Subject: Re: [stir] Delegation (was: Encoding considerations)

From: Alex Bobotek <[email-masked]>
Date: Mon, 19 Oct 2015 10:47:12 -0700

Service provider signing at origination will, IMO, be the dominant model.  It's also the low hanging fruit for a number of reasons including the difficulties of large scale cert management which have been discussed.  It presents, IMO, the best hope for mitigating abuse while  sustaining the openness that is a treasure of our civilization.

Much of the "delegation" will happen at the subscriber level, either with services like GV, or call centers looking for lowest cost.  So carrier signing can and will happen without strong evidence of calling party identity authorization.

Fortunately, signing by the originating service provider can handle this reasonably well.  Trustworthy service providers will be trusted, and evidence of abuse can be easily directed to a strongly identified responsible service provider.  Stay clean and stay in business.  Customers want their calls and messages
completed and delivered.

Reputation, carrier signing and feedback loops are IMO the key elements.

Regards,

Alex
Sent via the Samsung Galaxy Note® 5, an AT&T 4G LTE smartphone
-------- Original message --------
From: Richard Shockey <[email-masked]>
Date: 10/19/2015 7:05 AM (GMT-08:00)
To: Henning Schulzrinne <[email-masked]>, Paul Kyzivat <[email-masked]>, [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

I’d certainly guess no more than 10 or so. The vast majority of US ETC are rural ILEC’s.  Of the CLEC’s in the wholesale market 5 of those generating 90% or more of the traffic on delegated NANP numbers.  Its certainly significant and a major competitive force in certain markets..  Certain L+B and don’t forget X and B here in NOVA maybe G as well.  A COMPTEL question. :-)

On 10/18/15, 11:18 PM, "Henning Schulzrinne" <[email-masked]> wrote:

>Tangential, but curious: Any guess how many of the 1,600 or so US carriers actually delegate numbers to non-direct-customers to any significant degree? My sense is that the number of entities that serve the various SIP trunking providers (to the extent that they are not carriers themselves) and VoIP API providers (like Twilio) is very small. One starts with an L, the other a B, I believe. If these entities essentially operate as CAs for the numbers they assign to their customers, this seems to allow a carrier-driven mutual-trust models, without any centralized infrastructure, beyond maybe OCN-level certificates.
>
>I'm just trying to explore various options along the complexity scale.
>
>Henning
>
>________________________________________
>From: stir <[email-masked]> on behalf of Richard Shockey <[email-masked]>
>Sent: Friday, October 16, 2015 8:26 PM
>To: Paul Kyzivat; [email-masked]
>Subject: Re: [stir] Encoding considerations
>
>What you are saying is do you trust the North American Number Plan delegation model.  Full disclosure I’m a NANC member.
>
>Second to you trust the authority by which the United States or Canada or Jamaica delegates numbers to Licensed Carriers.
>
>Frankly I don’t care one way or the other.  The first order trust model IMHO is do I trust ATT [my mobile provider] to give me accurate information on who THEY trust.  I pay ATT by the way, quite happily and Verizon for my trustworthy FIOS landline.

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 19 Oct 2015 14:01:31 -0400

On 10/19/15 1:47 PM, Alex Bobotek wrote:
> Service provider signing at origination will, IMO, be the dominant
> model.

How will this work with roaming. If I am roaming in Europe, will my call 
be signed by the European access provider, or by my home provider in the 
US?

	Thanks,
	Paul

> It's also the low hanging fruit for a number of reasons
> including the difficulties of large scale cert management which have
> been discussed.  It presents, IMO, the best hope for mitigating abuse
> while  sustaining the openness that is a treasure of our civilization.
>
> Much of the "delegation" will happen at the subscriber level, either
> with services like GV, or call centers looking for lowest cost.  So
> carrier signing can and will happen without strong evidence of calling
> party identity authorization.
>
> Fortunately, signing by the originating service provider can handle this
> reasonably well.  Trustworthy service providers will be trusted, and
> evidence of abuse can be easily directed to a strongly identified
> responsible service provider.  Stay clean and stay in business.
>   Customers want their calls and messages
> completed and delivered.
>
> I’d certainly guess no more than 10 or so. The vast majority of US ETC
> are rural ILEC’s.  Of the CLEC’s in the wholesale market 5 of those
> generating 90% or more of the traffic on delegated NANP numbers.  Its
> certainly significant and a major competitive force in certain
> markets..  Certain L+B and don’t forget X and B here in NOVA maybe G as
> well.  A COMPTEL question. :-)
>
>
>
>  >Tangential, but curious: Any guess how many of the 1,600 or so US
> carriers actually delegate numbers to non-direct-customers to any
> significant degree? My sense is that the number of entities that serve
> the various SIP trunking providers (to the extent that they are not
> carriers themselves) and VoIP API providers (like Twilio) is very small.
> One starts with an L, the other a B, I believe. If these entities
> essentially operate as CAs for the numbers they assign to their
> customers, this seems to allow a carrier-driven mutual-trust models,
> without any centralized infrastructure, beyond maybe OCN-level certificates.
>  >
>  >What you are saying is do you trust the North American Number Plan
> delegation model.  Full disclosure I’m a NANC member.
>  >
>  >Second to you trust the authority by which the United States or Canada
> or Jamaica delegates numbers to Licensed Carriers.
>  >
>  >Frankly I don’t care one way or the other.  The first order trust
> model IMHO is do I trust ATT [my mobile provider] to give me accurate
> information on who THEY trust.  I pay ATT by the way, quite happily and
> Verizon for my trustworthy FIOS landline.
>

---

From: "Gorman, Pierce A [CTO]" <[email-masked]>
Date: Mon, 19 Oct 2015 20:06:20 +0000

With LTE and IMS, my guess is roamers will most often have their calls signed by the home provider, at least in early deployments.  The alternative "Home Routed" is Local Break-Out (LBO) and just like many other examples, it isn't clear (yet) how trust would be delegated.

Pierce Gorman
Core Network Planning
[email-masked]

-----Original Message-----
From: Paul Kyzivat [mailto:[email-masked]]
Sent: October 19, 2015 1:02 PM
To: Alex Bobotek <[email-masked]>; Richard Shockey <[email-masked]>; Henning Schulzrinne <[email-masked]>; [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

> Service provider signing at origination will, IMO, be the dominant

How will this work with roaming. If I am roaming in Europe, will my call be signed by the European access provider, or by my home provider in the US?

Thanks,
Paul

> It's also the low hanging fruit for a number of reasons including the
> difficulties of large scale cert management which have been discussed.
> It presents, IMO, the best hope for mitigating abuse while  sustaining
> the openness that is a treasure of our civilization.
>
> Fortunately, signing by the originating service provider can handle
> this reasonably well.  Trustworthy service providers will be trusted,
> and evidence of abuse can be easily directed to a strongly identified
>   Customers want their calls and messages completed and delivered.
>
> markets..  Certain L+B and don’t forget X and B here in NOVA maybe G
> as well.  A COMPTEL question. :-)
>
>
>
>  >Subject: Re: [stir] Encoding considerations  >  >What you are saying
> is do you trust the North American Number Plan delegation model.  Full
> disclosure I’m a NANC member.
>  >
>  >Second to you trust the authority by which the United States or
> Canada or Jamaica delegates numbers to Licensed Carriers.
>  >
> information on who THEY trust.  I pay ATT by the way, quite happily
> and Verizon for my trustworthy FIOS landline.
>

________________________________

This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message.

---

From: "Dwight, Timothy M (Tim)" <[email-masked]>
Date: Mon, 19 Oct 2015 17:06:45 -0400

VoLTE uses home network control, i.e., the signaling from a roaming device always goes back to its home network.  The "break out" issue has to do with handling of the media... with Local Break Out (LBO) there are 2 options, one in which the media is routed by the visited network back to the home network (LBO with HPMN routing) and one in which the media is routed by the visited network directly to the terminating network (LBO with VPMN routing).  The last of these is similar to how 3G works.  Then there is "S8 Home Routing"... but anyway in all the VoLTE roaming architectures of which I'm aware, the answer to Paul's question would be as Pierce says... the roaming device's home network would do the signing.

tim

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Gorman, Pierce A [CTO]
Sent: Monday, October 19, 2015 3:06 PM
To: Paul Kyzivat; Alex Bobotek; Richard Shockey; Henning Schulzrinne; [email-masked]
Subject: [E] Re: [stir] Delegation (was: Encoding considerations)

Pierce Gorman
Core Network Planning
[email-masked]

-----Original Message-----
From: Paul Kyzivat [mailto:[email-masked]]
Sent: October 19, 2015 1:02 PM
To: Alex Bobotek <[email-masked]>; Richard Shockey <[email-masked]>; Henning Schulzrinne <[email-masked]>; [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

Thanks,
Paul

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 19 Oct 2015 17:51:14 -0400

On 10/19/15 4:06 PM, Gorman, Pierce A [CTO] wrote:
> With LTE and IMS, my guess is roamers will most often have their calls signed by the home provider, at least in early deployments.

In this case the home provider will need some other means of reliably 
establishing the appropriate trust in the UAC before signing. Right?

And the caller will need to trust that the elements between it and its 
home provider haven't altered the call in inappropriate ways.

> The alternative "Home Routed" is Local Break-Out (LBO) and just like many other examples, it isn't clear (yet) how trust would be delegated.

Right.

	Thanks,
	Paul

---

From: "Gorman, Pierce A [CTO]" <[email-masked]>
Date: Mon, 19 Oct 2015 22:18:22 +0000

"In this case the home provider will need some other means of reliably establishing the appropriate trust in the UAC before signing. Right?"

PG-> A carrier would want that, yes.

" And the caller will need to trust that the elements between it and its home provider haven't altered the call in inappropriate ways."

PG->  Your question is complicated.  My view is the main purpose of the STIR/VT exercise is for carriers to attach credentials in SIP authenticating the originating carrier and should include some level of authentication with respect to the calling number (which could include "unvalidated").  There are many other purposes which will likely be enabled by the work in the IETF, but that's my view of what is most wanted at this time.  What you've said is the caller needs to trust that the visited network did not interfere with the calling number information (at least).  I believe this is outside the scope of the task at hand, but just mention the trust could be enhanced by encrypting the signaling between the caller and the home network.

You do remind me manual roaming requirements present a special case where the roamer needs to be permitted to place a credit card or collect call on a visited network.  I assume STIR/VT credentials will someday make it to court and be attached to liability.    What credentials and attestation should be used?  (Similar question for emergency services on a visited network where there is no roaming agreement or billing relationship with the home network.)

Pierce Gorman
Core Network Planning
[email-masked]

-----Original Message-----
From: Paul Kyzivat [mailto:[email-masked]]
Sent: October 19, 2015 4:51 PM
To: Gorman, Pierce A [CTO] <[email-masked]>; Alex Bobotek <[email-masked]>; Richard Shockey <[email-masked]>; Henning Schulzrinne <[email-masked]>; [email-masked]
Subject: Re: [stir] Delegation

> With LTE and IMS, my guess is roamers will most often have their calls signed by the home provider, at least in early deployments.

In this case the home provider will need some other means of reliably establishing the appropriate trust in the UAC before signing. Right?

And the caller will need to trust that the elements between it and its home provider haven't altered the call in inappropriate ways.

Right.

Thanks,
Paul

> To: Alex Bobotek <[email-masked]>; Richard Shockey
> <[email-masked]>; Henning Schulzrinne
> <[email-masked]>; [email-masked]
>> It presents, IMO, the best hope for mitigating abuse while
>> sustaining the openness that is a treasure of our civilization.
>>
>> carrier signing can and will happen without strong evidence of
>> calling party identity authorization.
>>
>> I’d certainly guess no more than 10 or so. The vast majority of US
>> ETC are rural ILEC’s.  Of the CLEC’s in the wholesale market 5 of
>> those generating 90% or more of the traffic on delegated NANP
>> numbers.  Its certainly significant and a major competitive force in
>> certain markets..  Certain L+B and don’t forget X and B here in NOVA
>> maybe G as well.  A COMPTEL question. :-)
>>
>>
>>
>> significant degree? My sense is that the number of entities that
>> serve the various SIP trunking providers (to the extent that they are
>> not carriers themselves) and VoIP API providers (like Twilio) is very small.
>>   >Subject: Re: [stir] Encoding considerations  >  >What you are
>> saying is do you trust the North American Number Plan delegation
>> model.  Full disclosure I’m a NANC member.
>>   >

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 21 Oct 2015 12:36:14 +0000

Concur.

Given that all 3GPP IMS and CS calling users are meant to be authenticated by the home network in some manner, I am not sure why this part of the discussion has occurred. I thought the STIR problem was giving some form of assurance to the called user.

The only exception is where the regulatory authority allows unauthenticated emergency calls, but that is a use case STIR does no need to worry about. Where it is possible emergency calls are meant to be authenticated anyway.

Regards

Keith

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Dwight, Timothy M (Tim)
Sent: 19 October 2015 22:07
To: Gorman, Pierce A [CTO]; Paul Kyzivat; Alex Bobotek; Richard Shockey; Henning Schulzrinne; [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

tim

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Gorman, Pierce A [CTO]
Sent: Monday, October 19, 2015 3:06 PM
To: Paul Kyzivat; Alex Bobotek; Richard Shockey; Henning Schulzrinne; [email-masked]
Subject: [E] Re: [stir] Delegation (was: Encoding considerations)

Pierce Gorman
Core Network Planning
[email-masked]

-----Original Message-----
From: Paul Kyzivat [mailto:[email-masked]]
Sent: October 19, 2015 1:02 PM
To: Alex Bobotek <[email-masked]>; Richard Shockey <[email-masked]>; Henning Schulzrinne <[email-masked]>; [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

Thanks,
Paul

---

From: Richard Shockey <[email-masked]>
Date: Wed, 21 Oct 2015 10:00:21 -0400

Keith … right now the current STIR solution set is closer to giving some assurances to the called user’s network and not the user itself.  That BTW is my issue.  If the home network can/cannot validate the origin of the inbound INVITE then how is that data delivered to the called user.  Where does the server stick the data that the UA can display. 

If you have any ideas .. I’d be delighted to listen.

---

From: "Gorman, Pierce A [CTO]" <[email-masked]>
Date: Wed, 21 Oct 2015 15:18:28 +0000

We've talked about the originating carrier AND the calling number as being signed and attested to by the originating carrier.  I think it really implies a 3-tuple is being authenticated:

     1) originating carrier identity
     2) calling number
     3) calling_number_validated_by_originating_carrier

The example where a user has credentials and an identity has been authenticated to the network is going to be the majority.  There are numerous examples where it is difficult or impossible for the originating carrier to know with certainty if the originating number is "valid".

There are legitimate uses cases for spoofing, but probably the most common example where identity validation will be difficult or impossible will be enterprises with blocks of numbers.  A carrier won't know if the source number was an invalid unassigned number.  Anywhere number block delegation is in place will be a challenge.   Having authenticated #s 1 and 2 will have value regardless.  It does raise the question of whether #3 should be required, and how to document the caveats.

Best regards,

Pierce Gorman
Core Network Planning

-----Original Message-----
From: Richard Shockey [mailto:[email-masked]]
Sent: October 21, 2015 9:00 AM
To: DRAGE, Keith (Keith) <[email-masked]>; Dwight, Timothy M (Tim) <[email-masked]>; Gorman, Pierce A [CTO] <[email-masked]>; Paul Kyzivat <[email-masked]>; Alex Bobotek <[email-masked]>; Henning Schulzrinne <[email-masked]>; [email-masked]
Subject: Re: [stir] Delegation (was: Encoding considerations)

On 10/21/15, 8:36 AM, "stir on behalf of DRAGE, Keith (Keith)" <[email-masked] on behalf of [email-masked]> wrote:

>To: Gorman, Pierce A [CTO]; Paul Kyzivat; Alex Bobotek; Richard
>Shockey; Henning Schulzrinne; [email-masked]

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 21 Oct 2015 11:38:26 -0400

There are two distinct issues here:

1) How does a recipient of a signature cert decide if the is validly 
bound to the number being signed.

2) How can a server operating on behalf of the callee communication 
*decisions* about the validity of the calling id to the calling UA?

Note that if the UAC does (1) for itself then (2) may not be needed. But 
I think in many cases the UAC will want to delegate (1) and depend upon 
(2) for its own purposes.

These are two distinct mechanisms. They can be worked on independently, 
in parallel.

For (2), I propose using Alert-Info, with URNs per rfc7462. This is 
exactly the sort of thing it was designed for. We could identify some 
well defined validity cases, and specific URNs to signal them.

	Thanks,
	Paul

---

From: Chris Wendt <[email-masked]>
Date: Wed, 21 Oct 2015 13:17:12 -0500

Hi Pierce, 

One suggestion i would have to maybe modify your premise a bit.  

The certificate association with a carrier is clear, a certificate association to a telephone number is clear also.

How you have a certificate represent calling number validated by originating caller, i’m not exactly sure.

To me, there is various use cases where some calls can be validated by carrier in a straight forward way particularly where the caller-id is associated with that originating carrier.  Other scenarios where telephone number signature, along with a service provider signature provides proof of validity.

I think all the use cases need to be taken one by one to fully account for what a signature implies for that scenario, but one thing i think is important to reconcile is that the routing of a call and the valid use of a caller-id aren’t always orthogonal.  Particularly when an originating carrier is originating an legitimately spoofed call with a caller-id they don’t own.

The originating service provider can validate that they believe the call is legitimate, and indeed they did originate the call, but may not have the ability to sign for the telephone number directly.

-Chris

> On Oct 21, 2015, at 10:18 AM, Gorman, Pierce A [CTO] <[email-masked]> wrote:
> 
> From: Richard Shockey [mailto:[email-masked] <mailto:[email-masked]>]
> To: DRAGE, Keith (Keith) <[email-masked] <mailto:[email-masked]>>; Dwight, Timothy M (Tim) <[email-masked] <mailto:[email-masked]>>; Gorman, Pierce A [CTO] <[email-masked] <mailto:[email-masked]>>; Paul Kyzivat <[email-masked] <mailto:[email-masked]>>; Alex Bobotek <[email-masked] <mailto:[email-masked]>>; Henning Schulzrinne <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/stir <https://www.ietf.org/mailman/listinfo/stir>

---

From: Richard Shockey <[email-masked]>
Date: Wed, 21 Oct 2015 17:47:48 -0500

Why URN’s … can’t we just insert text UTF 8?

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 23 Oct 2015 14:21:02 -0400

> Why URN’s … can’t we just insert text UTF 8?

Insert UTF8 into *what*?

Have you *read* rfc7462? The point is that it conveys some *semantics* 
that the recipient might want to take into account when alerting. It 
leaves it to the recipient to decide *how* it wants to do the alerting.

	Thanks,
	Paul