Subject: [Ecrit] Unauthenticated Network Access

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 15 Mar 2007 22:09:33 +0100

Hi all,

next Monday we are going to have our information sharing event with the 
IEEE. I went through their documents to get a better idea of their work 
and I noticed that the IEEE is working on solutions for unauthenticated 
network access. This essentially allows an emergency caller without 
credentials to access an IEEE 802 network. (Hence, I am not talking 
about unauthenticated emergency calls at the SIP layer).

The support for  unauthenticated network access raises a number of 
security challenges including architectural questions.

I was wondering whether there are some regulatory requirements that 
require an architecture to support this type of functionality.

Ciao
Hannes

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: <[email-masked]>
Date: Mon, 19 Mar 2007 09:45:08 -0500

Hello,

I do not think this question is relevant from ieee point of view. 

But as ieee technology is used to deploy commercial cellular radio
networks (e.g. wimax), which may (or are already) inherit the current
existing requirement of being possible to place an emergency call using
a phone without a SIM card (i.e. no credentials), I think it is natural
that ieee is going to provide a solution of satisfying the requirement.

Gabor

-----Original Message-----
From: ext Hannes Tschofenig [mailto:[email-masked]] 
Sent: Thursday, March 15, 2007 2:10 PM
To: ECRIT
Subject: [Ecrit] Unauthenticated Network Access

Hi all,

Ciao
Hannes

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 19 Mar 2007 11:01:56 -0400

Okay, but please understand the current situation.

The PSAPs have now lived with the "uninitialized device" problem for several
years. The current considered position is that the cure is worse than the
problem.  The number of legitimate emergency calls from uninitialized phones
is infinitesimally small.  Most PSAPs can go a year without one.

The number of prank calls is huge.  In many PSAPs, it's their largest source
of nuisance calls.  They are NOT eager to have more such calls.

Nevertheless, there is presently a regulator requirement in some countries
to support them on mobile phones.  There are some carriers who believe that
802.11 (or whatever) wireless networks which they support seamless roaming
to will need to allow them to meet their regulatory obligations when
uninitialized devices are on such networks.

However, that is ALL that is needed, and you should, I believe, design
support for such a circumstance as narrow as possible.  It only needs to
work on networks which the carriers have roaming agreements with, and it
ONLY needs to work for their devices.  I would also strongly urge you to
copy whatever identity information the device can supply and carry it
through, so that we have as much information as possible to track down prank
callers.

Brian

> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, March 19, 2007 10:45 AM
> To: [email-masked]; [email-masked]
> Subject: RE: [Ecrit] Unauthenticated Network Access
> 
> Hello,
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2007 11:26:41 -0400

In the IP environment, we have two identities (L2/L3 and L7), instead  
of one. Thus, I think we have more design freedom. As an example,  
consider a model where a wireless (802.16 or otherwise) ISP has  
agreements with a number of modest number of consumer VSPs that allow  
unauthenticated L2 calls, with the assumption that these VSPs have  
strong customer identity information. This customer identity  
information is conveyed to the PSAP, either literally or in some  
discoverable format should the call pose problems. (In other words,  
where anonymous emergency calls are a requirement, a PSAP can get a  
court order if there's a crank call to map the call-ID to an  
indictable identity.)

Sure, it discriminates against small VSPs, non-domestic VSPs or the  
SIP-proxy-at-home crowd, but I'd rather allow L7-authenticated  
emergency call to a larger population than not at all. I'm guessing  
that you'd get 90%+ of all possible callers with fewer than a dozen  
VSPs. Naturally, nothing prevents customers of these VSPs make calls  
as authenticated L2 users.

Given the widespread and increasing availability of open-access  
hotspots, I do see this as a more generic problem. Would you suggest  
preventing emergency calls from such networks? How would you enforce  
that?

Henning

---

From: "Marc Linsner" <[email-masked]>
Date: Mon, 19 Mar 2007 11:43:09 -0400

> work for their devices.  I would also strongly urge you to 
> copy whatever identity information the device can supply and 
> carry it through, so that we have as much information as 
> possible to track down prank callers.

Ah yes, I can see it now.  Buy your Linksys 802.11 phone at the Walmart gun
counter so they can register your mac address with the Bureau of Alcohol,
Tobacco and Firearms.

:^)

-Marc-

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 19 Mar 2007 11:43:24 -0400

But then you are not talking about a non-initialized device.  You have a
good identity.  If you have a good identity, then I'm all for being able to
use that to make an emergency call.  The problem we are talking about is a
device that has no identity at all. 

I'm not sure how you get into a circumstance where you have a good L7
identity but an unauthenticated L2.  How does that arise?  It would seem to
me that if the ISP supports the VSP, then the device should be able to be
authorized on the L2/L3 network.

Brian

> From: Henning Schulzrinne [mailto:[email-masked]]
> Sent: Monday, March 19, 2007 11:27 AM
> To: Brian Rosen
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [Ecrit] Unauthenticated Network Access
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2007 11:56:22 -0400

> device that has no identity at all.

I think part of the problem is defining "identity" and "device". In  
this particular case, the device has no identity as such; rather a  
piece of software running SIP has a L7 identity and happens to reside  
on a laptop using  a non-authenticating network.

I don't think it is helpful to conflate 'device' and 'service'. If  
they are the same, we could greatly simplify the SIPPING  
configuration discussion :-)

If we agree that authenticated means "has a traceable identity either  
at L2 or L7 (or both)", we are in agreement, but clearly,  
unauthenticated network access doesn't imply that.

> authorized on the L2/L3 network.

I gave two examples:

- 802.11 networks with no authentication (e.g., all city parks in NYC  
in the near future, Columbia University and many other universities,  
Panera Bread, non-WEP home networks with SSID linksys, corporate  
networks with 'guest' access)

- 802.16 networks that explicitly allow non-authenticated emergency  
call access, as I described in my note.

At a more basic level, this is even true for the IETF Ethernet. A few  
years ago, the Lexington airport offered Ethernet plugs on their  
lower level for free, without any authentication.

Henning

---

From: "Marc Linsner" <[email-masked]>
Date: Mon, 19 Mar 2007 11:58:45 -0400

Brian, 

> I'm not sure how you get into a circumstance where you have a 
> good L7 identity but an unauthenticated L2.  How does that 
> arise?  It would seem to me that if the ISP supports the VSP, 
> then the device should be able to be authorized on the L2/L3 network.

Your 802.11 phone works, Vonage is your VSP, but you don't have $6 in your
pocket to buy time on T-Mobile.

-Marc-

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 19 Mar 2007 12:09:23 -0400

But Vonage doesn't have an agreement with T-Mobile that would permit this.
If they did, then it would work.  That was Henning's preposition.

Brian

> From: Marc Linsner [mailto:[email-masked]]
> Sent: Monday, March 19, 2007 11:59 AM
> To: 'Brian Rosen'; 'Henning Schulzrinne'
> Cc: [email-masked]; [email-masked]

---

From: "McCann, Stephen" <[email-masked]>
Date: Mon, 19 Mar 2007 16:10:36 -0000

Dear all,
	I listened in to today's lunch time meeting (thanks
for setting up the audio link by the away) and I just wanted
to state a couple of things from the IEEE 802.11 point of 
view:

1)	The presentation from Dorothy is very much work in progress
      and we require assistance from the IETF to fill in some of
      our gaps.

2)	The whole issue of emergency services is now gaining momentum
      within IEEE 802 (not just specifically 802.11) and is not
      something it can ignore or dismiss.

3)	I think it might be useful for ECRIT to write a list of issues
      that IEEE 802.11 needs to respond to, as an outcome of this
      meeting.

Kind regards

Stephen

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 19 Mar 2007 12:18:08 -0400

Perhaps I'm wrong, but I think that if the user has an identity acceptable
to the VSP, then it can be arranged that he has an identity acceptable to
the L2/L3 operator.  I think that is the direction everyone is heading, so
that a phone can roam.  For example, most pay-for-service wifi hotspots have
roaming agreements that allow subscribers to other hotspot users to use
their credentials.  The VSP could arrange the same courtesy.

Traceable identity, either by the L2/L3 operator or the L7 operator is
acceptable, I agree.

I still don't understand the examples.  They seem to already allow
unfettered L2/L3 access, but would require identity to the L7 provider.  If
the L2/L3 provider starts requiring some kind of credentials for access,
then the L7 provider can arrange such credentials as above.  I don't think
we need more than that.

The work that I'm objecting to seems to provide for any device to gain
access by declaring that it's trying to place an emergency call without
regard to whether it has L7 credentials or not.

Brian

> Sent: Monday, March 19, 2007 11:56 AM
> To: Brian Rosen

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2007 13:05:50 -0400

> their credentials.  The VSP could arrange the same courtesy.

This might be true and I'm clearly only guessing, but I'm guessing  
that it's a lot easier to simply route calls to a proxy than  
authenticate users and share IDs. The latter requires some kind of  
AAA access, and then distinguish emergency-only from fully-paid  
customers.

Given that wireless hotspots charge $10 or more a day and that VSPs  
charge $10 or so a month, I'm not quite sure that courtesy wireless  
roaming is imminent.

> regard to whether it has L7 credentials or not.

I think we're in general agreement; we just need to be precise in our  
discussions. "unrestricted unauthenticated network access" is bad,  
"L7-authenticated unauthenticated network access" is ok.

---

From: <[email-masked]>
Date: Mon, 19 Mar 2007 13:58:38 -0500

-----Original Message-----
From: ext Henning Schulzrinne [mailto:[email-masked]] 
Sent: Monday, March 19, 2007 10:06 AM
To: Brian Rosen
Cc: Bajko Gabor (Nokia-NET/MtView); [email-masked];
[email-masked]

> access by declaring that it's trying to place an emergency call 
> without regard to whether it has L7 credentials or not.
>

IEEE is trying to solve the "unauthenticated network access" case, not
the "unrestricted unauthenticated network access". Unauthentication here
referring to L2. Whether L-7 authentication will be required or not,
that is going to be decided by the carrier which will deploy ieee
technology for commercial VoIP services. So, if e.g. wimax is going to
use the "unauthenticated network access" solution provided by ieee, you
can ask wimax to require L-7 authentication in their specs.

Gabor

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 19 Mar 2007 17:10:11 -0400

I continue to not understand why the credentials used for L7 access are not
acceptable for L2 access.  They are for WiFi now.  Why would you supply a
solution that is not as good as they do today?

Today, the carrier wishing to provide L2/L3 authenticated access on a
partner's WiFi network would provide (something like) a RADIUS
authentication of the subscriber username/password collected by the partner.
The partner would only provide access if the user correctly authenticated
via the carrier's RADIUS server.

Brian

> Sent: Monday, March 19, 2007 2:59 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2007 17:16:46 -0400

Please remember that the WiMax provider may not necessarily be the  
VoIP provider. The case where ISP = VSP is the easy one. We certainly  
don't want to imply this.

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2007 17:33:59 -0400

> solution that is not as good as they do today?

Do know any any WiFi credentials that can be used for SIP or vice versa?

It's theoretically possible, but requires a significant change in AAA  
mechanisms, for example.

> via the carrier's RADIUS server.

This requires a full-fledged business relationship, given the high  
relative charges for WiFi access. If it's so easy, why hasn't Vonage  
done this already, say?

Henning

---

From: "Marc Linsner" <[email-masked]>
Date: Mon, 19 Mar 2007 17:56:08 -0400

Brian, 

> 
> I continue to not understand why the credentials used for L7 
> access are not acceptable for L2 access.  They are for WiFi 
> now.  Why would you supply a solution that is not as good as 
> they do today?

Can you provide an example of L7 service credentials used for
roaming/multi-carrier L2 access?  I'm only familiar with those like IPass
that is strictly L2/L3.  IPass doesn't buy you much in the L7 world.

-Marc-