Subject: [Sip] [Query] SIP security and trusted spontaneous interactions between end points

From: "Khare, Anir" <[email-masked]>
Date: Fri, 23 Apr 2004 09:16:06 +1000

Hello,
 
Can someone please point me to the known issues with SIP security? 
 
Also are there any initiatives in progress for using Liberty alliance
like identity/trust infrastructure in conjunction with SIP protocols to
facilitate spontaneous trusted real time communication between a A party
and a B party, who are not registered with one SIP proxy? 
 
Thanks,
Anir

---

From: Ali Fessi <[email-masked]>
Date: Fri, 23 Apr 2004 16:52:56 +0200

Hi Anir,

to be clear, I'm not an expert! But I have been also working on SIP 
security lately. (I have been mostly working on different solutions for 
SIP deployment with firewalls and NATs).

Check these links for some infomation about SIP security. I found them 
helpful.

http://www.dynamicsoft.com/news/presentations/SIPSecurity.pdf

http://www.off-pisteconsulting.com/research/pubs/ndss03-slides.ppt

Considering your question about spontanous calls: I think there are 
several reasons that make this not possible.

Except DOS attacks to SIP servers/user agents, one of the issue that I 
was thinking about is:

you can very easily write a little script that generates INVITE messages 
and sends them to random SIP URLs. Without any authentication 
mechanisms, the result will be: you will make the SIP phones of tousends 
of peaple ringing!!

Note here that this is more a social issue, a sort of SIP spam!!

Any comments are welcome!

If I misunderstood your question, please let me know!

Ali
--
Ali Fessi
NEC Network Laboratories

>and a B party, who are not registered with one SIP proxy? 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Harry Behrens <[email-masked]>
Date: Fri, 23 Apr 2004 11:07:20 +0200

> like identity/trust infrastructure in conjunction with SIP protocols 
> to facilitate spontaneous trusted real time communication between a A 
> party and a B party, who are not registered with one SIP proxy?
>
>  
>

Karsten Knüttel and I have proposed something to that extent in March on 
the SIPPING list,
which uses PKI to allow dynamic agreement on trust and billing 
relationships.
Maybe it proves useful to you:

Interdomain Trust-Relationships for SIP-based Roaming

This draft describes an authentication mechanism which can be used to 
enable users of VoIP to globally roam between any number of ITSPs 
(Internet Telephony Service Providers) without needing to have a prior 
customer or billing relationship with all of them. This enables 
profiles and one-line-billing. 
Providers using this authentication mechanism do neither need full-mesh 
trust relationships or roaming agreements with every other possible 
provider nor do they need to rely on a centralized brokerage entity to 
process calls. 
The Home Network (HN), which handles all AAA for a user attempting to 
use an ITSP's service is determined through a unique identifier 
submitted by the user. This Network Access Identifier [RFC2486] 
contains information about the trust domain or trust realm the user 
belongs to. Based on a simple discovery mechanism a provider can 
establish a trust path to this home network. Once this is established, 
the provider can authenticate the user and check his credit with the 
home network. Accounting and rate information will be sent to the home 
network for mediation and processing. 

@
http://www.snom.com/download/draft-behrens-sipping-roaming-architecture-01.txt

Regards,

    Harry