March 2008IETF 71 (Philadelphia) - RUCUS1 SPIT architectural issues Henning Schulzrinne Columbia University (based partially on draft-tschofenig-sipping-framework-spit-reduction-03)

March 2008IETF 71 (Philadelphia) - RUCUS2 Unsolicited communications IMs SUBSCRIBEs Calls – -spam like: robots, canned –revival of telemarketing just from Bangalore or Lagos bypass Do-Not-Call list regulations Residence and enterprise –most spam products sold to enterprises today…

March 2008IETF 71 (Philadelphia) - RUCUS3 Bot nets May dominate SPIT problem Three kinds: –fake identity –real identity (of unwitting host) random destinations destinations from host address book or Facebook friends list

March 2008IETF 71 (Philadelphia) - RUCUS4 User behavior Closed groups –only communicate within group –example: children Semi-open groups –mostly within group –plus introductions, possibly by other means (e.g., ) –example: research staff in company Open groups –communicate with public –examples: PSAP, call center, front desk

March 2008IETF 71 (Philadelphia) - RUCUS5 The cast caller.comisp.comsmith.org *all proxies are optional columbia.edu oracle honey pot peering

March 2008IETF 71 (Philadelphia) - RUCUS6 Mechanism Mechanisms likely to evolve No single best mechanism –type of destination residence vs. business vs. PSAP –cost of false positive vs. false negative varies –SPIT evolves Volume and duration by itself insufficient –“reverse 911” –school closing calls at 5 am

March 2008IETF 71 (Philadelphia) - RUCUS7 Classes of mechanisms Identity-based –at callee –relationship to other identities (web pages, ) Statistics –at origin or destination Price-based –make incoming or outgoing calls expensive –monetary, computational or human resources (CAPTCHA)

March 2008IETF 71 (Philadelphia) - RUCUS8 Detection vs. action Detection of call characteristics –caller statistics not visible to one destination Action based on characteristics + policy –same characteristics + different policy --> different actions e.g., reject - Turing test - voice mail

March 2008IETF 71 (Philadelphia) - RUCUS9 Mechanisms WL BL Is a SPIT bot? Does caller.com host SPITers? Is Bob making more than 100 calls/day? Trust?

March 2008IETF 71 (Philadelphia) - RUCUS10 Identity crisis Assumption: –RFC 4474 provides strong identity assurance –needed for white lists Reality: –E.164: draft-rosenberg-sip-rfc4474- concerns-00 –Baiting: draft-kaplan-sip-baiting-attack-02

March 2008IETF 71 (Philadelphia) - RUCUS11 Communicating WL BL policy language call properties oracle queries update and share

March 2008IETF 71 (Philadelphia) - RUCUS12 What’s to do? Many & evolving mechanisms Components from different vendors Need for glue to allow distributed mechanism, e.g., –mechanisms to convey metrics downstream –mechanisms to query oracles –policy language to allow automated decisions Sieve RAI: common policy

March 2008IETF 71 (Philadelphia) - RUCUS13 Summary Separate mechanisms from communication protocols Separate call evaluation and measurement from policy Allow for multiple parties –service providers, trust brokers, … Both mechanisms and tools likely to evolve –keep communication tools one step ahead in generality