Assertion Values for Resource Priority Header and SIP Priority Header Claims in Support of Emergency Services Networks
Extracted elements (15)
PASSporT claims and values defined in this document are intended only for environments where there are means to verify that the signer of the SIP 'Resource-Priority' and 'Priority' header fields is authoritative, reflecting the trust model assumption underlying the extension.
The 'sph' claim is intentionally scoped only to emergency services (not a general SIP Priority header protection mechanism) because the signer of the 'rph' PASSporT can authoritatively represent both 'Resource-Priority' and 'Priority' header fields in the emergency callback context. General protection would require a new PASSporT extension.
The use of the compact form of PASSporT is not specified in this document and is not recommended for 'rph' PASSporTs; implementations should use the full form of PASSporT as specified in RFC 8225.
For emergency-service-destined calls, the 'dest' claim MUST be either a country- or region-specific dial string (e.g., '911' or '112') or 'urn:service:sos' representing the emergency services destination.
For emergency services callbacks, the 'orig' claim of the 'rph' PASSporT MUST represent the PSAP telephone number, and the 'dest' claim MUST be the telephone number of the original calling party being called back.
The authority MUST use its credentials associated with the specific service supported by the resource priority namespace in the claim. If r-values are added or dropped by intermediaries, they must generate a new 'rph' identity header and sign the claim with their own authority.
The order of claim keys MUST follow the rules of RFC 8225 Section 9 for deterministic JSON serialization; claim keys MUST appear in lexicographic order (dest, iat, orig, rph, sph).
The 'sph' claim MUST only be used with an 'auth' claim containing an 'esnet.x' value, indicating an authorized emergency callback call corresponding to a SIP 'Priority' header field with the value 'psap-callback'.
The value of the 'sph' claim key MUST match the SIP 'Priority' header field value for authorized emergency services callbacks; if the value is anything other than 'psap-callback', PASSporT validation MUST be considered a failure.
When using 'esnet.x' as the 'auth' assertion value in emergency-service-destined calls, the 'orig' claim of the PASSporT MUST represent the calling party number that initiates the call to emergency services.
A new PASSporT claim key 'sph' (SIP Priority Header) is defined as an optional claim within the 'rph' PASSporT. Its only defined value is 'psap-callback', corresponding to the SIP 'Priority' header field for emergency services callback calls as defined in RFC 7090.
New 'rph' claim assertion values for the 'esnet.x' namespace are defined, where x is the priority level (0–4 inclusive as of this specification) for local emergency communications per RFC 7135. The string must exactly match the SIP 'Resource-Priority' header field namespace invoked in the call.
The 'sph' claim is an optional extension to the 'rph' PASSporT and is not a general-purpose mechanism for protecting SIP 'Priority' header fields; its use is explicitly restricted to emergency services callback scenarios.
IANA is requested to add a new claim 'sph' (SIP Priority header field) to the 'JSON Web Token Claims' registry as defined in RFC 7519, with change controller IESG and specification document RFC 9027.
The security considerations from RFC 8224, RFC 8225, and RFC 8443 are fully applicable to this specification. Compromise of SIP 'Resource-Priority' or 'Priority' header fields could lead to misuse of network resources during congestion scenarios and improper handling of PSAP callbacks.