[sip-ops] draft-lawrence-sip-3rd-party-authorization-00

["Scott Lawrence" <[e-mail]>]

draft-lawrence-sip-3rd-party-authorization-00.txt has been submitted by
Scott Lawrence and posted to the IETF repository.

Filename:	 draft-lawrence-sip-3rd-party-authorization
Revision:	 00
Title:		 Third Party Authorization in the Session Initiation Protocol
Creation_date:	 2009-05-03
WG ID:		 Independent Submission
Number_of_pages: 15

Abstract:
        This draft describes some circumstances that are common in SIP
        deployments which lack a rigorous authorization model, and points out
        some ways in which this has resulted in poor security
        characteristics.
        
        The purpose of this document is to stimulate discussion of the
        identified problem and proposed requirements for any solution.

In this draft, I lay out a case for why SIP would benefit from an
authorization model that allows for one party to send a request to a
second party who must decide whether or not to allow the request, but
have a third party provide an explicit authorization in the request.
The goal is to allow separation of the evaluation of a request with
respect to a security policy from other parts of responding to the
request.

I _do_not_ include any discussion in this draft of _how_ the
requirements it lists could or should be met.  While I'm very interested
in that discussion, I think it's important to first discover whether or
not there is agreement in the SIP community that there really is a
problem and what part or parts of that problem need to be solved; this
draft is focused on that discussion.