[Sipping] draft-camarillo-sipping-sbc-funcs-02.txt

[[e-mail]]

The I-D "SIP-Unfriendly Functions in Current
Communication Architectures"
http://www.ietf.org/internet-drafts/draft-camarillo-sipping-sbc-funcs-02.txt


 is both very timely and an excellent piece of work.

The section "4.Security Considerations" needs however to go in some more
detail. For example:

- If the SBC is compromised (it happens on the Internet) then what are the
vulnerabilities for (1) SIP signaling and (2) RTP media streams?

- What possible attacks and vulnerabilities are there for the users and for
the operator of the SBC? (DOS, SPIT, impersonation, telemarketing, MIM,
theft of service, traffic monitoring, privacy, collecting internal IP
addresses, other - if all this may indeed apply.) What are the techniques
for securing an SBC, besides obscurity?

- How are the above vulnerabilities affected from keeping call state in the
SBC?

Maybe a section on interoperability could also be added. If two networks use
SBCs from different vendors, how will the interoperability be tested with
two SBCs in the path? See also the transparency criteria from Dean Willis.

Congratulations again for dealing with this difficult topic with such
clarity!

Thanks, Henry


_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [e-mail] for questions on current sip
Use [e-mail] for new developments of core SIP