Re: [dispatch] draft-lawrence-sip-3rd-party-authorization-00

["Dutkiewicz, Marek" <[e-mail]>]

I will lend my voice to the need for a solution to the issue described
in draft-lawrence-sip-3rd-party-authorization-00 posted by Scott
Lawrence. 

 

You can add multi-cast paging to the list of scenarios that are ripe for
hacker abuse due to the weak level of authentication/authorization that
is in place. I'm dreading the day when a spam attack on an important
enterprise casts a shadow over VoIP security similar to the situation
encountered by a well known VoIP operator several years ago.

 

The solutions I am aware of that are 'secure' rely on the call server
(typically a B2BUA implementation) to enforce
authentication/authorization rules. The UAs are configured to
authenticate (using Digest Authentication) that SIP signaling is
originating from the server. This provides a reasonable level of
security.

 

However increasingly I am seeing people wanting to disaggregate the
control away from a central server model. This makes sense since this is
one of the benefits presented by SIP. However the security implications
could be severe.

 

I'm not an expert in this area, so not well qualified to recommend a
solution, however one thought is to look at the AAA implementations that
are used in the cellular world to see whether this offers any useful
insight. Perhaps there could be a central authority that the various SIP
elements can turn to whenever they might be concerned about the
authenticity or authority of a particular message.

 

Regards

Marek

 

 

_________________________
Marek Dutkiewicz
Director, VoIP Product Management
Suite 200 3605 Gilmore Way, 
Burnaby, BC, 
V5G 4X5
Direct:  604.453.9455
Cell: 604-764-8651

www.polycom.com <http://www.polycom.com/> 

 

 


This communication (including any attachments) may contain privileged or
confidential information of Polycom and is intended for a specific
individual.  If you are not the intended recipient, you should delete
this communication, including any attachments without reading or saving
them in any manner, and you are hereby notified that any disclosure,
copying, or distribution of this communication, or the taking of any
action based on it, is strictly prohibited.