1 / 95

Session I5 Creating Secure Services for Internet Telephony

Session I5 Creating Secure Services for Internet Telephony. Henning Schulzrinne Columbia University hgs@cs.columbia.edu. Overview. What are IP telephony services? Where do services reside? How to create services? basic “fixed” services (call forwarding, follow me, ...)

ciara-wong
Télécharger la présentation

Session I5 Creating Secure Services for Internet Telephony

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Session I5Creating Secure Services for Internet Telephony Henning Schulzrinne Columbia University hgs@cs.columbia.edu

  2. Overview • What are IP telephony services? • Where do services reside? • How to create services? • basic “fixed” services (call forwarding, follow me, ...) • registration-based services: caller preferences • sip-cgi model • Call Processing Language (CPL) • sip servlets & JAIN • Event notification and presence • Example of an enterprise IP telephony platform • Billing in IP telephony IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  3. Overview • Security in IP telephony • dealing with NATs and firewalls • differences to classical PSTN networks • threats • theft of service • registration impersonation • denial of service • privacy • current SIP approaches • Summary and conclusion IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  4. Aside: evolution of SIP • Not quite what we had in mind • initially, SIP for initiating multicast conferencing • in progress since 1992 • still small niche • even the IAB and IESG meet by POTS conference… • then VoIP • written-off equipment (circuit-switched) vs. new equipment (VoIP) • bandwidth is (mostly) not the problem • “can’t get new services if other end is POTS’’  “why use VoIP if I can’t get new services” IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  5. Evolution of SIP • VoIP: avoiding the installed base issue • cable modems – lifeline service • 3GPP – vaporware? • Finally, IM/presence and events • probably, first major application • offers real advantage: interoperable IM • also, new service IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  6. VoIP at Home • Lifeline (power) • Multiple phones per household • expensive to do over PNA or 802.11 • BlueTooth range too short • need wireless SIP base station + handsets • PDAs with 802.11 and GSM? (Treo++) • Incentives • SMS & IM services IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  7. SIP phones • Hard to build really basic phones • need real multitasking OS • need large set of protocols: • IP, DNS, DHCP, maybe IPsec, SNTP and SNMP • UDP, TCP, maybe TLS • HTTP (configuration), RTP, SIP • user-interface for entering URLs is a pain • see “success” of Internet appliances • “PCs with handset” cost $500 and still have a Palm-size display • thus, offer services • Java-programmable • XML forms input IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  8. Example SIP phones IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  9. What are IP telephony services? • Services (features) modify basic call behavior • Can be • invoked by user • pre-programmed into network elements (e.g., SIP proxies) • programmable feature logic • PSTN: CLASS (Custom local area signaling services) features • call waiting • call forwarding • caller ID (calling number delivery) • distinctive ringing • selective call rejection • three-way calling, ... • PSTN: pre-subscribed for feature access codes (e.g., *66) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  10. Call routing services: pre-call, one party speed dial click-to-dial call forwarding “follow me” call filtering/blocking (in/out) do not disturb distinctive ringing call prioritization feature-based agent selection call return Call handling features hotline autoanswer intercom Multi-party features call waiting whispered call waiting blind transfer: no confirmation of success attended transfer consultative transfer: three-party conference  transfer conference call call park call pickup music on hold call monitoring barge-in speakerphone paging single-line extension IP telephony services IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  11. IP telephony features – Internet-specific • Presence-enabled calls • place call only if callee is available • Presence-enabled conferencing • call conference participants when all are online and not busy • IM conference alerts • receive IM when someone joins a conference • Unified messaging • receive email with new voice message • IM alert for voicemails IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  12. Voice-enabled features • Interactive Voice Response (IVR) • VoiceXML • voice browser IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  13. Voice-enabled features: VoiceXML <?xml version="1.0"?> <vxml version="2.0"> <form id="basic"> <field name="acctnum" type="digits"> <prompt> What is your account number? </prompt> </field> <field name="acctphone" type="phone"> <prompt> What is your home telephone number? </prompt> <filled> <!-- The values obtained by the two fields are supplied to the calling dialog by the "return" element. --> <return namelist="acctnum acctphone"/> </filled> </field> </form> </vxml> IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  14. PSTN vs. Internet Telephony Internet Telephony end system PSTN Number of lines or pending calls is virtually unlimited More intelligence, PCs can be considered to be end-user devices Single line, 12 buttons and hook flash to signal IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  15. PSTN vs. Internet Telephony PSTN: Signaling & Media Signaling & Media Internet telephony: Signaling Signaling Media IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  16. Service provider architectures • Models of providing services: • IP PBX • IP Centrex (and cable/DSL) • Carrier / 3G • Similar equipment (logically), but • different trust models • sharing of resources (SIP proxies, gateways) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  17. IP PBX IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  18. IP Centrex IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  19. IP Carrier IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  20. 3G Architecture (Registration) mobility management signaling serving interrogating interrogating CSCF proxy home IM domain registration signaling (SIP)_ visited IM domain IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  21. Service models & protocols • Master-slave protocols (MGCP, Megaco) • feature logic in media gateway controller (MGC) • send detailed behavioral commands to MG • send ring tone • expect dialed digit string • play announcement • MG can only “guess” what is meant • assembly-language instructions • Peer-to-peer protocols (SIP, H.323) • more like function calls • methods (SIP method, H.323 request) and parameters (SIP headers, H.323 ASN.1 variables) • H.323: per-feature specification (H.450.x) • SIP: building blocks (Headers, REFER, JOIN, ...) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  22. Combining peer-to-peer and master-slave IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  23. CLASS services: Caller-ID • SIP To/From headers (+ Organization) • Also: Call-Info Call-Info: http://alice.com/photo.jpg ;purpose=icon, <http://alice.com/> ;purpose=info • Can be “anonymous’’ • Cannot necessarily be trusted, since inserted by user Remote-Party-ID: "John Doe" <sip:jdoe@foo.com>;party=calling; idtype=subscriber;privacy=full;screen=yes IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  24. CLASS services: call forwarding, follow-me • Built into core SIP • Call forwarding: • either at proxy or at end system • 302 + Contact: temporary forwarding • 301 + Contact: permanent forwarding • Follow me: • REGISTER using single identifier • with different temporary IP addresses • “adopt” different hardware via (e.g.,) i-button IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  25. SIP personal mobility IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  26. Call filtering (in/out) • Outbound call filtering done by outbound proxy • Often, outbound proxy controls firewall • Inbound call filtering at any of the stages: • e.g., sip:alice@bigcorp.com  sip:alice@paris.eng.bigcorp.com • proxies can do filtering at • bigcorp.com • eng.bigcorp.com • paris.eng.bigcorp.com • Fixed or programmable rules (later) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  27. Call routing -- forking IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  28. Call routing -- ENUM • Translation between E.164 telephone numbers and URIs (e.g., SIP URIs) • RFC 2916 • +46-8-9761234 becomes 4.3.2.1.6.7.9.8.6.4.e164.arpa • Look up using (new) NAPTR DNS record • Example  contact 1st using SIP, 2nd using email: $ORIGIN 4.3.2.1.6.7.9.8.6.4.e164.arpa. IN NAPTR 100 10 "u" "sip+E2U" "!^.*$!sip:info@tele2.se!" . IN NAPTR 102 10 "u" "mailto+E2U" "!^.*$!mailto:info@tele2.se!" . IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  29. Call routing – TRIP and SLP • TRIP (RFC 3219) allows routing of SIP requests to the “best” IP telephony gateway • Based on BGP model of route propagation IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  30. Do not disturb & distinctive ringing • End system or proxy features • Distinctive ringing inserted by proxy: Alert-Info: http://www.example.com/sounds/moo.wav • Do not disturb: • 600 (Busy) • 603 (Decline) • with Retry-After IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  31. Call prioritization • SIP Priority header Subject: A tornado is heading our way! Priority: emergency • Can be inserted or removed by proxy • Useful for call routing IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  32. Caller preferences • One SIP address  many destinations: • home vs. office • cell phone vs. landline • PC video phone vs. black phone • Callee’s proxy decides, but caller preferences mechanism allows caller to influence choices • Can influence: • whether to proxy or redirect • which URI to proxy or redirect to • whether to fork or not • whether to search recursively or not • whether to search in parallel or sequentially IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  33. Caller preferences • Adds parameters to Contact headers describing properties of location: • Carol speaks English, Spanish and German and can send/receive audio + video, but only wants this address to be used for urgent calls: Contact: Carol <sip:carol@example.com> ;language="en,es,de" ;media="audio/*,video/*,application/chat" ;duplex="full" ;priority="urgent“ • INVITE request then contains headers: Accept-Contact: sip:user@host;feature="voicemail&attendant" Accept-Contact: sip:user@foo.edu;mobility="!fixed" IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  34. Using URIs for SIP Service Control • RFC 3087 • User part is left to local configuration • Voice mail services sip:rjs@vm.wcom.com;mode=deposit sip:670002@vm.wcom.com • Ad-hoc conferences • Invoke VoiceXML scripts sip:dialog.vxml.http%3a//dialogs.server.com/script32.vxml@vxmlservers.com IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  35. Using SIP events for services • Many telecom services generate asynchronous events: • participant joined or left conference • message waiting • call leg completed or terminated • SIP defines event notification requests: SUBSCRIBE and NOTIFY • Event packages for call legs, conferences, message waiting, IM, DTMF, ... NOTIFY sip:rohan@rmahy-phone.cisco.com SIP/2.0 To: <sip:rohan@cisco.com>;tag=78923 From: <sip:rohan@cisco.com>;tag=4442 Event: message-summary Content-Type: application/simple-message-summary Messages-Waiting: yes Voicemail: 4/8 (1/2) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  36. Wait 2 minutes Line 2 ringing Press line 2 180 Ringing INVITE, SDP’s c=0 INVITE Talk on line 1 182 Wait 2 minutes 200 OK Call waiting no notion of “lines”  unlimited number of line presences A B C IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  37. 200 OK Talk on line 2 Call waiting A Hold on line 1 C B IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  38. Call transfer (unsupervised) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  39. Multi-party features • Permanently or temporarily mixing multiple media streams • Generally, combinations of • adding conference servers (ad-hoc conferences) • transfer: use REFER to ask other party to do something • combinations of who asks whom to do what  recipient just follows instructions IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  40. Third-party call control • Separate signaling and media endpoints • Also sometimes called back-to-back UA (B2BUA) • but some B2BUA’s handle media, too IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  41. End system vs. Network server End system Temporary IP address Powered off so often (User’s address always changed and can not be reached sometime) Limited computational capacity Low bandwidth (One to one or small size conf.) Direct user interaction Signal and media converge (easier to deal with human interaction, easier to deal with interaction with media) Network server Permanent IP address Always on (User can have unique address and can always be reached) Ample computational capacity High bandwidth (Conference) Indirect user interaction Usually only deals with signaling (Based on predefined mechanisms, or indirect user interaction, like through web page) IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  42. End system vs. Network server Network server Information hiding Logical call distribution Gateway End system Busy handling Call transfer Distinctive ringing IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  43. Service location examples IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony (*) = with information provided by end system

  44. Service architectureProgramming language model IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  45. Programmable service creation • Can’t win by (just) recreating PSTN services • Programmable services: • equipment vendors, operators: JAIN • local sysadmin, vertical markets: sip-cgi • proxy-based call routing: CPL • voice-based control: VoiceXML IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  46. Programmable service creation IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  47. APIs (e.g., JAIN) • Tradition of TAPI, JTAPI, ... • Typically, call model • Treat calls as objects to be manipulated • e.g., JAIN: • bearer independent (PSTN, IP, ATM) • protocol-independent (ISUP, SIP, H.323, BICC, ...) • protocol APIs and application APIs IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  48. SIP servlets • Servlet runs in SIP server • Receives SIP objects and processes them • Example: call rejection application import org.ietf.sip.*; public class RejectServlet extends SipServletAdapter { protected int statusCode; protected String reasonPhrase; public void init(ServletConfig config) { super.init(config); try { statusCode = Integer.parseInt(getInitParameter("status-code")); reasonPhrase = getInitParameter("reason-phrase"); } catch (Exception _) {...} } public boolean doInvite(SipRequest req) { SipResponse res = req.createResponse(); res.setStatus(statusCode, reasonPhrase); res.send(); return true; } } IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  49. sip-cgi • web common gateway interface (cgi): • oldest (and still most commonly used) interface for dynamic content generation • web server invokes process and passes HTTP request via • stdin (POST body) • environment variables  HTTP headers, URL • arguments as POST body or GET headers (?arg1=var1&arg2=var2) • new process for each request  not very efficient • but easy to learn, robust (no state) • support from just about any programming language (C, Perl, Tcl, Python, VisualBasic, ...) • Adapt cgi model to SIP  sip-cgi • RFC 3050 IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

  50. sip-cgi • Designed for SIP proxies and end systems: • call routing • controlling forking • call rejection • call modification (Priority, Call-Info, Alert-Info) • cgi: once per HTTP request • sip-cgi: maintain state via an opaque token • script gets body of request on stdin • script gets SIP headers via environment variables • initiates actions via stdout: • proxy request • return response • generate request • generate response IEEE NJ Coast Section seminar on Wireless LAN & IP Telephony

More Related