Location Hiding: Problem Statement and Requirements
Balancing emergency call routing with caller location privacy
Schulzrinne, H., Liess, L., Tschofenig, H., Stark, B., and A. Kuett, "Location Hiding: Problem Statement and Requirements", RFC 6444, DOI 10.17487/RFC6444, January 2012, <https://www.rfc-editor.org/info/rfc6444>.
@misc{rfc6444,
series = {Request for Comments},
number = 6444,
howpublished = {RFC 6444},
publisher = {RFC Editor},
doi = {10.17487/RFC6444},
url = {https://www.rfc-editor.org/info/rfc6444},
author = {H. Schulzrinne and L. Liess and H. Tschofenig and B. Stark and A. Kuett},
title = {{Location Hiding: Problem Statement and Requirements}},
pagetotal = 9,
year = 2012,
month = jan,
} RFC text
Contents
Internet Engineering Task Force (IETF) H. Schulzrinne
Request for Comments: 6444 Columbia University
Category: Informational L. Liess
ISSN: 2070-1721 Deutsche Telekom
H. Tschofenig
Nokia Siemens Networks
B. Stark
AT&T
A. Kuett
Skype
January 2012
Location Hiding: Problem Statement and Requirements
Abstract
The emergency services architecture developed in the IETF Emergency
Context Resolution with Internet Technology (ECRIT) working group
describes an architecture where location information is provided by
access networks to endpoints or Voice over IP (VoIP) service
providers in order to determine the correct dial string and
information to route the call to a Public Safety Answering Point
(PSAP). To determine the PSAP Uniform Resource Identifier (URI), the
usage of the Location-to-Service Translation (LoST) protocol is
envisioned.
This document provides a problem statement and lists requirements for
situations where the Internet Access Provider (IAP) and/or the
Internet Service Provider (ISP) are only willing to disclose limited
or no location information.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6444.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Table of Contents
1. Introduction ....................................................3
1.1. Emergency Services Architecture ............................3
1.2. Location Hiding ............................................3
1.3. Location by Reference ......................................4
2. Terminology .....................................................5
3. Requirements ....................................................5
4. Security Considerations .........................................7
5. Acknowledgments .................................................7
6. Normative References ............................................7
1. Introduction
1.1. Emergency Services Architecture
The emergency services architecture developed in the IETF Emergency
Context Resolution with Internet Technology (ECRIT) working group,
see [RFC6443], describes an architecture where location information
is provided by access networks to endpoints or VoIP service providers
in order to determine the correct dial string and information to
route the call to a Public Safety Answering Point (PSAP). The
Location-to-Service Translation (LoST) protocol [RFC5222] allows
callers and other call-routing entities to determine the PSAP Uniform
Resource Identifier (URI) for a specific geographical location
together with a service URN [RFC5031]. The basic architecture is
shown in Figure 1 of [RFC6443] and further detailed in the message
flow in Figure 2 of [RFC6443].
For emergency services, location information is needed for three
purposes:
1. Emergency call routing to the PSAP that is responsible for a
specific geographical region.
2. Dispatch of the emergency personnel to the scene of an accident,
crime, or other type of incident.
3. Additionally, a Voice Service Provider (VSP) may need to verify
that a call is indeed an emergency call and may therefore require
location information to ensure that calls routed to a specific
URI point to a PSAP.
This document focuses on items (1) and (3). Providing location
information by the ISP to emergency authorities, including PSAPs,
regional emergency management association, and emergency personnel is
typically a legal obligation covered by regulatory frameworks.
1.2. Location Hiding
Internet Access Providers (IAPs) and Internet Service Providers
(ISPs) typically have little incentive to provide location
information to end hosts or independent VSPs (without monetary
compensation) for any purpose, including for emergency call routing.
The decision to deny disclosure of location information can be driven
by a number of technical and business concerns. Some providers may
perceive a risk that allowing users to access location information
for non-emergency purposes or prior to an emergency call will incur
additional server load and thus costs. Other providers may not want
to make location information available without the ability to charge
for it. Yet, others fear problems with regard to privacy when
disclosing location information to potentially unknown third parties.
1.3. Location by Reference
The work on the Location Configuration Protocol (LCP) indicated the
need to provide the capability to obtain Location-by-References
(LbyRs) in addition to Location-by-Value (LbyV) from a Location
Information Server (LIS).
The LCP problem statement and requirements document is [RFC5687].
The requirements for obtaining an LbyR via the LCP and the
corresponding dereferencing step can be found in [RFC5808].
HTTP Enabled Location Delivery (HELD), see [RFC5985], is an
instantiation of the LCP concept and allows LbyVs and LbyRs to be
requested.
A location reference may already satisfy the requirement for location
hiding if the PSAP has the appropriate credentials to resolve the
reference. These credentials allow the ISP/IAP to authenticate and
to authorize the party that would like to request location
information. The policy to obtain these credentials allows ISPs/IAPs
to put constraints under which these credentials are handed out.
ISPs/IAPs ideally might want to engage in a business relationship
with the VSP to receive a financial compensation for the service they
provide. On the Internet, the number of VSPs is potentially large
and the VSPs would not want to enter a business contract with
potentially every ISP/IAP worldwide. The number of potential
contracts between ISPs/IAPs and PSAPs is, however, relatively small
as they typically need to have a local relationship as PSAPs provide
their emergency services support in a certain geographical region for
which certain ISPs/IAPs have networks deployed.
Note that the requirement being met here is for delivery of location
information to the PSAP, not for LoST routing or for validation at
the VSP. Since LoST [RFC5222] requires location by value, location
by reference cannot be used for location-based routing. Also, LoST
servers may be operated by independent parties, including VSPs, which
again may not be able to resolve the reference to location by value.
(Note that LoST is a protocol used for determining the location-
appropriate PSAP based on location information and a Service URN
[RFC5031].)
2. Terminology
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119], with the
important qualification that, unless otherwise stated, these terms
apply to the design of an solution supporting location hiding, not
its implementation or application.
This document reuses terminology from [RFC5687].
3. Requirements
Req-1: There MUST be a way for the ISP/IAP to withhold precise
location information from the endpoint and from the VSP.
Req-2: The ISP/IAP MUST support the ability of the endpoint or the
VSP to route emergency calls.
Req-3: The VSP MUST be able to validate that a call purported to be
an emergency call is being routed to a bona fide URI, which
is denoted by being a URI in LoST for the designated
emergency service. This requirement is provided to deal
with potential security problems described in Section 5.1 of
[RFC5069].
Req-4: The PSAP MUST receive precise location information (by
value) about emergency callers. As such, any solution MUST
be able to provide location information to the PSAP even
while withholding it from the emergency caller.
Req-5: The proposed solution MUST NOT assume a business or trust
relationship between the caller's VSP and the caller's ISP.
Req-6: A solution MUST consider deployment scenarios where a VSP
does not operate in the same jurisdiction as the PSAP.
Req-7: The solution MUST consider that service boundaries for the
various emergency services responsible for a particular
location may differ.
Req-8: The steps needed by the endpoint for emergency calling
SHOULD be no different when location is withheld versus when
location is not withheld. In particular, user agents cannot
require additional configuration to discover in which
particular environment (hiding or no hiding) they find
themselves.
Req-9: The solution SHOULD work without the ISP/IAP having to
support SIP and without the need to utilize SIP between the
endpoint and the VSP.
Req-10: The solution MUST work if PSAP boundaries have holes. (For
a discussion about holes in PSAP boundaries and their
encoding, the reader is referred to [RFC5964].)
Req-11: The solution MUST NOT assume the existence of Emergency
Service Routing Proxies (ESRPs) per country, state, and
city.
Req-12: The solution MUST consider that service boundaries for
different emergency services may differ, but they overlap at
the location of the caller.
Req-13: Though the solution MAY add steps to the emergency call
routing process described in [RFC6443], these steps MUST NOT
significantly increase call setup latency. For example, the
revised process MUST NOT include "trial-and-error"
operations on its critical path, such as attempts at LbyR
resolutions that may take time to time out.
Req-14: The solution MUST allow the end host to determine PSAP/ESRP
URLs prior to the call, for all emergency services.
Req-15: The solution MUST allow user agents (UAs) to discover at
least their dial string ahead of the emergency call.
Req-16: The solution MUST have minimal impact on UAs, i.e., a
solution is preferred if it does not require a substantially
different emergency service procedure compared to the
procedure of dealing with emergency services where no
location hiding is applied.
Req-17: The solution MUST NOT interfere with the use of LoST for
non-emergency services.
Req-18: The solution MUST allow emergency calls to reach an IP-to-
PSTN gateway rather than the IP-based PSAP directly.
Req-19: The solution MUST NOT shift effort (externality), i.e., the
convenience of the location-hiding ISP MUST NOT impose a
burden on user agents or non-hiding ISPs/IAPs and SHOULD NOT
impose a burden on VSPs.
Req-20: The solution SHOULD minimize the impact on LoST, SIP
conveyance [RFC6442], and DHCP.
Req-21: The solution SHOULD NOT break in the presence of NATs and
SHOULD consider the presence of legacy devices, as described
in [RFC5687].
4. Security Considerations
This document does not raise additional security consideration beyond
those mentioned in [RFC5687] and discussed in this document.
5. Acknowledgments
We would like to thank the following ECRIT working group members (in
no particular order) for their contributions:
o Andrew Newton (andy@hxr.us)
o James Winterbottom (James.Winterbottom@andrew.com)
o Brian Rosen (br@brianrosen.net)
o Richard Barnes (rbarnes@bbn.com)
o Marc Linsner (mlinsner@cisco.com)
o Ted Hardie (hardie@qualcomm.com)
The authors would also like to thank Ben Campbell for his Gen-ART
review. Additionally, we would like to thank Jari Arkko, Alexey
Melnikov, Tim Polk, and Dan Romascanu for their IESG review.
6. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5031] Schulzrinne, H., "A Uniform Resource Name (URN) for
Emergency and Other Well-Known Services", RFC 5031,
January 2008.
[RFC5069] Taylor, T., Tschofenig, H., Schulzrinne, H., and M.
Shanmugam, "Security Threats and Requirements for
Emergency Call Marking and Mapping", RFC 5069,
January 2008.
[RFC5222] Hardie, T., Newton, A., Schulzrinne, H., and H.
Tschofenig, "LoST: A Location-to-Service Translation
Protocol", RFC 5222, August 2008.
[RFC5687] Tschofenig, H. and H. Schulzrinne, "GEOPRIV Layer 7
Location Configuration Protocol: Problem Statement and
Requirements", RFC 5687, March 2010.
[RFC5808] Marshall, R., "Requirements for a Location-by-Reference
Mechanism", RFC 5808, May 2010.
[RFC5964] Winterbottom, J. and M. Thomson, "Specifying Holes in
Location-to-Service Translation (LoST) Service
Boundaries", RFC 5964, August 2010.
[RFC5985] Barnes, M., "HTTP-Enabled Location Delivery (HELD)",
RFC 5985, September 2010.
[RFC6442] Polk, J., Rosen, B., and J. Peterson, "Location Conveyance
for the Session Initiation Protocol", RFC 6442,
December 2011.
[RFC6443] Rosen, B., Schulzrinne, H., Polk, J., and A. Newton,
"Framework for Emergency Calling Using Internet
Multimedia", RFC 6443, December 2011.
Authors' Addresses
Henning Schulzrinne
Columbia University
Department of Computer Science
450 Computer Science Building
New York, NY 10027
US
Phone: +1 212 939 7004
EMail: hgs+ecrit@cs.columbia.edu
URI: http://www.cs.columbia.edu
Laura Liess
Deutsche Telekom Networks
Deutsche Telekom Allee 7
Darmstadt, Hessen 64295
Germany
Phone:
EMail: L.Liess@telekom.de
URI: http://www.telekom.de
Hannes Tschofenig
Nokia Siemens Networks
Linnoitustie 6
Espoo 02600
Finland
Phone: +358 (50) 4871445
EMail: Hannes.Tschofenig@gmx.net
URI: http://www.tschofenig.priv.at
Barbara Stark
AT&T
725 W Peachtree St, NE
Atlanta, GA 30308
USA
Phone: +1 404 499 7026
EMail: barbara.stark@att.com
Andres Kuett
Skype
EMail: andres.kytt@skype.net
AI ELI5
On this page
§1Emergency Services and Location
The emergency services architecture for Voice over IP (VoIP) calls relies on location information flowing from access networks to endpoints and service providers. This location data serves three critical purposes: routing emergency calls to the correct Public Safety Answering Point (PSAP) responsible for that region, dispatching emergency personnel to the correct location, and validating that calls routed to a PSAP URI are indeed going to a legitimate emergency service.
The LoST protocol (Location-to-Service Translation) is used to determine which PSAP handles a particular location and service type. This architecture was developed by the IETF's Emergency Context Resolution with Internet Technology (ECRIT) working group.
The emergency system needs your location to send help to the right place. A protocol called LoST helps match your location to the right emergency center. But figuring out how to share that information securely is complicated.
§2Why Networks Hide Location
Internet Access Providers (IAPs) and Internet Service Providers (ISPs) typically resist disclosing location information to endpoints or independent Voice Service Providers without compensation. Several technical and business factors drive this decision.
Providers fear that allowing non-emergency access to location data would increase server load and operational costs. Some see location information as a valuable asset and wish to charge for its use. Others worry about privacy risks when disclosing location to unknown third parties. Additionally, many providers lack trust relationships with independent VSPs and do not want to enter business agreements with large numbers of potentially competing services.
Networks don't want to give out your location data for free or to everyone, because it could cost them money or create privacy problems. They'd rather control who gets that information.
§3Location by Reference as a Solution
Instead of sending location as actual coordinates (location by value), a solution could use location by reference: send an encrypted or authorized reference that the PSAP (and only the PSAP) can resolve using credentials provided by the ISP.
This approach allows PSAPs to obtain precise location information without the ISP revealing coordinates to all parties. The ISP can authenticate and authorize the PSAP to access the reference. The number of potential trust relationships is much smaller than with VSPs, since PSAPs operate in specific geographic regions where only a limited number of ISPs have networks deployed.
However, location by reference cannot be used for the LoST routing step, since LoST itself requires location by value. Also, LoST may be operated by independent parties (including VSPs) that cannot resolve location references.
Instead of saying "you are at 42 Main Street," you could send a secret code that only emergency responders can open. The network gives emergency centers the key to decode the secret, but not regular people.
§4Requirements for Location Hiding
The RFC defines 21 requirements that any solution must satisfy. Key requirements include: the ISP must be able to withhold precise location from endpoints and VSPs (Req-1), yet the endpoint and VSP must still be able to route emergency calls (Req-2). The PSAP must receive precise location by value (Req-4), even while it is withheld from the caller. The solution must not assume a business relationship between VSP and ISP (Req-5).
The solution must work without requiring the ISP to support SIP or breaking existing protocols like LoST for non-emergency services (Req-9, Req-17, Req-20). Call setup latency must not be significantly increased (Req-13), and the solution must not shift burden onto user agents or non-hiding ISPs (Req-19). The endpoint must be able to discover PSAP addresses and dial strings ahead of the emergency call (Req-14, Req-15).
Additional requirements address deployment complexity: the solution must work with PSAP boundary holes (Req-10), different service boundaries (Req-12), and must not assume Emergency Service Routing Proxies exist at all political boundaries (Req-11). It must also work with IP-to-PSTN gateways (Req-18) and function across jurisdiction boundaries (Req-6).
Any solution would need to let the network keep location secret from you while making sure emergency centers still get it. It can't slow down emergency calls, break other systems, or make it harder for people or other networks.
§5Security and Privacy
The RFC notes that this problem statement does not introduce new security considerations beyond those already discussed in related location configuration work. However, the fundamental tension is inherent: enabling location hiding creates a new privilege boundary where ISPs control what parties can resolve location information, creating both opportunities for access control and risks if that control is compromised.
The document emphasizes that any solution must prevent abuse where fake location information could deceive emergency services or where location by reference could be misused to route calls to the wrong destination.
Keeping location secret only works if the system can be trusted to give it only to real emergency centers, not to scammers or wrong addresses.