Subject: [Sip] Privacy in multi domain setups

From: Nils Ohlmeier <[email-masked]>
Date: Tue, 27 Jun 2006 18:30:50 +0200

Hello,

does anybody have an idea or opinion what is best solution to get privacy 
according to RFC3323 working in a multi-domain setup?

Scenario:
I have a SIP proxy running which serves multiple domains (on one IP). If an 
INVITE (or any other request) comes in with [email-masked] in 
the From header I currently see no way how I can determine if the caller is 
from one of my local domains or from a foreign domain.

Or to say it in another way: as the request contains no information to which 
domain the caller belongs I can not challenge him (because I can not determine 
the correct realm). But if I do not challenge INVITEs from 
[email-masked] then this is the perfect gate for SPIT.

Do I overlook here something?
Or does someone has a solution for this scenario?

Thanks
  Nils Ohlmeier

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Tue, 27 Jun 2006 14:17:06 -0400

From: Nils Ohlmeier <[email-masked]>

   Or to say it in another way: as the request contains no information
   to which domain the caller belongs I can not challenge him (because
   I can not determine the correct realm). But if I do not challenge
   INVITEs from [email-masked] then this is the perfect
   gate for SPIT.

I take it you have too many realms to just include a
Proxy-Authenticate for each one of them?

Dale

---

From: Nils Ohlmeier <[email-masked]>
Date: Wed, 28 Jun 2006 16:27:48 +0200

> Proxy-Authenticate for each one of them?

Ok, good point.
But I think two reasons are spaeking against this solution:
- reply might getting big
- the UA would have to know which realm to choose. As the realm is suppose to 
be a free text displayed to the user I fear an automatic selection might fail 
(if the realm wasn't provisioned to the phone already which I guess is rarely 
the case).

Thanks
  Nils Ohlmeier

---

From: [email-masked]
Date: Wed, 28 Jun 2006 11:43:40 -0400

I didn't expect it to be a workable solution.  But you might have been
lucky and known that there were only 2 (say) realms, maximum.

   - the UA would have to know which realm to choose. As the realm is
   suppose to be a free text displayed to the user I fear an automatic
   selection might fail (if the realm wasn't provisioned to the phone
   already which I guess is rarely the case).

In the cases I've seen, the UA is configured with at most one realm,
so it has no difficulty choosing.

Actually, this problem is quite difficult in the general case -- the
proxy accepts authentication for a large number of realms, and the UA
can present authentication for several realms.  How to negotiate which
realm to use?  Even worse if the UA must prompt the user before
presenting authentication for a realm.

Dale