<pre>Internet Engineering Task Force (IETF)                   J. Winterbottom
Request for Comments: 6155                                    M. Thomson
Category: Standards Track                             Andrew Corporation
ISSN: 2070-1721                                            H. Tschofenig
                                                  Nokia Siemens Networks
                                                               R. Barnes
                                                        BBN Technologies
                                                              March 2011


    <span class="h1">Use of Device Identity in HTTP-Enabled Location Delivery (HELD)</span>

Abstract

   When a Location Information Server receives a request for location
   information (using the locationRequest message), described in the
   base HTTP-Enabled Location Delivery (HELD) specification, it uses the
   source IP address of the arriving message as a pointer to the
   location determination process.  This is sufficient in environments
   where the location of a Device can be determined based on its IP
   address.

   Two additional use cases are addressed by this document.  In the
   first, location configuration requires additional or alternative
   identifiers from the source IP address provided in the request.  In
   the second, an entity other than the Device requests the location of
   the Device.

   This document extends the HELD protocol to allow the location request
   message to carry Device identifiers.  Privacy and security
   considerations describe the conditions where requests containing
   identifiers are permitted.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in <a href="./rfc5741#section-2">Section&nbsp;2 of RFC 5741</a>.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   <a href="http://www.rfc-editor.org/info/rfc6155">http://www.rfc-editor.org/info/rfc6155</a>.





<span class="grey">Winterbottom, et al.         Standards Track                    [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.





































<span class="grey">Winterbottom, et al.         Standards Track                    [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


Table of Contents

   <a href="#section-1">1</a>.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  <a href="#page-4">4</a>
     <a href="#section-1.1">1.1</a>.  Applications . . . . . . . . . . . . . . . . . . . . . . .  <a href="#page-5">5</a>
     <a href="#section-1.2">1.2</a>.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  <a href="#page-6">6</a>
   <a href="#section-2">2</a>.  Device Identity  . . . . . . . . . . . . . . . . . . . . . . .  <a href="#page-6">6</a>
     <a href="#section-2.1">2.1</a>.  Identifier Suitability . . . . . . . . . . . . . . . . . .  <a href="#page-7">7</a>
       <a href="#section-2.1.1">2.1.1</a>.  Subjective Network Views . . . . . . . . . . . . . . .  <a href="#page-7">7</a>
       <a href="#section-2.1.2">2.1.2</a>.  Transient Identifiers  . . . . . . . . . . . . . . . .  <a href="#page-9">9</a>
       <a href="#section-2.1.3">2.1.3</a>.  Network Interfaces and Devices . . . . . . . . . . . .  <a href="#page-9">9</a>
     <a href="#section-2.2">2.2</a>.  Identifier Format and Protocol Details . . . . . . . . . .  <a href="#page-9">9</a>
   <a href="#section-3">3</a>.  Identifiers  . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
     <a href="#section-3.1">3.1</a>.  IP Address . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
     <a href="#section-3.2">3.2</a>.  MAC Address  . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
     <a href="#section-3.3">3.3</a>.  Port Numbers . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
     <a href="#section-3.4">3.4</a>.  Network Access Identifier  . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
       <a href="#section-3.4.1">3.4.1</a>.  Using NAI for Location Configuration . . . . . . . . . <a href="#page-13">13</a>
     <a href="#section-3.5">3.5</a>.  URI  . . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
     <a href="#section-3.6">3.6</a>.  Fully Qualified Domain Name  . . . . . . . . . . . . . . . <a href="#page-14">14</a>
     <a href="#section-3.7">3.7</a>.  Cellular Telephony Identifiers . . . . . . . . . . . . . . <a href="#page-14">14</a>
     <a href="#section-3.8">3.8</a>.  DHCP Unique Identifier . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
   <a href="#section-4">4</a>.  Privacy Considerations . . . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
     <a href="#section-4.1">4.1</a>.  Targets Requesting Their Own Location  . . . . . . . . . . <a href="#page-16">16</a>
     <a href="#section-4.2">4.2</a>.  Third-Party Requests . . . . . . . . . . . . . . . . . . . <a href="#page-17">17</a>
   <a href="#section-5">5</a>.  Security Considerations  . . . . . . . . . . . . . . . . . . . <a href="#page-17">17</a>
     <a href="#section-5.1">5.1</a>.  Identifier Suitability . . . . . . . . . . . . . . . . . . <a href="#page-18">18</a>
     <a href="#section-5.2">5.2</a>.  Targets Requesting Their Own Location  . . . . . . . . . . <a href="#page-18">18</a>
     <a href="#section-5.3">5.3</a>.  Third-Party Requests . . . . . . . . . . . . . . . . . . . <a href="#page-19">19</a>
   <a href="#section-6">6</a>.  XML Schema . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-19">19</a>
   <a href="#section-7">7</a>.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . <a href="#page-21">21</a>
     7.1.  URN Sub-Namespace Registration for
           urn:ietf:params:xml:ns:geopriv:held:id . . . . . . . . . . <a href="#page-21">21</a>
     <a href="#section-7.2">7.2</a>.  XML Schema Registration  . . . . . . . . . . . . . . . . . <a href="#page-22">22</a>
     <a href="#section-7.3">7.3</a>.  Registration of HELD 'badIdentifier' Error Code  . . . . . <a href="#page-22">22</a>
   <a href="#section-8">8</a>.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-22">22</a>
   <a href="#section-9">9</a>.  References . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-23">23</a>
     <a href="#section-9.1">9.1</a>.  Normative References . . . . . . . . . . . . . . . . . . . <a href="#page-23">23</a>
     <a href="#section-9.2">9.2</a>.  Informative References . . . . . . . . . . . . . . . . . . <a href="#page-25">25</a>













<span class="grey">Winterbottom, et al.         Standards Track                    [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>.  Introduction</span>

   Protocols for requesting and providing location information require a
   way for the requestor to specify the location that should be
   returned.  In a Location Configuration Protocol (LCP), the location
   being requested is the requestor's location.  This fact can make the
   problem of identifying the Device simple, since IP datagrams that
   carry the request already carry an identifier for the Device --
   namely, the source IP address of an incoming request.  Existing LCPs,
   such as HTTP-Enabled Location Delivery (HELD) [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>] and DHCP
   ([<a href="./rfc3825" title="&quot;Dynamic Host Configuration Protocol Option for Coordinate-based Location Configuration Information&quot;">RFC3825</a>], [<a href="./rfc4776" title="&quot;Dynamic Host Configuration Protocol (DHCPv4 and DHCPv6) Option for Civic Addresses Configuration Information&quot;">RFC4776</a>]) rely on the source IP address or other
   information present in protocol datagrams to identify a Device.

   Aside from the datagrams that form a request, a Location Information
   Server (LIS) does not necessarily have access to information that
   could further identify the Device.  In some circumstances, as shown
   in [<a href="./rfc5687" title="&quot;GEOPRIV Layer 7 Location Configuration Protocol: Problem Statement and Requirements&quot;">RFC5687</a>], additional identification information can be included
   in a request to identify a Device.

   This document extends the HELD protocol to support the inclusion of
   additional identifiers for the Device in HELD location requests.  An
   XML schema is defined that provides a structure for including these
   identifiers in HELD requests.

   An important characteristic of this addition is that the HELD
   protocol with identity extensions implemented is not considered an
   LCP.  The scope of an LCP is limited to the interaction between a
   Device and a LIS, and LCPs can guarantee the identity of Devices
   without additional authorization checks.  A LIS identifies the Device
   making the LCP request using the source addressing on the request
   packets, using return routability to ensure that these identifiers
   are not spoofed.

   HELD with identity extensions allows a requestor to explicitly
   provide identification details in the body of a location request.
   This means that location requests can be made in cases where
   additional Device identity checks are necessary, and in cases where
   the requestor is not the Device itself.  Third-party Location
   Recipients (LRs) are able to make requests that include identifiers
   to retrieve location information about a particular Device.

   The usage of identifiers in HELD introduces a new set of privacy
   concerns.  In an LCP, the requestor can be implicitly authorized to
   access the requested location information, because it is their own
   location.  In contrast, a third-party LR must be explicitly
   authorized when requesting the location of a Device.  Establishing
   appropriate authorization and other related privacy concerns are
   discussed in <a href="#section-4">Section 4</a>.



<span class="grey">Winterbottom, et al.         Standards Track                    [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>.  Applications</span>

   This document defines a means to explicitly include Device identity
   information in the body of a HELD location request.  This identity
   information is used to identify the Device that is the subject (or
   Target) of the location request.  If Device identity is present, the
   identity of the requestor in the form of the source IP address is not
   used to identify the subject of the request.

   Device identifiers in HELD can be used for two purposes:

   Location configuration:  A Device can use these parameters to
      identify itself to a LIS.  Identification information other than
      an IP address might be needed to determine the location of a
      Device.

      A LIS can authorize location configuration requests using a policy
      that allows Devices to acquire their own location (see
      <a href="#section-4.1">Section 4.1</a>).  If an unauthorized third party falsifies addressing
      on request packets to match the provided Device identity, the
      request might be erroneously authorized under this policy.
      Requests containing Device identity MUST NOT be authorized using
      this policy unless specific measures are taken to prevent this
      type of attack.

      This document describes a mechanism that provides assurances that
      the requestor and included Device identity are the same for the
      Network Access Identifier (NAI) in a WiMAX network.  The LIS MUST
      treat requests containing other identifiers as third-party
      requests, unless it is able to ensure that the provided Device
      identity is uniquely attributable to the requestor.

   Third-party requests:  A third-party Location Recipient can be
      granted authorization to make requests for a given Device.  In
      particular, network services can be permitted to retrieve location
      for a Device that is unable to acquire location information for
      itself (see Section 6.3 of [<a href="#ref-EMERGENCY-CALLING">EMERGENCY-CALLING</a>]).  This allows use
      of location-dependent applications -- particularly essential
      services like emergency calling -- where Devices do not support a
      location configuration protocol or they are unable to successfully
      retrieve location information.

      This document does not describe how a third party acquires an
      identifier for a Device, nor how that third party is authorized by
      a LIS.  It is critical that these issues are resolved before
      permitting a third-party request.  A pre-arranged contract between
      the third party, a Rule Maker, and the LIS operator is necessary
      to use Device identifiers in this fashion.  This contract must



<span class="grey">Winterbottom, et al.         Standards Track                    [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


      include how the request is authenticated and the set of
      identifiers (and types of identifiers) that the third party is
      authorized to use in requests.

      Automated mechanisms to ensure that privacy constraints are
      respected are possible.  For instance, a policy rules document
      could be used to express the agreed policy.  Formal policy
      documents, such as the common policy [<a href="./rfc4745" title="&quot;Common Policy: A Document Format for Expressing Privacy Preferences&quot;">RFC4745</a>], can be applied in
      an automated fashion by a LIS.

<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>.  Terminology</span>

   This document uses the term Location Information Server (LIS) and
   Location Configuration Protocol (LCP) as described in [<a href="./rfc5687" title="&quot;GEOPRIV Layer 7 Location Configuration Protocol: Problem Statement and Requirements&quot;">RFC5687</a>] and
   [<a href="#ref-GEOPRIV-ARCH">GEOPRIV-ARCH</a>].

   The term Device is used specifically as the subject of an LCP,
   consistent with [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>].  This document also uses the term Target
   to refer to any entity that might be a subject of the same location
   information.  Target is used in a more general sense, including the
   Device, but also any nearby entity, such as the user of a Device.

   A Target has a stake in setting authorization policy on the use of
   location information.  A Rule Maker is the term used for the role
   that makes policy decisions about authorization, determining what
   entities are permitted to receive location and how that information
   is provided.

   Device, Target, and Rule Maker are defined in [<a href="#ref-GEOPRIV-ARCH">GEOPRIV-ARCH</a>].

   The term "requestor" is used in this document to refer to the entity
   making a HELD request.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [<a href="./rfc2119" title="&quot;Key words for use in RFCs to Indicate Requirement Levels&quot;">RFC2119</a>].

<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>.  Device Identity</span>

   Identifiers are used as the starting point in location determination.
   Identifiers might be associated with a different Device over time,
   but their purpose is to identify the Device, not to describe its
   environment or network attachment.








<span class="grey">Winterbottom, et al.         Standards Track                    [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>.  Identifier Suitability</span>

   Use of any identifier MUST only be allowed if it identifies a single
   Device at the time that location is determined.  The LIS is
   responsible for ensuring that location information is correct for the
   Device, which includes ensuring that the identifier is uniquely
   attributable to the Device.

   Some identifiers can be either temporary or could potentially
   identify multiple Devices.  Identifiers that are transient or
   ambiguous could be exploited by an attacker to either gain
   information about another Device or to coerce the LIS into producing
   misleading information.

   The identifiers described in this document MUST only be used where
   that identifier is used as the basis for location determination.
   Considerations relating to the use of identifiers for a Device
   requesting its own location are discussed in <a href="./rfc5687#section-5">Section&nbsp;5 of [RFC5687]</a>;
   this section discusses use of identifiers for authorized third-party
   requests.

      It is tempting for a LIS implementation to allow alternative
      identifiers for convenience or some other perceived benefit.  The
      LIS is responsible for ensuring that the identifier used in the
      request does not refer to a Device other than the one for which it
      determines location.

   Some identifiers are always uniquely attributable to a single Device.
   However, other identifiers can have a different meaning to different
   entities on a network.  This is especially true for IP addresses
   [<a href="./rfc2101" title="&quot;IPv4 Address Behaviour Today&quot;">RFC2101</a>], but this can be true for other identifiers to varying
   degrees.  Non-uniqueness arises from both topology (all network
   entities have a subjective view of the network) and time (the network
   changes over time).

<span class="h4"><a class="selflink" id="section-2.1.1" href="#section-2.1.1">2.1.1</a>.  Subjective Network Views</span>

   Subjective views of the network mean that the identifier a requestor
   uses to refer to one physical entity could actually apply to a
   different physical entity when used in a different network context.
   Unless an authorized third-party requestor and LIS operate in the
   same network context, each could have a different subjective view of
   the meaning of the identifier.








<span class="grey">Winterbottom, et al.         Standards Track                    [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   Where subjective views differ, the third party receives information
   that is correct only within the network context of the LIS.  The
   location information provided by the LIS is probably misleading: the
   requestor believes that the information relates to a different entity
   than it was generated for.

   Authorization policy can be affected by a subjective network view if
   it is applied based on an identifier or if its application depends on
   identifiers.  The subjective view presented to the LIS and Rule Maker
   need to agree for the two entities to understand policy on the same
   terms.  For instance, it is possible that the LIS could apply the
   incorrect authorization policy if it selects the policy using a
   subjective identifier.  Alternatively, it may use the correct policy
   but apply it incorrectly if subjective identifiers are used.

      In IP networks, network address translation (NAT) and other forms
      of address modification create network contexts.  Entities on
      either side of the point where modification occurs have a
      different view of the network.  Private use addresses [<a href="./rfc1918" title="&quot;Address Allocation for Private Internets&quot;">RFC1918</a>]
      are the most easily recognizable identifiers that have limited
      scope.

   A LIS can be configured to recognize scenarios where the subjective
   view of a requestor or Rule Maker might not coincide with the view of
   the LIS.  The LIS can either provide location information that takes
   the view of the requestor into account, or it can reject the request.

      For instance, a LIS might operate within a network that uses a
      private address space, with NAT between that network and other
      networks.  A third-party request that originates in an external
      network with an IP address from the private address space might
      not be valid -- it could be identifying an entity within another
      address space.  The LIS can be configured to reject such requests,
      unless it knows by other means that the request is valid.

      In the same example, the requestor might include an address from
      the external space in an attempt to identify a host within the
      network.  The LIS could use knowledge about how the external
      address is mapped to a private address, if that mapping is fixed,
      to determine an appropriate response.

   The residential gateway scenario in <a href="./rfc5687#section-3.1">Section&nbsp;3.1 of [RFC5687]</a> is a
   particular example of where a subjective view is permitted.  The LIS
   knowingly provides Devices on the remote side of the residential
   gateway with location information.  The LIS provides location
   information with appropriate uncertainty to allow for the fact that
   the residential gateway serves a small geographical area.




<span class="grey">Winterbottom, et al.         Standards Track                    [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h4"><a class="selflink" id="section-2.1.2" href="#section-2.1.2">2.1.2</a>.  Transient Identifiers</span>

   Some identifiers are temporary and can, over the course of time, be
   assigned to different physical entities.  An identifier that is
   reassigned between the time that a request is formulated by a
   requestor and when the request is received by the LIS causes the LIS
   to locate a different entity than the requestor intended.  The
   response from the LIS might be accurate, but the request incorrectly
   associates this information with the wrong subject.

   A LIS should be configured with information about any potentially
   temporary identifiers.  It can use this information to identify when
   changes have occurred.  A LIS must not provide location information
   if the identifier it uses might refer to a different Device.  If an
   identifier might have been reassigned recently, or it is likely to be
   reassigned, it is not suitable as an identifier.

   It's possible that some degree of uncertainty could persist where
   identifiers are reassigned frequently; the extent to which errors
   arising from using transient identifiers are tolerated is a matter
   for local policy.

<span class="h4"><a class="selflink" id="section-2.1.3" href="#section-2.1.3">2.1.3</a>.  Network Interfaces and Devices</span>

   Several of the identifiers in this document are used to identify a
   network interface.  A Device can have multiple network interfaces.
   Uniquely identifying any network interface is assumed to be
   sufficient to identify the Device.  When a network interface is
   identified, the goal is to identify the Device that is immediately
   attached to the network interface.

   Most network interfaces remain physically attached to a particular
   Device, though a network interface might be physically separable from
   the Device.  By identifying a network interface, any Device that is
   intended to be identified could change.

<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>.  Identifier Format and Protocol Details</span>

   XML elements are used to express the Device identity.  The "device"
   element is used as a general container for identity information.
   This document defines a basic set of identifiers.  An example HELD
   request, shown in Figure 1, includes an IP version 4 address.









<span class="grey">Winterbottom, et al.         Standards Track                    [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


     &lt;locationRequest xmlns="urn:ietf:params:xml:ns:geopriv:held"
                      responseTime="8"&gt;
       &lt;locationType exact="true"&gt;geodetic&lt;/locationType&gt;
       &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
         &lt;ip v="4"&gt;192.0.2.5&lt;/ip&gt;
       &lt;/device&gt;
     &lt;/locationRequest&gt;

                Figure 1: HELD Request with Device Identity

   A LIS that supports this specification echoes the "device" element in
   a successful HELD response, including the identifiers that were used
   as the basis for location determination.  Absence of this indication
   means that the location information was generated using the source IP
   address in the request.

   A "badIdentifier" HELD error code indicates that the requestor is not
   authorized to use that identifier or that the request contains an
   identifier that is badly formatted or not supported by the LIS.  This
   code is registered in <a href="#section-7.3">Section 7.3</a>.

   If the LIS requires an identifier that is not provided in the
   request, the desired identifiers MAY be identified in the HELD error
   response, using the "requiredIdentifiers" element.  This element
   contains a list of XML qualified names [<a href="#ref-W3C.REC-xml-names11-20060816">W3C.REC-xml-names11-20060816</a>]
   that identify the identifier elements required by the LIS.  Namespace
   prefix bindings for the qualified names are taken from document
   context.  Figure 2 shows an example error indicating that the
   requestor needs to include a media access control (MAC) address
   (<a href="#section-3.2">Section 3.2</a>) and IP address (<a href="#section-3.1">Section 3.1</a>) if the request is to
   succeed.

     &lt;error xmlns="urn:ietf:params:xml:ns:geopriv:held"
            code="badIdentifier"&gt;
       &lt;message xml:lang="en"&gt;MAC address required&lt;/message&gt;
       &lt;requiredIdentifiers
           xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
         mac ip
       &lt;/requiredIdentifiers&gt;
     &lt;/error&gt;

            Figure 2: HELD Error Requesting Device Identifiers









<span class="grey">Winterbottom, et al.         Standards Track                   [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>.  Identifiers</span>

   A limited selection of identifiers are included in this document.
   The basic Device identity schema allows for the inclusion of elements
   from any namespace; therefore, additional elements can be defined
   using different XML namespaces.

<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>.  IP Address</span>

   The "ip" element can express a Device identity as an IP address
   ([<a href="./rfc0791" title="&quot;Internet Protocol&quot;">RFC0791</a>], [<a href="./rfc4291" title="&quot;IP Version 6 Addressing Architecture&quot;">RFC4291</a>]).  The "v" attribute identifies the IP version
   with a single hexadecimal digit.  The element uses the textual format
   specific to the indicated IP version.  The textual format for IP
   version 4 and version 6 addresses MUST conform to the grammar defined
   in [<a href="./rfc3986" title="&quot;Uniform Resource Identifier (URI): Generic Syntax&quot;">RFC3986</a>] ("IPv4address" and "IPv6address", respectively).  IP
   version 6 addresses SHOULD conform to the formatting conventions in
   [<a href="./rfc5952" title="&quot;A Recommendation for IPv6 Address Text Representation&quot;">RFC5952</a>].

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;ip v="6"&gt;2001:db8::1:ea7:fee1:d1e&lt;/ip&gt;
     &lt;/device&gt;

   In situations where location configuration does not require
   additional identifiers, using an IP address as an identifier enables
   authorized third-party requests.

<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>.  MAC Address</span>

   The MAC address used by network interfaces attached to the IEEE LAN
   [<a href="#ref-IEEE802" title="&quot;IEEE Standard for Local and Metropolitan Area Networks: Overview and Architecture&quot;">IEEE802</a>].  A MAC address is a unique sequence that is either
   assigned at the time of manufacture of the interface, or assigned by
   a local administrator.  A MAC address is an appropriate identifier
   for the Device that uses the network interface as long as the two
   remain together (see <a href="#section-2.1.3">Section 2.1.3</a>).

   A MAC address can be represented as a MAC-48, EUI-48, or EUI-64
   address ([<a href="#ref-IEEE802" title="&quot;IEEE Standard for Local and Metropolitan Area Networks: Overview and Architecture&quot;">IEEE802</a>], or an extended unique identifier [<a href="#ref-EUI64" title="&quot;Guidelines for 64-bit Global Identifier (EUI-64) Registration Authority&quot;">EUI64</a>]) using
   the hexadecimal representation defined in [<a href="#ref-IEEE802" title="&quot;IEEE Standard for Local and Metropolitan Area Networks: Overview and Architecture&quot;">IEEE802</a>].

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;mac&gt;A0-12-34-56-78-90&lt;/mac&gt;
     &lt;/device&gt;

   A locally assigned MAC address is not guaranteed to be unique outside
   the administrative domain where it is assigned.  Locally assigned MAC
   addresses can only be used within this domain.





<span class="grey">Winterbottom, et al.         Standards Track                   [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


<span class="h3"><a class="selflink" id="section-3.3" href="#section-3.3">3.3</a>.  Port Numbers</span>

   A host might only be known by a flow of packets that it is sending or
   receiving.  On its own, a port number is insufficient to uniquely
   identify a single host.  In combination with an IP address, a port
   number can be used to uniquely identify a Device in some
   circumstances.

   Use of a particular port number can be transient; often significantly
   more than use of any given IP address.  However, widespread use of
   network address translation (NAT) means that some Devices cannot be
   uniquely identified by IP address alone.  An individual Device might
   be identified by a flow of packets that it generates.  Providing that
   a LIS has sufficient knowledge of the mappings used by the NAT, an
   individual target on the remote side of the NAT might be able to be
   identified uniquely.

   Port numbers are defined for UDP [<a href="./rfc0768" title="&quot;User Datagram Protocol&quot;">RFC0768</a>], TCP [<a href="./rfc0793" title="&quot;Transmission Control Protocol&quot;">RFC0793</a>], SCTP
   [<a href="./rfc4960" title="&quot;Stream Control Transmission Protocol&quot;">RFC4960</a>], and DCCP [<a href="./rfc4340" title="&quot;Datagram Congestion Control Protocol (DCCP)&quot;">RFC4340</a>].

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;ip v="4"&gt;192.0.2.75&lt;/ip&gt;
       &lt;udpport&gt;51393&lt;/udpport&gt;
     &lt;/device&gt;

   Use of port numbers is especially reliant on the value remaining
   consistent over time.

<span class="h3"><a class="selflink" id="section-3.4" href="#section-3.4">3.4</a>.  Network Access Identifier</span>

   A Network Access Identifier (NAI) [<a href="./rfc4282" title="&quot;The Network Access Identifier&quot;">RFC4282</a>] is an identifier used in
   network authentication in a range of networks.  The identifier
   establishes a user identity within a particular domain.  Often,
   network services use an NAI in relation to location records, tying
   network access to user authentication and authorization.

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;nai&gt;user@example.net&lt;/nai&gt;
     &lt;/device&gt;

   The formal grammar for NAI [<a href="./rfc4282" title="&quot;The Network Access Identifier&quot;">RFC4282</a>] permits sequences of octets that
   are not valid UTF-8 [<a href="./rfc3629" title="&quot;UTF-8, a transformation format of ISO 10646&quot;">RFC3629</a>] sequences.  These sequences cannot be
   expressed using XML.  Therefore, this expression of NAI permits
   escaping.  Sequences of octets that do not represent a valid UTF-8
   encoding can be expressed using a backslash ('\') followed by two
   case-insensitive hexadecimal digits representing the value of a
   single octet.




<span class="grey">Winterbottom, et al.         Standards Track                   [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   The canonical representation of an NAI is the sequence of octets that
   is produced from the concatenation of UTF-8 encoded sequences of
   unescaped characters and octets derived from escaped components.  The
   resulting sequence of octets MUST conform to the constraints in
   [<a href="./rfc4282" title="&quot;The Network Access Identifier&quot;">RFC4282</a>].

   For example, the NAI "f&lt;U+FC&gt;\&lt;0xFF&gt;@bar.com" that includes the UTF-8
   encoded u-umlaut character (U+FC) and an invalid UTF-8 octet (0xFF)
   might be represented as "f\c3\bc\5c\90@bar.com", though the u-umlaut
   character might be included directly.

<span class="h4"><a class="selflink" id="section-3.4.1" href="#section-3.4.1">3.4.1</a>.  Using NAI for Location Configuration</span>

   An NAI in WiMAX is uniquely attributable to a single Device at any
   one time.  An NAI either identifies a Device or a service
   subscription, neither of which can have multiple active sessions.

   In a WiMAX network, an IP address is not sufficient information for a
   LIS to locate a Device.  The following procedure relies on an NAI to
   identify the Device.  This procedure and the messages and parameters
   is relies upon are defined in [<a href="#ref-WiMAX-T33-110-R015v01-B">WiMAX-T33-110-R015v01-B</a>].

   Location requests in a WiMAX network always require the inclusion of
   an NAI.  However, if a LIS receives a request that does not come from
   an authenticated and authorized third-party requestor, it can treat
   this request as a location configuration request.

   After receiving a location request that includes an NAI, the LIS
   sends a "Location-Requestor-Authentication-Protocol" access request
   message to the Authentication, Authorization, and Accounting (AAA)
   server.  This request includes an "MS-Identity-Assertion" parameter
   containing the NAI.

   The AAA server consults network policy, and if the request is
   permitted, the response includes the IP address that is currently
   assigned to the Device.  If this IP address matches the source IP
   address of the HELD location request, the location request can be
   authorized under the LCP policy (see <a href="#section-4.1">Section 4.1</a>).  Otherwise, the
   request must be treated as a third-party request.

   This relies on the same protections against IP address spoofing that
   are required by [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>].  In addition, the request made of the AAA
   uses either Diameter [<a href="./rfc3588" title="&quot;Diameter Base Protocol&quot;">RFC3588</a>] or RADIUS [<a href="./rfc2865" title="&quot;Remote Authentication Dial In User Service (RADIUS)&quot;">RFC2865</a>], and therefore
   relies on the protections provided by those protocols.  In order to
   rely on the access request, the AAA server MUST be authenticated to
   be a trusted entity for the purpose of providing a link between the





<span class="grey">Winterbottom, et al.         Standards Track                   [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   NAI and IP address.  The AAA protocol MUST also provide protection
   from modification and replay attacks to ensure that data cannot be
   altered by an attacker.

<span class="h3"><a class="selflink" id="section-3.5" href="#section-3.5">3.5</a>.  URI</span>

   A Device can be identified by a URI [<a href="./rfc3986" title="&quot;Uniform Resource Identifier (URI): Generic Syntax&quot;">RFC3986</a>].  Any URI can be used
   providing that the requestor and LIS have a common understanding of
   the semantics implied by use of the URI.

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;uri&gt;sip:user@example.net;gr=kjh29x97us97d&lt;/uri&gt;
     &lt;/device&gt;

   Particular care needs to be taken in ensuring that a particular URI
   only refers to a single Device.  In many cases, a URI can resolve to
   multiple destinations.  For example, a SIP address of record URI can
   correspond to a service subscription rather than a single Device.

   A "tel:" URI [<a href="./rfc3966" title="&quot;The tel URI for Telephone Numbers&quot;">RFC3966</a>] can be used to identify a Device by telephone
   number:

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;uri&gt;tel:800-555-1111;extension=1234;phone-context=+1&lt;/uri&gt;
     &lt;/device&gt;

<span class="h3"><a class="selflink" id="section-3.6" href="#section-3.6">3.6</a>.  Fully Qualified Domain Name</span>

   A fully qualified domain name can be used as the basis for
   identification using the "fqdn" element.

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;fqdn&gt;host.example.net&lt;/fqdn&gt;
     &lt;/device&gt;

   This domain name slot, which is aware of Internationalized Domain
   Names for Applications (IDNA) [<a href="./rfc5890" title="&quot;Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework&quot;">RFC5890</a>], is formed from any sequence
   of valid U-labels or NR-LDH-labels.

   A domain name does not always correspond to a single IP address or
   host.  If this is the case, a domain name is not a suitable
   identifier.

<span class="h3"><a class="selflink" id="section-3.7" href="#section-3.7">3.7</a>.  Cellular Telephony Identifiers</span>

   A range of different forms of mobile station identifiers are used for
   different cellular telephony systems.  Elements are defined for these
   identifiers.  The following identifiers are defined:



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   msisdn:  The Mobile Station International Subscriber Dial Number
      (MSISDN) [<a href="#ref-E.213" title="&quot;E.213 : Telephone and ISDN numbering plan for land mobile stations in public land mobile networks (PLMN)&quot;">E.213</a>] is an E.164 number [<a href="#ref-E.164" title="&quot;E.164 : The international public telecommunication numbering plan&quot;">E.164</a>] between 6 and 15
      digits long.

   imsi:  The International Mobile Subscriber Identity (IMSI)
      [<a href="#ref-TS.3GPP.23.003">TS.3GPP.23.003</a>] is an identifier associated with all GSM (Global
      System for Mobile Communications) and UMTS (Universal Mobile
      Telecommunications System) mobile subscribers between 6 and 15
      digits in length.

   imei:  The International Mobile Equipment Identifier (IMEI)
      [<a href="#ref-TS.3GPP.23.003">TS.3GPP.23.003</a>] is a unique device serial number up to 15 digits
      long.

   min:  The Mobile Identification Number (MIN) [<a href="#ref-TIA.EIA.IS-2000-6">TIA.EIA.IS-2000-6</a>] is a
      10-digit unique number assigned to CDMA handsets.

   mdn:  The Mobile Directory Number (MDN) is an E.164 number [<a href="#ref-E.164" title="&quot;E.164 : The international public telecommunication numbering plan&quot;">E.164</a>],
      with usage similar to MSISDN.

   Each identifier contains a string of decimal digits with a length as
   specified.

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;msisdn&gt;11235550123&lt;/msisdn&gt;
     &lt;/device&gt;

<span class="h3"><a class="selflink" id="section-3.8" href="#section-3.8">3.8</a>.  DHCP Unique Identifier</span>

   The Dynamic Host Configuration Protocol (DHCP) uses a binary
   identifier for its clients.  The DHCP Unique Identifier (DUID) is
   expressed in Option 61 of DHCPv4 (see [<a href="./rfc4361" title="&quot;Node-specific Client Identifiers for Dynamic Host Configuration Protocol Version Four (DHCPv4)&quot;">RFC4361</a>]) or Option 1 of
   DHCPv6 and follows the format defined in <a href="./rfc3315#section-9">Section&nbsp;9 of [RFC3315]</a>.  The
   "duid" element includes the binary value of the DUID expressed in
   hexadecimal.

     &lt;device xmlns="urn:ietf:params:xml:ns:geopriv:held:id"&gt;
       &lt;duid&gt;1234567890AaBbCcDdEeFf&lt;/duid&gt;
     &lt;/device&gt;

<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>.  Privacy Considerations</span>

   Location configuration protocols can make use of an authorization
   model known as "LCP policy", which permits only Targets to be the
   recipients of their own locations.  In effect, an LCP server (that
   is, the LIS) follows a single-rule policy that states that the Target
   is the only authorized Location Recipient.




<span class="grey">Winterbottom, et al.         Standards Track                   [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   The security and privacy considerations of the base HELD protocol
   [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>] are applicable.  However, the considerations relating to
   return routability do not apply to third-party requests.  Return
   routability may also not apply to requests from Targets for their own
   location, depending on the anti-spoofing mechanisms employed for the
   identifier.

<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a>.  Targets Requesting Their Own Location</span>

   When a Target uses identity extensions to obtain its own location,
   HELD can no longer be considered an LCP.  The authorization policy
   that the LIS uses to respond to these requests must be provisioned by
   one or more Rule Makers.

   In the case that the LIS exclusively provides Targets with their own
   locations, the LIS can still be said to be following the "LCP
   policy".  The "LCP policy" concept and further security and privacy
   considerations can be found in [<a href="#ref-GEOPRIV-ARCH">GEOPRIV-ARCH</a>].

   The spoofing protections provided when using HELD with identity
   extensions to provide Targets with their own locations differ from
   the protections inherent in an LCP.  For an LCP, return routability
   is considered sufficient protection against spoofing.  For a similar
   policy to be used, specific measures MUST be defined to protect
   against spoofing of the alternative identifier.  This document
   defines this for an NAI when used in WiMAX networks (see
   <a href="#section-3.4.1">Section 3.4.1</a>), but for no other identifier.

   A Rule Maker might require an assurance that the identifier is owned
   by the requestor.  Any multi-stage verification process that includes
   a return routability test cannot provide any stronger assurance than
   return routability alone; therefore, policy might require the use of
   additional, independent methods of verification.

   Care is required where a direct one-to-one relationship between
   requestor and Device identity does not exist.  If identifiers are not
   uniquely attributable to a single Device, the use of HELD identity
   extensions to provide Targets with their own locations could be
   exploited by an attacker.

      It might be possible in some networks to establish multiple
      concurrent sessions using the same credentials.  For instance,
      Devices with different MAC addresses might be granted concurrent
      access to a network using the same NAI.  It is not appropriate to
      provide Targets with their own locations based on the NAI in this
      case.  Neither is it appropriate to authenticate a Device using
      NAI and allow that Device to provide an unauthenticated MAC
      address as a Device identifier, even if the MAC address is



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 16]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-17" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


      registered to the NAI.  The MAC address potentially identifies a
      different Device than the one that is making the request.  The
      correct way of gaining authorization is to establish a policy that
      permits this particular request as a third-party request.

   <a href="#section-3.4.1">Section 3.4.1</a> discusses the implications of using an NAI as an
   identifier for location requests made of a LIS serving a WiMAX
   network.  Additional security considerations are discussed in
   [<a href="#ref-WiMAX-T33-110-R015v01-B">WiMAX-T33-110-R015v01-B</a>].

<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a>.  Third-Party Requests</span>

   The "LCP policy" does not allow requests made by third parties.  If a
   LIS permits requests from third parties using Device identity, it
   assumes the rule of a Location Server (LS).  As a Location Server,
   the LIS MUST explicitly authorize requests according to the policies
   that are provided by Rule Makers, including the Target.  The LIS MUST
   also authenticate requestors according to any agreed-upon
   authorization policy.

   An organization that provides a LIS that allows third-party requests
   must provide a means for a Rule Maker to specify authorization
   policies as part of the LIS implementation (e.g, in the form of
   access control lists).  Authorization must be established before
   allowing third-party requests for the location of any Target.  Until
   an authorization policy is established, the LIS MUST reject requests
   by third parties (that is, the default policy is "deny all").

   When the LIS is operated by an access network, the relationship
   between the Target and the LIS can be transient.  As the Target is a
   potential Rule Maker, this presents a problem.  However, the process
   of establishing network access usually results in a form of agreement
   between the Target and the network provider.  This process offers a
   natural vehicle for establishing location privacy policies.
   Establishing authorization policy might be a manual process, an
   explicit part of the terms of service for the network, or an
   automated system that accepts formal authorization policies (see
   [<a href="./rfc4745" title="&quot;Common Policy: A Document Format for Expressing Privacy Preferences&quot;">RFC4745</a>] and [<a href="./rfc4825" title="&quot;The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)&quot;">RFC4825</a>]).  This document does not mandate any
   particular mechanism for establishing an authorization policy.

<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>.  Security Considerations</span>

   The security considerations in [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>] describe the use of
   Transport Layer Security (TLS) [<a href="./rfc5246" title="&quot;The Transport Layer Security (TLS) Protocol Version 1.2&quot;">RFC5246</a>] for server authentication,
   confidentiality, and protection from modification.  These protections
   apply to both Target requests for their own locations and requests
   made by third parties.




<span class="grey">Winterbottom, et al.         Standards Track                   [Page 17]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-18" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   All HELD requests containing identity MUST be authenticated by the
   LIS.  How authentication is accomplished and what assurances are
   desired is a matter for policy.

   The base HELD protocol uses return reachability of an IP address
   implied by the requestor being able to successfully complete a TCP
   handshake.  It is RECOMMENDED that any means of authentication
   provide at least this degree of assurance.  For requests that include
   Device identity, the requestor MUST support HTTP digest
   authentication [<a href="./rfc2617" title="&quot;HTTP Authentication: Basic and Digest Access Authentication&quot;">RFC2617</a>].  Unauthenticated location requests
   containing Device identity can be challenged with an HTTP 401
   (Unauthorized) response or rejected with an HTTP 403 (Forbidden)
   response.

   HELD [<a href="./rfc5985" title="&quot;HTTP-Enabled Location Delivery (HELD)&quot;">RFC5985</a>] does not mandate that Devices implement
   authentication.  A LIS SHOULD NOT send a HTTP 401 response if the
   Device does not include Device identity.

<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>.  Identifier Suitability</span>

   Transient and ambiguous identifiers can be exploited by malicious
   requests and are not suitable as a basis for identifying a Device.
   <a href="#section-2.1">Section 2.1</a> provides further discussion on this subject.

   Identifier transience can lead to incorrect location information
   being provided.  An attacker could exploit the use of transient
   identifiers.  In this attack, the attacker either knows of a
   re-allocation of that identifier or is able to force the identifier
   to be re-allocated during the processing of the request.

   An attacker could use this to acquire location information for
   another Device or to coerce the LIS to lie on its behalf if this
   re-allocation occurs between the time where authorization is granted
   and location information is granted.

   Ambiguous identifiers present a similar problem.  An attacker could
   legitimately gain authorization to use a particular identifier.
   Since an ambiguous identifier potentially refers to multiple Devices,
   if authorization is granted for one of those Devices, an attacker
   potentially gains access to location information for all of those
   Devices.

<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>.  Targets Requesting Their Own Location</span>

   Requests made by a Device for its own location are covered by the
   same set of protections offered by HELD.  These requests might be
   authorized under a policy similar to the "LCP policy" that permits a
   Target access to location information about itself.



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 18]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-19" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   Identity information provided by the Device is private data that
   might be sensitive.  The Device provides this information in the
   expectation that it assists the LIS in providing the Device a
   service.  The LIS MUST NOT use identity information for any other
   purpose other than serving the request that includes that
   information.

<span class="h3"><a class="selflink" id="section-5.3" href="#section-5.3">5.3</a>.  Third-Party Requests</span>

   Requests from third parties have the same requirements for server
   authentication, confidentiality, and protection from modification as
   Target requests for their own locations.  However, because the third
   party needs to be authorized, the requestor MUST be authenticated by
   the LIS.  In addition, third-party requests MUST be explicitly
   authorized by a policy that is established by a Rule Maker.

   More detail on the privacy implications of third-party requests are
   covered in <a href="#section-4">Section 4</a>.

<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>.  XML Schema</span>

   &lt;xs:schema
       targetNamespace="urn:ietf:params:xml:ns:geopriv:held:id"
       xmlns:xs="http://www.w3.org/2001/XMLSchema"
       xmlns:id="urn:ietf:params:xml:ns:geopriv:held:id"
       elementFormDefault="qualified"
       attributeFormDefault="unqualified"&gt;

     &lt;xs:annotation&gt;
       &lt;xs:appinfo
           source="urn:ietf:params:xml:schema:geopriv:held:id"&gt;
         HELD Device Identity
       &lt;/xs:appinfo&gt;
       &lt;xs:documentation
           source="http://www.rfc-editor.org/rfc/rfc6155.txt"&gt;
         This document defines Device identity elements for HELD.
       &lt;/xs:documentation&gt;
     &lt;/xs:annotation&gt;

     &lt;xs:element name="device" type="id:deviceIdentity"/&gt;
     &lt;xs:complexType name="deviceIdentity"&gt;
       &lt;xs:sequence&gt;
         &lt;xs:any namespace="##any" processContents="lax"
                 minOccurs="0" maxOccurs="unbounded"/&gt;
       &lt;/xs:sequence&gt;
     &lt;/xs:complexType&gt;

     &lt;xs:element name="requiredIdentifiers" type="id:qnameList"/&gt;



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 19]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-20" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


     &lt;xs:simpleType name="qnameList"&gt;
       &lt;xs:list itemType="xs:QName"/&gt;
     &lt;/xs:simpleType&gt;

     &lt;xs:element name="ip" type="id:ipAddress"/&gt;
     &lt;xs:complexType name="ipAddress"&gt;
       &lt;xs:simpleContent&gt;
         &lt;xs:extension base="xs:token"&gt;
           &lt;xs:attribute name="v" use="required"&gt;
             &lt;xs:simpleType&gt;
               &lt;xs:restriction base="xs:token"&gt;
                 &lt;xs:pattern value="[\da-fA-F]"/&gt;
               &lt;/xs:restriction&gt;
             &lt;/xs:simpleType&gt;
           &lt;/xs:attribute&gt;
         &lt;/xs:extension&gt;
       &lt;/xs:simpleContent&gt;
     &lt;/xs:complexType&gt;

     &lt;xs:element name="mac" type="id:macAddress"/&gt;
     &lt;xs:simpleType name="macAddress"&gt;
       &lt;xs:restriction base="xs:token"&gt;
         &lt;xs:pattern
     value="[\da-fA-F]{2}(-[\da-fA-F]{2}){5}((-[\da-fA-F]{2}){2})?"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;

     &lt;xs:element name="udpport" type="id:portNumber"/&gt;
     &lt;xs:element name="tcpport" type="id:portNumber"/&gt;
     &lt;xs:element name="sctpport" type="id:portNumber"/&gt;
     &lt;xs:element name="dccpport" type="id:portNumber"/&gt;
     &lt;xs:simpleType name="portNumber"&gt;
       &lt;xs:restriction base="xs:nonNegativeInteger"&gt;
         &lt;xs:maxInclusive value="65535"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;

     &lt;xs:element name="nai" type="id:naiType"/&gt;
     &lt;xs:simpleType name="naiType"&gt;
       &lt;xs:restriction base="xs:token"&gt;
         &lt;xs:pattern
             value="([^\\]|\\[\dA-Fa-f]{2})*
                    (@([A-Za-z\d]([A-Za-z\d\-]*[A-Za-z\d])*\.)+
                     [A-Za-z\d]([A-Za-z\d\-]*[A-Za-z\d])*)?"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;

     &lt;xs:element name="uri" type="xs:anyURI"/&gt;



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 20]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-21" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


     &lt;xs:element name="fqdn" type="xs:token"/&gt;

     &lt;xs:element name="duid" type="xs:hexBinary"/&gt;

     &lt;xs:element name="msisdn" type="id:e164"/&gt;
     &lt;xs:element name="imsi" type="id:e164"/&gt;
     &lt;xs:element name="imei" type="id:digit15"/&gt;
     &lt;xs:element name="min" type="id:digit10"/&gt;
     &lt;xs:element name="mdn" type="id:e164"/&gt;
     &lt;xs:simpleType name="digits"&gt;
       &lt;xs:restriction base="xs:token"&gt;
         &lt;xs:pattern value="[\d]+"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;
     &lt;xs:simpleType name="e164"&gt;
       &lt;xs:restriction base="id:digit15"&gt;
         &lt;xs:minLength value="6"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;
     &lt;xs:simpleType name="digit15"&gt;
       &lt;xs:restriction base="id:digits"&gt;
         &lt;xs:maxLength value="15"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;
     &lt;xs:simpleType name="digit10"&gt;
       &lt;xs:restriction base="id:digits"&gt;
         &lt;xs:length value="10"/&gt;
       &lt;/xs:restriction&gt;
     &lt;/xs:simpleType&gt;

   &lt;/xs:schema&gt;

<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>.  IANA Considerations</span>

   This document registers an XML namespace and schema with IANA in
   accordance with guidelines in [<a href="./rfc3688" title="&quot;The IETF XML Registry&quot;">RFC3688</a>].

<span class="h3"><a class="selflink" id="section-7.1" href="#section-7.1">7.1</a>.  URN Sub-Namespace Registration for</span>
<span class="h3">      urn:ietf:params:xml:ns:geopriv:held:id</span>

   This section registers a new XML namespace,
   "urn:ietf:params:xml:ns:geopriv:held:id", as per the guidelines in
   [<a href="./rfc3688" title="&quot;The IETF XML Registry&quot;">RFC3688</a>].

   URI: urn:ietf:params:xml:ns:geopriv:held:id

   Registrant Contact:  IETF, GEOPRIV working group (geopriv@ietf.org),
      James Winterbottom (james.winterbottom@andrew.com).



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 21]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-22" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   XML:

   BEGIN
     &lt;?xml version="1.0"?&gt;
     &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
       "<a href="http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd</a>"&gt;
     &lt;html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"&gt;
       &lt;head&gt;
         &lt;title&gt;HELD Device Identity Parameters&lt;/title&gt;
       &lt;/head&gt;
       &lt;body&gt;
         &lt;h1&gt;Namespace for HELD Device Identity Parameters&lt;/h1&gt;
         &lt;h2&gt;urn:ietf:params:xml:ns:geopriv:held:id&lt;/h2&gt;
         &lt;p&gt;See &lt;a href="http://www.rfc-editor.org/rfc/rfc6155.txt"&gt;
            <a href="./rfc6155">RFC 6155</a>&lt;/a&gt;.&lt;/p&gt;
       &lt;/body&gt;
     &lt;/html&gt;
   END

<span class="h3"><a class="selflink" id="section-7.2" href="#section-7.2">7.2</a>.  XML Schema Registration</span>

   This section registers an XML schema as per the guidelines in
   [<a href="./rfc3688" title="&quot;The IETF XML Registry&quot;">RFC3688</a>].

   URI:  urn:ietf:params:xml:schema:geopriv:held:id

   Registrant Contact:  IETF, GEOPRIV working group (geopriv@ietf.org),
      James Winterbottom (james.winterbottom@andrew.com).

   Schema:  The XML for this schema can be found as the entirety of
      <a href="#section-6">Section 6</a> of this document.

<span class="h3"><a class="selflink" id="section-7.3" href="#section-7.3">7.3</a>.  Registration of HELD 'badIdentifier' Error Code</span>

   This section registers the "badIdentifier" error code in the IANA
   maintained "HELD Error Codes" sub-registry of the "Geopriv HTTP
   Enabled Location Delivery (HELD) Parameters" registry.

   badIdentifier  This error code indicates that a Device identifier
      used in the HELD request was either: not supported by the LIS,
      badly formatted, or not one for which the requestor was authorized
      to make a request.

<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>.  Acknowledgements</span>

   The National Emergency Number Association (NENA) VoIP location
   working group provided assistance in the definition of the schema
   used in this document.  Special thanks go to Barbara Stark, Guy



<span class="grey">Winterbottom, et al.         Standards Track                   [Page 22]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-23" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   Caron, Nadine Abbott, Jerome Grenier, and Martin Dawson.  Bob Sherry
   provided input on use of URIs.  Thanks to Adam Muhlbauer and Eddy
   Corbett for providing further corrections.  Bernard Aboba provided
   excellent feedback on use cases and the security model; Bernard,
   along with Alan DeKok, also helped resolve an issue with NAIs.  Ray
   Bellis provided motivation for the protocol port parameters.  Marc
   Linsner and Alissa Cooper provided guidance and text (respectively)
   that greatly clarified the discussion relating to LCPs.  Thanks to
   Jon Peterson and Cullen Jennings for forcing this to be practical.

<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>.  References</span>

<span class="h3"><a class="selflink" id="section-9.1" href="#section-9.1">9.1</a>.  Normative References</span>

   [<a id="ref-RFC0768">RFC0768</a>]  Postel, J., "User Datagram Protocol", STD 6, <a href="./rfc768">RFC 768</a>,
              August 1980.

   [<a id="ref-RFC0791">RFC0791</a>]  Postel, J., "Internet Protocol", STD 5, <a href="./rfc791">RFC 791</a>,
              September 1981.

   [<a id="ref-RFC0793">RFC0793</a>]  Postel, J., "Transmission Control Protocol", STD 7,
              <a href="./rfc793">RFC 793</a>, September 1981.

   [<a id="ref-RFC2119">RFC2119</a>]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.

   [<a id="ref-RFC2617">RFC2617</a>]  Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S.,
              Leach, P., Luotonen, A., and L. Stewart, "HTTP
              Authentication: Basic and Digest Access Authentication",
              <a href="./rfc2617">RFC 2617</a>, June 1999.

   [<a id="ref-RFC2865">RFC2865</a>]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
              "Remote Authentication Dial In User Service (RADIUS)",
              <a href="./rfc2865">RFC 2865</a>, June 2000.

   [<a id="ref-RFC3315">RFC3315</a>]  Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
              and M. Carney, "Dynamic Host Configuration Protocol for
              IPv6 (DHCPv6)", <a href="./rfc3315">RFC 3315</a>, July 2003.

   [<a id="ref-RFC3588">RFC3588</a>]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
              Arkko, "Diameter Base Protocol", <a href="./rfc3588">RFC 3588</a>, September 2003.

   [<a id="ref-RFC3629">RFC3629</a>]  Yergeau, F., "UTF-8, a transformation format of ISO
              10646", STD 63, <a href="./rfc3629">RFC 3629</a>, November 2003.

   [<a id="ref-RFC3688">RFC3688</a>]  Mealling, M., "The IETF XML Registry", <a href="https://www.rfc-editor.org/bcp/bcp81">BCP 81</a>, <a href="./rfc3688">RFC 3688</a>,
              January 2004.




<span class="grey">Winterbottom, et al.         Standards Track                   [Page 23]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-24" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   [<a id="ref-RFC3986">RFC3986</a>]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
              Resource Identifier (URI): Generic Syntax", STD 66,
              <a href="./rfc3986">RFC 3986</a>, January 2005.

   [<a id="ref-RFC4282">RFC4282</a>]  Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
              Network Access Identifier", <a href="./rfc4282">RFC 4282</a>, December 2005.

   [<a id="ref-RFC4291">RFC4291</a>]  Hinden, R. and S. Deering, "IP Version 6 Addressing
              Architecture", <a href="./rfc4291">RFC 4291</a>, February 2006.

   [<a id="ref-RFC4340">RFC4340</a>]  Kohler, E., Handley, M., and S. Floyd, "Datagram
              Congestion Control Protocol (DCCP)", <a href="./rfc4340">RFC 4340</a>, March 2006.

   [<a id="ref-RFC4361">RFC4361</a>]  Lemon, T. and B. Sommerfeld, "Node-specific Client
              Identifiers for Dynamic Host Configuration Protocol
              Version Four (DHCPv4)", <a href="./rfc4361">RFC 4361</a>, February 2006.

   [<a id="ref-RFC4960">RFC4960</a>]  Stewart, R., "Stream Control Transmission Protocol",
              <a href="./rfc4960">RFC 4960</a>, September 2007.

   [<a id="ref-RFC5890">RFC5890</a>]  Klensin, J., "Internationalized Domain Names for
              Applications (IDNA): Definitions and Document Framework",
              <a href="./rfc5890">RFC 5890</a>, August 2010.

   [<a id="ref-RFC5985">RFC5985</a>]  Barnes, M., "HTTP-Enabled Location Delivery (HELD)",
              <a href="./rfc5985">RFC 5985</a>, September 2010.

   [<a id="ref-W3C.REC-xml-names11-20060816">W3C.REC-xml-names11-20060816</a>]
              Hollander, D., Tobin, R., Layman, A., and T. Bray,
              "Namespaces in XML 1.1 (Second Edition)", World Wide Web
              Consortium Recommendation REC-xml-names11-20060816,
              August 2006,
              &lt;<a href="http://www.w3.org/TR/2006/REC-xml-names11-20060816">http://www.w3.org/TR/2006/REC-xml-names11-20060816</a>&gt;.

   [<a id="ref-IEEE802">IEEE802</a>]  IEEE, "IEEE Standard for Local and Metropolitan Area
              Networks: Overview and Architecture", IEEE 802,
              February 2002.

   [<a id="ref-EUI64">EUI64</a>]    IEEE, "Guidelines for 64-bit Global Identifier (EUI-64)
              Registration Authority", March 1997,
              &lt;<a href="http://standards.ieee.org/regauth/oui/tutorials/EUI64.html">http://standards.ieee.org/regauth/oui/tutorials/</a>
              <a href="http://standards.ieee.org/regauth/oui/tutorials/EUI64.html">EUI64.html</a>&gt;.

   [<a id="ref-E.164">E.164</a>]    ITU-T, "E.164 : The international public telecommunication
              numbering plan", ITU-T Recommendation E.164,
              February 2005,
              &lt;<a href="http://www.itu.int/rec/T-REC-E.164-200502-I/en">http://www.itu.int/rec/T-REC-E.164-200502-I/en</a>&gt;.




<span class="grey">Winterbottom, et al.         Standards Track                   [Page 24]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-25" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   [<a id="ref-E.213">E.213</a>]    ITU-T, "E.213 : Telephone and ISDN numbering plan for land
              mobile stations in public land mobile networks (PLMN)",
              ITU-T Recommendation E.213, November 1988,
              &lt;<a href="http://www.itu.int/rec/T-REC-E.213-198811-I/en">http://www.itu.int/rec/T-REC-E.213-198811-I/en</a>&gt;.

   [<a id="ref-TS.3GPP.23.003">TS.3GPP.23.003</a>]
              3GPP, "Numbering, addressing and identification", 3GPP
              TS 23.003 9.4.0, September 2010,
              &lt;<a href="http://www.3gpp.org/ftp/Specs/html-info/23003.htm">http://www.3gpp.org/ftp/Specs/html-info/23003.htm</a>&gt;.

   [<a id="ref-TIA.EIA.IS-2000-6">TIA.EIA.IS-2000-6</a>]
              TIA/EIA, "Analog Signaling Standard for CDMA 2000 Spread
              Spectrum Systems",  TIA/EIA/IS-2000-6-C, May 2002.

   [<a id="ref-WiMAX-T33-110-R015v01-B">WiMAX-T33-110-R015v01-B</a>]
              WiMAX Forum, "Protocols and Procedures for Location Based
              Services", WiMAX Forum Network Architecture T33-110-
              R015v01-B, May 2009.

   [<a id="ref-RFC5952">RFC5952</a>]  Kawamura, S. and M. Kawashima, "A Recommendation for IPv6
              Address Text Representation", <a href="./rfc5952">RFC 5952</a>, August 2010.

<span class="h3"><a class="selflink" id="section-9.2" href="#section-9.2">9.2</a>.  Informative References</span>

   [<a id="ref-RFC1918">RFC1918</a>]  Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
              E. Lear, "Address Allocation for Private Internets",
              <a href="https://www.rfc-editor.org/bcp/bcp5">BCP 5</a>, <a href="./rfc1918">RFC 1918</a>, February 1996.

   [<a id="ref-RFC2101">RFC2101</a>]  Carpenter, B., Crowcroft, J., and Y. Rekhter, "IPv4
              Address Behaviour Today", <a href="./rfc2101">RFC 2101</a>, February 1997.

   [<a id="ref-RFC3825">RFC3825</a>]  Polk, J., Schnizlein, J., and M. Linsner, "Dynamic Host
              Configuration Protocol Option for Coordinate-based
              Location Configuration Information", <a href="./rfc3825">RFC 3825</a>, July 2004.

   [<a id="ref-RFC3966">RFC3966</a>]  Schulzrinne, H., "The tel URI for Telephone Numbers",
              <a href="./rfc3966">RFC 3966</a>, December 2004.

   [<a id="ref-RFC4745">RFC4745</a>]  Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J.,
              Polk, J., and J. Rosenberg, "Common Policy: A Document
              Format for Expressing Privacy Preferences", <a href="./rfc4745">RFC 4745</a>,
              February 2007.

   [<a id="ref-RFC4776">RFC4776</a>]  Schulzrinne, H., "Dynamic Host Configuration Protocol
              (DHCPv4 and DHCPv6) Option for Civic Addresses
              Configuration Information", <a href="./rfc4776">RFC 4776</a>, November 2006.





<span class="grey">Winterbottom, et al.         Standards Track                   [Page 25]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-26" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


   [<a id="ref-RFC4825">RFC4825</a>]  Rosenberg, J., "The Extensible Markup Language (XML)
              Configuration Access Protocol (XCAP)", <a href="./rfc4825">RFC 4825</a>, May 2007.

   [<a id="ref-RFC5246">RFC5246</a>]  Dierks, T. and E. Rescorla, "The Transport Layer Security
              (TLS) Protocol Version 1.2", <a href="./rfc5246">RFC 5246</a>, August 2008.

   [<a id="ref-RFC5687">RFC5687</a>]  Tschofenig, H. and H. Schulzrinne, "GEOPRIV Layer 7
              Location Configuration Protocol: Problem Statement and
              Requirements", <a href="./rfc5687">RFC 5687</a>, March 2010.

   [<a id="ref-GEOPRIV-ARCH">GEOPRIV-ARCH</a>]
              Barnes, R., Lepinski, M., Cooper, A., Morris, J.,
              Tschofenig, H., and H. Schulzrinne, "An Architecture for
              Location and Location Privacy in Internet Applications",
              Work in Progress, October 2010.

   [<a id="ref-EMERGENCY-CALLING">EMERGENCY-CALLING</a>]
              Rosen, B. and J. Polk, "Best Current Practice for
              Communications Services in support of Emergency Calling",
              Work in Progress, October 2010.































<span class="grey">Winterbottom, et al.         Standards Track                   [Page 26]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-27" ></span>
<span class="grey"><a href="./rfc6155">RFC 6155</a>                      HELD Identity                   March 2011</span>


Authors' Addresses

   James Winterbottom
   Andrew Corporation
   Andrew Building (39)
   Wollongong University Campus
   Northfields Avenue
   Wollongong, NSW  2522
   AU

   Phone: +61 2 4221 2938
   EMail: james.winterbottom@andrew.com


   Martin Thomson
   Andrew Corporation
   Andrew Building (39)
   Wollongong University Campus
   Northfields Avenue
   Wollongong, NSW  2522
   AU

   Phone: +61 2 4221 2915
   EMail: martin.thomson@andrew.com


   Hannes Tschofenig
   Nokia Siemens Networks
   Linnoitustie 6
   Espoo  02600
   Finland

   Phone: +358 (50) 4871445
   EMail: Hannes.Tschofenig@gmx.net
   URI:   <a href="http://www.tschofenig.priv.at">http://www.tschofenig.priv.at</a>


   Richard Barnes
   BBN Technologies
   9861 Broken Land Pkwy, Suite 400
   Columbia, MD  21046
   USA

   Phone: +1 410 290 6169
   EMail: rbarnes@bbn.com






Winterbottom, et al.         Standards Track                   [Page 27]
</pre>