Subject: [SIP] authentication at gateway

From: Serban Tatu <[email-masked]>
Date: Tue, 04 Jul 2000 09:42:19 -0700

Hi,

How is authentication performed by a SIP-enabled gateway? Let's say somebody on
a PSTN phone wants to gain access to a service and therefore has to provide a
username/password. Some scenarios come to mind (<attention>newbie
here</attention>):

Scenario 1 (smart gateway):

- SIP UAS at service side sends a 401 unauthorized as a response to the INVITE.
The response contains a voice prompt audio file (e.g. <announcer_voice>Gimme
username/password</announcer_voice>).
- gateway is so smart that it knows how to play the prompt and collect DTMF
tones representing username and password, which it then sends back encoded
somehow to the service.

Scenario 2 (not so smart gateway):

- SIP UAS at service side sends back a 200 OK response to the INVITE. The
response contains the voice prompt as before.
- gateway knows how to play the audio file, sends ACK, media connections are
open.
- SIP UAS at service side then sends an INFO message with a DTMF collection
scheme (voice prompt could also be sent here).
- gateway collects the tones and sends them back with another INFO message.

Scenario 3 (dumb gateway):

- SIP UAS at service side sends back a 200 OK response to the INVITE.
- gateway and SIP UAS establish their media channels.
- service then plays the whole authentication scenario through the media
channels. Gateway lets DTMF tones flow through the media path.

Do any of these scenarios make any sense? It seems to me that 1 and 2 are sci-fi
given the current gateway solutions, while 3 might not be possible because the
gateway grabs the DTMF tones, or if it doesn't then it's an ugly solution since
signaling and media are all mixed together.

Thanks,
Serban

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 05 Jul 2000 00:01:13 -0400

THe most likely scenario is one you left out: the prompting and
collection for the PIN are all performed by the originating gateway. In
general, the entity demanding authentication will not know that the
request is through a gateway. I believe its unlikely the entity would
return 200 OK, or even a 401 with content. Rather, just a 401. 

So, upon receiving the 401, the gateway performs some local operation to
get the username and password. Perhaps it plays out an announcement and
collects the username/password; perhaps they are simply established
ahead of time and stored in a database - the gateway just fetches them
when prompted for authentication.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip