Subject: [Sipping] RE: Question on draft-ejzak-sipping-p-em-auth-01.txt

From: "Ejzak, Richard P (Richard)" <[email-masked]>
Date: Wed, 12 Jul 2006 13:11:05 -0500

Gonzalo Camarillo wrote:
...
> So, is there a requirement that unauthorized early media 
> needs to be cut 
> as close to the UA as possible?

No, but there already is a mechanism to block media near the UA so another device at the network border may be redundant.

...
> If the idea is not to have an SBC (including a media proxy) 
> when going 
> from the IMS to the public Internet, then this may make sense. If 
> effectively, everybody will implement such an SBC in their networks, 
> this arguments would be quite weak.

There is an assumption built in to the question that the only scenario of interest for the header is when interconnecting to the public Internet.  The more interesting case is actually when partner trusted networks with different early media policies are interconnected.

> > Another use case to consider is when IMS is transiting traffic from
> > one network to another.  In this case the originating network may
> > have a different early media policy than the transit network, so you
> > would not want to force the transit network policy on the 
> originating
> > network.
> 
> Could you elaborate on this? What do you mean by transit network? It 
> seems that the originating and the terminating networks would not be 
> part of the trusted domain, and so, it would not be possible 
> to use this 
> header.

A transit network is exactly what you imply - a network sandwiched in between an originating network and a terminating network.  We assume the transitive trust model, so I may or may not choose to trust the servers at the boundaries to the other networks (so may decide to share the header with them), and may or may not have any reason to put SBCs there.

BR Richard

> Cheers,
> Gonzalo

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: stuart jacobs <[email-masked]>
Date: Wed, 12 Jul 2006 14:29:19 -0400

An additional 2 cents:

On Jul 12, 2006, at 2:11 PM, Ejzak, Richard P (Richard) wrote:

> No, but there already is a mechanism to block media near the UA so 
> another device at the network border may be redundant.
>
> ...
> There is an assumption built in to the question that the only scenario 
> of interest for the header is when interconnecting to the public 
> Internet.  The more interesting case is actually when partner trusted 
> networks with different early media policies are interconnected.
>
> A transit network is exactly what you imply - a network sandwiched in 
> between an originating network and a terminating network.  We assume 
> the transitive trust model, so I may or may not choose to trust the 
> servers at the boundaries to the other networks (so may decide to 
> share the header with them), and may or may not have any reason to put 
> SBCs there.
Does the transit network concern itself with routing, only looking at 
IP headers, or does this transit network actually process application 
protocol information?

Your transitive trust model is NOT uniformly not valid.  In the PSTN 
world there is transitive trust regarding SS7 networking between 
carriers given that each carrier has entered into a contractual 
agreement to respect and not abuse another carrier's SS7 
infrastructure.  This contractually transitive trust is possible given 
the limited number of carriers interacting via SS7, the closed nature 
of SS7 networks and that SS7 networks (both logically and physically) 
are not used to carry any traffic except signaling & control between 
SSPs, STPs and SCPs.

In the VoIP world there is NO reason for a Verizon to trust signaling 
or media received at a peering-point with an ATT unless said signaling 
is strongly authenticated as to sending entity identity and data origin 
or the received media can be directly associated with authorized 
signaling that has been authenticated.

Stu

>> Gonzalo
========================================================
Stuart Jacobs, CISM, CISSP
PMTS - Sr. Technologist
Network Security
Verizon Laboratories
40 Sylvan Road
Waltham MA 02451-1128
(781) 466-3076

---

From: stuart jacobs <[email-masked]>
Date: Wed, 12 Jul 2006 14:29:19 -0400

An additional 2 cents:

Stu