.org/mailman/listinfo/humanresolvers 

	We already had some discussions on the IETF list recently. 
	You may want to take a look at the archives for an introduction:
	
	http://www1.ietf.org/mail-archive/web/ietf/current/msg48129.html

	There is also a side discussion on CAPTCHAs:
	
	http://www1.ietf.org/mail-archive/web/ietf/current/msg48172.html

	Regards, 
	pars mutaf

_______________________________________________
humanresolvers mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/humanresolvers

---

From: "Pars Mutaf" <[email-masked]>
Date: Fri, 28 Sep 2007 13:17:56 +0200

Hello,

Thanx for the message, I hope you and (other SIP experts)
subscribe to the ML:

Personally, I'm not sure if we need a store/forward
solution. We probably don't want to store a pairing
request message while the user is off-line. Because
the request message itself can be used for SPAM.

Maybe a real-time solution is preferable. I.e., if
the target user is off-line we don't care. The querier
needs to try later to get the user's consent.

Personally, I'm also against a SIP-based solution.
This is my personal opinion and of course open to
discussion.

I really hope we can talk about these issues.

Thanks,
pars

On 9/28/07, Dean Willis <[email-masked]> wrote:
>
>
> On Sep 27, 2007, at 4:38 PM, [email-masked] wrote:
>
> >    From: "Pars Mutaf" <[email-masked]>
> >
> > How do you make this work?  Step 2 seems to require that you have
> > already located the target phone, whereas the protocol's *purpose* is
> > to locate the target phone.
> >
>
>
> One possibility is that the directory service is operating on behalf
> of the target, not the searcher. As such, the directory service is
> trusted to know the display name to userID binding. When it receives
> a query, the directory service uses the target's SIP contact
> registration to send a consent request to the target user. If the
> target user response positively, then the directory service returns
> the directory's query result to the searcher.
>
> Basically, another layer of indirection (directory) in front of a
> watcher pattern.
>
> There are probably other embodiments, but that's the obvious one.
>
> --
> Dean
>
>
>
>
>
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
>