Subject: RE: [SIP] authentication at gateway

From: "Gardell, Steve" <[email-masked]>
Date: Wed, 5 Jul 2000 07:41:47 -0400

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Wednesday, July 05, 2000 12:01 AM
> To: Serban Tatu
> Cc: siplist
> Subject: Re: [SIP] authentication at gateway
> 
> 
> THe most likely scenario is one you left out: the prompting and
> collection for the PIN are all performed by the originating 
> gateway. In
> general, the entity demanding authentication will not know that the
> request is through a gateway. I believe its unlikely the entity would
> return 200 OK, or even a 401 with content. Rather, just a 401. 
> 
> So, upon receiving the 401, the gateway performs some local 
> operation to
> get the username and password. Perhaps it plays out an 
> announcement and
> collects the username/password; perhaps they are simply established
> ahead of time and stored in a database - the gateway just fetches them
> when prompted for authentication.
> 

A practical issue with this approach is that gateways are often
deployed in support of many different services that may have 
different authentication requirements. Placing all of the 
authentication smarts in the gateway makes it difficult to roll
out new services. Now admittedly this is a "telco centric" view
of the service world - I suggest that the appropriate "converged"
architecture is to have authentication controlled from outside 
the gateway and to implement it via a SIP Proxy(like?) element in
situations where we want the core service to be agnostic as to whether
the endpoint is a gateway or a UA. 

> -Jonathan R.
> 
> Serban Tatu wrote:
> > 
> > Hi,
> > 
> > How is authentication performed by a SIP-enabled gateway? 
> Let's say somebody on
> > a PSTN phone wants to gain access to a service and 
> therefore has to provide a
> > username/password. Some scenarios come to mind (<attention>newbie
> > here</attention>):
> > 
> > Scenario 1 (smart gateway):
> > 
> > - SIP UAS at service side sends a 401 unauthorized as a 
> response to the INVITE.
> > The response contains a voice prompt audio file (e.g. 
> <announcer_voice>Gimme
> > username/password</announcer_voice>).
> > - gateway is so smart that it knows how to play the prompt 
> and collect DTMF
> > tones representing username and password, which it then 
> sends back encoded
> > somehow to the service.
> > 
> > Scenario 2 (not so smart gateway):
> > 
> > - SIP UAS at service side sends back a 200 OK response to 
> the INVITE. The
> > response contains the voice prompt as before.
> > - gateway knows how to play the audio file, sends ACK, 
> media connections are
> > open.
> > - SIP UAS at service side then sends an INFO message with a 
> DTMF collection
> > scheme (voice prompt could also be sent here).
> > - gateway collects the tones and sends them back with 
> another INFO message.
> > 
> > Scenario 3 (dumb gateway):
> > 
> > - SIP UAS at service side sends back a 200 OK response to 
> the INVITE.
> > - gateway and SIP UAS establish their media channels.
> > - service then plays the whole authentication scenario 
> through the media
> > channels. Gateway lets DTMF tones flow through the media path.
> > 
> > Do any of these scenarios make any sense? It seems to me 
> that 1 and 2 are sci-fi
> > given the current gateway solutions, while 3 might not be 
> possible because the
> > gateway grabs the DTMF tones, or if it doesn't then it's an 
> ugly solution since
> > signaling and media are all mixed together.
> > 
> > Thanks,
> > Serban
> 
> -- 
> Jonathan D. Rosenberg                       72 Eagle Rock Ave.
> Chief Scientist                             First Floor
> dynamicsoft                                 East Hanover, NJ 07936
> [email-masked]                     FAX:   (973) 952-5050
> http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
> http://www.dynamicsoft.com
> 
> 
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
> 

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Rohan Mahy <[email-masked]>
Date: Wed, 05 Jul 2000 10:50:35 -0700

Hi,

Obviously you have to write the smarts somewhere.  If you want scalability, 
the more of that stuff you push to the edges, the better your deployment 
will scale.  If it is painful to touch the edges, then you may do more of 
the work in the center. The nice thing is, whosoever deployeth services 
using SIP may chooseth the manner suitable to their network.

thanks,
-rohan

---

From: Michael Thomas <[email-masked]>
Date: Wed, 5 Jul 2000 12:52:28 -0700 (PDT)

> the endpoint is a gateway or a UA. 

   Maybe I'm misunderstanding, but I'd think that
   the *inability* to authenticate an untrusted UA
   would be a major impediment to deploying new
   services; spoofing attacks are far too easy. 

   Also: I guess I don't understand why you think
   that building some sort of security proxy would
   be easier than just building in end to end
   security. From what I've seen, they are mainly
   hacks to get around things that can't do end to
   end security themselves, but they add a lot of 
   overall complexity since they're essentially
   second guessing what an application should have
   done with all of the disadvantages of being a
   bump in the wire.

	   Mike

---

From: Henry Sinnreich <[email-masked]>
Date: Wed, 05 Jul 2000 17:01:50 -0500

>I suggest that the appropriate
>"converged"

Exactly right!

Henry

>From: [email-masked]
>[mailto:[email-masked]]On Behalf Of
>Gardell, Steve
>Sent: Wednesday, July 05, 2000 6:42 AM
>To: 'Jonathan Rosenberg'; Serban Tatu
>Cc: siplist
>Subject: RE: [SIP] authentication at gateway
>
>