Location Hiding: Problem Statement and Requirements
draft-ietf-ecrit-location-hiding-req-03.txt

Abstract

The emergency services architecture developed in the IETF Emergency Context Resolution with Internet Technology (ECRIT) working group describes an architecture where location information is provided by access networks to end points or VoIP service providers in order to determine the correct dial string and information to route the call to a Public Safety Answering Point (PSAP). For determining the PSAP Uniform Resource Identifier (URI) the usage of the Location-to-Service Translation (LoST) Protocol is envisioned.

This document provides a problem statement and lists requirements for situations where the Internet Access Provider (IAP) and/or the Internet Service Provider (ISP) are only willing to disclose limited or no location information.

Status of this Memo

This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”

The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.

This Internet-Draft will expire on August 25, 2010.

Copyright Notice

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the BSD License.

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English.

Table of Contents

1.  Introduction
    1.1.  Emergency Services Architecture
    1.2.  Location Hiding
    1.3.  Location by Reference
2.  Terminology
3.  Requirements
    3.1.  High-Level Requirements
    3.2.  Detailed Requirements
    3.3.  Miscellaneous Properties
4.  IANA Considerations
5.  Security Considerations
6.  Acknowledgments
7.  References
    7.1.  Normative References
    7.2.  Informative References
§  Authors' Addresses

1.  Introduction

1.1.  Emergency Services Architecture

The emergency services architecture developed in the IETF Emergency Context Resolution with Internet Technology (ECRIT) working group, see [I‑D.ietf‑ecrit‑framework] (Rosen, B., Schulzrinne, H., Polk, J., and A. Newton, “Framework for Emergency Calling using Internet Multimedia,” July 2009.), describes an architecture where location information is provided by access networks to end points or VoIP service providers in order to determine the correct dial string and information to route the call to a Public Safety Answering Point (PSAP). The Location-to-Service Translation (LoST) Protocol [RFC5222] (Hardie, T., Newton, A., Schulzrinne, H., and H. Tschofenig, “LoST: A Location-to-Service Translation Protocol,” August 2008.) allows callers and other call-routing entities to determine the PSAP Uniform Resource Identifier (URI) for a specific geographical location together with a service URI [RFC5031] (Schulzrinne, H., “A Uniform Resource Name (URN) for Emergency and Other Well-Known Services,” January 2008.). The basic architecture is shown in Figure 1 of [I‑D.ietf‑ecrit‑framework] (Rosen, B., Schulzrinne, H., Polk, J., and A. Newton, “Framework for Emergency Calling using Internet Multimedia,” July 2009.) and further detailed in the message flow in Figure 2 of [I‑D.ietf‑ecrit‑framework] (Rosen, B., Schulzrinne, H., Polk, J., and A. Newton, “Framework for Emergency Calling using Internet Multimedia,” July 2009.).

For emergency services, location information is needed in three ways:

1. Emergency call routing to the PSAP that is responsible for a specific geographical region
2. Dispatch of the emergency personnel to the scene of an accident, crime or other types of incidents
3. Additionally, a Voice Service Provider (VSP) may need to verify that an call is indeed an emergency call and may therefore require location information to ensure that calls routed to a specific URI point to a PSAP.

This document focuses on item (1) and item (3). Providing location information by the ISP to the PSAP and to the emergency personnel are typically legal obligations covered by regulatory frameworks.

1.2.  Location Hiding

Internet Access Providers (IAPs) and Internet Service Providers (ISPs)) typically have little incentives to provide location information to end hosts or independent VSPs (without monetary compensation) for any purpose, including for emergency call routing. The decision to deny disclosure of location information can be driven by a number of technical and business concerns. Some providers may perceive a risk that allowing users to access location information for non-emergency purposes or prior to an emergency call will incur additional server load and thus costs. Other providers may not want to make location information available without the ability to charge for it. Yet others fear problems with regard to privacy when disclosing location information to potentially unknown third parties.

1.3.  Location by Reference

The work on the Location Configuration Protocol (LCP) indicated the need to provide the capability to obtain Location-by-References (LbyRs) in addition to Location-by-Value (LbyV) from a Location Information Server (LIS).

The LCP problem statement and requirements document can be found in [I‑D.ietf‑geopriv‑l7‑lcp‑ps] (Tschofenig, H. and H. Schulzrinne, “GEOPRIV Layer 7 Location Configuration Protocol; Problem Statement and Requirements,” July 2009.). The requirements for obtaining an LbyR via the LCP and the corresponding dereferencing step can be found in [I‑D.ietf‑geopriv‑lbyr‑requirements] (Marshall, R., “Requirements for a Location-by-Reference Mechanism,” November 2009.).

HTTP Enabled Location Delivery (HELD), see [I‑D.ietf‑geopriv‑http‑location‑delivery] (Barnes, M., Winterbottom, J., Thomson, M., and B. Stark, “HTTP Enabled Location Delivery (HELD),” August 2009.), is an instantiation of the LCP concept and allows LbyVs and LbyRs to be requested.

A location reference may already satisfy the requirement for location hiding if the PSAP has the appropriate credentials to resolve the reference. These credentials allow the ISP/IAP to authenticate and to authorize the party that would like to request location information. The policy to obtain these credentials allows ISPs/IAPs to put constraints under which these credentials are handed out. ISP/IAPs ideally might want to engage in a business relationship with the VSP to receive a financial compensation for the service they provide. On the Internet the number of VSPs is potentially large and the VSPs would not want to enter a business contract with potentially every ISP/IAP worldwide. The number of potential contracts between ISPs/IAPs and PSAPs is, however, relatively small as they typically need to have a local relationship as PSAPs provide their emergency services support in a certain geographical region for which certain ISPs/IAPs have networks deployed.

Note that the requirement being met here is for delivery of location information to the PSAP, not for LoST routing or for validation at the VSP. Another obstacle when it comes to the usage of location reference for location-based routing from a technical point of view is that a location reference cannot be used as input to LoST [RFC5222] (Hardie, T., Newton, A., Schulzrinne, H., and H. Tschofenig, “LoST: A Location-to-Service Translation Protocol,” August 2008.), as LoST requires location per value rather than a reference. Also, LoST servers may be operated by independent parties, including VSPs, which again may not be able to resolve the reference to location by value. (Note that LoST is a protocol used for determining the location-appropriate PSAP based on location information and a Service URN [RFC5031] (Schulzrinne, H., “A Uniform Resource Name (URN) for Emergency and Other Well-Known Services,” January 2008.).

2.  Terminology

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.), with the important qualification that, unless otherwise stated, these terms apply to the design of an solution supporting location hiding, not its implementation or application.

This document reuses terminology from [I‑D.ietf‑geopriv‑l7‑lcp‑ps] (Tschofenig, H. and H. Schulzrinne, “GEOPRIV Layer 7 Location Configuration Protocol; Problem Statement and Requirements,” July 2009.).

3.  Requirements

3.1.  High-Level Requirements

Req-A:

There MUST be a way for the ISP/IAP to withhold precise location information from the endpoint and from the VSP.

Req-B:

The ISP/IAP MUST support the ability of the endpoint or the VSP to route emergency calls.

Req-C:

The VSP MUST be able to validate that a call purported to be an emergency call is being routed to a bona fide URI, which is denoted by being a URI in LoST for the designated emergency service. This requirement is provided to deal with potential security problems described in Section 5.1 of [RFC5069] (Taylor, T., Tschofenig, H., Schulzrinne, H., and M. Shanmugam, “Security Threats and Requirements for Emergency Call Marking and Mapping,” January 2008.).

Req-D:

The PSAP MUST receive precise location information (by value) about emergency callers. As such, any solution MUST be able to provide location information to the PSAP even while withholding it from the emergency caller.

3.2.  Detailed Requirements

Req-1:

The proposed solution MUST NOT assume a business or trust relationship between the caller's VSP and the caller's ISP.

Req-2:

A solution MUST consider deployment scenarios where a VSP does not operate in the same jurisdiction as the PSAP.

Req-3:

The solution MUST offer automated discovery of servers and and other necessary configuration information. No manual configuration can be assumed.

Req-4:

The steps needed by the endpoint for emergency calling SHOULD be no different when location is withheld vs. when location is not withheld. In particular, user agents cannot require additional configuration to discover which particular environment (hiding or no hiding) they find themselves in.

Req-5:

The solution SHOULD work without the ISP/IAP having to support SIP and without the need to utilize SIP between the endpoint and the VSP.

Req-6:

The solution MUST work if PSAP boundaries have holes. (For a discussion about holes in PSAP boundaries and their encoding the reader is referred to [I‑D.ietf‑ecrit‑specifying‑holes] (Winterbottom, J. and M. Thomson, “Specifying Holes in LoST Service Boundaries,” March 2010.).)

Req-7:

The solution MUST NOT assume the existence of Emergency Service Routing Proxies (ESRPs) per country, state and city.

Req-8:

The solution MUST consider that service boundaries for different emergency services may differ, but they overlap at the location of the caller.

Req-9:

Though the solution MAY add steps to the emergency call routing process described in [I‑D.ietf‑ecrit‑framework] (Rosen, B., Schulzrinne, H., Polk, J., and A. Newton, “Framework for Emergency Calling using Internet Multimedia,” July 2009.), these steps MUST NOT significantly increase call setup latency. For example, the revised process MUST NOT include "trial-and-error" operations on its critical path, such as attempts at LbyR resolutions that may take time to time out.

Req-10:

The solution MUST allow the end host to determine PSAP/ESRP URLs prior to the call, for all emergency services.

Req-11:

The solution MUST allow UAs to discover at least their dial string ahead of the emergency call.

Req-12:

The solution MUST have minimal impact on UAs, i.e., a solution is preferred if it does not require an substantially different emergency services procedures compared to the procedure of dealing with emergency services where no location hiding is applied.

Req-13:

The solution MUST NOT interfere with the use of LoST for non-emergency services.

Req-14:

The solution MUST allow emergency calls to reach an IP-to-PSTN gateway rather than the IP-based PSAP directly.

3.3.  Miscellaneous Properties

• The solution MUST NOT shift effort (externality), i.e., the convenience of the location-hiding ISP MUST NOT impose a burden on user agents or non-hiding ISPs/IAPs and SHOULD NOT impose a burden on VSPs.
  
  
• The solution SHOULD minimize the impact on LoST, SIP conveyance [I‑D.ietf‑sipcore‑location‑conveyance] (Polk, J. and B. Rosen, “Location Conveyance for the Session Initiation Protocol,” February 2010.) and DHCP.
  
  
• The solution SHOULD NOT break in the presence of NATs and SHOULD consider the presence of legacy devices, as described in [I‑D.ietf‑geopriv‑l7‑lcp‑ps] (Tschofenig, H. and H. Schulzrinne, “GEOPRIV Layer 7 Location Configuration Protocol; Problem Statement and Requirements,” July 2009.).

4.  IANA Considerations

This document does not require actions by IANA.

5.  Security Considerations

This document does not raise additional security consideration beyond those mentioned in [I‑D.ietf‑geopriv‑l7‑lcp‑ps] (Tschofenig, H. and H. Schulzrinne, “GEOPRIV Layer 7 Location Configuration Protocol; Problem Statement and Requirements,” July 2009.) and discussed in this document.

6.  Acknowledgments

We would like to thank the following ECRIT working group members (in no particular order) for their contributions:

• Andrew Newton (andy@hxr.us)
• James Winterbottom (James.Winterbottom@andrew.com)
• Brian Rosen (br@brianrosen.net)
• Richard Barnes (rbarnes@bbn.com)
• Marc Linsner (mlinsner@cisco.com)
• Ted Hardie (hardie@qualcomm.com)

The authors would also like to thank Ben Campbell for his Gen-ART review. Additionally, we would like to thank Jari Arkko, Alexey Melnikov, Tim Polk, and Dan Romascanu for their IESG review.

7.  References

7.1. Normative References

7.2. Informative References

Authors' Addresses