1. The Internet standards process Ian Brown

2. Overview What standards need setting? Protocols – the IETF and the ITU Approaches to wiretapping Approaches to patents Domain names and addresses

3. Ideal of open standards Many different client and server applications give user choice, competition on features and price, and resistance to catastrophic attacks

4. Communications protocols Define the format and sequence of messages that pass between two or more communicating processes on one or more processors Can be closed (many proprietary systems), open (standards-based) or open with proprietary extensions

5. What does a protocol look like? HELO machinename MAIL FROM: I.Brown RCPT TO: I.Brown DATA 250 Looks good to me 250 OK 354 Enter Mail, end by a line with only '.' 250 OK 250 Submitted & queued (0/msg.28043-0) Message text

6. Competition implications Closed protocols can be used to leverage a monopoly in one area (e.g. desktop operating system) into another (e.g. server software) Protocol analysers and reverse engineering can be used to discover details of protocols – arms race

7. Internet Engineering Task Force First met in San Diego in 1986 with 21 attendees Forthcoming meeting in Minneapolis is 73 rd in series Attendance peaked at 3,000 in 2000 and is still around 2,000, 3 times a year

8. IETF working groups All IETF protocols developed in ~120 working groups in one of 8 areas Groups make decisions by rough consensus and running code Consensus must be found on mailing lists rather than at physical meetings

9. Example IETF working groups avt Audio/Video Transportavt behave Behavior Engineering for Hindrance Avoidancebehave dccp Datagram Congestion Control Protocoldccp enum Telephone Number Mappingenum ieprep Internet Emergency Preparednessieprep ippm IP Performance Metricsippm ips IP Storageips iptel IP Telephonyiptel megaco Media Gateway Controlmegaco midcom Middlebox Communicationmidcom

10. IETF process Protocol documents begin life as Internet drafts (currently over 1,000) Successful drafts become Requests for Comments (RFCs) RFCs can be standards-track (proposed, draft or full), Informational, Experimental or Best Current Practice

11. ITU-T International Telecommunications Union (Telecoms sector) Part of United Nations system where governments and companies coordinate telecoms networks and services Work done in study groups mostly by corporate staff but needs to be agreed by government representatives

12. ITU process Much lower volume communication than IETF Work tends to progress more slowly and mainly at Geneva meetings

13. Example ITU study groups Study Group 13 Multi-protocol and IP-based networks and their internetworking Lead Study Group for IP related matters, B-ISDN, Global Information Infrastructure and satellite matters. Study Group 16 Multimedia services, systems and terminals Lead Study Group on multimedia services, systems and terminals, e-business and e-commerce. Study Group 17 Data Networks and Telecommunication Software Lead Study Group on frame relay, communication system security, languages and description techniques.

14. Other relevant bodies W3C – World Wide Web Consortium ETSI – European Telecommunications Standards Institute IEEE – Institute for Electrical and Electronics Engineering ISO – International Standards Organisation

15. Approaches to lawful access Wiretapping requirements imposed by legislation (e.g. Communications Assistance to Law Enforcement Act of 1994 in US, Regulation of Investigatory Powers Act 2000 in UK) Requirements placed on manufacturers in US, ISPs and phone companies in both countries

16. Lawful access requirements Undetectable to subject Invisible to unauthorised personnel and other interceptors Any available decryption keys should be provided Only authorised information should be provided

17. IETF approach FBI requested wiretapping capability in Megaco protocol IETF created mailing list to debate; 500 participants Plenary debate at Washington DC meeting; very few in favour, many against, majority silent

18. IETF decision The IETF has decided not to consider requirements for wiretapping as part of the process for creating and maintaining IETF standards 1. Inappropriate in global standards – different legal and privacy requirements 2. Would increase protocol complexity and decrease security 3. End-to-end security makes unworkable 4. Otherwise, many facilities already available

19. Ongoing IETF debate the IETF believes that mechanisms designed to facilitate or enable wiretapping, or methods of using other facilities for such purposes, should be openly described, so as to ensure the maximum review of the mechanisms and ensure that they adhere as closely as possible to their design constraints. Cisco Architecture for Lawful Intercept in IP Networks (RFC 3924)

20. ETSI approach The Technical Committee on Lawful Interception (TC LI) is the leading body for lawful interception standardization within ETSI. Lawful interception standards have also been developed by ETSI technical bodies AT, TISPAN (/SPAN and TIPHON), TETRA, and by 3GPPATTISPANTETRA3GPP

21. ETSI standards ES 201 671 Telecommunications Security; Lawful Interception (LI); Handover Interface for the Lawful Interception of Telecommunications Traffic (revised version). ES 201 158 Telecommunications Security; Lawful Interception (LI); Requirements for Network Functions TS 102 234 Telecommunications Security; Lawful Interception (LI); Service-specific details for internet access services; TS 102 233 Telecommunications Security; Lawful interception (LI); Service-specific details for e-mail services TS 102 232 Telecommunications Security; Lawful Interception (LI); Handover Specification for IP Delivery TS 101 671 Telecommunications Security; Lawful Interception (LI); Handover interface for the lawful interception of telecommunications traffic. TS 101 331 Telecommunications Security; Lawful Interception (LI); Requirements of Law Enforcement Agencies TR 102 053 Telecommunications Security; Lawful Interception (LI); Notes on ISDN lawful interception functionality. TR 101 944 Telecommunications Security; Lawful Interception (LI); Issues on IP Interception. TR 101 943 Telecommunications Security; Lawful Interception (LI); Concepts of Interception in a Generic Network Architecture.

22. Patent issues Open standards of limited use if they require patent-protected technology Very popular with patent owners! Standards bodies now addressing issue to a greater or lesser extent

23. IETF IPR policy This page provides a mechanism for filing Disclosures about intellectual property rights (IPR) and for finding out what IPR Disclosures have been filed. https://datatracker.ietf.org/public/ipr_disclosure.cgi https://datatracker.ietf.org/public/ipr_disclosure.cgi The IETF takes no position regarding the validity or scope of any intellectual property rights or other rights that might be claimed to pertain to the implementation or use of the technology described in any IETF documents or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org."

24. W3C IPR policy Whenever possible, technical decisions should be made unencumbered by intellectual property right (IPR) claims. To this end, W3C discloses to the entire Membership which organizations have made IPR claims about a particular technology, as well as the details of those claims where they have been provided. Individuals should immediately disclose any IPR claims they know may be essential to implementing a Recommendation track technical report. Goes further than IETF RAND target

25. Domain names Domain Name System maps IP addresses (128.16.64.182) to Fully-Qualified Domain Names (happy.cs.ucl.ac.uk) Overseen by ICANN, managed by registrars and registrants International controversy (US control of process and root servers) Trouble with trademarks