2. Directed SIP Peer-to-Peer Telephony Creating a New Carrier-Class Model Joel Maloff, Ph.D. – EVP and CTO Fusion Telecommunications International jmaloff@fusiontel.com

3. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Objectives To describe the approaches used to blend the superior attributes of SIP Peer-to-Peer telephony with techniques that provide high quality services at low cost to the service provider. To understand the security vulnerabilities introduced by the P2P “super node” concept, and more attractive alternatives. To define “carrier class” SIP P2P telephony services, and highlight a model for their delivery.

4. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Peer-to-Peer Telephony Models The Skype Model SIP P2P Model Directed SIP P2P (DSP) Model How do these models differ architecturally? What are the security implications? Scalability Consumer-Grade vs. Carrier-Class

5. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara The Skype Model As understood from publicly available sources. –Skype is a quasi-Peer-to-Peer service using a small infrastructure for registration and enlisting unsuspecting end-users as “super nodes” to act as the presence coordination and interconnection link between users. –On an average day, there are approximately 20,000 users whose machines have been enlisted by Skype as super nodes – mostly without their knowledge (www.blackhat.com March 2006).www.blackhat.com

6. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara The Skype Super Node Issue This is an example of the impact that the super node function has on a PC. One minute intervals show Skype super node function capturing +/- 100 mbps Source: http://www.voipwiki.com/blog/ 17 July 2006http://www.voipwiki.com/blog/

7. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Skype Issues The Skype model relies on the ignorance of the public concerning the enlistment of super nodes. Super nodes compromise the most basic network security policies in corporate environment. The Skype “keep-alive functionality has the potential to decrease hard drive life by as much as 50%. The Skype model is proprietary, has not been disclosed, and has not been patented. As of 19 July 2006, it is reported that a Chinese company has cracked the Skype code, reversed engineered it, and plans to deploy WITHOUT super node functionality.

8. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara SIP P2P Model One of the major criticisms of Skype is the closed proprietary approach. Various working groups including the IETF and a team from Columbia University have been working on a SIP P2P model (“Peer-to-Peer Internet Telephony Using SIP). –For these models to work, however, almost all of them retain the “super node” concept for decentralization and economies of scale as opposed to more traditional client server models. –The advantage of this approach is the ability to build functionality as a community via the open standards architecture.

9. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Directed SIP P2P (DSP) Model The DSP approach (patent pending – Fusion Telecommunications International) incorporates SIP but uses a distributed server architecture to direct calls and establish presence rather than enlisting consumers and businesses as “super nodes.” –In this way, the best aspects of client-server are combined with the cost benefits of P2P and SIP.

10. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Security Implications Any model that uses a super node must punch holes through a corporate network’s perimeter defenses or a consumer’s desktop firewall. Typical server security vulnerabilities and vectors can be exploited to compromise services, capture confidential information, or be used as a vehicle to invade other machines. Many corporations and government entities are banning Skype and similar services due to these risks.

11. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Scalability True Peer-to-Peer telephony may have great promise for enterprises. Limited numbers of users employing sophisticated applications on their PCs or using VoIP-specific devices in an encrypted, tunneled or VPN environment can be quite valuable. –Attempting to scale these systems in a secure, well- managed environment to multiple millions is impractical. Super node-based models can work only as long as the users are unconcerned about their flaws OR until there are better models.

12. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Scalability The DSP model is designed to scale infinitely through the use of geographically dispersed nodes that are part of the core infrastructure.

13. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Consumer-Grade vs. Carrier-Class An underlying issue of concern to VoIP developers is the distinction between consumer-grade and carrier-class VoIP solutions. –Consumer grade is a generally a free service offered by an entity that has very little traditional telephony infrastructure, and for off-net calling, must interface with one or more other carriers. End-to-end quality control is beyond their reach or their concern. –Carrier class includes advanced VoIP services, such as DSP telephony, that are layered on top of traditional telephony services and may incorporate soft switch functionality and interconnection with hundreds of other carriers. –Just as most Internet Service Providers began as technical entrepreneur driven and evolved into professional organizations, so too will VoIP providers – evolving into carrier-class providers.

14. www.voipdeveloper.com August 8-10, 2006 Santa Clara, California Hyatt Regency Santa Clara Conclusions As VoIP developers, it is critical to understand where the market is evolving and what will be expected from your solutions. Some of these include: –Hardened applications that are security-aware and do not expose end-users to unnecessary risk. –Scalable applications that address the needs of both enterprises AND global carriers. –The distinction between consumer-grade and carrier- class applications/services.