Subject: [SIP] SIP Security Abstract

From: "Tom Tang" <[email-masked]>
Date: Mon, 27 Nov 2000 11:35:06 -0800

Hello Everyone:

   I would like initiate some type of action in this WG on
 addressing security for SIP.  Everyone knows that its an
 important topic, but so far little has been done.  I have
 written a short and very high level problem statement to try
 and provide a start for these discussions.

 End-To-End Security For SIP

    SIP messages can/might traverse N proxies between the sender and the
 destination.  Each proxy along this path has "promised" to provide some
 service to messages it receives (We will address this idea of a promise
 in the lower paragraph).  However, in order to provide this service,
 the proxy might need to modify/access the SIP payload.  So while we the
 sender want to provide enough information to the proxy so that they can
 provide this service, we also do not want to expose our message in
entirety.
 How do we do this ?  The SIP draft has mentioned using underlying security
 mechanisms, but the adaptations of these are not discussed in enough
detail.
 For example, IPSec does not know how to operate on partial payloads.

 Proxy Services

    SIP proxies essentially provide a service to messages they receive.
 However, how do we know that these proxies are actually trusted ?  Or
 better yet, how do we know that a specific proxy is trusted to provide
 a certain service ?  The common answer would be to integrate PKI into the
 SIP infrastructure, but would that be deployable ?

 Plan ?

    Security is an issue which requires detailed addressing before
 mass acceptance.  Additional requirements would be compatibility
 with existing infrastructure, latency, costs, and possibly CALEA.  I would
 like to propose that at the next IETF, this body start addressing security
 seriously.  A trust model would be an ideal starting point.

 Cheers,
 - Tom Tang

Tom Tang
Systems Software Architect
IP Unity
1575 McCandless Drive
Milpitas, CA 95035
(408) 957-0800 x154 (w)
(408) 957-0823 (f)

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip