RFC 4484
Trait-Based Authorization Requirements for the Session Initiation Protocol (SIP)
Heyyy bestie 🎀 this is RFC 4484, a super cute Informational doc from the Network Working Group, published August 2006 🦋. It's called Trait-Based Authorization Requirements for the Session Initiation Protocol (SIP), and it was written by J. Peterson (NeuStar), J. Polk (Cisco), D. Sicker (CU Boulder), and H. Tschofenig (Siemens) 👑. It's category Informational, so it's sharing info, not setting a standard 💅. The title block doesn't list any RFCs it obsoletes or updates ✨.
Status of This Memo
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. 🌸
Copyright Notice
Copyright (C) The Internet Society (2006). 💜
Abstract
This document lays out a set of requirements related to trait-based authorization for the Session Initiation Protocol (SIP). 🧚 While some authentication mechanisms are described in the base SIP specification, trait-based authorization provides information used to make policy decisions based on the attributes of a participant in a session. This approach provides a richer framework for authorization, as well as allows greater privacy for users of an identity system. 🔥
Table of Contents
1. Introduction ....................................................2
2. Terminology .....................................................4
3. Trait-Based Authorization Framework .............................4
4. Example Use Cases ...............................................7
4.1. Settlement for Services ....................................7
4.2. Associating Gateways with Providers ........................7
4.3. Permissions on Constrained Resources .......................8
4.4. Managing Priority and Precedence ...........................9
4.5. Linking Different Protocols ...............................10
5. Trait-Based Authorization Requirements .........................11
6. Security Considerations ........................................13
7. Acknowledgements ...............................................13
8. References .....................................................13
8.1. Normative References ......................................13
8.2. Informative References ....................................131. Introduction ✨
This document explores requirements of the Session Initiation Protocol (SIP) [1] for enabling trait-based authorization. 🦋 This effort stems from the recognition that when SIP requests are received by a User Agent Server (UAS), there are authorization requirements that are orthogonal to ascertaining of the identity of the User Agent Client (UAC). Supplemental authorization information might allow the UAS to implement non-identity-based policies that depend on further attributes of the principal that originated a SIP request. 💅
For example, in traditional SIP authorization architectures, the mere fact that a UAC has been authenticated by a UAS doesn't mean that the UAS will grant the UAC full access to its services or capabilities -- in most instances, a UAS will compare the authenticated identity of the UAC to some set of users that are permitted to make particular requests (as a way of making an authorization decision). 🙈 However, in large communities of users with few preexisting relationships (such as federations of discrete service providers), it is unlikely that the authenticated identity of a UAC alone will give a UAS sufficient information to decide how to handle a given request. 💀
Trait-based authorization entails an assertion by an authorization service of attributes associated with an identity. An assertion is a sort of document consisting of a set of these attributes that are wrapped within a digital signature provided by the party that generates the assertion (the operator of the authorization service). These attributes describe the 'trait' or 'traits' of the identity in question -- facts about the principal corresponding to that identity. For example, a given principal might be a faculty member at a university. An assertion for that principal's identity might state that they have the 'trait' of 'is a faculty member', and the assertion would be issued (and signed) by a university. 🎓 When a UAS receives a request with this trait assertion, if it trusts the signing university, it can make an authorization decision based on whether or not faculty members are permitted to make the request in question, rather than just looking at the identity of the UAC and trying to discern whether or not they are a faculty member through some external means. Thus, these assertions allow a UAS to authorize a SIP request without having to store or access attributes associated with the identity of the UAC itself. 🫶 Even complex authorization decisions based the presence of multiple disjointed attributes are feasible; for example, a 'faculty' member could be part of the 'chemistry' department, and both of these traits could be used to make authorization decisions in a given federation. 🧪
It is easy to see how traits can be used in a single administrative domain, for example, a single university, where all users are managed under the same administration. In order for traits to have a broader usage for services like SIP, which commonly are not bounded by administrative domains, domains that participate in a common authorization scheme must federate with one another. The concept of federation is integral to any trait-based authorization scheme. Domains that federate with one another agree on the syntax and semantics of traits -- without this consensus, trait-based authorization schemes would only be useful in an intradomain context. A federation is defined as a set of administrative domains that implement common policies regarding the use and applicability of traits for authorization decisions. Federation necessarily implies a trust relationship, and usually implies some sort of pre-shared keys or other means of cryptographic assurance that a particular assertion was generated by an authorization service that participates in the federation. 🔐
In fact, when trait-based authorization is used, an assertion of attributes can be presented to a UAS instead of the identity of user of the UAC. In many cases, a UAS has no need to know who, exactly, has made a request -- knowing the identity is only a means to the end of matching that identity to policies that actually depend on traits independent of identity. This fact allows trait-based authorization to offer a very compelling privacy and anonymity solution. 🌈 Identity becomes one more attribute of an assertion that may or may not be disclosed to various destinations. 🙌
Trait-based authorization for SIP depends on authorization services that are trusted by both the UAC and the UAS that wish to share a session. For that reason, the authorization services described in this document are most applicable to clients either in a single domain or in federated domains that have agreed to trust one another's authorization services. This could be common in academic environments, or business partnerships that wish to share attributes of principals with one another. Some trait-based authorization architectures have been proposed to provide single sign-on services across multiple providers. 🍓
Although trait-based identity offers an alternative to traditional identity architectures, this effort should be considered complementary to the end-to-end cryptographic SIP identity effort [3]. An authentication service might also act as an authorization service, generating some sort of trait assertion token instead of an authenticated identity body. ⭐
2. Terminology ✨
In this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in RFC 2119 [2] and indicate requirement levels for compliant SIP implementations. 📚
3. Trait-Based Authorization Framework ✨
Okay so a trait-based authorization setup has an authorization service at its heart 💅. Devices have to send requests to that service to get an assertion they can use in the context of a given network request. Different kinds of network requests usually need different or extra attributes in the assertions the service hands back 🎀
For SIP, SIP requests might get fed to an authorization service as the basis for an assertion 🦋. A user agent could take a particular SIP request, like an INVITE, that it wants an assertion for and forward it to the authorization service. This is kinda like how an authenticated identity body gets requested in [3]. User agents might also use a separate protocol to ask for an assertion. Either way, the client needs to authenticate itself to an authorization service before it receives an assertion. That authentication could use any of the standard mechanisms described in RFC 3261 [1], or some other means of authentication 🔐
Once a SIP UA has an assertion, it needs some way to carry that assertion within a SIP request 🧚 The assertion could be provided by reference or by value. For example, a SIP UA could include a MIME body within a SIP request that contains the assertion, and that would be inclusion by value. Alternatively, content indirection [4], or some new header, could be used to provide a URI (perhaps an HTTP URL) where interested parties could acquire the assertion. That's inclusion by reference 💜
The basic model looks like this:
+----------------+ | |
| +------------+ | Request | +------------+ |
| | Entity | |------------------------>| | Assertion | |
| | requesting | | | | Granting | |
| | authz | |<------------------------| | Entity | |
| | assertions | | Assertion | +------------+ |
| +------------+ | | ^ |
| | | | . Trust |
| | | | . Rel. |
| | | | v |
| | | | +------------+ |
| Transfer | | | Assertion | |
| | | | | Verifying | |
| | | | | Entity | |
| | | | +------------+ |
| | | | |
| v | +----------------+
| +------------+ | Service Request + ^ |
| | Entity | | Assertion | |
| | using authz| | -----------------------------+ |
| | assertion | | |
| +------------+ | <-------------------------------+
+----------------+ Response/ErrorThe entity that requests authorization assertions (or the entity that gets some assertions granted) and the entity that uses those assertions might be co-located in the same host or domain. They might also be entities in different domains that share a federate with one another. The same goes for the entity that grants these assertions to a particular entity and the entity that verifies them 🌸
From a protocol point of view, it's worth noting that getting some assertions might happen some time before they're actually used 👑 Also, different protocols might be used, and the assertions may have a lifetime that allows them to be presented to the verifying entity multiple times during that lifetime 🫶
Some important design decisions come with carrying assertions in a SIP request 😭 If an assertion is carried by value, or uses a MIME-based content indirection system, then proxy servers won't be able to inspect the assertion themselves. If the assertion were referenced in a header, though, the proxy might be able to acquire and inspect the assertion itself. There are definitely architectures where it would make sense for proxy servers to apply admission controls based on assertions 🔥
Carrying assertions by reference also lets versatile access controls be applied to the assertion itself, and that's so iconic 🌈 For instance, an HTTP URL where an assertion could be acquired could point to a web server that challenged requests and only allowed certain authorized sources to inspect the assertion. Or that server could provide different versions of the assertion depending on who is asking. When a SIP UA initiates a request with privacy controls [5], a web server might provide only trait information ('faculty', 'student', or 'staff') to most queries. Privileged askers, though, could get more detailed information, including the identity of the originator of the SIP request. End-users who make requests should have some way to tell authorization services which attributes should be shared with particular destinations 💅
Assertions themselves might be scoped to a particular SIP transaction or SIP dialog, or they might have a longer lifetime ⭐ The recipient of an assertion associated with a SIP request needs some way to verify that the authorization service intended this assertion to be used for that request. However, the format of assertions isn't specified by these requirements 🧚
Trait assertions for responses to SIP requests are outside the scope of these requirements 🙈 It isn't clear whether the recipient of a request ever needs to provide authorization data back to the requestor.
Trait-based authorization has big applicability to SIP, and I'm obsessed 😍 There are tons of situations where it's valuable to assert particular facts about a principal other than their identity, so the recipient can make an authorization policy decision. For example, a telephony service provider might assert that a particular user is a 'customer' as a trait. An emergency services network might indicate that a particular user has privileged status as a caller 🚨
4. Example Use Cases 🍓
These use cases are by no means exhaustive, but they give a few high-level examples of the kinds of services trait-based authorization might provide 🌸 All of the cases below consider interdomain usage of authorization assertions.
4.1. Settlement for Services 💰
When endpoints in two domains share real-time communications services, the domains sometimes need to exchange accounting and settlement information in real time ⏱️ The operators of valuable resources (for example, Public Switched Telephone Network (PSTN) trunking, conference bridges, or the like) in the called domain may want to settle with the calling domain. That settlement could be with the operators of the domain or with a particular user. Some accounting operations might need to finish before a call is terminated 🎧 For example, a caller in one domain might want to access a conference bridge in another domain, and the called domain might want to settle for the usage of the bridge with the calling domain. Or, in a wireless context, a roaming user might want to use services in a visited network, and the visited network might need to understand how to settle with the user's home network for those services 📱
If the calling domain is some sort of commercial service that can exchange accounting information, the called domain may want to verify that the remote user has a billable account in good standing before letting that remote user access valuable resources 💳 Moreover, the called domain may need to discover the network address of an accounting server and some basic information about how to settle with it 🔍
An authorization assertion created by the calling domain could give the called domain assurance that a user's account can settle for a particular service ✨ In some cases, no further information is needed to process a transaction. But if more specific accounting data is needed, traits could also communicate the network address of an accounting server, the settlement protocol that should be used, and so on 🦋
4.2. Associating Gateways with Providers 🌉
Imagine a case where a telephone service provider has deployed lots of PSTN-SIP gateways 📞 When calls come in from the PSTN, they're eventually proxied to various SIP user agents. Each SIP user agent server is, of course, interested in knowing the identity of the PSTN caller. That identity could be given within SIP messages in any number of ways, like in SIP headers, in bodies, or what have you. However, for the recipient to trust the identity stated in the call (in this instance, the calling party's telephone number), they must first trust that the call originated from the gateway and that the gateway is operated by a known and trusted provider 🫣
There are a number of ways a service provider might try to address this problem 💅 One possibility would be routing all calls from gateways through a recognizable 'edge' proxy server, say sip.example.com. Accordingly, any SIP entity that received a request via the edge proxy server (assuming hop-by-hop mutual cryptographic authentication is used) would know the service provider the call originated from. However, requests from the originating service provider's edge proxy might be proxied again before reaching the destination user agent server. In many cases, then, the originating service provider's identity would only be known transitively 🌀 Moreover, in many architectures, requests that did not originate from PSTN gateways could also be sent through the edge proxy server. In the end analysis, the recipient of the request is less interested in knowing which carrier the request came from than in knowing that the request came from a gateway 🙄
Another possible solution is to issue certificates to every gateway corresponding to the hostname of the gateway, like gateway1.example.com. Gateways could then sign SIP requests directly, and this property could be preserved end-to-end 🔐 But depending on the public key infrastructure, this could get costly for large numbers of gateways. Also, a user agent server that receives the request has no direct assurance from a typical certificate that the host is actually a gateway just because it happens to be named 'gateway1' 😬
Trait-based authorization would enable the trait 'is a gateway' to be associated with an assertion generated by the service provider (i.e., signed by example.com) 👑 Since these assertions would travel end-to-end from the originating service provider to the destination user agent server, SIP requests that carry them can pass through any number of intermediaries without discarding cryptographic authentication information. This mechanism also doesn't rely on hostname conventions to figure out what counts as a gateway and what doesn't. It relies on an explicit and unambiguous attribute in an assertion 🎀 Literally iconic, bestie 💖
4.3. Permissions on Constrained Resources ✨
okay so picture this 🎀 two universities are sharing a videoconferencing service, and the bandwidth is kinda limited 😭. Both schools want rules for who gets to use that bandwidth from their own communities. Like, faculty might be allowed to set up video calls during the day, but students probably not 💀. Faculty could also add students to a call on the fly or moderate what goes on in the meeting, while students mostly just participate more passively 🫶.
Trait-based authorization is literally made for this 💅. It's about group membership, not individual users. Instead of checking every single person, you assign levels or roles that both universities honor, since they're both in the same federation 🌸.
If the federation honored the traits "faculty", "staff", and "student", they could be used to make sure the network resource gets used appropriately between the universities in the federation ✨. Every request to set up a session would carry an assertion saying what role the requestor has 📜. The session only gets granted if the requestor has the right trait 🔥. Ideally, the enforcement happens at intermediaries (SIP proxy servers) that can inspect and verify those assertions 👑.
4.4. Managing Priority and Precedence
the Internet telephony community is obsessed with giving certain calls a 'priority' based on who the user is 🧚. The idea is that prioritized calls get preferential treatment when network resources are scarce 🔥. Different domains might use different criteria for assigning priority, and a domain is unlikely to link a non-local user's identity to a need for priority 🙈. That's true even when domains want to respect each other's prioritization policies 🫶.
Existing proposals mostly focus on adding a new header field to SIP that might carry a priority indicator 📨. This use case doesn't challenge that strategy. It just shows, by example, how this requirement might be met with a trait-based authorization system ✨. So the limitations of the header field approach won't be compared against a hypothetical trait-based system here 💅.
An assertion created by a domain for a particular request might have an associated 'priority' attribute 🦋. Recipients of the request could inspect and verify the signature on the assertion to figure out which domain authenticated the user and made the priority assessment 🔍. If the assertion's creator is trusted by the evaluator, the given priority could be factored into any relevant request processing 👑.
4.5. Linking Different Protocols
okay, cryptographic computations are expensive 😭, and making an authorization decision can take a lot of time and multiple messages between the entity enforcing the decision and the entity computing it 🐢. Especially in a mobile environment, these entities are physically separated, or not even in the same administrative domain 🌍. So the idea of "single sign-on" is another potential use for authorization assertions and trait-based authorization ✨. A user gets authenticated and authorized through one protocol, then reuses the resulting assertion in other, potentially unrelated protocol exchanges 🦋.
For example, in some environments it's useful to make the authorization decision for a "high-level" service, like a voice call 📞. The authorization for the "voice call" itself might include authorization for SIP signaling and also for lower-level network functions. One example is a quality-of-service (QoS) reservation to improve the performance of real-time media sessions set up by SIP 🎀. The SIP signaling protocol and the QoS reservation protocol are totally separate, so the authorization decisions of the two protocols need to be linked 🔗. The authorization decision might be valid for a number of different protocol exchanges, for different protocols, and for a certain duration or some other attributes ⏳.
To make this work as part of the initial authorization step, an authorization assertion gets returned to the end host of the SIP UAC, cryptographically protected 🔐. If QoS is necessary, the end host can reuse the returned assertion in the QoS signaling protocol 💜. Any domains in the federation that would honor the assertion generated to authorize the SIP signaling would honor the use of that assertion for QoS too 🫶. When an authorization server first generates the assertion, traits can be added that specify the desired level of quality to grant the media for a SIP session ✨.
5. Trait-Based Authorization Requirements
Here's the checklist of constraints and requirements for trait-based authorization in SIP 📋:
- The mechanism MUST support a way for SIP user agents to embed an authorization assertion in SIP requests. Assertions can be carried either by reference or by value.
- The mechanism MUST allow SIP UACs to deliver to an authorization service those SIP requests that need to carry an assertion. The mechanism SHOULD also provide a way for SIP intermediaries to recognize that an assertion will be needed, and either forward requests to an authorization service themselves or notify the UAC of the need to do so.
- Authorization services MUST be capable of delivering an assertion to a SIP UAC, either by reference or by value. It MAY also be possible for an authorization service to add assertions to requests itself, if the user profile permits this (for example, through the use of content-indirection as described in [4]).
- Authorization services MUST have a way to authenticate a SIP UAC.
- The assertions generated by authorization services MUST be capable of providing a set of values for a particular trait that a principal is entitled to claim.
- The mechanism MUST provide a way for authorized SIP intermediaries (e.g., authorized proxy servers) to inspect assertions.
- The mechanism MUST have a single baseline mandatory-to-implement authorization assertion scheme. The mechanism MUST also allow support of other assertion schemes, which would be optional to implement. One example of an assertion scheme is Security Assertion Markup Language (SAML) [6] and another is RFC 3281 X.509 Attribute Certificates [7].
- The mechanism MUST ensure reference integrity between a SIP request and assertion. Reference integrity refers to the relationship between a SIP message and the assertion authorizing the message. For example, a reference integrity check would compare the sender of the message (as expressed in the SIP request, for example, in the
"From"header field value) with the identity provided by the assertion. Reference integrity is necessary to prevent various sorts of relay and impersonation attacks. Note that reference integrity MAY apply on a per-message, per-transaction, or per-dialog basis. - Assertion schemes used for this mechanism MUST be capable of asserting attributes and/or traits associated with the identity of the principal originating a SIP request. No specific traits or attributes are required by this specification.
- The mechanism MUST support a means for end-users to specify policies to an authorization service for the distribution of their traits and/or attributes to various destinations.
- The mechanism MUST provide a way of preventing unauthorized parties (either intermediaries or endpoints) from viewing the contents of assertions.
- Assertion schemes MUST provide a way of selectively sharing the traits and/or attributes of the principal in question. In other words, it must be possible to show only some of the attributes of a given principal to particular recipients, based on the cryptographically-assured identity of the recipient.
- It MUST be possible to provide an assertion that contains no identity -- that is, to present only attributes or traits of the principal making a request, rather than the identity of the principal.
- The manner in which an assertion is distributed MUST permit cryptographic authentication and integrity properties to be applied to the assertion by the authorization service.
- It MUST be possible for a UAS or proxy server to reject a request that lacks a present and valid authorization assertion, and to inform the sending UAC that it must acquire such an assertion in order to complete the request.
- The recipient of a request containing an assertion MUST be able to ascertain which authorization service generated the assertion.
- It MUST be possible for a UAS or proxy server to reject a request containing an assertion that does not provide any attributes or traits that are known to the recipient or that are relevant to the request in question.
- It SHOULD be possible for a UAC to attach multiple assertions to a single SIP request, in cases where multiple authorization services must provide assertions in order for a request to complete.
6. Security Considerations
okay, this part is serious 🚨. The subject of this document is an authorization system for SIP that isn't based on distributing end-users' identities. It shares traits of the users instead 🔐. That's why the bulk of this document is about security 💀.
Distributing authorization assertions needs a bunch of security properties 🔒. An authorization service has to be able to sign assertions, or provide some similar cryptographic assurance that gives non-repudiation for assertions ✍️. These requirements are explained in more detail in Section 3 📖.
7. Acknowledgements
The authors thank Christopher Eagan and Mary Barnes for their valuable input 🫶💖.
8. References
8.1. Normative References
[1] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.
[2] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
8.2. Informative References
[3] Peterson, J. and C. Jennings, "Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)", RFC 4474, August 2006.
[4] Burger, E., Ed., "A Mechanism for Content Indirection in Session Initiation Protocol (SIP) Messages", RFC 4483, May 2006.
[5] Peterson, J., "A Privacy Mechanism for the Session Initiation Protocol (SIP)", RFC 3323, November 2002.
[6] Organization for the Advancement of Structured Industry Standards, "Security Assertion Markup Language v1.0", November 2002, <http://www.oasis-open.org>.
[7] Farrell, S. and R. Housley, "An Internet Attribute Certificate Profile for Authorization", RFC 3281, April 2002.
Authors' Addresses ✨
okay bestie, here are the four humans who wrote this, with their contact deets so you can slide into their inboxes 💌
Jon Peterson
NeuStar, Inc.
1800 Sutter St
Suite 570
Concord, CA 94520
US
Phone: +1 925/363-8720
EMail: jon.peterson@neustar.biz
URI: http://www.neustar.biz/James M. Polk
Cisco Systems
2200 East President George Bush Turnpike
Suite 570
Richardson, TX 75802
US
EMail: jmpolk@cisco.comDouglas C. Sicker
University of Colorado at Boulder
ECOT 531
Boulder, CO 80309
US
EMail: douglas.sicker@colorado.eduHannes Tschofenig
Siemens AG
Otto-Hahn-Ring 6
Munich 81739
Germany
EMail: Hannes.Tschofenig@siemens.comFull Copyright Statement 🎀
the legal bit, but make it cute 💅 the Internet Society holds the copyright here, and it's dated 2006. Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
translation: it's provided as-is and nobody's promising it'll work for every single use 🙈 no warranties, no vibes-based guarantees.
Intellectual Property 🦋
the IETF doesn't take a side on whether any IP rights apply to the tech in here, or whether you can actually get a license to use it. it also hasn't gone hunting for those rights itself. if you want the rules on rights in RFC docs, check out BCP 78 and BCP 79 📚
if anyone has filed IPR disclosures with the IETF Secretariat, or has promised to license their rights, you can find all that in the IETF's online IPR repository at http://www.ietf.org/ipr. same goes for the result of any attempt to get a general license or permission for implementers or users.
and if you know about any copyrights, patents, patent applications or other proprietary rights that might cover tech needed to implement this standard, the IETF wants to hear about it! send that info to ietf-ipr@ietf.org 🫶
Acknowledgement 🌈
big thanks to the funding crew: the RFC Editor function is paid for by the IETF Administrative Support Activity (IASA) 💖
📦 where this page comes from
- ietf: rfc4484 2006-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms