RFC 4725
ENUM Validation Architecture
RFC 4725: ENUM Validation Architecture (Part 1 of 3) ✨
Network Working Group 🎀 Request for Comments: 4725 🦋 Category: Informational 💅 Authors: A. Mayrhofer (enum.at) and B. Hoeneisen (Switch) 🌸 Date: November 2006 ⭐ This header doesn't list anything it obsoletes or updates, so this one stands on its own 🫶
Status of This Memo 📜
okay so this memo is just giving info to the Internet community 💜 It does not specify an Internet standard of any kind, and distribution of it is unlimited 🌈
Copyright Notice ©️
Copyright (C) The IETF Trust (2006). 💖
Abstract 🧚
An ENUM domain name is tightly coupled with the underlying E.164 number 🔗 Checking whether the Registrant of an ENUM domain name is the same entity as the Assignee of the matching E.164 number is commonly called "validation" ✅ This document describes validation requirements and a high-level architecture for an ENUM validation infrastructure 💅✨
Table of Contents 📚
1. Introduction ....................................................3
2. Requirements ....................................................3
3. ENUM Provisioning Model and Roles ...............................4
3.1. Number Assignment Entity (NAE) .............................5
3.2. Assignee ...................................................7
3.3. Registrant .................................................7
3.4. Validation Entity (VE) .....................................7
3.5. Registry ...................................................8
3.6. Registrar ..................................................8
3.7. Domain Name System Service Provider (DNS-SP) ...............8
3.8. Application Service Provider (ASP) .........................8
4. Validation Process Assumptions ..................................9
4.1. Workflow ...................................................9
4.2. Trust Relations ...........................................10
4.3. Data Flow and Format ......................................11
5. Example Scenarios ..............................................11
5.1. E.164 Number Assignment along with ENUM Registration ......11
5.2. Fully Disjoint Roles ......................................13
6. Security Considerations ........................................14
6.1. Fraud Prevention ..........................................14
6.2. Assignee Data .............................................14
7. Acknowledgements ...............................................15
8. References .....................................................15
8.1. Normative References ......................................15
8.2. Informative References ....................................151. Introduction 🌷
okay bestie, so E.164 Number Mapping (ENUM) [1] uses the Domain Name System (DNS) [4] to go from E.164 numbers [2] to Uniform Resource Identifiers (URIs) [3] 📞➡️🔗 The way E.164 numbers get mapped to domain names is explained further in RFC 3761 [1] 💅
"Ordinary" domain names are usually handed out first-come-first-served, and the registration data is the whole story for who owns them 🙃 ENUM domain names are different though! They're linked to E.164 numbers, so they're intrinsically tied to the status and the "Assignee" (defined in Section 3.2) of the matching E.164 number 🫶 it's giving main character energy for the number 📱✨
2. Requirements 💖
Keeping the integrity between ENUM and E.164 is one of the biggest concerns in ENUM implementations 🔥 This is often why "trials" happen before commercial rollouts 🧪
so to keep this relationship between E.164 numbers and ENUM domain names healthy, registration processes must make sure these requirements are fulfilled for the entire lifetime of an ENUM delegation 👑
- The ENUM domain name corresponds either to an assigned E.164 number, or to a respective E.164 number that gets assigned during the registration process itself. 🌸
- The corresponding E.164 number is within a number range approved to be used with ENUM. 🦋
- The registration of the ENUM domain name is authorized by the Assignee of the corresponding E.164 number. In other words, the entity asking for the registration is either the Assignee of that E.164 number itself, or an entity authorized to request registration on behalf of said Assignee. 🫶
- The "Registrant" (see Section 3.3) of the ENUM domain is identical to the Assignee of the corresponding E.164 number. 💅
Checking these requirements during registration is commonly called "initial validation" 📝 But that's only a one-time check! Provisions must be made so that ENUM domain name delegations get revoked when the above requirements are no longer met 🚫 In other words, the state of the ENUM domain name must track any change in state and ownership of the corresponding E.164 number, no cap 🔄 The regular process of checking that the above requirements are still satisfied is commonly called "recurring validation" or "revalidation" 🔁
⚠️ The above requirements are usually part of the local registration policy issued by the authorities in charge of ENUM administration. So the rules can come from whoever runs ENUM locally 📜
3. ENUM Provisioning Model and Roles 🧚♀️
The requirements above lead to a new role in the provisioning model: an entity doing validation-related tasks, called the Validation Entity (VE) 💜 A typical ENUM provisioning model (the one this document is based on) is shown in Figure 1 👇
+----------+
.| Registry |- -- -- -- -- -- --
. +----------+ |
. |
. | | Trust
DNS Delegation | Relation
. | Registration |
. |
. | |
+--------+ +-----------+ +----+
| DNS-SP |-- -- -- -- --| Registrar |----------------| VE |
+--------+ Nameservers +-----------+ Validation +----+
: | / |
: | E.164 Number
: | ENUM Assignment
: NAPTR | Management _ Verification
: | / |
: | _
: | / |
+-----+ ENUM enabled +------------+ E.164 Number +-----+
| ASP |- -- -- -- -- --| Assignee = |-- -- -- -- --| NAE |
+-----+ Service | Registrant | Assignment +-----+
+------------+
Legend:
ASP: Application Service Provider
DNS-SP: Domain Name System Service Provider
NAE: Number Assignment Entity
VE: Validation Entity
Figure 1: ENUM ModelThese roles get explained more below 👀 Heads up that one entity can play more than one of these roles at the same time! For example, the Registrar, the DNS-SP, and the ASP roles could all be run by one single company 🏢✨
3.1. Number Assignment Entity (NAE) 📱
A Number Assignment Entity (NAE) hands out E.164 numbers to end-users 📲 Often, but not always, the Communication Service Provider (CSP) of the end-user (the Assignee) is the one acting as NAE 💅 There are two main variants for E.164 number assignments:
- Indirect assignment: The National Number Plan Administrator (NNPA) assigns ranges of E.164 numbers to CSPs. Out of those ranges, the CSPs assign numbers (or number blocks) to their customers (end-users, Assignees). In this variant, the CSPs perform the role of the NAE 🌈
- Direct assignment: In certain cases, an NNPA assigns E.164 numbers directly to Assignees (end-users), so the NNPA acts as NAE in this variant. This typically covers special purpose numbers, like premium rate ones 💎
These two variants are shown in Figure 2 🦋
+--------------------------------------------+
| International Telecommunication Union (ITU)|
+--------------------------------------------+
|
Country codes (e.g., +44)
|
v
+-------------------------------------------+
| National Number Plan Administrator (NNPA) |------------+
+-------------------------------------------+ |
| |
Number Ranges |
(e.g., +44 20 7946 xxxx) |
| |
v |
+--------------------------------------+ |
| Communication Service Provider (CSP) | |
+--------------------------------------+ |
| |
| Single Numbers
Either Single Numbers (e.g., +44 909 8790879)
or Number Blocks (Variant 2)
(e.g., +44 20 7946 0999, +44 20 7946 07xx) |
(Variant 1) |
| |
v |
+----------+ |
| Assignee |<------------------------------+
+----------+
Figure 2: E.164 Number Assignment🙈 Quick note: the numbers above are "drama" numbers, shown for illustrative purposes only. Assignment policies for similar "real" numbers in country code +44 may differ!
The Assignee (subscriber) data tied to an E.164 number is the primary source of number assignment information 📇 So the NAE usually holds the authoritative information needed to confirm the assignment 👑
A CSP acting as NAE (indirect assignment) can therefore pretty easily assert the E.164 number assignment for its subscribers 💅 In some cases, these CSPs run databases with service information about their subscribers' numbers 🗂️ Typically, authorized entities like other CSPs are allowed to access these databases in real time, under contract, for the limited purposes of billing and validation (no marketing, data mining, or anything else) 🔒 These databases could be reused for ENUM validation purposes 🌸
Number portability transactions can lead to situations where the CSP that originally acted as NAE no longer has authoritative assignment information about the ported numbers 😭 Whether the old and/or the new CSP acts as NAE for ported numbers depends on local policy 📍
Still, it's unlikely that all CSPs acting as NAEs will take part in ENUM validation 🥲
3.2. Assignee 🎀
The person or organization that a NAE assigns an E.164 number to is called the Assignee of that number 💜 For the scope of this document, the terms Assignee, subscriber, and number-holder are used equivalently 🫶
The Assignee has the "right to use" on the assigned E.164 number ✨
3.3. Registrant
okay so the ENUM Registrant is the end-user 💖, the person or organization who is the "holder" of the ENUM domain name 🎀
the Registrant usually has control over their ENUM domain name(s) and its DNS zone content ✨ like, it's their domain, bestie 🫶
3.4. Validation Entity (VE)
the Validation Entity (VE) is the one checking whether the Registrant of an ENUM domain name is identical to the Assignee of the matching E.164 number 🔍💅
often it also verifies that the entity asking for the ENUM domain name registration is either the Assignee of that E.164 number itself, or an entity that's authorized to request registration on the Assignee's behalf 🦋
this role can be played by several parties and isn't necessarily limited to a single entity, so it's giving teamwork 👑
the actual validation methods can vary depending on, e.g., the particular party, available data sources, the Assignee's choice, and regulatory requirements 🌈 validation methods are out of scope of this document, so we're not going there today 🙈
3.5. Registry
the ENUM Registry operates the master database of ENUM domain delegations and runs the authoritative nameservers for the relevant zone under e164.arpa 🏛️✨ there MUST always be a single authoritative ENUM Registry for a specific zone 🔥
3.6. Registrar
an ENUM Registrar performs ENUM domain delegations on behalf of a Registrant by interacting with the Registry, typically through a protocol like Extensible Provisioning Protocol (EPP) [5] 📨 this role is super similar to what Registrars do in the "ordinary" domain name registration world 🌸
the Registrar may well not be the same entity as the CSP of the Registrant 🤷♀️ so a Registrar may lack authoritative number-assignment information 💀 if the Registrar and the CSP are the same entity (or has a source of authoritative data), the Registrar could perform the role of the VE itself 🧚
but in any case, a Registrar MUST ensure a proper validation through a VE prior to the registration of an ENUM domain name 🚨🫶
3.7. Domain Name System Service Provider (DNS-SP)
the Domain Name System Service Provider (DNS-SP) operates the nameservers for the ENUM DNS zones, which contain the ENUM Naming Authority Pointer (NAPTR) Resource Record (RR) entries [1] 🍓
in most cases, the Registry delegates the ENUM DNS zones to the nameservers at the DNS-SP 💜
the DNS-SP is usually not involved in the validation process 😌
3.8. Application Service Provider (ASP)
the Application Service Provider (ASP) operates a service for the Registrant ✨ this service could be an IP telephony service, whereby the service provider populates the ENUM zone for its customers so that others can discover that customer's URI 📞🦋
usually, the ASP is not involved in the validation process 💅
4. Validation Process Assumptions 🎀
4.1. Workflow
the prototypical initial validation workflow using the above roles and definitions goes like this 🧠 it has the following steps:
- A potential Registrant approaches a Registrar, and orders an ENUM domain name 🛍️
- The Registrar chooses a cooperating Validation Entity, and requests an initial validation for the ENUM domain name ordered 🤝
- The Validation Entity performs the actual validation, which could require interaction with the Assignee/Registrant 🔎
- The Validation Entity indicates the result of the initial validation to the Registrar 📬
- If the validation process was successful, the Registrar provisions the ENUM domain name with the Registry 🎉 depending on the local Registry policy, validation-related information may be provided to the Registry along with this registration 🌷
in most cases, local policy mandates expiration dates to be imposed on successful validations ⏰ if the ENUM delegation is to be kept beyond this expiration date, recurring validation MUST be performed 🔁 a typical revalidation workflow involves the following steps:
- In good time before the current validation expires, the Registrar requests the Validation Entity to revalidate the domain name in question ⏳
- The Validation Entity verifies if the delegation requirements are still met 🕵️♀️ it may use information acquired during the initial validation or associated to the registration data 📂
- The Validation Entity indicates the result of the recurring validation to the Registrar 📤
- In case the revalidation has been successful, the domain delegation may persist 🥳 local Registry policy may require updating domain name registration data, especially in case the Registry keeps validation-related expiry information 🗂️
- In case the revalidation has failed, the ENUM domain delegation MUST be suspended, either by explicit interaction with the Registry or -- if the Registry keeps validation-related information -- automatically when the current validation expires 🚫 local policy may grant a grace period on the expiration date 🕊️
this workflow ensures the integrity between the E.164 and ENUM namespaces 💜 ENUM domain delegations that fail to meet the validation requirements are suspended from the DNS 🙅♀️
4.2. Trust Relations
the above validation workflow implies the following trust relations 🫣
- The Registry trusts the Validation Entities to enforce the local validation policy 🤝
- The Registrars trust the Validation Entities to properly perform validation based on the Registrar's request 💖
- Depending on the amount of validation data provided to the Registry, additional trust relations may be necessary 🧐 three cases can be differentiated:
- The Registry receives no validation-related data: The Registry needs to trust the Registrar that validation has been performed, and the result was positive 🙏 in addition, the Registry needs to trust the Registrar that it will properly remove delegations for which revalidation fails 🗑️
- The Registry receives validation-related data including expiry date, but there are no means of checking its authenticity: The Registry needs to trust the Registrar that the validation data provided is authentic 🫠
- The Registry receives validation-related data including expiry date and means to verify its authenticity (e.g., a cryptographic signature issued by the VE): No additional trust relations are necessary 🙌✨
4.3. Data Flow and Format
the validation process requires the following regular data flows (Note: data flows not directly related to validation are out of scope of this document 🙈):
- Registrars communicate with Validation Entities to initiate, modify, or cancel validation requests 📡 Validation Entities act upon validation requests and provide validation results to Registrars 📦 since Registrars could potentially communicate with several Validation Entities, and Validation Entities could provide services to several Registrars (worst case: full mesh), a standardized protocol and data format SHOULD be used in this data flow 🕸️
- If the local Registry policy mandates that validation-related information is to be stored along with delegation records, a validation-related data flow between Registry and Registrar is required 🔗 since the registration itself already requires communication between those entities, validation-related information in a standardized data format SHOULD be embedded into the existing Registry-Registrar protocol data flow 🧩
- Validation Entities may need to communicate with Assignees to perform validation 💬 a Validation Entity MAY choose to perform all communication with the Assignee via the requesting Registrar rather than contacting the Assignee by itself 📮 since the actual communication form and process are expected to greatly vary, it does not make sense to specify any data formats or processes for this purpose 🤷♀️
5. Example Scenarios 🌈
5.1. E.164 Number Assignment along with ENUM Registration
in this simple scenario, we assume that the roles of the Registrar, the VE, and the NAE are performed by the same entity, e.g., an Internet Telephony Service Provider (ITSP) 📞 this ITSP is a CSP that was assigned number ranges by the NNPA 🗺️ out of these ranges, he assigns numbers to his customers (Assignees) to provide those with communication services 💜 the ITSP chooses to assign an E.164 number together with the corresponding ENUM domain name 🎀 therefore, it can perform the validation simply by reference to its subscriber database 🧾
figure 3 shows the external interactions needed for the ENUM domain name provisioning process 👀
+----------+
| Registry |
+----------+
^
|
|(3)
|
+--------------------------------------+
| |
| ITSP |
| +-----------+ +----+ |
| | Registrar | | VE | |
| +-----------+ (2) +----+ |
| |
+--------------------------+ |
^ | |
| | |
|(1) | |
| | |
| | |
+------------+ (4) | +-----+ |
| Assignee = |<----------| | NAE | |
| Registrant | | +-----+ |
------------- | |
+-----------+
Legend:
ITSP: Internet Telephony Service Provider
NAE: Number Assignment Entity
VE: Validation Entity
Figure 3: E.164 Number Assignment along with ENUM Registration- The ITSP receives an order for ENUM services 🛒
- The ITSP assigns a free E.164 number and performs the validation at the same time ⚡
- The ITSP sends an ENUM registration request to the Registry, which might contain additional information about the validation applied 📤
- The ITSP sends a confirmation about the E.164 number assignment and the ENUM registration to its customer, who is now Assignee and Registrant 🎊
this scenario is quite close to "ordinary" domain name registrations 💅✨
Part 2 done, bestie! 🌈💖 Part 3 is coming next, so stay tuned 🦋
5.2. Fully Disjoint Roles 💅
okay bestie, this is the big boss version 🫶 Every single role in the ENUM provisioning model is played by a different entity. In the last example (Section 5.1) things were way more cozy, but here the ENUM domain name is built on an E.164 number that's already been assigned, and the NAE gives the VE access to its subscriber database. We also assume the VE has to check that the Assignee really means it, so the validation process has to contact the Assignee too 📞✨
Here's the whole flow in Figure 4 🦋
+----------+
| Registry |
+----------+
^
|
|(9)
|
|
| (3)
+-----------+ ---------->+----+
| Registrar |<---------- | VE |
+-----------+ (8) > +----+
^ / / ^ |
| / / | |
| (7)/ / | |
|(2) / / | |
| / / (5)| |
| / / | |
| / / | |
| / /(6) | |
| / / | |(4)
| / / | |
| / / | |
+------------+< | v
| Assignee = | +-----+
| Registrant |<---------- | NAE |
+------------+ (1) +-----+ Legend:
NAE: Number Assignment Entity
VE: Validation Entity
Figure 4: Fully Disjoint RolesHere's the step-by-step, main character style 👑
(1) The NAE assigns an E.164 number 🔢 This could have happened way back, like when the Assignee signed up for a regular phone service, long before anyone thought about ENUM 🕰️
(2) The Assignee orders the matching ENUM domain name at a Registrar of his choice 🛒
(3) The Registrar asks an independent VE to validate it 🙋♀️
(4) The VE checks the NAE's subscriber database to confirm that the Assignee of the E.164 number is the same person as the Registrant of the ENUM domain name 🔍
(5) The subscriber database says yes ✅ The result is positive!
(6) The VE calls back the E.164 number that's about to become the ENUM domain name, sets up authentication, and asks the Assignee to confirm they really want this 📲
(7) The Assignee confirms, and the VE writes that confirmation down 📝
(8) The VE sends a positive answer back to the Registrar 💌 The answer might include extra details about the validation, like an expiration date, the validation method used, and stuff like that 🗓️
(9) Last but not least, the Registrar sends an ENUM registration request to the Registry 🎉 That request might come with extra info about the validation as well 🧚
6. Security Considerations 🔥
okay, this part is serious bestie, so no sipping drinks while reading 🥤🚫
6.1. Fraud Prevention
Any situation where someone controls the ENUM domain of a third party's E.164 number is a HUGE fraud risk 😭 If an unauthorized person got control over a bank's ENUM domain, they could, for example, run a "man in the middle" attack on telephone banking apps 🏦💀 Attacks like that could make people distrust ENUM as a whole, and that would be a total disaster.
So high-quality validation processes are super crucial for any ENUM deployment, and they deserve a LOT of attention 👀🛡️
6.2. Assignee Data
When you're handling Assignee data, privacy and discretion are a must-think-about 🙈 Implementations that send assignee data across the Internet must use authenticated and encrypted transport protocols 🔐 Local registration and validation policies, along with agreements, should clearly limit how assignee data gets used 📜💜
7. Acknowledgements 🫶
The authors want to give a big thank-you to these wonderful people for their valuable suggestions and contributions 🌸: Lawrence Conroy, Michael Haberler, Ted Hardie, Otmar Lendl, Hala Mowafy, Marcel Parodi, Jon Peterson, Penn Pfautz, Patrik Schaefer, and Richard Stastny. Literally legends 👑✨
8. References 📚
8.1. Normative References
[1] Faltstrom, P. and M. Mealling, "The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM)", RFC 3761, April 2004.
[2] ITU-T, "The international public telecommunication numbering plan", Recommendation E.164 (02/05), Feb 2005.
8.2. Informative References
[3] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005.
[4] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
[5] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", RFC 3730, March 2004.
Authors' Addresses 🧚
Alexander Mayrhofer
enum.at GmbH
Karlsplatz 1/9
Wien A-1010
Austria
Phone: +43 1 5056416 34
EMail: alexander.mayrhofer@enum.at
URI: http://www.enum.at/
Bernie Hoeneisen
Switch
Neumuehlequai 6
CH-8001 Zuerich
Switzerland
Phone: +41 44 268 1515
EMail: hoeneisen@switch.ch, b.hoeneisen@ieee.org
URI: http://www.switch.ch/Full Copyright Statement ⚖️
Copyright (C) The IETF Trust (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors keep all of their rights 💜
This document and the information in it are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🦋
The IETF doesn't take a position on whether any Intellectual Property Rights or other rights claimed to cover the technology in this document are valid or in scope, or on whether any license under those rights is available. It also doesn't say it has independently tried to find any such rights. Info about how RFC documents handle rights is in BCP 78 and BCP 79 📖
Copies of IPR disclosures sent to the IETF Secretariat, along with any assurances of licenses that will be made available, or the result of an attempt to get a general license or permission to use those proprietary rights for implementers or users of this specification, can be found at http://www.ietf.org/ipr 🔗
The IETF invites anyone interested to tell it about any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard 🙌 Send that info to the IETF at ietf-ipr@ietf.org 💌
Acknowledgement 🌈
Funding for the RFC Editor function is currently provided by the Internet Society ✨
📦 where this page comes from
- ietf: rfc4725 2006-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms