SIP AAI a possibility for TF-EMC2 and TF-ECS cooperation Jan Růžička CESNET email,sip:janru@cesnet.cz Florence 28. 3. 2007

SIP Signaling not only for VoIP&VC creates, modifies and terminates session RFC 3261 textual (HTTP style) easy to extend No more simple SIP URI sip:janru@cesnet.cz

Architecture User Agent Server registrar redirect proxy B2BUA stateless statefull B2BUA Gateway (UA) MCU (UA) Outbound proxy SIP enabled firewall with NAT functionality – not transparent SBC (B2BUA)

Request INVITE sip:mamut@iptel.org SIP/2.0. Max-Forwards: 10. Record-Route: <sip:195.113.222.3;ftag=5DAA94E7;lr=on>. Via: SIP/2.0/UDP 195.113.222.3;branch=z9hG4bK0a5d.90580ee2.0. Via: SIP/2.0/UDP 195.113.134.233:5062;branch=z9hG4bK2E1FD348. CSeq: 262 INVITE. To: <sip:mamut@iptel.org>. Proxy-Authorization: Digest username="bbb", realm="ces.net", nonce="43788e90381194d66364fced4dc7097828391e81", uri="sip:mamut@iptel.org", cnonce="abcdefghi", nc=00001, response="aaaaa" Content-Type: application/sdp. From: "Franta Vomacka" <sip:bbb@ces.net>;tag=5DAA94E7. Call-ID: 379332994@195.113.134.233. Subject: sip:bbb@ces.net. Content-Length: 234. User-Agent: kphone/4.2. Contact: "Franta Vomacka" <sip:bbb@195.113.134.233:5062;transport=udp>. Remote-Party-ID: "Franta Vomacka" <sip:950070101@ces.net>;party=calling;id-type=subscriber;privacy=off; screen=yes. . v=0. o=username 0 0 IN IP4 195.113.134.233. s=The Funky Flow. c=IN IP4 195.113.134.233. t=0 0. m=audio 33728 RTP/AVP 0 97. a=rtpmap:0 PCMU/8000. a=rtpmap:97 iLBC/8000.

Locationg SIP Servers domain part of URI sip:janru@dom.cz,sip:12345@dom.cz ENUM Telephone number to uri transformation 5.4.3.2.1.e164.arpa IN NAPTR 1 1 "u" "E2U+sip" "!^.*$!sip:user@dom.cz!" . “service” NAPTR records IN NAPTR 1 5 "s" "SIPS+D2T" "" _sips._tcp.dom.cz. IN NAPTR 2 5 "s" "SIP+D2T" "" _sip._tcp.dom.cz. IN NAPTR 3 5 "s" "SIP+D2U" "" _sip._udp.dom.cz. SRV records (_sip._udp, _sip._tcp, _sips._tcp) _sip._tcp.cesnet.cz IN SRV 0 1 5060 ser1.dom.cz _sip._tcp.cesnet.cz IN SRV 0 2 5060 ser2.dom.cz A, AAAA records DNSSec ?

Record routing The way to stay in signaling part Outbound proxy is not enough (if not first in way, requests from other side) Add Record-Route in request, Response delivers RR set Subsequent requests of the call are routed according to record route set (Route header)

SIP „trapeziod“ Domain alfa Domain beta sip01.alfa sip01.beta Local policy, ENUM, SRV Outbound proxy and RR User A sip:a@alfa User B sip:b@beta

Authentication HTTP Digest User-to-user (401 Unauthorized, WWW- Authenticate,Authorization) User-to proxy (407 - Proxy authentication required, Proxy-Authenticate, Proxy-Authorization) Local HTTP digest Obtain connectivity and establish VPN to the home network (Firewall issues) TLS – minimum of clients use client cert, TLS + HTTP Digest

Authentication II Interdomain – opening of closed islands and interconnecting of them, anti-spit HTTP digest -weak and uncomfortable TLS Hop-by-hop identity assertions signed headers SIP-identity RFC4474 SAML

Domain identity INVITE sip:bob@biloxi.example.org SIP/2.0 Via: SIP/2.0/TLS pc33.atlanta.example.com;branch=z9hG4bKnashds8 To: Bob <sip:bob@biloxi.example.org> From: Alice <sip:alice@atlanta.example.com>;tag=1928301774 Call-ID: a84b4c76e66710 CSeq: 314159 INVITE Max-Forwards: 70 Date: Thu, 21 Feb 2002 13:02:03 GMT Contact: <sip:alice@pc33.atlanta.example.com> Content-Type: application/sdp Content-Length: 147 v=0 o=UserA 2890844526 2890844526 IN IP4 pc33.atlanta.example.com s=Session SDP c=IN IP4 pc33.atlanta.example.com t=0 0 m=audio 49172 RTP/AVP 0 a=rtpmap:0 PCMU/8000

Domain identity II Interesting headers Identity signature sip:alice@atlanta.example.com|sip:bob@biloxi.example.org|a84b4c76e66710|314159 INVITE|Thu, 21 Feb 2002 13:02:03 GMT|alice@pc33.atlanta.example.com|v=0 o=UserA 2890844526 2890844526 IN IP4 pc33.atlanta.example.com s=Session SDP c=IN IP4 pc33.atlanta.example.com t=0 0 m=audio 49172 RTP/AVP 0 a=rtpmap:0 PCMU/8000 Identity signature Identity:"kjOP4YVZXmF0X3/4RUfAG6ffwbVQepNGRBz58b3dJq3prEV4h5Gn S4F6udDRCI4/rSK9cl+TFv45nu0Qu2d/0WPPOvvc3JWwuUmHrCwG wC+tW7fOWnC07QKgQn40uwg57WaXixQev5N0JfoLXnO3UDoum 89JRhXPAIp2vffJbD4=" Identity-Info: <https://atlanta.example.com/atlanta.cer>;alg=rsa-sha1

SIP „trapeziod“ II Transport depends on client capab. UDP,TCP,TLS Domain alfa sip01.alfa Domain beta sip01.beta TLS (?) + HTTP Digest TLS ?, domain identity domain identity Local policy, ENUM, SRV Outbound proxy and RR User A sip:a@alfa User B sip:b@beta

Service – Server relationship Additional information in certificate Autoritative server for service within domain Outbound and inbound servers could be different

Discussion Thank you