Subject: RE: third alternative (was RE: [Sip] RE: Identity after reinvite)

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 22 Nov 2004 20:29:53 -0500

A few notes on the "Monica property": as RFC3323 suggests, I think that some
sort of anonymization service, which could be instantiated by a B2BUA, is an
appropriate way to conceal the identity of a called or calling party. What
scares me a little is the way people suggest that retargeting, as opposed to
redirection, can inherently be expected to provide privacy. When I register
a contact, I can't always guarantee that the location service in question
will be used exclusively for retargeting rather than redirection; moreover,
the revelation of the target Request-URI to the caller is not the only way
that the caller can learn who the connected-party is: contact headers of new
requests in the backwards direction of the dialog, SDP in a 200 OK, and so
on, are information leaks that are not addressed at all by retargeting, but
would be addressed by an anonymization service.

RFC3323 is about due for an update, I think, because the major functions
that it provides can be performed without a B2BUA, thanks to new SIP
mechanisms like GRUUs and session-policy. So while I agree that an
anonymization service is the right approach to this problem, these days I
think you can probably build an anonymization service without building a
B2BUA.

Finally, I think RFC3323 plays well with redirection. In fact, one can
redirect to a URI like "sip:[email-masked]", and the caller
can be satisfied, when they see new requests in the backwards direction,
that they are talking to the entity that the original target domain wanted
them to talk to. On the other hand, if my request is just retargeted to that
anonymous URI without my knowledge, I'll always be left to wonder, when I
see new requests in the backwards direction, if this is the person I'm
supposed to be talking to...

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: David R Oran [mailto:[email-masked]]
> Sent: Friday, November 19, 2004 6:30 AM
> To: Peterson, Jon
> Cc: 'Cullen Jennings'; 'Paul Kyzivat'; [email-masked]'
> Subject: Re: third alternative (was RE: [Sip] RE: Identity after
> reinvite)
> 
> 
[snip]
>
> Redirection is generally cleaner than retargeting, but does not satisfy 
> the "Monica property". It may be that a B2BUA is inescapable in those 
> cases anyway.
> 
> > I really think that the problem of mid-call changes in 
> connected-party 
> > is a
> > very different case, and much more specialized than what we're 
> > concerned
> > with here. We're talking here about assuring the identity 
> of the first 
> > and
> > second parties to a dialog at the time of dialog establishment. I'd 
> > like to
> > think that the ultimate solutions to the mid-call 'identity update' 
> > sort of
> > problems are more along the transfer/replaces line of thinking.
> >
> I tend to agree. It would be much cleaner if all 
> identity/connected-party changes devolved to a flavor of transfer 
> (except the Monica cases I mention above).
> 
> Dave.
> > Jon Peterson
> > NeuStar, Inc.
> >
> >> 	Paul
> >>
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 24 Nov 2004 03:24:06 -0500

> think you can probably build an anonymization service without building a

I believe this is probably true. Here's how I think it'd work:

A client that wants to make an anonymous call contacts a TURN server 
providing anonymization services. That server provides the client with 
IP addresses and ports that it can use in its Via, contact, and SDP. The 
 From field is anonymized. A privacy header is inserted. The request is 
sent via the TURN server to the user's outbound proxy. That proxy can 
still authenticate the client, and even insert an identity header that 
at least vouches that the client is a legit client that is just anonymous.

The provider of the anonymization server (turn in this case) can be 
completely decoupled from the sip provider. That provides an excellent 
level of anonymity compared to even a b2bua. The b2bua approach would 
still allow the recipient to trace the IP address in the SDP and Contact 
to the particular provider; this might not be sufficient (I don't recall 
off hand if rfc3323 discusses this problme).

It also means that there is no need to signal things like header or 
media level privacy. The client simply chooses to obfuscate (using the 
learned turn addresses) whatever fields it wishes to anonymize. This has 
the impact of simplifying the privacy spec significantly. Indeed, it 
would seem that it is hardly needed at all...

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Director, Service Provider VoIP Architecture   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 24 Nov 2004 09:33:38 -0500

Jonathan - inline.

	Paul

> at least vouches that the client is a legit client that is just anonymous.

While I buy the approach, I don't think what you are describing is a 
TURN server. It is a combination of a TURN server and a SIP 
anonymization server. And I don't even see how this can be viewed as one 
thing. The client has to contact a TURN server from the address/port it 
intends to use for media. For multiple media streams it needs to do this 
multiple times from different source ports. It also has to contact the 
sip anonymization server to set up the sip anonymization. Then it can 
proceed as you describe.

Still seems like a good approach - but it requires additional servers / 
protocols, and extra work on the part of the client. I can see how some 
might find it easier to just send a sip request to a server that does 
all the work by magic.

	Paul