SIPPING G. Camarillo
Internet-Draft Ericsson
Expires: August 29, 2006 February 25, 2006
A Document Format for Expressing Consent
draft-camarillo-sipping-consent-format-00.txt
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on August 29, 2006.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This document defines an Extensible Markup Language (XML) format for
expressing consent. A permission document written in this format
gives a relay permission to perform a particular translation, which
is described in the document.
Camarillo Expires August 29, 2006 [Page 1]
Internet-Draft Permission Document Format February 2006
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Permission Document Structure . . . . . . . . . . . . . . . . 3
3.1. Conditions . . . . . . . . . . . . . . . . . . . . . . . . 4
3.1.1. Identity Condition . . . . . . . . . . . . . . . . . . 4
3.1.2. Sender Condition . . . . . . . . . . . . . . . . . . . 4
3.1.3. Target Condition . . . . . . . . . . . . . . . . . . . 7
3.2. Actions . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2.1. Translation Handling . . . . . . . . . . . . . . . . . 7
4. Example Document . . . . . . . . . . . . . . . . . . . . . . . 7
5. XML Schema . . . . . . . . . . . . . . . . . . . . . . . . . . 8
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
9.1. Normative References . . . . . . . . . . . . . . . . . . . 10
9.2. Informative References . . . . . . . . . . . . . . . . . . 10
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 11
Intellectual Property and Copyright Statements . . . . . . . . . . 12
Camarillo Expires August 29, 2006 [Page 2]
Internet-Draft Permission Document Format February 2006
1. Introduction
The framework for consent-based communications in SIP [7] identifies
the need for a format to create permission documents. Such
permission documents give (or deny) SIP [3] relays permission to
perform translations. A relay is defined as any SIP server, be it a
proxy, B2BUA (Back-to-Back User Agent), or some hybrid, which
receives a request and translates the request URI into one or more
next hop URIs to which it then delivers a request.
The format for permission documents specified in this document is
based on the XML document format for expressing Privacy Preferences
[8].
2. Terminology
In this document, the key words "MUST", "MUST NOT", "REQUIRED",
"SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT
RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as
described in BCP 14, RFC 2119 [1] and indicate requirement levels for
compliant implementations.
Recipient URI: The request-URI of an outgoing request sent by an
entity (e.g., a user agent or a proxy). The sending of such
request may have been the result of a translation operation.
Target URI: The request-URI of an incoming request that arrives to an
entity (e.g., a proxy) that will perform a translation operation.
Translation operation: Operation by which an entity (e.g., a proxy)
translates the request URI of an incoming request (i.e., the
target URI) into one or more URIs (i.e., recipient URIs) which are
used as the request URIs of one or more outgoing requests.
3. Permission Document Structure
A permission document is an XML document, formatted according to the
schema defined in [8]. Permission documents inherit the MIME type of
common policy documents, 'application/auth-policy+xml'. As described
in [8], this document is composed of three parts: conditions,
actions, and transformations.
This section defines the new conditions and actions defined by this
specification. This specification does not define any new
transformation.
Camarillo Expires August 29, 2006 [Page 3]
Internet-Draft Permission Document Format February 2006
3.1. Conditions
Note that, as discussed in [8], a permission document applies to a
translation if all the expressions in its conditions part evaluate to
TRUE.
3.1.1. Identity Condition
The identity condition, defined in [8], is matched against the
recipient URI of a translation.
When performing a translation, a relay matches the identity condition
against the destination URI of the outgoing request. When receiving
a permission document (e.g., in a PUBLISH request as described in
[7], the relay matches the identity condition against the identity of
the entity uploading the permission document (e.g., the sender of the
PUBLISH request).
Although the <identity> element is defined in [8], that specification
indicates that the specific usages of the framework document need to
define details that are protocol and usage specific. In particular,
this section defines acceptable means of authentication.
The elements <one> and <except> MUST contain a scheme when they
appear in a permission document.
When used with SIP, a recipient uploading a permission document to a
relay is considered authenticated if one of the following techniques
is used:
SIP Identity [6], as described in [7]. For PUBLISH requests that are
authenticated using the SIP Identity mechanism, the identity of
the sender of the PUBLISH request is equal to the SIP URI in the
From header field of the request, assuming that the signature in
the Identity header field has been validated.
P-Asserted-Identity [5], as described in [7]. For PUBLISH requests
that are authenticated using the P-Asserted-Identity mechanism,
the identity of the sender of the PUBLISH request is equal to the
P-Asserted-Identity header field of the request.
Return Routability Test, as described in [7].
3.1.2. Sender Condition
The sender condition is matched against the URI of the sender of the
request that is used as input for a translation. Sender conditions
can contain the same elements and attributes as identity conditions.
Camarillo Expires August 29, 2006 [Page 4]
Internet-Draft Permission Document Format February 2006
When performing a translation, a relay matches the sender condition
against the identity of the sender of the incoming request.
The following subsections define:
acceptable means of authentication.
the procedure for representing the identity of the sender as a
URI.
the procedure for converting an identifier of the form
user@domain, present in the 'id' attribute of the <one> and
<except> elements, into a URI.
3.1.2.1. Acceptable Means of Authentication
When used with SIP, a request sent by a sender is considered
authenticated if one of the following techniques is used:
SIP Digest the relay authenticates the sender using SIP digest
authentication [2]. However, if the anonymous authentication
described on page 194 of RFC 3261 [3] is used, the sender is not
considered authenticated.
Asserted Identity: if a request contains a P-Asserted-ID header field
[5] and the request is coming from a trusted element, the sender
is considered authenticated.
Cryptographically Verified Identity: if a request contains an
Identity header field as defined in [6], and it validates the From
header field of the request, the request is considered to be
authenticated. Note that this is true even if the request
contained a From header field of the form
sip:anonymous@example.com. As long as the signature verifies that
the request legitimately came from this identity, it is considered
authenticated.
3.1.2.2. Computing a URI for the Sender
For requests that are authenticated using SIP Digest, the identity of
the sender is set equal to the user and domain part of the SIP
Address of Record (AOR) for the user that has authenticated
themselves. For example, consider the following "user record" in a
database:
SIP AOR: sip:alice@example.com
digest username: ali
digest password: f779ajvvh8a6s6
digest realm: example.com
If the relay receives a request, challenges it with the realm set to
Camarillo Expires August 29, 2006 [Page 5]
Internet-Draft Permission Document Format February 2006
"example.com", and the subsequent request contains an Authorization
header field with a username of "ali" and a digest response generated
with the password "f779ajvvh8a6s6", the identity used in matching
operations is "sip:alice@example.com".
For requests that are authenticated using RFC 3325 [5], the identity
of the watcher is equal to the username and domain parts of the SIP
URI in the P-Asserted-ID header field. If there are multiple values
for the P-Asserted-ID header field (there can be one sip URI and one
tel URI [9]), then each of them is used for the comparisons outlined
in [8], and if either of them match a <one> or <except> element, it
is considered a match.
For requests that are authenticated using the SIP Identity mechanism
[6], identity of the sender is equal to the SIP URI in the From
header field of the request, assuming that the signature in the
Identity header field has been validated.
SIP also allows for anonymous requests. If a request is anonymous
because the digest challenge/response used the "anonymous" username,
the request is considered unauthenticated and will not match the
<identity> condition. If a request is anonymous because it contains
a Privacy header field [4], but still contains a P-Asserted-ID header
field, the identity in the P-Asserted-ID header field is still used
in the authorization computations; the fact that the request was
anonymous has no impact on the identity processing. However, if the
request had traversed a trust boundary and the P-Asserted-ID header
field and the Privacy header field had been removed, the request will
be considered unauthenticated when it arrives at the presence server,
and thus not match the <identity> condition. Finally, if a request
contained an Identity header field that was validated, and the From
header field contained a URI of the form sip:anonymous@example.com,
then the watcher is considered authenticated, and it will have an
identity equal to sip:anonymous@example.com. Had such an identity
been placed into a <one> or <except> element, there will be a match.
3.1.2.3. Computing a SIP URI from the id Attribute
If the <one> or <except> condition does not contain a scheme,
conversion of the value in the 'id' attribute to a SIP URI is done
trivially. If the characters in the 'id' attribute are valid
characters for the user and hostpart components of the SIP URI, a
'sip:' is appended to the contents of the 'id' attribute, and the
result is the SIP URI. If the characters in the 'id' attribute are
not valid for the user and hostpart components of the SIP URI,
conversion is not possible. This happens, for example, when the user
portion of the 'id' attribute contain UTF-8 characters.
Camarillo Expires August 29, 2006 [Page 6]
Internet-Draft Permission Document Format February 2006
3.1.3. Target Condition
The target condition is matched against the target URI of a
translation. Sender conditions can contain the same elements and
attributes as identity conditions.
When performing a translation, a relay matches the target condition
against the destination of the incoming request, which is typically
contained in the Request-URI.
3.2. Actions
The actions in a permission document indicate whether or not the
recipient gives the relay permission to perform a translation.
3.2.1. Translation Handling
The <trans-handling> element specifies whether or not the relay is
allowed to perform a translation. The <trans-handling> element is an
enumerated Integer type. The defined values are:
OPEN ISSUE: does it need to be an Integer?
block: this action tells the relay not to perform the translation.
It has the value of zero, and it represents the default value. No
value of the <trans-handling> element can ever be lower than this.
Strictly speaking, it is not necessary to even include an explicit
block action, since the default in the absence of any action will
be block. However, it is included for completeness.
pending: this action tells the relay not to perform the translation.
Additionally, it also indicates that the receiver of the
translation has not given or denied the relay permission to
perform the translation. It has a value of one.
allow: this action tells the server to perform the translation. This
action has a value of two.
4. Example Document
The following permission document gives the relay handling
'sip:alices-friends@example.com' permission to relay requests sent to
that URI to 'sip:bob@example.org'.
Camarillo Expires August 29, 2006 [Page 7]
Internet-Draft Permission Document Format February 2006
<?xml version="1.0" encoding="UTF-8"?>
<cr:ruleset
xmlns="urn:ietf:params:xml:ns:consent-rules"
xmlns:cr="urn:ietf:params:xml:ns:common-policy"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:consent-rules consent-rules.xsd">
<cr:rule id="1">
<cr:conditions>
<cr:identity>
<cr:id entity="bob@example.org" scheme="sip"/>
</cr:identity>
<target>
<cr:id entity="alices-friends@example.com" scheme="sip"/>
</target>
<sender>
<cr:any/>
</sender>
</cr:conditions>
<cr:actions>
<trans-handling>allow</trans-handling>
</cr:actions>
<cr:transformations/>
</cr:rule>
</cr:ruleset>
5. XML Schema
Camarillo Expires August 29, 2006 [Page 8]
Internet-Draft Permission Document Format February 2006
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema
targetNamespace="urn:ietf:params:xml:ns:consent-rules"
xmlns:cr="urn:ietf:params:xml:ns:consent-rules"
xmlns:cp="urn:ietf:params:xml:ns:common-policy"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"
attributeFormDefault="unqualified">
<!-- Conditions -->
<xs:element name="sender" type="cp:identityType"/>
<xs:element name="target" type="cp:identityType"/>
<!-- Actions -->
<xs:element name="trans-handling">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="block"/>
<xs:enumeration value="pending"/>
<xs:enumeration value="allow"/>
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:schema>
6. IANA Considerations
This document does not require the IANA to take any actions.
7. Security Considerations
TBD.
8. Acknowledgements
Jonathan Rosenberg provided useful ideas.
9. References
Camarillo Expires August 29, 2006 [Page 9]
Internet-Draft Permission Document Format February 2006
9.1. Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S.,
Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication:
Basic and Digest Access Authentication", RFC 2617, June 1999.
[3] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[4] Peterson, J., "A Privacy Mechanism for the Session Initiation
Protocol (SIP)", RFC 3323, November 2002.
[5] Jennings, C., Peterson, J., and M. Watson, "Private Extensions
to the Session Initiation Protocol (SIP) for Asserted Identity
within Trusted Networks", RFC 3325, November 2002.
[6] Peterson, J. and C. Jennings, "Enhancements for Authenticated
Identity Management in the Session Initiation Protocol (SIP)",
draft-ietf-sip-identity-06 (work in progress), October 2005.
[7] Rosenberg, J., "A Framework for Consent-Based Communications in
the Session Initiation Protocol (SIP)",
draft-ietf-sipping-consent-framework-03 (work in progress),
October 2005.
[8] Schulzrinne, H., "A Document Format for Expressing Privacy
Preferences", draft-ietf-geopriv-common-policy-06 (work in
progress), October 2005.
9.2. Informative References
[9] Schulzrinne, H., "The tel URI for Telephone Numbers", RFC 3966,
December 2004.
Camarillo Expires August 29, 2006 [Page 10]
Internet-Draft Permission Document Format February 2006
Author's Address
Gonzalo Camarillo
Ericsson
Hirsalantie 11
Jorvas 02420
Finland
Email: Gonzalo.Camarillo@ericsson.com
Camarillo Expires August 29, 2006 [Page 11]
Internet-Draft Permission Document Format February 2006
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2006). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society.
Camarillo Expires August 29, 2006 [Page 12]