draft-ietf-sipping-spam-05.txt   rfc5039.txt 
SIPPING J. Rosenberg Network Working Group J. Rosenberg
Internet-Draft C. Jennings Request for Comments: 5039 C. Jennings
Intended status: Informational Cisco Category: Informational Cisco
Expires: January 10, 2008 July 9, 2007 January 2008
The Session Initiation Protocol (SIP) and Spam The Session Initiation Protocol (SIP) and Spam
draft-ietf-sipping-spam-05
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Status of This Memo
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on January 10, 2008.
Copyright Notice
Copyright (C) The IETF Trust (2007). This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Abstract Abstract
Spam, defined as the transmission of bulk unsolicited messages, has Spam, defined as the transmission of bulk unsolicited messages, has
plagued Internet email. Unfortunately, spam is not limited to email. plagued Internet email. Unfortunately, spam is not limited to email.
It can affect any system that enables user to user communications. It can affect any system that enables user-to-user communications.
The Session Initiation Protocol (SIP) defines a system for user to The Session Initiation Protocol (SIP) defines a system for user-to-
user multimedia communications. Therefore, it is susceptible to user multimedia communications. Therefore, it is susceptible to
spam, just as email is. In this document, we analyze the problem of spam, just as email is. In this document, we analyze the problem of
spam in SIP. We first identify the ways in which the problem is the spam in SIP. We first identify the ways in which the problem is the
same and the ways in which it is different from email. We then same and the ways in which it is different from email. We then
examine the various possible solutions that have been discussed for examine the various possible solutions that have been discussed for
email and consider their applicability to SIP. email and consider their applicability to SIP.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
skipping to change at page 2, line 21 skipping to change at page 2, line 19
2.1. Call Spam . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Call Spam . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. IM Spam . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.2. IM Spam . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3. Presence Spam . . . . . . . . . . . . . . . . . . . . . . 7 2.3. Presence Spam . . . . . . . . . . . . . . . . . . . . . . 7
3. Solution Space . . . . . . . . . . . . . . . . . . . . . . . . 8 3. Solution Space . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1. Content Filtering . . . . . . . . . . . . . . . . . . . . 8 3.1. Content Filtering . . . . . . . . . . . . . . . . . . . . 8
3.2. Black Lists . . . . . . . . . . . . . . . . . . . . . . . 9 3.2. Black Lists . . . . . . . . . . . . . . . . . . . . . . . 9
3.3. White Lists . . . . . . . . . . . . . . . . . . . . . . . 9 3.3. White Lists . . . . . . . . . . . . . . . . . . . . . . . 9
3.4. Consent-Based Communications . . . . . . . . . . . . . . . 10 3.4. Consent-Based Communications . . . . . . . . . . . . . . . 10
3.5. Reputation Systems . . . . . . . . . . . . . . . . . . . . 12 3.5. Reputation Systems . . . . . . . . . . . . . . . . . . . . 12
3.6. Address Obfuscation . . . . . . . . . . . . . . . . . . . 14 3.6. Address Obfuscation . . . . . . . . . . . . . . . . . . . 14
3.7. Limited Use Addresses . . . . . . . . . . . . . . . . . . 14 3.7. Limited-Use Addresses . . . . . . . . . . . . . . . . . . 14
3.8. Turing Tests . . . . . . . . . . . . . . . . . . . . . . . 15 3.8. Turing Tests . . . . . . . . . . . . . . . . . . . . . . . 15
3.9. Computational Puzzles . . . . . . . . . . . . . . . . . . 17 3.9. Computational Puzzles . . . . . . . . . . . . . . . . . . 17
3.10. Payments at Risk . . . . . . . . . . . . . . . . . . . . . 17 3.10. Payments at Risk . . . . . . . . . . . . . . . . . . . . . 17
3.11. Legal Action . . . . . . . . . . . . . . . . . . . . . . . 18 3.11. Legal Action . . . . . . . . . . . . . . . . . . . . . . . 18
3.12. Circles of Trust . . . . . . . . . . . . . . . . . . . . . 19 3.12. Circles of Trust . . . . . . . . . . . . . . . . . . . . . 19
3.13. Centralized SIP Providers . . . . . . . . . . . . . . . . 19 3.13. Centralized SIP Providers . . . . . . . . . . . . . . . . 19
4. Authenticated Identity in Email . . . . . . . . . . . . . . . 20 4. Authenticated Identity in Email . . . . . . . . . . . . . . . 20
4.1. Sender Checks . . . . . . . . . . . . . . . . . . . . . . 21 4.1. Sender Checks . . . . . . . . . . . . . . . . . . . . . . 21
4.2. Signature-Based Techniques . . . . . . . . . . . . . . . . 21 4.2. Signature-Based Techniques . . . . . . . . . . . . . . . . 21
5. Authenticated Identity in SIP . . . . . . . . . . . . . . . . 22 5. Authenticated Identity in SIP . . . . . . . . . . . . . . . . 22
6. Framework for Anti-Spam in SIP . . . . . . . . . . . . . . . . 23 6. Framework for Anti-Spam in SIP . . . . . . . . . . . . . . . . 23
7. Additional Work . . . . . . . . . . . . . . . . . . . . . . . 24 7. Additional Work . . . . . . . . . . . . . . . . . . . . . . . 24
8. Security Considerations . . . . . . . . . . . . . . . . . . . 24 8. Security Considerations . . . . . . . . . . . . . . . . . . . 24
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 24 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24 10. Informative References . . . . . . . . . . . . . . . . . . . . 25
11. Informative References . . . . . . . . . . . . . . . . . . . . 25
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 27
Intellectual Property and Copyright Statements . . . . . . . . . . 28
1. Introduction 1. Introduction
Spam, defined as the transmission of bulk unsolicited email, has been Spam, defined as the transmission of bulk unsolicited email, has been
a plague on the Internet email system. Many solutions have been a plague on the Internet email system. Many solutions have been
documented and deployed to counter the problem. None of these documented and deployed to counter the problem. None of these
solutions is ideal. However, one thing is clear: the spam problem solutions is ideal. However, one thing is clear: the spam problem
would be much less significant had solutions been deployed would be much less significant had solutions been deployed
ubiquitously before the problem became widespread. ubiquitously before the problem became widespread.
The Session Initiation Protocol (SIP) [2] is used for multimedia The Session Initiation Protocol (SIP) [2] is used for multimedia
communications between users, including voice, video, instant communications between users, including voice, video, instant
messaging and presence. Consequently, it can be just as much of a messaging, and presence. Consequently, it can be just as much of a
target for spam as email. To deal with this, solutions need to be target for spam as email. To deal with this, solutions need to be
defined and recommendations put into place for dealing with spam as defined and recommendations put into place for dealing with spam as
soon as possible. soon as possible.
This document serves to meet those goals by defining the problem This document serves to meet those goals by defining the problem
space more concretely, analyzing the applicability of solutions used space more concretely, analyzing the applicability of solutions used
in the email space, identifying protocol mechanisms that have been in the email space, identifying protocol mechanisms that have been
defined for SIP which can help the problem, and making defined for SIP that can help the problem, and making recommendations
recommendations for implementors. for implementors.
2. Problem Definition 2. Problem Definition
The spam problem in email is well understood, and we make no attempt The spam problem in email is well understood, and we make no attempt
to further elaborate on it here. The question, however, is what is to further elaborate on it here. The question, however, is what is
the meaning of spam when applied to SIP? Since SIP covers a broad the meaning of spam when applied to SIP? Since SIP covers a broad
range of functionality, there appear to be three related but range of functionality, there appear to be three related but
different manifestations: different manifestations:
Call Spam: This type of spam is defined as a bulk unsolicited set of Call Spam: This type of spam is defined as a bulk unsolicited set of
session initiation attempts (i.e., INVITE requests), attempting to session initiation attempts (i.e., INVITE requests), attempting to
establish a voice, video, instant messaging [1] or other type of establish a voice, video, instant messaging [1], or other type of
communications session. If the user should answer, the spammer communications session. If the user should answer, the spammer
proceeds to relay their message over the real time media. This is proceeds to relay their message over the real-time media. This is
the classic telemarketer spam, applied to SIP. This is often the classic telemarketer spam, applied to SIP. This is often
called SPam over Ip Telephony or SPIT. called SPam over Ip Telephony, or SPIT.
IM Spam: This type of spam is similar to email. It is defined as a IM Spam: This type of spam is similar to email. It is defined as a
bulk unsolicited set of instant messages, whose content contains bulk unsolicited set of instant messages, whose content contains
the message that the spammer is seeking to convey. IM spam is the message that the spammer is seeking to convey. IM spam is
most naturally sent using the SIP MESSAGE [3] request. However, most naturally sent using the SIP MESSAGE [3] request. However,
any other request which causes content to automatically appear on any other request that causes content to automatically appear on
the user's display will also suffice. That might include INVITE the user's display will also suffice. That might include INVITE
requests with large Subject headers (since the Subject is requests with large Subject headers (since the Subject is
sometimes rendered to the user), or INVITE requests with text or sometimes rendered to the user), or INVITE requests with text or
HTML bodies. This is often called SPam over Instant Messaging or HTML bodies. This is often called SPam over Instant Messaging, or
SPIM. SPIM.
Presence Spam: This type of spam is similar to IM spam. It is Presence Spam: This type of spam is similar to IM spam. It is
defined as a bulk unsolicited set of presence requests (i.e., defined as a bulk unsolicited set of presence requests (i.e.,
SUBSCRIBE requests [4] for the presence event package [6]), in an SUBSCRIBE requests [4] for the presence event package [6]), in an
attempt to get on the "buddy list" or "white list" of a user in attempt to get on the "buddy list" or "white list" of a user in
order to send them IM or initiate other forms of communications. order to send them IM or initiate other forms of communications.
This is occasionally called SPam over Presence Protocol or SPPP. This is occasionally called SPam over Presence Protocol, or SPPP.
There are many other SIP messages that a spammer might send. There are many other SIP messages that a spammer might send.
However, most of the other ones do not result in content being However, most of the other ones do not result in content being
delivered to a user, nor do they seek input from a user. Rather, delivered to a user, nor do they seek input from a user. Rather,
they are answered by automata. OPTIONS is a good example of this. they are answered by automata. OPTIONS is a good example of this.
There is little value for a spammer in sending an OPTIONS request, There is little value for a spammer in sending an OPTIONS request,
since it is answered automatically by the UAS. No content is since it is answered automatically by the User Agent Server (UAS).
delivered to the user, and they are not consulted. No content is delivered to the user, and they are not consulted.
In the sections below, we consider the likelihood of these various In the sections below, we consider the likelihood of these various
forms of SIP spam. This is done in some cases by a rough cost forms of SIP spam. This is done in some cases by a rough cost
analysis. It should be noted that all of these analyses are analysis. It should be noted that all of these analyses are
approximate, and serve only to give a rough sense of the order of approximate, and serve only to give a rough sense of the order of
magnitude of the problem. magnitude of the problem.
2.1. Call Spam 2.1. Call Spam
Will call spam occur? That is an important question to answer. Will call spam occur? That is an important question to answer.
Clearly, it does occur in the existing telephone network, in the form Clearly, it does occur in the existing telephone network, in the form
of telemarketer calls. Although these calls are annoying, they do of telemarketer calls. Although these calls are annoying, they do
not arrive in the same kind of volume as email spam. The difference not arrive in the same kind of volume as email spam. The difference
is cost; it costs more for the spammer to make a phone call than it is cost; it costs more for the spammer to make a phone call than it
does to send email. This cost manifests itself in terms of the cost does to send email. This cost manifests itself in terms of the cost
for systems which can perform telemarketer call, and in cost per for systems that can perform telemarketer call, and in cost per call.
call.
Both of these costs are substantially reduced by SIP. A SIP call Both of these costs are substantially reduced by SIP. A SIP call
spam application is easy to write. It is just a SIP User Agent that spam application is easy to write. It is just a SIP User Agent that
initiates, in parallel, a large number of calls. If a call connects, initiates, in parallel, a large number of calls. If a call connects,
the spam application generates an ACK and proceeds to play out a the spam application generates an ACK and proceeds to play out a
recorded announcement, and then it terminates the call. This kind of recorded announcement, and then it terminates the call. This kind of
application can be built entirely in software, using readily application can be built entirely in software, using readily
available (and indeed, free) off the shelf software components. It available (and indeed, free) off-the-shelf software components. It
can run on a low end PC and requires no special expertise to execute. can run on a low-end PC and requires no special expertise to execute.
The cost per call is also substantially reduced. A normal The cost per call is also substantially reduced. A normal
residential phone line allows only one call to be placed at a time. residential phone line allows only one call to be placed at a time.
If additional lines are required, a user must purchase more expensive If additional lines are required, a user must purchase more expensive
connectivity. Typically, a T1 or T3 would be required for a large connectivity. Typically, a T1 or T3 would be required for a large-
volume telemarketing service. That kind of access is very expensive volume telemarketing service. That kind of access is very expensive
and well beyond the reach of an average user. A T1 line is and well beyond the reach of an average user. A T1 line is
approximately US $250 per month, and about 1.5 cents per minute for approximately US $250 per month, and about 1.5 cents per minute for
calls. T1 lines used only for outbound calls (such as in this case) calls. T1 lines used only for outbound calls (such as in this case)
are even more expensive than inbound trunks due to the reciprocal are even more expensive than inbound trunks due to the reciprocal
termination charges that a provider pays and receives. termination charges that a provider pays and receives.
There are two aspects to the capacity: the call attempt rate, and the There are two aspects to the capacity: the call attempt rate, and the
number of simultaneous successful calls that can be in progress. A number of simultaneous successful calls that can be in progress. A
T1 would allow a spammer at most 24 simultaneous calls, and assuming T1 would allow a spammer, at most, 24 simultaneous calls, and
about 10 seconds for each call attempt, about 2.4 call attempts per assuming about 10 seconds for each call attempt, about 2.4 call
second. At high volume calling, the per-minute rates far exceed the attempts per second. At high-volume calling, the per-minute rates
flat monthly fee for the T1. The result is a cost of 250,000 far exceed the flat monthly fee for the T1. The result is a cost of
microcents for each successful spam delivery, assuming 10 seconds of 250,000 microcents for each successful spam delivery, assuming 10
content. seconds of content.
With SIP, this cost is much reduced. Consider a spammer using a With SIP, this cost is much reduced. Consider a spammer using a
typical broadband Internet connection that provides 500 Kbps of typical broadband Internet connection that provides 500 Kbps of
upstream bandwidth. Initiating a call requires just a single INVITE upstream bandwidth. Initiating a call requires just a single INVITE
message. Assuming, for simplicity's sake, that this is 1 KB, a 500 message. Assuming, for simplicity's sake, that this is 1 KB, a 500
Kbps upstream DSL or cable modem connection will allow about 62 call Kbps upstream DSL or cable modem connection will allow about 62 call
attempts per second. A successful call requires enough bandwidth to attempts per second. A successful call requires enough bandwidth to
transmit a message to the receiver. Assuming a low compression codec transmit a message to the receiver. Assuming a low compression codec
(say, G.723.1 at 5.6 Kbps), as many as 46 simultaneous calls can be (say, G.723.1 at 5.3 Kbps), this requires approximately 16 Kbps after
in progress. With 10 seconds of content per call, that allows for RTP, UDP, and IP overheads. With 500 Kbps upstream bandwidth, this
4.6 successful call attempts per second. This means that a system means as many as 31 simultaneous calls can be in progress. With 10
could deliver a voice message successfully to users at a rate of seconds of content per call, that allows for 3.1 successful call
around 9 per second. If broadband access is around $50/month, the attempts per second. If broadband access is around $50/month, the
cost per successful voice spam is about 415 microcents each. This cost per successful voice spam is about 6.22 microcents each. This
assumes that calls can be made 24 hours a day, which may or may not assumes that calls can be made 24 hours a day, 30 days a month, which
be the case. may or may not be the case.
These figures indicate that SIP call spam is roughly three orders of These figures indicate that SIP call spam is roughly four orders of
magnitude cheaper to send than traditional circuit-based telemarketer magnitude cheaper to send than traditional circuit-based telemarketer
calls. This low cost is certainly going to be very attractive to calls. This low cost is certainly going to be very attractive to
spammers. Indeed, many spammers utilize computational and bandwidth spammers. Indeed, many spammers utilize computational and bandwidth
resources provided by others, by infecting their machines with resources provided by others, by infecting their machines with
viruses that turn them into "zombies" that can be used to generate viruses that turn them into "zombies" that can be used to generate
spam. This can reduce the cost of call spam to nearly zero. spam. This can reduce the cost of call spam to nearly zero.
Even ignoring the zombie issue, this reduction in cost is even more Even ignoring the zombie issue, this reduction in cost is even more
amplified for international calls. Currently, there is very little amplified for international calls. Currently, there are few
telemarketing calls across international borders, largely due to the telemarketing calls across international borders, largely due to the
large cost of making international calls. This is one of the reasons large cost of making international calls. This is one of the reasons
why the "do not call list", a United States national list of numbers why the "do not call list", a United States national list of numbers
that telemarketers cannot call - has been effective. The law only that telemarketers cannot call -- has been effective. The law only
affects U.S. companies, but since most telemarketing calls are affects U.S. companies, but since most telemarketing calls are
domestic, it has been effective. Unfortunately (and fortunately), domestic, it has been effective. Unfortunately (and fortunately),
the IP network provides no boundaries of these sorts, and calls to the IP network provides no boundaries of these sorts, and calls to
any SIP URI are possible from anywhere in the world. This will allow any SIP URI are possible from anywhere in the world. This will allow
for international spam at a significantly reduced cost. for international spam at a significantly reduced cost.
International spam is likely to be even more annoying that national
International spam is likely to be even more annoying than national
spam, since it may arrive in languages that the recipient doesn't spam, since it may arrive in languages that the recipient doesn't
even speak. even speak.
These figures assume that the primary limitation is the access These figures assume that the primary limitation is the access
bandwidth and not CPU, disk, or termination costs. Termination costs bandwidth and not CPU, disk, or termination costs. Termination costs
merit further discussion. Currently, most VoIP calls terminate on merit further discussion. Currently, most Voice over IP (VoIP) calls
the Public Switched Telephone Network (PSTN), and this termination terminate on the Public Switched Telephone Network (PSTN), and this
costs the originator of the call money. These costs are similar to termination costs the originator of the call money. These costs are
the per-minute rates of a T1. It ranges anywhere from half a cent to similar to the per-minute rates of a T1. It ranges anywhere from
three cents per minute, depending on volume and other factors. half a cent to three cents per minute, depending on volume and other
However, equipment costs, training and other factors are much lower factors. However, equipment costs, training, and other factors are
for SIP-based termination than a T1, making the cost still lower than much lower for SIP-based termination than a T1, making the cost still
circuit connectivity. Furthermore, the current trend in VoIP systems lower than circuit connectivity. Furthermore, the current trend in
is to make termination free for calls that never touch the PSTN, that VoIP systems is to make termination free for calls that never touch
is, calls to actual SIP endpoints. Thus, as more and more SIP the PSTN, that is, calls to actual SIP endpoints. Thus, as more and
endpoints come online, termination costs will probably drop. Until more SIP endpoints come online, termination costs will probably drop.
then, SIP spam can be used in concert with termination services for a Until then, SIP spam can be used in concert with termination services
lower cost form of traditional telemarketer calls, made to normal for a lower-cost form of traditional telemarketer calls, made to
PSTN endpoints. normal PSTN endpoints.
It is useful to compare these figures with email. VoIP can deliver It is useful to compare these figures with email. VoIP can deliver
approximately 9 successful call attempts per second. Email spam can, approximately 3.1 successful call attempts per second. Email spam
of course, deliver more. Assuming 1 KB per email, and an upstream can, of course, deliver more. Assuming 1 KB per email, and an
link of 500 Kbps, a spammer can generate 62.5 messages per second. upstream link of 500 Kbps, a spammer can generate 62.5 messages per
This number goes down with larger messages of course. Interestingly, second. This number goes down with larger messages of course.
spam filters delete large numbers of these mails, so the cost per Interestingly, spam filters delete large numbers of these mails, so
viewed message is likely to be much higher. In that sense, call spam the cost per viewed message is likely to be much higher. In that
is much more attractive, since its content is much more likely to be sense, call spam is much more attractive, since its content is much
examined by a user if a call attempt is successful. more likely to be examined by a user if a call attempt is successful.
Another part of the cost of spamming is collecting addresses. Another part of the cost of spamming is collecting addresses.
Spammers have, over time, built up immense lists of email addresses, Spammers have, over time, built up immense lists of email addresses,
each of the form user@domain, to which spam is directed. SIP uses each of the form user@domain, to which spam is directed. SIP uses
the same form of addressing, making it likely that email addresses the same form of addressing, making it likely that email addresses
can easily be turned into valid SIP addresses. Telephone numbers can easily be turned into valid SIP addresses. Telephone numbers
also represent valid SIP addresses; in concert with a termination also represent valid SIP addresses; in concert with a termination
provider, a spammer can direct SIP calls at traditional PSTN devices. provider, a spammer can direct SIP calls at traditional PSTN devices.
It is not clear whether email spammers have also been collecting It is not clear whether email spammers have also been collecting
phone numbers as they perform their web sweeps, but it is probably phone numbers as they perform their Web sweeps, but it is probably
not hard to do so. Furthermore, unlike email addresses, phone not hard to do so. Furthermore, unlike email addresses, phone
numbers are a finite address space and one that is fairly densely numbers are a finite address space and one that is fairly densely
packed. As a result, going sequentially through phone numbers is packed. As a result, going sequentially through phone numbers is
likely to produce a fairly high hit rate. Thus, it seems like the likely to produce a fairly high hit rate. Thus, it seems like the
cost is relatively low for a spammer to obtain large numbers of SIP cost is relatively low for a spammer to obtain large numbers of SIP
addresses to which spam can be directed. addresses to which spam can be directed.
2.2. IM Spam 2.2. IM Spam
IM spam is very much like email, in terms of the costs for deploying IM spam is very much like email, in terms of the costs for deploying
and generating spam. Assuming, for the sake of argument, a 1KB and generating spam. Assuming, for the sake of argument, a 1KB
message to be sent and 500 Kbps of upstream bandwidth, thats 62 message to be sent and 500 Kbps of upstream bandwidth, that is 62.5
messages per second. At $50/month, the result is 31 microcents per messages per second. At $50/month, the result is .31 microcents per
message. This is less than voice spam, but not substantially less. message. This is less than voice spam, but not substantially less.
The cost is probably on par with email spam. However, IM is much The cost is probably on par with email spam. However, IM is much
more intrusive than email. In today's systems, IMs automatically pop more intrusive than email. In today's systems, IMs automatically pop
up and present themselves to the user. Email, of course, must be up and present themselves to the user. Email, of course, must be
deliberately selected and displayed. However, most popular IM deliberately selected and displayed. However, most popular IM
systems employ white lists, which only allow IM to be delivered if systems employ white lists, which only allow IM to be delivered if
the sender is on the white list. Thus, whether or not IM spam will the sender is on the white list. Thus, whether or not IM spam will
be useful seems to depend a lot on the nature of the systems as the be useful seems to depend a lot on the nature of the systems as the
network is opened up. If they are ubiquitously deployed with white- network is opened up. If they are ubiquitously deployed with white-
list access, the value of IM spam is likely to be low. list access, the value of IM spam is likely to be low.
skipping to change at page 8, line 24 skipping to change at page 8, line 24
possible to deal with SIP spam. We primarily consider techniques possible to deal with SIP spam. We primarily consider techniques
that have been employed to deal with email spam. It is important to that have been employed to deal with email spam. It is important to
note that the solutions documented below are not meant to be an note that the solutions documented below are not meant to be an
exhaustive study of the spam solutions used for email but rather just exhaustive study of the spam solutions used for email but rather just
a representative set. We also consider some solutions that appear to a representative set. We also consider some solutions that appear to
be SIP-specific. be SIP-specific.
3.1. Content Filtering 3.1. Content Filtering
The most common form of spam protection used in email is based on The most common form of spam protection used in email is based on
content filtering. These spam filters analyze the content of the content filtering. Spam filters analyze the content of the email,
email, and look for clues that the email is spam. Bayesian spam and look for clues that the email is spam. Bayesian spam filters are
filters are in this category. in this category.
Unfortunately, this type of spam filtering, while successful for Unfortunately, this type of spam filtering, while successful for
email spam, is completely useless for call spam. There are two email spam, is completely useless for call spam. There are two
reasons. First, in the case where the user answers the call, the reasons. First, in the case where the user answers the call, the
call is already established and the user is paying attention before call is already established and the user is paying attention before
the content is delivered. The spam cannot be analyzed before the the content is delivered. The spam cannot be analyzed before the
user sees it. Second, if the content is stored before the user user sees it. Second, if the content is stored before the user
accesses it (e.g., with voicemail), the content will be in the form accesses it (e.g., with voicemail), the content will be in the form
of recorded audio or video. Speech and video recognition technology of recorded audio or video. Speech and video recognition technology
is not likely to be good enough to analyze the content and determine is not likely to be good enough to analyze the content and determine
whether or not it is spam. Indeed, if a system tried to perform whether or not it is spam. Indeed, if a system tried to perform
speech recognition on a recording in order to perform such an speech recognition on a recording in order to perform such an
analysis, it would be easy for the spammers to make calls with analysis, it would be easy for the spammers to make calls with
background noises, poor grammar and varied accents, all of which will background noises, poor grammar, and varied accents, all of which
throw off recognition systems. Video recognition is even harder to will throw off recognition systems. Video recognition is even harder
do and remains primarily an area of research. to do and remains primarily an area of research.
IM spam, due to its similarity to email, can be countered with IM spam, due to its similarity to email, can be countered with
content analysis tools. Indeed, the same tools and techniques used content analysis tools. Indeed, the same tools and techniques used
for email will directly work for IM spam. for email will directly work for IM spam.
Content filtering is unlikely to help for presence spam because it
can only be applied to the relative name being used to display the
requester of the presence information.
3.2. Black Lists 3.2. Black Lists
Black listing is an approach whereby the spam filter maintains a list Black listing is an approach whereby the spam filter maintains a list
of addresses that identify spammers. These addresses include both of addresses that identify spammers. These addresses include both
usernames (spammer@example.com) and entire domains (example.com). usernames (spammer@example.com) and entire domains (example.com).
Pure blacklists are not very effective in email for two reasons. Pure blacklists are not very effective in email for two reasons.
First, email addresses are easy to spoof, making it easy for the First, email addresses are easy to spoof, making it easy for the
sender to pretend to be someone else. If the sender varies the sender to pretend to be someone else. If the sender varies the
addresses they send from, the black list becomes almost completely addresses they send from, the black list becomes almost completely
useless. The second problem is that, even if the sender doesn't useless. The second problem is that, even if the sender doesn't
forge the from address, email addresses are in almost limitless forge the From address, email addresses are in almost limitless
supply. Each domain contains an infinite supply of email addresses, supply. Each domain contains an infinite supply of email addresses,
and new domains can be obtained for very low cost. Furthermore, and new domains can be obtained for very low cost. Furthermore,
there will always be public providers that will allow users to obtain there will always be public providers that will allow users to obtain
identities for almost no cost (for example, Yahoo or AOL mail identities for almost no cost (for example, Yahoo or AOL mail
accounts). The entire domain cannot be blacklisted because it accounts). The entire domain cannot be blacklisted because it
contains so many valid users. Blacklisting needs to be for contains so many valid users. Blacklisting needs to be for
individual users. Those identities are easily changed. individual users. Those identities are easily changed.
As a result, as long as identities are easy to manufacture, or As a result, as long as identities are easy to manufacture, or
zombies are used, black lists will have limited effectiveness for zombies are used, black lists will have limited effectiveness for
email. email.
Blacklists are also likely to be ineffective for SIP spam. Blacklists are also likely to be ineffective for SIP spam.
Mechanisms for inter-domain authenticated identity for email and sip Mechanisms for inter-domain authenticated identity for email and SIP
are discussed in Section 4 and Section 5. Assuming these mechanisms are discussed in Section 4 and Section 5. Assuming these mechanisms
are used and enabled in inter-domain communications, it becomes are used and enabled in inter-domain communications, it becomes
difficult to forge sender addresses. However, it still remains cheap difficult to forge sender addresses. However, it still remains cheap
to obtain a nearly infinite supply of addresses. to obtain a nearly infinite supply of addresses.
3.3. White Lists 3.3. White Lists
White lists are the opposite of black lists. It is a list of valid White lists are the opposite of black lists. It is a list of valid
senders that a user is willing to accept email from. Unlike black senders that a user is willing to accept email from. Unlike black
lists, a spammer can not change identities to get around the white lists, a spammer can not change identities to get around the white
skipping to change at page 10, line 18 skipping to change at page 10, line 18
don't have to manage this list just for the purposes of spam don't have to manage this list just for the purposes of spam
prevention; it provides general utility, and assists in spam prevention; it provides general utility, and assists in spam
prevention for free. Many popular IM systems also have strong prevention for free. Many popular IM systems also have strong
identity mechanisms since they do not allow communications with IM identity mechanisms since they do not allow communications with IM
systems in other administrative domains. The introduction problem in systems in other administrative domains. The introduction problem in
these systems is solved with a consent framework, described below. these systems is solved with a consent framework, described below.
The success of white lists in IM systems has applicability to SIP as The success of white lists in IM systems has applicability to SIP as
well. This is because SIP also provides a buddy list concept and has well. This is because SIP also provides a buddy list concept and has
an advanced presence system as part of its specifications. The an advanced presence system as part of its specifications. The
introduction problem remains. In email, techniques like the Turing introduction problem remains. In email, techniques like Turing tests
tests have been employed for this purpose. Those are considered have been employed to address the introduction problem. Turing tests
further in the sections below. As with email, a technique for are considered further in the sections below. As with email, a
solving the introduction problem would need to be applied in technique for solving the introduction problem would need to be
conjunction with a white list. applied in conjunction with a white list.
If a user's computer is compromised and used a zombie, that computer If a user's computer is compromised and used a zombie, that computer
can usually be used to send spam to anyone that has put the user on can usually be used to send spam to anyone that has put the user on
their white list. their white list.
3.4. Consent-Based Communications 3.4. Consent-Based Communications
A consent-based solution is used in conjunction with white or black A consent-based solution is used in conjunction with white or black
lists. That is, if user A is not on user B's white or black list, lists. That is, if user A is not on user B's white or black list,
and user A attempts to communicate with user B, user A's attempt is and user A attempts to communicate with user B, user A's attempt is
initially rejected, and they are told that consent is being initially rejected, and they are told that consent is being
requested. Next time user B connects, user B is informed that user A requested. Next time user B connects, user B is informed that user A
had attempted communications. User B can then authorize or reject had attempted communications. User B can then authorize or reject
user A. user A.
These kinds of consent-based systems are used widely in presence and These kinds of consent-based systems are used widely in presence and
IM. Since most of today's popular IM systems only allow IM. Since most of today's popular IM systems only allow
communications within a single administrative domain, sender communications within a single administrative domain, sender
identities can be authenticated. Email often uses similar consent identities can be authenticated. Email often uses similar consent-
based systems for mailing lists. They use a form of authentication based systems for mailing lists. They use a form of authentication
based on sending cookies to an email address to verify that a user based on sending cookies to an email address to verify that a user
can receive mail at that address. can receive mail at that address.
This kind of consent-based communications has been standardized in This kind of consent-based communications has been standardized in
SIP for presence, using the watcher information event package [7] and SIP for presence, using the watcher information event package [7] and
data format [8], which allow a user to find out that someone has data format [8], which allow a user to find out that someone has
subscribed. Then, the XML Configuration Access Protocol (XCAP) [10] subscribed. Then, the XML Configuration Access Protocol (XCAP) [10]
is used, along with the XML format for presence authorization [11] to is used, along with the XML format for presence authorization [11] to
provide permission for the user to communicate. provide permission for the user to communicate.
A consent framework has also been developed that is applicable to A consent framework has also been developed that is applicable to
other forms of SIP communications [12]. However, this framework other forms of SIP communications [12]. However, this framework
focuses on authorizing the addition of users to "mailing lists", focuses on authorizing the addition of users to "mailing lists",
known as exploders in SIP terminology. Though spammers typically use known as exploders in SIP terminology. Though spammers typically use
such exploder functions, presumably one run by a spammer would not such exploder functions, presumably one run by a spammer would not
use this technique. Consequently, this consent framework is not use this technique. Consequently, this consent framework is not
directly applicable to the spam problem. It is, however, useful as a directly applicable to the spam problem. It is, however, useful as a
tool for managing a white list. Through the PUBLISH mechanism, it tool for managing a white list. Through the PUBLISH mechanism, it
allows a user to upload a permission document [13] which indicates allows a user to upload a permission document [13] that indicates
that they will only accept incoming calls from a particular sender. that they will only accept incoming calls from a particular sender.
Can a consent framework, like the ones used for presence, help solve Can a consent framework, like the ones used for presence, help solve
call spam? At first glance, it would seem to help a lot. However, call spam? At first glance, it would seem to help a lot. However,
it might just change the nature of the spam. Instead of being it might just change the nature of the spam. Instead of being
bothered with content, in the form of call spam or IM spam, users are bothered with content, in the form of call spam or IM spam, users are
bothered with consent requests. A user's "communications inbox" bothered with consent requests. A user's "communications inbox"
might instead be filled with requests for communications from a might instead be filled with requests for communications from a
multiplicity of users. Those requests for communications don't multiplicity of users. Those requests for communications don't
convey much useful content to the user, but they can convey some. At convey much useful content to the user, but they can convey some. At
skipping to change at page 11, line 49 skipping to change at page 11, line 49
consent is required first, the value in sending spam is reduced, and consent is required first, the value in sending spam is reduced, and
perhaps it will cease for those spam cases where consent is not given perhaps it will cease for those spam cases where consent is not given
to spammers. to spammers.
As such, the real question is whether or not the consent system would As such, the real question is whether or not the consent system would
make it possible for a user to give consent to non-spammers and make it possible for a user to give consent to non-spammers and
reject spammers. Authenticated identity can help. A user in an reject spammers. Authenticated identity can help. A user in an
enterprise would know to give consent to senders in other enterprises enterprise would know to give consent to senders in other enterprises
in the same industry, for example. However, in the consumer space, in the same industry, for example. However, in the consumer space,
if sip:bob@example.com tries to communicate with a user, how does if sip:bob@example.com tries to communicate with a user, how does
that user determine whether bob is a spammer or a long-lost friend that user determine whether Bob is a spammer or a long-lost friend
from high school? There is no way based on the identity alone. In from high school? There is no way based on the identity alone. In
such a case, a useful technique is to grant permission for bob to such a case, a useful technique is to grant permission for Bob to
communicate but to ensure that the permission is extremely limited. communicate but to ensure that the permission is extremely limited.
In particular, bob may be granted permission to send no more than 200 In particular, Bob may be granted permission to send no more than 200
words of text in a single IM, which he can use to identify himself, words of text in a single IM, which he can use to identify himself,
so that the user can determine whether or not more permissions are so that the user can determine whether or not more permissions are
appropriate. It may even be possible that an automated system could appropriate. It may even be possible that an automated system could
do some form of content analysis on this initial short message. do some form of content analysis on this initial short message.
However, this 200 words of text may be enough for a spammer to convey However, this 200 words of text may be enough for a spammer to convey
their message, in much the same way they might convey it in the user their message, in much the same way they might convey it in the user
part of the SIP URI. part of the SIP URI.
Thus, it seems that a consent-based framework, along with white lists Thus, it seems that a consent-based framework, along with white lists
and black lists, cannot fully solve the problem for SIP, although it and black lists, cannot fully solve the problem for SIP, although it
skipping to change at page 12, line 30 skipping to change at page 12, line 30
A reputation system is also used in conjunction with white or black A reputation system is also used in conjunction with white or black
lists. Assume that user A is not on user B's white list, and A lists. Assume that user A is not on user B's white list, and A
attempts to contact user B. If a consent-based system is used, B is attempts to contact user B. If a consent-based system is used, B is
prompted to consent to communications from A, and along with the prompted to consent to communications from A, and along with the
consent, a reputation score might be displayed in order to help B consent, a reputation score might be displayed in order to help B
decide whether or not they should accept communications from A. decide whether or not they should accept communications from A.
Traditionally, reputation systems are implemented in highly Traditionally, reputation systems are implemented in highly
centralized messaging architectures; the most widespread reputation centralized messaging architectures; the most widespread reputation
systems in messaging today have been deployed by monolithic instant systems in messaging today have been deployed by monolithic instant
messaging providers (though many web sites with a high degree of messaging providers (though many Web sites with a high degree of
interactivity employ very similar concepts of reputation). interactivity employ very similar concepts of reputation).
Reputation is calculated based on user feedback. For example, a Reputation is calculated based on user feedback. For example, a
button on the user interface of the messaging client might empower button on the user interface of the messaging client might empower
users to inform the system that a particular user is abusive. Of users to inform the system that a particular user is abusive. Of
course, the input of any single user has to be insufficient to ruin course, the input of any single user has to be insufficient to ruin
one's reputation, but consistent negative feedback would give the one's reputation, but consistent negative feedback would give the
abusive user a negative reputation score. abusive user a negative reputation score.
Reputation systems have been successful in systems where Reputation systems have been successful in systems where
centralization of resources (user identities, authentication, etc.) centralization of resources (user identities, authentication, etc.)
and monolithic control dominate. Examples of these include the large and monolithic control dominate. Examples of these include the large
instant messaging providers that run IM system that do not exchange instant messaging providers that run IM systems that do not exchange
messages with other administrative domains. That control, first of messages with other administrative domains. That control, first of
all, provides a relatively strong identity assertion for users (since all, provides a relatively strong identity assertion for users (since
all users trust a common provider, and the common provider is the all users trust a common provider, and the common provider is the
arbiter of authentication and identity). Secondly, it provides a arbiter of authentication and identity). Secondly, it provides a
single place where reputation can be managed. single place where reputation can be managed.
Reputation systems based on negative reputation scores suffer from Reputation systems based on negative reputation scores suffer from
many of the same problems as black lists, since effectively the many of the same problems as black lists, since effectively the
consequence of having a negative reputation is that you are consequence of having a negative reputation is that you are
blacklisted. If identities are very easy to acquire, a user with a blacklisted. If identities are very easy to acquire, a user with a
negative reputation will simply acquire a new one. Moreover, negative reputation will simply acquire a new identity. Moreover,
negative reputation is generated by tattling, which requires users to negative reputation is generated by tattling, which requires users to
be annoyed enough to click the warning button. Additionally, it can be annoyed enough to click the warning button -- a process that can
be abused. In some reputation systems, "reputation mafias" be abused. In some reputation systems, "reputation mafias"
consisting of large numbers of users routinely bully or extort consisting of large numbers of users routinely bully or extort
victims by threatening collectively to give victims a negative victims by threatening collectively to give victims a negative
reputation. reputation.
Reputation systems based on positive reputation, where users praise Reputation systems based on positive reputation, where users praise
each other for being good, rather than tattling on each other for each other for being good, rather than tattling on each other for
being bad, have some similar drawbacks. Collectives of spammers, or being bad, have some similar drawbacks. Collectives of spammers, or
just one spammer who acquires a large number identities, could praise just one spammer who acquires a large number identities, could praise
one another in order to create an artificial positive reputation. one another in order to create an artificial positive reputation.
Users similarly have to overcome the inertia required to press the Users similarly have to overcome the inertia required to press the
"praise" button. Unlike negative reputation systems, however, "praise" button. Unlike negative reputation systems, however,
positive reputation is not circumvented when users require a new positive reputation is not circumvented when users acquire a new
identity, since basing authorization decisions on positive reputation identity, since basing authorization decisions on positive reputation
is essentially a form of white listing. is essentially a form of white listing.
So, while positive reputation systems are superior to negative So, while positive reputation systems are superior to negative
reputation systems, they are far from perfect. Intriguingly, though, reputation systems, they are far from perfect. Intriguingly, though,
combining presence-based systems with reputation systems leads to an combining presence-based systems with reputation systems leads to an
interesting fusion. The "buddy-list" concept of presence is, in interesting fusion. The "buddy-list" concept of presence is, in
effect, a white list - and one can therefore probably infer that the effect, a white list - and one can infer that the users on one's
users on one's buddy list are people whom you are "praising". This buddy list are people whom you are "praising". This eliminates the
eliminates the problem of user inertia in the use of the "praise" problem of user inertia in the use of the "praise" button, and
button, and automates the initial establishment of reputation. automates the initial establishment of reputation.
And of course, your buddies in turn have buddies. Collectively, you And of course, your buddies in turn have buddies. Collectively, you
and your buddies (and their buddies, and so on) constitute a social and your buddies (and their buddies, and so on) constitute a social
network of reputation. If there were a way to leverage this social network of reputation. If there were a way to leverage this social
network, it would eliminate the need for centralization of the network, it would eliminate the need for centralization of the
reputation system. Your perception of a particular user's reputation reputation system. Your perception of a particular user's reputation
might be dependent on your relationship to them in the social might be dependent on your relationship to them in the social
network: are they one buddy removed (strong reputation), four buddies network: are they one buddy removed (strong reputation), four buddies
removed (weaker reputation), three buddies removed but connected to removed (weaker reputation), three buddies removed but connected to
you through several of your buddies, etc. This web of trust you through several of your buddies, etc. This web of trust
skipping to change at page 14, line 8 skipping to change at page 14, line 8
your own social network. your own social network.
If a users machine is compromised and turned into a zombie, this If a users machine is compromised and turned into a zombie, this
allows SPAM to be sent and may impact their reputation in a negative allows SPAM to be sent and may impact their reputation in a negative
way. Once their reputation decreases, it becomes extremely difficult way. Once their reputation decreases, it becomes extremely difficult
to reestablish a positive reputation. to reestablish a positive reputation.
3.6. Address Obfuscation 3.6. Address Obfuscation
Spammers build up their spam lists by gathering email addresses from Spammers build up their spam lists by gathering email addresses from
web sites and other public sources of information. One way to Web sites and other public sources of information. One way to
minimize spam is to make your address difficult or impossible to minimize spam is to make your address difficult or impossible to
gather. Spam bots typically look for text in pages of the form gather. Spam bots typically look for text in pages of the form
"user@domain", and assume that anything of that form is an email "user@domain", and assume that anything of that form is an email
address. To hide from such spam bots, many websites have recently address. To hide from such spam bots, many Web sites have recently
begun placing email addresses in an obfuscated form, usable to humans begun placing email addresses in an obfuscated form, usable to humans
but difficult for an automata to read as an email address. Examples but difficult for an automata to read as an email address. Examples
include forms such as, "user at example dot com" or "j d r o s e n a include forms such as, "user at example dot com" or "j d r o s e n a
t e x a m p l e d o t c o m". t e x a m p l e d o t c o m".
These techniques are equally applicable to prevention of SIP spam, These techniques are equally applicable to prevention of SIP spam,
and are likely to be as equally effective or ineffective in its and are likely to be as equally effective or ineffective in its
prevention. prevention.
It is worth mentioning that the source of addresses need not be a web It is worth mentioning that the source of addresses need not be a Web
site - any publicly accessible service containing addresses will site - any publicly accessible service containing addresses will
suffice. As a result, ENUM [9] has been cited as a potential gold suffice. As a result, ENUM [9] has been cited as a potential gold
mine for spammers. It would allow a spammer to collect SIP and other mine for spammers. It would allow a spammer to collect SIP and other
URIs by traversing the tree in e164.arpa and mining it for data. URIs by traversing the tree in e164.arpa and mining it for data.
This problem is mitigated in part if only number prefixes, as opposed This problem is mitigated in part if only number prefixes, as opposed
to actual numbers, appear in the DNS. Even in that case, however, it to actual numbers, appear in the DNS. Even in that case, however, it
provides a technique for a spammer to learn which phone numbers are provides a technique for a spammer to learn which phone numbers are
reachable through cheaper direct SIP connectivity. reachable through cheaper direct SIP connectivity.
3.7. Limited Use Addresses 3.7. Limited-Use Addresses
A related technique to address obfuscation is limited use addresses. A related technique to address obfuscation is limited-use addresses.
In this technique, a user has a large number of email addresses at In this technique, a user has a large number of email addresses at
their disposal, each of which has constraints on its applicability. their disposal, each of which has constraints on its applicability.
A limited use address can be time-bound, so that it expires after a A limited-use address can be time-bound, so that it expires after a
fixed period. Or, a different email address can be given to each fixed period. Or, a different email address can be given to each
correspondent. When spam arrives from that correspondent, the correspondent. When spam arrives from that correspondent, the
limited use address they were given is terminated. In another limited-use address they were given is terminated. In another
variation, the same limited use address is given to multiple users variation, the same limited-use address is given to multiple users
that share some property; for example, all work colleagues, all that share some property; for example, all work colleagues, all
coworkers from different companies, all retailers, and so on. Should coworkers from different companies, all retailers, and so on. Should
spam begin arriving on one of the addresses, it is invalidated, spam begin arriving on one of the addresses, it is invalidated,
preventing communications from anyone else that received the limited preventing communications from anyone else that received the limited
use address. use address.
This technique is equally applicable to SIP. One of the drawbacks of This technique is equally applicable to SIP. One of the drawbacks of
the approach is that it can make it hard for people to reach you; if the approach is that it can make it hard for people to reach you; if
an email address you hand out to a friend becomes spammed, changing an email address you hand out to a friend becomes spammed, changing
it requires you to inform your friend of the new address. SIP can it requires you to inform your friend of the new address. SIP can
help solve this problem in part, by making use of presence [6]. help solve this problem in part, by making use of presence [6].
Instead of handing out your email address to your friends, you would Instead of handing out your email address to your friends, you would
hand out your presence URI. When a friend wants to send you an hand out your presence URI. When a friend wants to send you an
email, they subscribe to your presence (indeed, they are likely email, they subscribe to your presence (indeed, they are likely to be
continuously subscribed from a buddy list application). The presence continuously subscribed from a buddy list application). The presence
data can include an email address where you can be reached. This data can include an email address where you can be reached. This
email address can be obfuscated and be of single use, different for email address can be obfuscated and be of single use, different for
each buddy who requests your presence. They can also be constantly each buddy who requests your presence. They can also be constantly
changed, as these changes are pushed directly to your buddies. In a changed, as these changes are pushed directly to your buddies. In a
sense, the buddy list represents an automatically updated address sense, the buddy list represents an automatically updated address
book, and would therefore eliminate the problem. book, and would therefore eliminate the problem.
Another approach is to give a different address to each and every Another approach is to give a different address to each and every
correspondent, so that it is never necessary to tell a "good" user correspondent, so that it is never necessary to tell a "good" user
that an address needs to be changed. This is an extreme form of that an address needs to be changed. This is an extreme form of
limited use addresses, which can be called a single-use address. limited-use addresses, which can be called a single-use address.
Mechanisms are available in SIP for the generation of [16] an Mechanisms are available in SIP for the generation of [16] an
infinite supply of single use addresses. However, the hard part infinite supply of single use addresses. However, the hard part
remains a useful mechanism for distribution and management of those remains a useful mechanism for distribution and management of those
addresses. addresses.
3.8. Turing Tests 3.8. Turing Tests
In email, Turing tests are those solutions whereby the sender of the In email, Turing tests are mechanisms whereby the sender of the
message is given some kind of puzzle or challenge, which only a human message is given some kind of puzzle or challenge, which only a human
can answer (since Turing tests rely on video or audio puzzles, they can answer (since Turing tests rely on video or audio puzzles, they
sometimes cannot be solved by individuals with handicaps). These sometimes cannot be solved by individuals with handicaps). These
tests are also known as captchas (Completely Automated Public Turing tests are also known as captchas (Completely Automated Public Turing
test to tell Computers and Humans Apart). If the puzzle is answered test to tell Computers and Humans Apart). If the puzzle is answered
correctly, the sender is placed on the user's white list. These correctly, the sender is placed on the user's white list. These
puzzles frequently take the form of recognizing a word or sequence of puzzles frequently take the form of recognizing a word or sequence of
numbers in an image with a lot of background noise. The tests need numbers in an image with a lot of background noise. The tests need
to be designed such that automata cannot easily perform the image to be designed such that automata cannot easily perform the image
recognition needed to extract the word or number sequence, but a recognition needed to extract the word or number sequence, but a
skipping to change at page 16, line 22 skipping to change at page 16, line 22
for an automated speech recognition system to be applied to the for an automated speech recognition system to be applied to the
media. The user then enters the numbers on their keypad. If they media. The user then enters the numbers on their keypad. If they
are entered correctly, the user is added to the white list. are entered correctly, the user is added to the white list.
This kind of voice-based Turing test is easily extended to a variety This kind of voice-based Turing test is easily extended to a variety
of media, such as video and text, and user interfaces by making use of media, such as video and text, and user interfaces by making use
of the SIP application interaction framework [14]. This framework of the SIP application interaction framework [14]. This framework
allows client devices to interact with applications in the network, allows client devices to interact with applications in the network,
where such interaction is done with stimulus signaling, including where such interaction is done with stimulus signaling, including
keypads (supported with the Keypad Markup Language [15]), but also keypads (supported with the Keypad Markup Language [15]), but also
including web browsers, voice recognition, and so on. The framework including Web browsers, voice recognition, and so on. The framework
allows the application to determine the media capabilities of the allows the application to determine the media capabilities of the
device (or user, in cases where they are handicapped) and interact device (or user, in cases where they are handicapped) and interact
with them appropriately. with them appropriately.
In the case of voice, the Turing test would need to be made to run in In the case of voice, the Turing test would need to be made to run in
the language of the caller. This is possible in SIP, using the the language of the caller. This is possible in SIP, using the
Accept-Language header field, though this is not widely used at the Accept-Language header field, though this is not widely used at the
moment, and meant for languages of SIP message components, not the moment, and meant for languages of SIP message components, not the
media streams. media streams.
The primary problem with the voice Turing test is the same one that The primary problem with the voice Turing test is the same one that
email tests have: instead of having an automata process the test, a email tests have: instead of having an automata process the test, a
spammer can pay cheap workers to take the tests. Assuming cheap spammer can pay cheap workers to take the tests. Assuming cheap
labor in a poor country can be obtained for about 60 cents per hour, labor in a poor country can be obtained for about 60 cents per hour,
and assuming a Turing test of 30 second duration, this is about 0.50 and assuming a Turing test of a 30-second duration, this is about
cents per test and thus 0.50 cents per message to send an IM spam. 0.50 cents per test and thus 0.50 cents per message to send an IM
Lower labor rates would reduce this further; the number quoted here spam. Lower labor rates would reduce this further; the number quoted
is based on real online bids in September of 2006 made for actual here is based on real online bids in September of 2006 made for
work of this type. actual work of this type.
As an alternative to paying cheap workers to take the tests, the As an alternative to paying cheap workers to take the tests, the
tests can be taken by human users that are tricked into completing tests can be taken by human users that are tricked into completing
the tests in order to gain access to what they believe is a the tests in order to gain access to what they believe is a
legitimate resource. This was done by a spambot that posted the legitimate resource. This was done by a spambot that posted the
tests on a pornography site, and required users to complete the tests tests on a pornography site, and required users to complete the tests
in order to gain access to content. in order to gain access to content.
Due to these limitations, Turing tests may never completely solve the Due to these limitations, Turing tests may never completely solve the
problem. problem.
skipping to change at page 17, line 17 skipping to change at page 17, line 17
This technique is similar to Turing tests. When user A tries to This technique is similar to Turing tests. When user A tries to
communicate with user B, user B asks user A to perform a computation communicate with user B, user B asks user A to perform a computation
and pass the result back. This computation has to be something a and pass the result back. This computation has to be something a
human user cannot perform and something expensive enough to increase human user cannot perform and something expensive enough to increase
user A's cost to communicate. This cost increase has to be high user A's cost to communicate. This cost increase has to be high
enough to make it prohibitively expensive for spammers but enough to make it prohibitively expensive for spammers but
inconsequential for legitimate users. inconsequential for legitimate users.
One of the problems with the technique is that there is wide One of the problems with the technique is that there is wide
variation in the computational power of the various clients that variation in the computational power of the various clients that
might legitimately communicate. The CPU speed on a low end cell might legitimately communicate. The CPU speed on a low-end cell
phone is around 50 MHz, while a high end PC approaches 5 GHz. This phone is around 50 MHz, while a high-end PC approaches 5 GHz. This
represents almost two orders of magnitude difference. Thus, if the represents almost two orders of magnitude difference. Thus, if the
test is designed to be reasonable for a cell phone to perform, it is test is designed to be reasonable for a cell phone to perform, it is
two orders of magnitude cheaper to perform for a spammer on a high two orders of magnitude cheaper to perform for a spammer on a high-
end machine. Recent research has focused on defining computational end machine. Recent research has focused on defining computational
puzzles that challenge the CPU/memory bandwidth, as opposed to just puzzles that challenge the CPU/memory bandwidth, as opposed to just
the CPU [26]. It seems that there is less variety in the CPU/memory the CPU [26]. It seems that there is less variety in the CPU/memory
bandwidth across devices, roughly a single order of magnitude. bandwidth across devices, roughly a single order of magnitude.
Recent work [28] suggests that, due to the ability of spammers to use Recent work [28] suggests that, due to the ability of spammers to use
virus-infected machines (also known as zombies) to generate the spam, virus-infected machines (also known as zombies) to generate the spam,
the amount of computational power available to the spammers is the amount of computational power available to the spammers is
substantial, and it may be impossible to have them compute a puzzle substantial, and it may be impossible to have them compute a puzzle
that is sufficiently hard that will not also block normal emails. If that is sufficiently hard that will not also block normal emails. If
skipping to change at page 17, line 48 skipping to change at page 17, line 48
with the introduction problem. with the introduction problem.
These techniques are an active area of research right now, and any These techniques are an active area of research right now, and any
results for email are likely to be usable for SIP. results for email are likely to be usable for SIP.
3.10. Payments at Risk 3.10. Payments at Risk
This approach has been proposed for email [27]. When user A sends This approach has been proposed for email [27]. When user A sends
email to user B, user A deposits a small amount of money (say, one email to user B, user A deposits a small amount of money (say, one
dollar) into user B's account. If user B decides that the message is dollar) into user B's account. If user B decides that the message is
not spam, user B refunds this money back to user A. If the message is not spam, user B refunds this money back to user A. If the message
spam, user B keeps the money. This technique requires two is spam, user B keeps the money. This technique requires two
transactions to complete: a transfer from A to B, and a transfer from transactions to complete: a transfer from A to B, and a transfer from
B back to A. The first transfer has to occur before the message can B back to A. The first transfer has to occur before the message can
be received in order to avoid reuse of "pending payments" across be received in order to avoid reuse of "pending payments" across
several messages, which would eliminate the utility of the solution. several messages, which would eliminate the utility of the solution.
The second one then needs to occur when the message is found not to The second one then needs to occur when the message is found not to
be spam. be spam.
This technique appears just as applicable to call spam and IM spam as This technique appears just as applicable to call spam and IM spam as
it is to email spam. Like many of the other techniques, this it is to email spam. Like many of the other techniques, this
exchange would only happen the first time you talk to people. Its exchange would only happen the first time you talk to people. Its
proper operation therefore requires a good authenticated identity proper operation therefore requires a good authenticated identity
infrastructure. infrastructure.
This technique has the potential make it arbitrarily expensive to This technique has the potential to make it arbitrarily expensive to
send spam of any sort. However, it relies on cheap micro-payment send spam of any sort. However, it relies on cheap micro-payment
techniques on the Internet. Traditional costs for internet payments techniques on the Internet. Traditional costs for Internet payments
are around 25 cents per transaction, which would probably be are around 25 cents per transaction, which would probably be
prohibitive. However, recent providers have been willing to charge prohibitive. However, recent providers have been willing to charge
15% of the transaction for small transactions, as small as one cent. 15% of the transaction for small transactions, as small as one cent.
This cost would have to be shouldered by users of the system. The This cost would have to be shouldered by users of the system. The
cost that would need to be shouldered per user is equal to the number cost that would need to be shouldered per user is equal to the number
of messages from unknown senders (that is, senders not on the white of messages from unknown senders (that is, senders not on the white
list) that are received. For a busy user, assume about 10 new list) that are received. For a busy user, assume about 10 new
senders per day. If the deposit is 5 cents, the transaction provider senders per day. If the deposit is 5 cents, the transaction provider
would take 0.75 cents and deliver 4.25 cents. If the sender is would take 0.75 cents and deliver 4.25 cents. If the sender is
allowed, the recipient returns 4.25 cents, the provider takes 0.64 allowed, the recipient returns 4.25 cents, the provider takes 0.64
cents, and returns 3.6 cents. This costs the sender 0.65 cents on cents, and returns 3.6 cents. This costs the sender 0.65 cents on
each transaction, if it was legitimate. If there are ten new each transaction, if it was legitimate. If there are ten new
recipients per day, thats US $1.95 per month, which is relatively recipients per day, that is US $1.95 per month, which is relatively
inexpensive. inexpensive.
Assuming a micro-payment infrastructure exists, another problem with Assuming a micro-payment infrastructure exists, another problem with
payment-at-risk is that it loses effectiveness when there are strong payment-at-risk is that it loses effectiveness when there are strong
inequities in the value of currency between sender and recipient. inequities in the value of currency between sender and recipient.
For example, a poor person in a third world country might keep the For example, a poor person in a Third World country might keep the
money in each mail message, regardless if it is spam. Similarly, a money in each mail message, regardless of whether it is spam.
poor person might not be willing to include money in an email, even Similarly, a poor person might not be willing to include money in an
if legitimate, for fear that the recipient might keep it. If the email, even if legitimate, for fear that the recipient might keep it.
amount of money is lowered to help handle these problems, it might If the amount of money is lowered to help handle these problems, it
become sufficiently small that spammers can just afford to spend it. might become sufficiently small that spammers can just afford to
spend it.
3.11. Legal Action 3.11. Legal Action
In this solution, countries pass laws that prohibit spam. These laws In this solution, countries pass laws that prohibit spam. These laws
could apply to IM or call spam just as easily as they could apply to could apply to IM or call spam just as easily as they could apply to
email spam. There is a lot of debate about whether these laws would email spam. There is a lot of debate about whether these laws would
really be effective in preventing spam. really be effective in preventing spam.
As a recent example in the US, "do not call" lists seem to be As a recent example in the US, "do not call" lists seem to be
effective. However, due to the current cost of long distance phone effective. However, due to the current cost of long-distance phone
calls, the telemarketing is coming from companies within the US. As calls, the telemarketing is coming from companies within the US. As
such, calls from such telemarketers can be traced. If a telemarketer such, calls from such telemarketers can be traced. If a telemarketer
violates the "do not call" list, the trace allows legal action to be violates the "do not call" list, the trace allows legal action to be
taken against them. A similar "do not irritate" list for VoIP or for taken against them. A similar "do not irritate" list for VoIP or for
email would be less likely to work because the spam is likely to come email would be less likely to work because the spam is likely to come
from international sources. This problem could be obviated if there from international sources. This problem could be obviated if there
was a strong way to identify the sender's legal entity, and then was a strong way to identify the sender's legal entity, and then
determine whether it was in a jurisdiction where it was practical to determine whether it was in a jurisdiction where it was practical to
take legal action against them. If the spammer is not in such a take legal action against them. If the spammer is not in such a
jurisdiction, the SIP spam could be rejected. jurisdiction, the SIP spam could be rejected.
skipping to change at page 19, line 34 skipping to change at page 19, line 35
In this model, a group of domains (e.g., a set of enterprises) all In this model, a group of domains (e.g., a set of enterprises) all
get together. They agree to exchange SIP calls amongst each other, get together. They agree to exchange SIP calls amongst each other,
and they also agree to introduce a fine should any one of them be and they also agree to introduce a fine should any one of them be
caught spamming. Each company would then enact measures to terminate caught spamming. Each company would then enact measures to terminate
employees who spam from their accounts. employees who spam from their accounts.
This technique relies on secure inter-domain authentication - that This technique relies on secure inter-domain authentication - that
is, domain B can know that messages are received from domain A. In is, domain B can know that messages are received from domain A. In
SIP, this is readily provided by usage of the mutually authenticated SIP, this is readily provided by usage of the mutually authenticated
Transport Level Security (TLS)[22] between providers or SIP Identity. Transport Level Security (TLS)[22] between providers or SIP Identity
[17].
This kind of technique works well for small domains or small sets of This kind of technique works well for small domains or small sets of
providers, where these policies can be easily enforced. However, it providers, where these policies can be easily enforced. However, it
is unclear how well it scales up. Could a very large domain truly is unclear how well it scales up. Could a very large domain truly
prevent its users from spamming? At what point would the network be prevent its users from spamming? At what point would the network be
large enough that it would be worthwhile to send spam and just pay large enough that it would be worthwhile to send spam and just pay
the fine? How would the pricing be structured to allow both small the fine? How would the pricing be structured to allow both small
and large domains alike to participate? and large domains alike to participate?
3.13. Centralized SIP Providers 3.13. Centralized SIP Providers
This technique is a variation on the circles of trust described in This technique is a variation on the circles of trust described in
Section 3.12. A small number of providers get established as "inter- Section 3.12. A small number of providers get established as "inter-
domain SIP providers". These providers act as a SIP-equivalent to domain SIP providers". These providers act as a SIP-equivalent to
the interexchange carriers in the PSTN. Every enterprise, consumer the interexchange carriers in the PSTN. Every enterprise, consumer
SIP provider or other SIP network (call these the local SIP SIP provider, or other SIP network (call these the local SIP
providers) connects to one of these inter-domain providers. The providers) connects to one of these inter-domain providers. The
local SIP providers only accept SIP messages from their chosen inter- local SIP providers only accept SIP messages from their chosen inter-
domain provider. The inter-domain provider charges the local domain provider. The inter-domain provider charges the local
provider, per SIP message, for the delivery of SIP messages to other provider, per SIP message, for the delivery of SIP messages to other
local providers. The local provider can choose to pass on this cost local providers. The local provider can choose to pass on this cost
to its own customers if it so chooses. to its own customers if it so chooses.
The inter-domain SIP providers then form bi-lateral agreements with The inter-domain SIP providers then form bi-lateral agreements with
each other, exchanging SIP messages according to strict contracts. each other, exchanging SIP messages according to strict contracts.
These contracts require that each of the inter-domain providers be These contracts require that each of the inter-domain providers be
skipping to change at page 21, line 38 skipping to change at page 21, line 41
4.2. Signature-Based Techniques 4.2. Signature-Based Techniques
Domain Keys Identified Mail (DKIM) Signatures[23] (and several non- Domain Keys Identified Mail (DKIM) Signatures[23] (and several non-
standard techniques that preceded it) provide strong identity standard techniques that preceded it) provide strong identity
assertions by allowing the sending domain to sign an email, and then assertions by allowing the sending domain to sign an email, and then
providing mechanisms by which the receiving MTA or Mail User Agent providing mechanisms by which the receiving MTA or Mail User Agent
(MUA) can validate the signature. (MUA) can validate the signature.
Unfortunately, when used with blacklists, this kind of authenticated Unfortunately, when used with blacklists, this kind of authenticated
identity is only as useful as the fraction of the emails which identity is only as useful as the fraction of the emails that utilize
utilize it. This is partly true for white lists as well; if any it. This is partly true for white lists as well; if any
unauthenticated email is accepted for an address on a white list, a unauthenticated email is accepted for an address on a white list, a
spammer can spoof that address. However a white list can be spammer can spoof that address. However, a white list can be
effective with limited deployment of DKIM if all of the people on the effective with limited deployment of DKIM if all the people on the
white list are those whose domains are utilizing the mechanism, and white list are those whose domains are utilizing the mechanism, and
the users on that whitelist aren't zombies. the users on that whitelist aren't zombies.
This kind of identity mechanism is also applicable to SIP, and is in This kind of identity mechanism is also applicable to SIP, and is in
fact exactly what is defined by SIP's authenticated identity fact, exactly what is defined by SIP's authenticated identity
mechanism [17]. mechanism [17].
Other signature based approaches for email include S/MIME[24] and Other signature-based approaches for email include S/MIME[24] and
OpenPGP[25]. OpenPGP[25].
5. Authenticated Identity in SIP 5. Authenticated Identity in SIP
One of the key parts of many of the solutions described above is the One of the key parts of many of the solutions described above is the
ability to securely identify the sender of a SIP message. SIP ability to securely identify the sender of a SIP message. SIP
provides a secure solution for this problem, called SIP Identity provides a secure solution for this problem, called SIP Identity
[17], and it is important to discuss it here. [17], and it is important to discuss it here.
The solution starts by having each domain authenticate its own users. The solution starts by having each domain authenticate its own users.
skipping to change at page 22, line 40 skipping to change at page 22, line 43
A weaker form of identity assertion is possible using the P-Asserted- A weaker form of identity assertion is possible using the P-Asserted-
Identity header field [5], but this technique requires mutual trust Identity header field [5], but this technique requires mutual trust
among all domains. Unfortunately, this becomes exponentially harder among all domains. Unfortunately, this becomes exponentially harder
to provide as the number of interconnected domains grows. As that to provide as the number of interconnected domains grows. As that
happens, the value of the identity assertion becomes equal to the happens, the value of the identity assertion becomes equal to the
trustworthiness of the least trustworthy domain. Since spam is a trustworthiness of the least trustworthy domain. Since spam is a
consequence of the receiving domain not being able to trust the consequence of the receiving domain not being able to trust the
sending domains to disallow the hosts in the sending to send spam, sending domains to disallow the hosts in the sending to send spam,
the P-Asserted-Identity technique becomes ineffective at exactly the the P-Asserted-Identity technique becomes ineffective at exactly the
same levels of interconnectness that introduce spam. same levels of interconnectedness that introduce spam.
Consider the following example to help illustrate this fact. A Consider the following example to help illustrate this fact. A
malicious domain, let us call them spam.example.com, would like to malicious domain -- let us call them spam.example.com, would like to
send SIP INVITE requests with false P-Asserted-Identity, indicating send SIP INVITE requests with false P-Asserted-Identity, indicating
users outside of its own domain. spam.example.com finds a regional users outside of its own domain. spam.example.com finds a regional
SIP provider in a small country who, due to its small size and SIP provider in a small country who, due to its small size and
disinterest in spam, accepts any P-Asserted-Identity from its disinterest in spam, accepts any P-Asserted-Identity from its
customers without verification. This provider, in turn, connects to customers without verification. This provider, in turn, connects to
a larger, interconnect provider. They do ask each of their customers a larger, interconnect provider. They do ask each of their customers
to verify P-Asserted-Identity but have no easy way of enforcing it. to verify P-Asserted-Identity but have no easy way of enforcing it.
This provider, in turn, connects to everyone else. As a consequence, This provider, in turn, connects to everyone else. As a consequence,
the spam.example.com domain is able to inject calls with a spoofed the spam.example.com domain is able to inject calls with a spoofed
called ID. This request can be directed to any recipient reachable caller ID. This request can be directed to any recipient reachable
through the network (presumably everyone due to the large size of the through the network (presumably everyone due to the large size of the
root provider). There is no way for a recipient to know that this root provider). There is no way for a recipient to know that this
particular P-Asserted-Identity came from this bad spam.example.com particular P-Asserted-Identity came from this bad spam.example.com
domain. As the example shows, even though the central provider's domain. As the example shows, even though the central provider's
policy is good, the overall effectiveness of P-Asserted-Identity is policy is good, the overall effectiveness of P-Asserted-Identity is
still only as good as the policies of the weakest link in the chain. still only as good as the policies of the weakest link in the chain.
SIP also defines the usage of TLS between domains, using mutual SIP also defines the usage of TLS between domains, using mutual
authentication, as part of the base specification. This technique authentication, as part of the base specification. This technique
provides a way for one domain to securely determine that it is provides a way for one domain to securely determine that it is
skipping to change at page 23, line 41 skipping to change at page 23, line 44
others, all work best when applied only to new requests, and others, all work best when applied only to new requests, and
successful completion of an introduction results in the placement successful completion of an introduction results in the placement
of a user on a white list. However, usage of white lists depends of a user on a white list. However, usage of white lists depends
on strong identity assertions. Consequently, any network that on strong identity assertions. Consequently, any network that
interconnects with others should make use of strong SIP identity interconnects with others should make use of strong SIP identity
as described in RFC 4474. P-Asserted-Identity is not strong as described in RFC 4474. P-Asserted-Identity is not strong
enough. enough.
White Lists: Secondly, with a strong identity system in place, White Lists: Secondly, with a strong identity system in place,
networks are recommended to make use of white lists. These are networks are recommended to make use of white lists. These are
ideally built off existing buddy lists if present. If not, ideally built off existing buddy lists, if present. If not,
separate white lists can be managed for spam. Placement on these separate white lists can be managed for spam. Placement on these
lists can be manual or based on the successful completion of one lists can be manual or based on the successful completion of one
or more introduction mechanisms. or more introduction mechanisms.
Solve the Introduction Problem: This in turn leads to the final Solve the Introduction Problem: This in turn leads to the final
recommendation to be made. Network designers should make use of recommendation to be made. Network designers should make use of
one or more mechanisms meant to solve the introduction problem. one or more mechanisms meant to solve the introduction problem.
Indeed, it is possible to use more than one and combine the Indeed, it is possible to use more than one and combine the
results through some kind of weight. A user that successfully results through some kind of weight. A user that successfully
completes the introduction mechanism can be automatically added to completes the introduction mechanism can be automatically added to
the white list. Of course, that can only be done usefully if the white list. Of course, that can only be done usefully if
their identity is verified by SIP Identity. The set of mechanisms their identity is verified by SIP Identity. The set of mechanisms
for solving the introduction problem, as described in this for solving the introduction problem, as described in this
document, are based on some (but not all) of the techniques known document, are based on some (but not all) of the techniques known
and used at the time of writing. Providers of SIP services should and used at the time of writing. Providers of SIP services should
keep tabs on solutions in email as they evolve, and utilize the keep tabs on solutions in email as they evolve, and utilize the
best of what those techniques have to offer. best of what those techniques have to offer.
skipping to change at page 24, line 13 skipping to change at page 24, line 16
results through some kind of weight. A user that successfully results through some kind of weight. A user that successfully
completes the introduction mechanism can be automatically added to completes the introduction mechanism can be automatically added to
the white list. Of course, that can only be done usefully if the white list. Of course, that can only be done usefully if
their identity is verified by SIP Identity. The set of mechanisms their identity is verified by SIP Identity. The set of mechanisms
for solving the introduction problem, as described in this for solving the introduction problem, as described in this
document, are based on some (but not all) of the techniques known document, are based on some (but not all) of the techniques known
and used at the time of writing. Providers of SIP services should and used at the time of writing. Providers of SIP services should
keep tabs on solutions in email as they evolve, and utilize the keep tabs on solutions in email as they evolve, and utilize the
best of what those techniques have to offer. best of what those techniques have to offer.
Don't Wait Until its Too Late: But perhaps most importantly, Don't Wait Until It's Too Late: But perhaps most importantly,
providers should not ignore the spam problem until it happens! As providers should not ignore the spam problem until it happens! As
soon as a provider inter-connects with other providers, or allows soon as a provider inter-connects with other providers, or allows
SIP messages from the open Internet, that provider must consider SIP messages from the open Internet, that provider must consider
how they will deal with spam. how they will deal with spam.
7. Additional Work 7. Additional Work
Though the above framework serves as a good foundation on which to Though the above framework serves as a good foundation on which to
deal with spam in SIP, there are gaps, some of which can be addressed deal with spam in SIP, there are gaps, some of which can be addressed
by additional work that has yet to be undertaken. by additional work that has yet to be undertaken.
skipping to change at page 24, line 39 skipping to change at page 24, line 42
removed it. As a result, transition mechanisms should be put in removed it. As a result, transition mechanisms should be put in
place to allow these to be differentiated. Without it, the value of place to allow these to be differentiated. Without it, the value of
the identity mechanism is much reduced. the identity mechanism is much reduced.
8. Security Considerations 8. Security Considerations
This document is entirely devoted to issues relating to spam in SIP This document is entirely devoted to issues relating to spam in SIP
and references a variety of security mechanisms in support of that and references a variety of security mechanisms in support of that
goal. goal.
9. IANA Considerations 9. Acknowledgements
There are no IANA considerations associated with this specification.
10. Acknowledgements
The authors would like to thank Rohan Mahy for providing information The authors would like to thank Rohan Mahy for providing information
on Habeas, Baruch Sterman for providing costs on VoIP termination on Habeas, Baruch Sterman for providing costs on VoIP termination
services, and Gonzalo Camarillo and Vijay Gurbani for their reviews. services, and Gonzalo Camarillo and Vijay Gurbani for their reviews.
Useful comments and feedback were provided by Nils Ohlmeir, Tony Useful comments and feedback were provided by Nils Ohlmeir, Tony
Finch, Randy Gellens, Lisa Dusseault, Sam Hartman, Chris Newman, Tim Finch, Randy Gellens, Lisa Dusseault, Sam Hartman, Chris Newman, Tim
Polk, Donald Eastlake, and Yakov Shafranovich. Jon Peterson wrote Polk, Donald Eastlake, and Yakov Shafranovich. Jon Peterson wrote
some of the text in this document and has contributed to the work as some of the text in this document and has contributed to the work as
it has moved along. it has moved along.
11. Informative References 10. Informative References
[1] Campbell, B., "The Message Session Relay Protocol", [1] Campbell, B., Mahy, R., and C. Jennings, "The Message Session
draft-ietf-simple-message-sessions-19 (work in progress), Relay Protocol (MSRP)", RFC 4975, September 2007.
February 2007.
[2] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., [2] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002. Session Initiation Protocol", RFC 3261, June 2002.
[3] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., and [3] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., and
D. Gurle, "Session Initiation Protocol (SIP) Extension for D. Gurle, "Session Initiation Protocol (SIP) Extension for
Instant Messaging", RFC 3428, December 2002. Instant Messaging", RFC 3428, December 2002.
[4] Roach, A., "Session Initiation Protocol (SIP)-Specific Event [4] Roach, A., "Session Initiation Protocol (SIP)-Specific Event
skipping to change at page 25, line 49 skipping to change at page 25, line 42
[8] Rosenberg, J., "An Extensible Markup Language (XML) Based [8] Rosenberg, J., "An Extensible Markup Language (XML) Based
Format for Watcher Information", RFC 3858, August 2004. Format for Watcher Information", RFC 3858, August 2004.
[9] Faltstrom, P. and M. Mealling, "The E.164 to Uniform Resource [9] Faltstrom, P. and M. Mealling, "The E.164 to Uniform Resource
Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Identifiers (URI) Dynamic Delegation Discovery System (DDDS)
Application (ENUM)", RFC 3761, April 2004. Application (ENUM)", RFC 3761, April 2004.
[10] Rosenberg, J., "The Extensible Markup Language (XML) [10] Rosenberg, J., "The Extensible Markup Language (XML)
Configuration Access Protocol (XCAP)", RFC 4825, May 2007. Configuration Access Protocol (XCAP)", RFC 4825, May 2007.
[11] Rosenberg, J., "Presence Authorization Rules", [11] Rosenberg, J., "Presence Authorization Rules", RFC 5025,
draft-ietf-simple-presence-rules-09 (work in progress), October 2007.
March 2007.
[12] Rosenberg, J., "A Framework for Consent-Based Communications in [12] Rosenberg, J., "A Framework for Consent-Based Communications in
the Session Initiation Protocol (SIP)", the Session Initiation Protocol (SIP)", Work in Progress,
draft-ietf-sip-consent-framework-01 (work in progress), October 2007.
November 2006.
[13] Camarillo, G., "A Document Format for Requesting Consent", [13] Camarillo, G., "A Document Format for Requesting Consent", Work
draft-ietf-sipping-consent-format-03 (work in progress), in Progress, October 2007.
April 2007.
[14] Rosenberg, J., "A Framework for Application Interaction in the [14] Rosenberg, J., "A Framework for Application Interaction in the
Session Initiation Protocol (SIP)", Session Initiation Protocol (SIP)", Work in Progress,
draft-ietf-sipping-app-interaction-framework-05 (work in October 2005.
progress), July 2005.
[15] Burger, E. and M. Dolly, "A Session Initiation Protocol (SIP) [15] Burger, E. and M. Dolly, "A Session Initiation Protocol (SIP)
Event Package for Key Press Stimulus (KPML)", RFC 4730, Event Package for Key Press Stimulus (KPML)", RFC 4730,
November 2006. November 2006.
[16] Rosenberg, J., "Applying Loose Routing to Session Initiation [16] Rosenberg, J., "Applying Loose Routing to Session Initiation
Protocol (SIP) User Agents (UA)", Protocol (SIP) User Agents (UA)", Work in Progress, June 2007.
draft-rosenberg-sip-ua-loose-route-01 (work in progress),
June 2007.
[17] Peterson, J. and C. Jennings, "Enhancements for Authenticated [17] Peterson, J. and C. Jennings, "Enhancements for Authenticated
Identity Management in the Session Initiation Protocol (SIP)", Identity Management in the Session Initiation Protocol (SIP)",
RFC 4474, August 2006. RFC 4474, August 2006.
[18] Allman, E. and H. Katz, "SMTP Service Extension for Indicating [18] Allman, E. and H. Katz, "SMTP Service Extension for Indicating
the Responsible Submitter of an E-Mail Message", RFC 4405, the Responsible Submitter of an E-Mail Message", RFC 4405,
April 2006. April 2006.
[19] Lyon, J. and M. Wong, "Sender ID: Authenticating E-Mail", [19] Lyon, J. and M. Wong, "Sender ID: Authenticating E-Mail",
skipping to change at page 27, line 28 skipping to change at page 27, line 18
December 2003. December 2003.
[28] Clayton, R. and B. Laurie, "Proof of Work Proves not to Work, [28] Clayton, R. and B. Laurie, "Proof of Work Proves not to Work,
Third Annual Workshop on Economics and Information Security", Third Annual Workshop on Economics and Information Security",
May 2004. May 2004.
Authors' Addresses Authors' Addresses
Jonathan Rosenberg Jonathan Rosenberg
Cisco Cisco
600 Lanidex Plaza Edison, NJ
Parsippany, NJ 07054
US US
Phone: +1 973 952-5000 EMail: jdrosen@cisco.com
Email: jdrosen@cisco.com
URI: http://www.jdrosen.net URI: http://www.jdrosen.net
Cullen Jennings Cullen Jennings
Cisco Cisco
170 West Tasman Dr. 170 West Tasman Dr.
San Jose, CA 95134 San Jose, CA 95134
US US
Phone: +1 408 421-9990 Phone: +1 408 421-9990
Email: fluffy@cisco.com EMail: fluffy@cisco.com
Full Copyright Statement Full Copyright Statement
Copyright (C) The IETF Trust (2007). Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors contained in BCP 78, and except as set forth therein, the authors
retain all their rights. retain all their rights.
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
skipping to change at page 28, line 44 skipping to change at line 1274
attempt made to obtain a general license or permission for the use of attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr. http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at this standard. Please address the information to the IETF at
ietf-ipr@ietf.org. ietf-ipr@ietf.org.
Acknowledgment
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
 End of changes. 92 change blocks. 
206 lines changed or deleted 164 lines changed or added

This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/