[rtcweb] 答复: 答复: Fwd: I-D Action: draft-westerlund-rtcweb-codec-control-00.txt

[邓灵莉/denglingli <[e-mail]>]

Agreed.

-----邮件原件-----
发件人: Magnus Westerlund [mailto:[e-mail]] 
发送时间: 2012年5月21日 14:59
收件人: 邓灵莉/denglingli
抄送: [e-mail]
主题: Re: 答复: [rtcweb] Fwd: I-D Action: draft-westerlund-rtcweb-codec-control-00.txt

On 2012-05-21 03:44, 邓灵莉/denglingli wrote:
> Hi, Magnus
> 
> It seems to me that there may be another security threat in 
> multi-party applications of COP, where an entity needs to combine 
> multiple sets of requested parameters, than the one discussed in the draft.
> That the initial downgrading of the combined potential ceiling for 
> collected parameters for media quality (codec capabilities plus COP 
> parameters as stated in Section 5) through SDP transaction by a malicious participant.
> Unlike the one stated in Section 8, the latter behavior only happens 
> once and could neither been distinguished afterwards as "actively 
> harmful" nor to be ignored in order to serve actually poorly-equipped users.
> Would that be an issue?
> 

Yes, this is clearly a security threat to the complete solution. Not that it is specific to codec control. It is a threat to all things expressed in the SDP, like which codecs being used, security mechanism is negotiated etc.

In the WebRTC security architecture my undestanding is that it so far are a deliberate choice of allowing the JavaScript and the web browser to be allowed to modify the SDP if desired by them. Thus a security model based on hop by hop security for the JSEP/SDP messages has been selected. For example the usage of HTTPS / Websocket over TLS can provide the security to prevent third parties not directly addressed from seeing and affecting the JSEP/SDP messages.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  [phone]
Färögatan 6                | Mobile [phone]
SE-164 80 Stockholm, Sweden| mailto: [e-mail]
----------------------------------------------------------------------


__________ Information from ESET NOD32 Antivirus, version of virus signature database 7138 (20120515) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com