Subject: RE: [Sip] [Query] SIP security and trusted spontaneous interactions between end points

From: "Khare, Anir" <[email-masked]>
Date: Mon, 26 Apr 2004 08:46:19 +1000

> Except DOS attacks to SIP servers/user agents, one of the issue that I

> was thinking about is:

> you can very easily write a little script that generates INVITE
messages 
> and sends them to random SIP URLs. Without any authentication 
> mechanisms, the result will be: you will make the SIP phones of
tousends 
> of peaple ringing!!

> Note here that this is more a social issue, a sort of SIP spam!!

Yes, this is the scenario I was thinking about. 

In the existing SIP standard, is there any way for a UAS to specify at
the time of REGISTER or otherwise, to avoid such spams by restricting
the incoming requests to some circle of trust, either introduced by the
SIP proxy server of the domain or by the UAS itself?

Also:
I came across following internet draft draft-ietf-sipping-trait-authz-00
- Trait based Authorization Requirements for Session Initiation Protocol
(SIP) Feb 7, 2004, by Jon Peterson et.al. on SIPPING.

I think, this is a very good step towards handling the spam issues by
tracking the sender's traits.

Liberty alliances deal with such issues in the context of http
interactions between service consumer and service provider of online
(web) services. Along with other standard single sign on scenarios,
liberty also covers the scenarios like service providers using selective
credentials authorizations (e.g. charging)and attributes (e.g. ZIP code)
provided by identity providers and identity services providers, about a
service consumer (principal, in order to provide access to online
services. The service providers don't need to have user accounts on
their sites and users don't need to disclose their identity to such
service providers. It provides the mechanisms for allowing spontaneous
trusted interactions between the liberty enabled entities.

The interactions between SIP UAC and SIP UAS, in large open communities
with few pre-existing relationships, will have similar issues. 

Probably the liberty framework (Liberty ID-FF and ID-WSF) can be used as
an authorization service as mentioned in section 5 of the abovementioned
draft by Jon Peterson et.al. Additionally use of Liberty architecture
may streamline some of the issues related to management of authorization
assertions carried by the SIP requests, as proposed in this draft. The
assertions may not be required to be physically added in the SIP
requests. The SIP requests can carry Liberty pseudonyms for example and
the authorization assertions can be retrieved by the UASs from the
identity web services, which are supposed to provide access control in
terms of who can access what attributes.

Just trying to understand, whether there is any synergy between the two
architectures or are there any known issues which prevent a protocol
like SIP from using Liberty architecture for achieving desired trust in
open environments.

 Anir

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip