Subject: RE: [Sip] [Query] SIP security and trusted spontaneous interactions between end points

From: "Khare, Anir" <[email-masked]>
Date: Mon, 26 Apr 2004 08:47:17 +1000

Hello Harry,

This is interesting.

A general query: Did you consider using Liberty alliance like protocols for security and accounting interactions between VN and HN. Are there any known issues about using Liberty protocols in this context?

A specific question about the requirements (section 2). Is ability for Alice to get a SIP URI in VN a mandatory requirement? i.e. why can't Alice use Mobile IP and continue using SIP infrastructure at HN? Is it because Alice wants to use some resources like PSTN gateway in the VN? 

Regards,
Anir 

-----Original Message-----
From: Harry Behrens [mailto:[email-masked]] 
Sent: Friday, 23 April 2004 7:07 PM
To: Khare, Anir
Cc: [email-masked]; [email-masked]
Subject: Re: [Sip] [Query] SIP security and trusted spontaneous interactions between end points

Khare, Anir wrote:

> Hello,
>
>  
>
> Can someone please point me to the known issues with SIP security?
>
>  
>

> Also are there any initiatives in progress for using Liberty alliance 
> like identity/trust infrastructure in conjunction with SIP protocols 
> to facilitate spontaneous trusted real time communication between a A 
> party and a B party, who are not registered with one SIP proxy?
>
>  
>

Karsten Knüttel and I have proposed something to that extent in March on 
the SIPPING list,
which uses PKI to allow dynamic agreement on trust and billing 
relationships.
Maybe it proves useful to you:

Interdomain Trust-Relationships for SIP-based Roaming

This draft describes an authentication mechanism which can be used to 
enable users of VoIP to globally roam between any number of ITSPs 
(Internet Telephony Service Providers) without needing to have a prior 
customer or billing relationship with all of them. This enables 
profiles and one-line-billing. 
Providers using this authentication mechanism do neither need full-mesh 
trust relationships or roaming agreements with every other possible 
provider nor do they need to rely on a centralized brokerage entity to 
process calls. 
The Home Network (HN), which handles all AAA for a user attempting to 
use an ITSP's service is determined through a unique identifier 
submitted by the user. This Network Access Identifier [RFC2486] 
contains information about the trust domain or trust realm the user 
belongs to. Based on a simple discovery mechanism a provider can 
establish a trust path to this home network. Once this is established, 
the provider can authenticate the user and check his credit with the 
home network. Accounting and rate information will be sent to the home 
network for mediation and processing. 

@
http://www.snom.com/download/draft-behrens-sipping-roaming-architecture-01.txt

Regards,

    Harry

> Thanks,
> Anir

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Harry Behrens <[email-masked]>
Date: Mon, 26 Apr 2004 13:32:34 +0200

Hello Aniruddha,

inline

>A general query: Did you consider using Liberty alliance like protocols for security and accounting interactions between VN and HN. Are there any known issues about using Liberty protocols in this c…

Yes. This was one of our first choices. The problem is that we are 
trying to be pragmatic (IETF is not a scientists' but an engineers' forum).
And the actual usage and implementation of LA is less than assuring of 
its success and potential ubiquity.
By using a derivate of Diffie-Helman - essentially that is what it boils 
down to - we kept it generic as well as simple.
Porting this to LA should be straightforward.

>A specific question about the requirements (section 2). Is ability for Alice to get a SIP URI in VN a mandatory requirement? i.e. why can't Alice use Mobile IP and continue using SIP infrastructure…

That is exactly the point. One can assume that the choice given by 
"local" carriers to be more competitive in terms of call termination to 
"local" destinations.
On the other hand, pls. note that we explicitly propose a double 
registration in section 7.2.2 of the draft.
This assures that Alice can make full use of any services its HN can 
provide, especially being reachable under her "home" number.
Pls. note that MIP would only become necessary in case of physical 
handover during dialog.
The scenario is written for "semi-stationary" or "nomadically mobile" 
(nomadic in the sense that: "users have to shut down an application or a 
session
and restart it when they connect at the new point of attachment.")
-> Layer-7 mobility
Extensions would have to be used to provide mobility at layer 4 downwards.

Regards,

    Harry