Subject: RE: 3GPP Arch. Why use a local proxy? (was Re: [Sip] Path scenario outside of 3GPP requirements)

From: "Christian Huitema" <[email-masked]>
Date: Tue, 26 Feb 2002 09:00:10 -0800

> Well, using TLS to the coporate server wouldn't work, because I need
to
> coordinate with the SIP ALG in the proxy-firewall.

The basic answer is, get a different proxy-firewall. There are two
fundamental problems with the "SIP ALG" approach: it breaks security,
and it breaks evolution. The security requirement is pretty simple: if
you cannot rely on end-to-end signature of the message body, you don't
know to whom you are sending the media; if you cannot rely on end to end
encryption of the body, you don't know who is snooping your calls. The
evolution requirement is also pretty simple: ALG only translate what
they understand, and they tend to hard wire that; if I come out with
smellovision (as an example ;-) and the ALG does not understand it,
poof, the smell is gone. The proper architecture is to use some form of
network level signaling to securely open holes in the firewall.

> They (3GPP) have a requirement to provide, at operator discretion,
very
> strict control of network usage. It's almost as if the entire
semantics of
> ATM SVCs have been transplanted onto IP, with UNI replaced by
> application-level control.  The operators want to do
service-senstitive
> AAA
> for the traffic. It's not the Internet.

Well, you say it: what these operators want to build "is not the
Internet." On the other hand, this is the IETF, and the "I" stands
precisely for "Internet". As such, we have no requirement to placate
groups that want to develop a "not-Internet." They can develop a
specification that fits their need, say a "3G voice over IP wireless
signaling protocol"; the one thing they should not do is, try to pretend
this is an Internet standard.

-- Christian Huitema

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Tue, 26 Feb 2002 17:50:44 -0600

On Tuesday 26 February 2002 11:00 am, Christian Huitema wrote:
> and it breaks evolution. The security requirement is pretty simple:
> if you cannot rely on end-to-end signature of the message body, you
> don't know to whom you are sending the media; if you cannot rely on
> end to end encryption of the body, you don't know who is snooping
> your calls. The evolution requirement is also pretty simple: ALG only
> translate what they understand, and they tend to hard wire that; if I
> come out with smellovision (as an example ;-) and the ALG does not
> understand it, poof, the smell is gone. The proper architecture is to
> use some form of network level signaling to securely open holes in
> the firewall.

Well, that requires some sort of signaling coming from the phone to the 
firewall, which is another whole basket of worms.   It also requires 
some AAA stuff that nobody has figured out how to manager. 

Also, corporate firewall admins have the same usage senitivity as do 
mobile operators. For example, coporate firewall administators ALSO 
require that they have application-level awareness of the firewall 
traversl. They aren't going to let me open a pinhole I claim is for 
a phone call and use it to watch streamoporn. At least, not if they 
have a choice.

> signaling protocol"; the one thing they should not do is, try to
> pretend this is an Internet standard.

Well, the important thing is that it interwork cleanly with the 
Internet. I want a plan in one of those walled gardens to be able to 
(should the gardner allow them) interact with the rest of the world. 
They seem to agree, and are trying very hard to figure out how to do 
this.

As we all know, 99% of the usage of Internet protocols is not really 
"in the Internet" nor is it completely consistent with "Internet 
Standards". Just look at all the networks out there running Microsoft 
products -- it's mostly an "enterprise internetworking" kind of world, 
laden with things like universal-plug-and-pray and not-quite-Kerberos. 
But it's still a constituency for the use of the protocols we produce.

--
Dean