Re: [rtcweb] Resolving RTP/SDES question in Paris

[Igor Faynberg <[e-mail]>]

+1

Indeed, this is the only way call centers could work.

Igor

On 3/21/2012 9:51 AM, Ravindran, Parthasarathi wrote:
> It will be good to add this CallCenter WebRTC usecase.
>
> Thanks
> Partha
>
>> -----Original Message-----
>> From: Jim Barnett [mailto:[e-mail]]
>> Sent: Wednesday, March 21, 2012 7:18 PM
>> To: Hutton, Andrew; Hadriel Kaplan; Ravindran, Parthasarathi
>> Cc: [e-mail]
>> Subject: RE: [rtcweb] Resolving RTP/SDES question in Paris
>>
>> One way to look at this case would be to say that it's the server at the
>> boundary of www.travel.co that is the RTCWeb endpoint,  _not_ the agent
>> desktop. The boundary server is acting as an RTCWeb-to-corporate network
>> gateway, and systems inside the corporate network are not affected.
>> Callers see themselves as connected to www.travel.co, rather than having
>> a direct RTCWeb-all-the-way connection to the agent.  I'm pretty sure
>> that call centers would like to do things this way since it doesn't
>> require any changes to their corporate infrastructure. (They can
>> add/upgrade the gateway without changing their recording systems or
>> agent desktops, etc.)
>>
>> I don't see anything like this in the use case document.  Is this a use
>> case we want to support?
>>
>> - Jim
>>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On Behalf
>> Of Hutton, Andrew
>> Sent: Tuesday, March 20, 2012 6:07 AM
>> To: Hadriel Kaplan; Ravindran, Parthasarathi
>> Cc: [e-mail]
>> Subject: Re: [rtcweb] Resolving RTP/SDES question in Paris
>>
>> Hi,
>>
>> Completely agree with Hadriel's statement below.
>>
>> In addition to wanting to know that you are connected to "www.travel.co"
>> or "www.mybank.co" you as a consumer and the company really want/need
>> the media to be recorded by the companies system for your own
>> protection. This is going to involve some kind of MITM or as we call it
>> in SIPREC a Session Recording Client (SRC) to be able to intercept the
>> media and route it to a Session Recording Server (SRS).
>>
>> The agent's desktop device could act as the SRC but more likely it will
>> be some kind of B2BUA that does this.
>>
>> In these scenario's you as a consumer using this service really want the
>> media to be secure at least as far as reaching the bank but after that
>> like any existing web based system you have to trust the bank with your
>> data this is no different whether that data is speech or text that you
>> entered on a web page.
>>
>> The recording system should be able to work with DTLS-SRTP but it will
>> most likely act as a MITM so will change the DTLS fingerprint. I don't
>> see that as a problem.
>>
>> Regards
>> Andy
>>
>>
>>
>>> -----Original Message-----
>>> From: [e-mail] [mailto:[e-mail]] On
>>> Behalf Of Hadriel Kaplan
>>> Sent: 20 March 2012 03:21
>>> To: Ravindran, Parthasarathi
>>> Cc: [e-mail]
>>> Subject: Re: [rtcweb] Resolving RTP/SDES question in Paris
>>>
>>>
>>> And, it should be noted, they *want* it that way.  They don't
>>> generally want you to know which agent picked up the call, or that the
>>> call got transferred from an IVR to a specific agent, or got put in a
>>> queue with elevator-music announcement server, or any of that.  You
>> "called"
>>> Travel Co., and they answered.  What goes on behind that SBC is
>>> equivalent to the back-end database stuff that goes on between the web
>>> server and back-end systems, while all you see is the web-server your
>>> browser happens to be connected to.
>>>
>>> The "identity" you'll get is www.travel.co, which you already had when
>>> your browser did HTTPS cert verification of their web-server.  HTTPS
>>> became the key-exchange transport for the SRTP key.  Since they
>>> already proved they own the cert for www.travel.co, having them claim
>>> to be www.travel.co shouldn't require yet more verification.
>>>
>>> -hadriel
>>>
>>>
>>> On Mar 19, 2012, at 9:15 PM, Ravindran, Parthasarathi wrote:
>>>
>>>> Jim,
>>>>
>>>> As a customer, you won't really know whether the identity
>>>> (DTLS-SRTP)
>>> of call center/travel site is agent or SBC. SBC can perform MITM
>>> attack easily as extending SDES-SRTP to DTLS-SRTP for call center site
>>> is feasible.
>>>> Thanks
>>>> Partha
>>> _______________________________________________
>>> rtcweb mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/rtcweb
>> _______________________________________________
>> rtcweb mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rtcweb
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb