Re: [Ecrit] FW: [Geopriv] Winterbottom-ecrit-direct considered

[Marc Linsner <mlinsner at cisco.com>]

On 10/30/09 2:29 PM, "Brian Rosen" <br at brianrosen.net> wrote:

> I'm the messenger here.  PSAPs prefer service providers to be on the path of
> a call, and they have bad experiences when they aren't.
> 
> Given their experiences, I can't fault them.
> 
> The reason the text is in phonebcp is as you said it is: because "normal" is
> likely to work.  The fact that "normal" means SP path in 99.999% of cases
> gets the PSAPs what they want.  They don't care about why we did it, they
> care they get the right result.

I, like others, believe the role/definition of the 'SP', as currently
defined by the PSAPs, will change significantly going forward.

> 
> I don't believe we are going to see vanity domains used on calls, and even
> if they were in "From", they won't be the domain in P-Asserted-Identity, or
> the SubjectAltName of the Identity signature.  If some service that used
> email addresses as identities sent us calls, the email address (with its
> domain) is the "userpart" of the identity, not the whole thing.  There are
> some interesting problems when you have URI to something like the MS IM
> systems.  The first "@' (br at brianrosen.net@msn.com) gets escaped.  We've
> built systems that handle that.

I think this is a little short-sighted.  Certificates for vanity domains are
certainly doable.  Besides P-Asserted-Identity is not a MUST in phonebcp.
:^)

> 
> The Firewall/Session Border controls will have several criteria when PSAPs
> are overloaded, but AFAIK, no existing firewalls or SBCs do what you suggest
> other than the repeat offender rule, which is the first line of defense.
> They do filter based on criteria that equate to IP Address or Domain of the
> SP, which we can deal with.  We'll use what works for the other users of
> these systems, we're unlikely to be able to have emergency services special
> firewalls or SBCs.

We're not talking about existing firewalls and SBCs.  We're talking about
ESInet Border Control Function.  If you don't define what you want there,
you'll live with what you get.  My suggestions are not beyond what's
possible, it's all software.

-Marc-