Re: [Alldispatch] New Version Notification for draft-jesske-dispatch-sip-product-identifier-00.txt

[[e-mail]]

Hi Ted,
thank you for your comment. I did get not the time to get the time to update this properly. So I will collect all comments including yours and update the draft with a solid text describing the security impacts and the other addressed comments when upload is possible again.

Thank you and Best Regards

Roland

Von: Ted Hardie <[e-mail]>
Gesendet: Donnerstag, 22. Februar 2024 11:39
An: Schott, Roland <[e-mail]>
Cc: [e-mail]; Dreyer, Bastian <[e-mail]>; Kreipl, Michael <[e-mail]>; [e-mail]; [e-mail]; [e-mail]; [e-mail]; Jesske, Roland <[e-mail]>
Betreff: Re: [Alldispatch] New Version Notification for draft-jesske-dispatch-sip-product-identifier-00.txt

Einige Personen, die diese Nachricht erhalten haben, erhalten nicht oft eine E-Mail von [e-mail]<mailto:[e-mail]>. Erfahren Sie, warum dies wichtig ist<https://aka.ms/LearnAboutSenderIdentification>
Dear authors,

I believe it would be useful to indicate what privacy considerations apply here, as the use of an identifier of this type runs the risk of being a cross-identity cookie.  If the product identifier is complex enough to be a fingerprint for a specific installation, it allows anyone in the network to know that two identities have the same source (e.g. that sip:[e-mail]<mailto:[e-mail]> shares a mobile phone with sip:[e-mail] and is thus likely to be the same person)
.
The security considerations within the draft also appears to be somewhat garbled:


   An uA may setup an product identifier that is not allowed for the

   current usage ie customer connected.  ZThua the network have to take

   care on such requests with wrong identifiers, to save the network and

   customer when provding wron services or seervices which does not

   apply for that profile.


regards,

Ted Hardie

On Thu, Feb 22, 2024 at 9:59 AM <[e-mail]<mailto:[e-mail]>> wrote:
Hi,

regarding the request for considering individual drafts in alldispatch wg, we would be happy if this draft will be considered in the alldispatch meeting in Brisbane.
On behalf of the author team, I would like to request a timeslot for presenting this work.
The draft is related to sip but could be applicable also for other or similar protocols.
What should we do, to get a timeslot for presenting it in alldispatch?


Best Regards

Roland Jesske, Michael Kreipl, Bastian Dreyer and Roland Schott


----

A new version of Internet-Draft
draft-jesske-dispatch-sip-product-identifier-00.txt has been successfully submitted by Roland Jesske and posted to the IETF repository.

Name:     draft-jesske-dispatch-sip-product-identifier
Revision: 00
Title:    SIP Product Identifier
Date:     2024-02-14
Group:    Individual Submission
Pages:    6
URL:      https://www.ietf.org/archive/id/draft-jesske-dispatch-sip-product-identifier-00.txt
Status:   https://datatracker.ietf.org/doc/draft-jesske-dispatch-sip-product-identifier/
HTMLized: https://datatracker.ietf.org/doc/html/draft-jesske-dispatch-sip-product-identifier


Abstract:

   Complex telephony networks using SIP as signalling like the IP
   Multimedia Subsystem (IMS) of the Third Generation Partnership (3GPP)
   serving different groups of customers like business and retail
   customers with different products like mobile, fixed and PBX services
   have the problem of different handling of the services.  This may end
   up in a complex analysis of the signalling syntax before starting the
   required procedures for calls based on their service provided to the
   customer.  With the introduction of microservice based technologies
   the complexity increases.

   This draft describes a generic identification mechanism for SIP
   dialogs in using an identifier indicating the service/product which
   the customer is using to allow an efficient processing of the SIP
   dialog and session.



The IETF Secretariat


--
Alldispatch mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/alldispatch