Subject: RE: Private Info in To/From (was RE: FW: [Sip] Comment, SIP Priva cy draft)

From: "Mark Watson"<[email-masked]>
Date: Thu, 11 Apr 2002 13:29:01 +0100

> > : (1) The user inserts their identity, but the subscriber of the
> > outgoing service being used requires outgoing sessions to 
> be anonymous.
> > Only the outgoing proxy knows this - well, it's a B2BUA now.
> > [Peterson, Jon] One could just as easily argue that this is a
> > requirement not to force such services into the local 
> outbound proxy.
> > The UA could always dynamically learn about privacy 
> preferences from the
> > service provider in some fashion, and the service provider 
> could reject
> > requests (at the local outbound) that don't conform to the privacy
> > rules. And we should when possible push SIP features to the 
> endpoints
> > anyway.
> > 
> > MW> I'm happy with any solution which works & the above sounds
> > promising. How would we get the privacy preferences to the 
> UAC & is it
> > backwards compatible ?
> 
> I agree with Jon that this is a reasonable approach. I had 
> suggested the
> same to some 3g folks in the past, to deal with the more generic
> problem, which was that the user signed up for privacy services, but
> "forgets" to put anonymous in the from field. 
>

In principle this would work for 3GPP, if the 'xxx Privacy Required'
response were defined, because 3GPP can place new requirements on the SIP
clients in 3GPP networks. But it's no good for people wanting to use RFC2543
clients & in practice probably too late for 3GPP.

Also, the requirement for subscriber privacy could be based on some complex
algorithm in the outgoing proxy (e.g. based on call destination), so the UA
cannot expect to 'learn' when it should include its identity and when not.
This could lead to a large percentage of calls having try without privacy
and then try again. This would not be acceptable over a wireless link.

> > 
> > (2) A calls B, who forwards to C. B requires privacy, but 
> unfortunately
> > A has inserted B's identity in the To field. So the proxy performing
> > forwarding for B must modify the To field - OK, so it's a B2BUA too.
> 
> IMHO, the notion of a network provided anonymous forwarding service is
> primarily an artifact of the PSTN, where the locations of identity
> information were easy to spot and remove. In an IP network, with a
> protocol like SIP, you are kidding yourself if you think To/From is
> sufficient to "cleanse". Identity information could be lurking in
> headers both known and unknown. Some examples:
> 

I'm not arguing that To/From are the only things you would need to modify -
it's just that To/From are the problematic ones because of the link to
dialog matching in RFC2543 clients. Other things are easy (well, easier) to
modify.

> Subject: Hey, Bob, lets go for lunch
> NewHeader: Bob once again
> Call-Info: http://foo.com/picture-of-bob-and-me.jpg
> 
> and let us not forget the SDP too...
> 
> The only way in SIP to offer a useful (meaning, would actually work
> reliably from the subscribers perspective) anonymous 
> forwarding service
> is to use a B2BUA "with a vengeance". This B2BUA would not 
> propagate ANY
> information from the original request, stripping everything, and
> reformulating the mandatory headers on its own. It would probably need
> to act as a media intermediary too. I would argue that, if you want an
> anonymous forwarding service to be network provided, you really DONT
> want a proxy in any sense of the word. THis would destroy services, of
> course, but thats the penalty for this feature.
>

You can imagine a whole continuum of 'anonymity' services providing various
levels of anonymity traded off against service transparency. For example, IP
address privacy may not be required in all cases, especially with IPv6
privacy addresses.

I don't know where on this continuum you would have to be to meet the
obligation to provide an anonymous forwarding service, but I'm arguing that
even the simplest such service cannot be provided by a straightforward SIP
proxy.

Any such service would *at least* have to modify From/To. Others seemed to
be saying that since these fields were entirely a matter for the UA, then
the network has no responsibility for their contents and would never need to
modify them.

As to whether 'anonymous forwarding' would be required to be provided by
Public Service Providers or not, it's a matter of legal interpretation of
the Data Protection legislation. We can't say whether it is, or whether it
is not, although we each may have opinions.

For my part, I can't see why this requirement would not apply to Public
Telcomminications Service Providers independent of the technology they use
to offer service. Therefore I think there is *at least* a significant
*chance* that SPs will have to provide such services, and so it's important
that we understand how they might do that.

> Arguing that only the To field needs to be stripped, because 
> that is the
> only thing the sip spec defines as identity, will hardly be comforting
> to a user that depends on the proper functioning of this service.
> 

See above.

...Mark

---

From: Chris Martin <[email-masked]>
Date: Thu, 11 Apr 2002 10:14:25 -0500

> obligation to provide an anonymous forwarding service, but I'm arguing
> that even the simplest such service cannot be provided by a
> straightforward SIP proxy.

For the privacy aspect I believe that it can be provided at least for
anonymity in the To or From, by a standard proxy, but as Johnathan
stated a B2BUA would be required to provide the topology (IP address)
hiding at all other levels, and then it would also be required to
provide the same actions for media. As for the example of content, 

> > Call-Info: http://foo.com/picture-of-bob-and-me.jpg

I dont think that these fall under the same category as far as identity
is concerned, since they are not headers asserting identity, merely
topics or objects within a conversation. To me identity would be
something more tangible than that, such as the content of a From, Via,
Route, etc., or even IP addressing...but then again if UA's are behind a
B2BUA even IP addressing is less of an identifier of the originator. 

Does this seem like a correct assumption?

> 
> Any such service would *at least* have to modify From/To. Others
> seemed to be saying that since these fields were entirely a matter for
> the UA, then the network has no responsibility for their contents and
> would never need to modify them.
>

I believe that, since we have been discussing this in terms of privacy
as it relates to an SP environment, the responsibility lies with the SP.
A UA not within an SP realm can assert that they are anyone they want to
be including anonymous, right? In an authenticated SP environment the
option for a UA to muck with identity would not be permitted becuase it
wouldnt authenticate correctly/at all, would it?

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip