RFC 6080
A Framework for Session Initiation Protocol User Agent Profile Delivery
Part 1 of 12 🎀✨
Abstract
okay so this doc is all about a framework that helps configure SIP user agents (UAs) 💖 The framework delivers the profile data they need to actually work, automatically, with minimal or no User and Administrative intervention 🫶 It covers how SIP UAs can discover sources, request profiles, and get notified when profiles change. There's a brand-new SIP event package defined just for profile-change notifications 🔥 It also gives minimal data retrieval options so everything stays interoperable. And the profile data itself? Not in scope, bestie 🙈
Status of This Memo
this is an Internet Standards Track document ✨
it's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community 👑 it got public review and was approved for publication by the Internet Engineering Steering Group (IESG) 💅 for more on Internet Standards, check Section 2 of RFC 5741 🦋
info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc6080 🌸
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved 🎀
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date 📜 read them carefully, because they spell out your rights and restrictions 🙈 any Code Components pulled out of this doc have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as the Simplified BSD License says 💜
some material in here may come from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008 🍓 the people who control the copyright on some of that stuff might not have let the IETF Trust allow modifications outside the IETF Standards Process 😭 so unless you've got an adequate license from them, this doc can't be modified outside the IETF Standards Process, and derivative works can't be made outside it either. the one exceptions are formatting it for publication as an RFC or translating it into languages other than English ✨
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3.1. Reference Model . . . . . . . . . . . . . . . . . . . . . 6
3.2. Motivation . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3. Profile Types . . . . . . . . . . . . . . . . . . . . . . 9
3.4. Profile Delivery Stages . . . . . . . . . . . . . . . . . 9
3.5. Supported Device Types . . . . . . . . . . . . . . . . . . 10
4. Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.1. Simple Deployment Scenario . . . . . . . . . . . . . . . . 10
4.2. Devices Supporting Multiple Users from Different
Service Providers . . . . . . . . . . . . . . . . . . . . 12
5. Profile Delivery Framework . . . . . . . . . . . . . . . . . . 14
5.1. Profile Delivery Stages . . . . . . . . . . . . . . . . . 14
5.2. Securing Profile Delivery . . . . . . . . . . . . . . . . 22
5.3. Additional Considerations . . . . . . . . . . . . . . . . 24
5.4. Support for NATs . . . . . . . . . . . . . . . . . . . . . 33
6. Event Package Definition . . . . . . . . . . . . . . . . . . . 33
6.1. Event Package Name . . . . . . . . . . . . . . . . . . . . 33
6.2. Event Package Parameters . . . . . . . . . . . . . . . . . 33
6.3. SUBSCRIBE Bodies . . . . . . . . . . . . . . . . . . . . . 36
6.4. Subscription Duration . . . . . . . . . . . . . . . . . . 37
6.5. NOTIFY Bodies . . . . . . . . . . . . . . . . . . . . . . 37
6.6. Notifier Processing of SUBSCRIBE Requests . . . . . . . . 37
6.7. Notifier Generation of NOTIFY Requests . . . . . . . . . . 38
6.8. Subscriber Processing of NOTIFY Requests . . . . . . . . . 38
6.9. Handling of Forked Requests . . . . . . . . . . . . . . . 39
6.10. Rate of Notifications . . . . . . . . . . . . . . . . . . 39
6.11. State Agents . . . . . . . . . . . . . . . . . . . . . . . 39
7. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.1. Example 1: Device Requesting Profile . . . . . . . . . . . 39
7.2. Example 2: Device Obtaining Change Notification . . . . . 42
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 46
8.1. SIP Event Package . . . . . . . . . . . . . . . . . . . . 46
8.2. Registry of SIP Configuration Profile Types . . . . . . . 46
9. Security Considerations . . . . . . . . . . . . . . . . . . . 47
9.1. Local-Network Profile . . . . . . . . . . . . . . . . . . 48
9.2. Device Profile . . . . . . . . . . . . . . . . . . . . . . 49
9.3. User Profile . . . . . . . . . . . . . . . . . . . . . . . 50
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 51
11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 52
11.1. Normative References . . . . . . . . . . . . . . . . . . . 52
11.2. Informative References . . . . . . . . . . . . . . . . . . 531. Introduction 🧚
okay so SIP user agents need configuration data to function properly 💅 that includes stuff specific to local networks, devices, and users. A configuration data set tied to one entity is called a profile ✨ like, a device profile holds the config data for a device. The process of giving devices one or more profiles is called "profile delivery" 🌈 and ideally, it should be automatic and need minimal or no user intervention 🫶
a lot of SIP user agent deployments need dynamic configuration and can't rely on pre-configuration 😭 this framework gives a standard way to do dynamic configuration, which makes life way easier when you've got SIP user agents from multiple vendors in one deployment 🔥 it also handles change notifications for when profiles change 💜 but the framework does NOT define what the profile looks like or what format it's in. That's left for future standardization work 🙈
here's how this doc is laid out 🦋 the normative requirements live in Section 5 (framework operations) and Section 6 (the event package definition) 👑 everything else is intro and supporting explanation. Section 3 gives a high-level overview of the abstract components, profiles, and profile delivery stages 🍓 Section 4 walks through some motivating use cases, and Section 7 wraps up with illustrative examples of the framework in action 💖
2. Terminology ✨
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🎀
this doc also reuses the SIP terminology from [RFC3261] and [RFC3265], and it specifies how the following terms are used 💅
Device: a software or hardware entity containing one or more SIP user agents 🌸 it may also contain applications like a DHCP client 🧚
Device Provider: the entity responsible for managing a given device 👑
Local Network Provider: the entity that controls the local network a given device is connected to 🦋
SIP Service Provider: the entity providing SIP services to users 💖 this can be a private or public enterprise ✨
Profile: a configuration data set specific to an entity (e.g., user, device, local network, or other) 💜
Profile Type: a particular category of profile data (e.g., user, device, local network, or other) 🍓
Profile Delivery Server (PDS): the source of a profile 🌈 it's the logical collection of the Profile Notification Component (PNC) and the Profile Content Component (PCC) 🫶
Profile Notification Component (PNC): the logical component of a Profile Delivery Server that is responsible for enrolling devices and providing profile notifications 🔥
Profile Content Component (PCC): the logical component of a Profile Delivery Server that is responsible for storing, providing access to, and accepting profile content 💅
Profile Delivery Stages: the processes that lead a device to obtain profile data, and any subsequent changes, are collectively called profile delivery stages 🎀
Bootstrapping: bootstrapping is the process by which a new (or factory reset) device, with no configuration or minimal "factory" pre-configuration, enrolls with the PDS 😭 the device may use a temporary identity and credentials to authenticate itself so it can enroll and receive profiles, and those profiles may provide more permanent identities and credentials for future enrollments 🌸
3. Overview ✨
okay so this section is basically the bird's-eye view 🦋 it lays out the reference model, the motivation, the profile delivery stages, and how all the concepts map onto real use cases. it's meant to be a reference section, not a neat step-by-step story, so you might need to bounce back and forth between parts to really get it 💅
the whole framework is a combo of SIP event messages (SUBSCRIBE and NOTIFY; [RFC3265]) and old-school file retrieval protocols like HTTP [RFC2616] 🌸 the point is to discover, monitor, and retrieve configuration profiles. there are three profile types (local-network, device, and user) so different administrative domains can manage their own bits independently 👑
the first SUBSCRIBE for each profile lets the UA describe itself (its implementation and who is asking for the profile), and it asks for a profile by type without needing to know the profile name or location beforehand 🧚 discovery mechanisms help the UA build the Subscription URI (the Request-URI for the SIP SUBSCRIBE) 🔥 the SIP User Agent Server (UAS) handling these subscriptions is called the Profile Delivery Server (PDS) 💜
when the PDS accepts a subscription, it sends a NOTIFY to the device 🫶 that initial NOTIFY can carry the profile data itself or a reference to where the profile lives, which the device then fetches with HTTP or a similar file retrieval protocol 📦 once you're subscribed, the UA keeps getting NOTIFY messages if the profile changes later 🦋 those might contain a whole new profile, a reference to one, or just a description of the changes, depending on the Content-Type [RFC3261] the subscription is using 💅
and the framework only covers how to get the three profile types, not the data model inside them (that's out of scope for this spec, bestie 🙈)
3.1. Reference Model 🎀
the framework was built off a careful look at what a huge range of SIP deployments actually need 🌈 so the reference model is super flexible, while breaking everything down into basic interactions that get reused across lots of scenarios ✨
the reference model covers the interactions between the Profile Delivery Server (PDS) and the device 💖 the device needs profile data to work properly on the network, and the PDS is the one responding to requests and handing that data over 🧚 figure 1 shows it:
+-------------------------+
+--------+ | Profile Delivery Server |
| Device |<==========================>| +---+ +---+ |
+--------+ | |PNC| |PCC| |
| +---+ +---+ |
+-------------------------+
PNC = Profile Notification Component
PCC = Profile Content Component
Figure 1: Framework Reference Modelthe PDS is split into two logical components 🍓
- Profile Notification Component (PNC), which enrolls devices for profiles and sends profile change notifications 🔔
- Profile Content Component (PCC), which stores profile content, provides access to it, and accepts modifications to it 📚
3.2. Motivation 💜
the motivation makes more sense once you apply the reference model from Section 3.1 to two scenarios 👑 they represent the two ends of the spectrum of possible SIP deployments 🌈
first, the simplest case 🦋 a device connects through a network controlled by a single provider, who runs the local network, manages the devices, and offers services to users 💅 that provider pushes profile data to the device with everything it needs to get services on the network (including local network info and user info) ✨ figure 2 shows it, and a simple enterprise network with SIP devices is a perfect example 🎀
--------------
/ Local Network, \
| Device & Service |
\ Provider /
----------------
|
|
--------
| Device |
--------
|
|
----
|User|
----
Figure 2: Simple Deployment Modelnow the messier case 🌸 devices can connect through a local network the SIP service provider doesn't control, like public WiFi hot spots 📶 in that situation, local network providers might want to hand the devices local network info like bandwidth constraints 🧚
devices can also be controlled by device providers who are separate from the SIP service provider 🔥 think kiosks that let users access services from remote locations 🖥️ then the profile data might have to come from different sources: the local network provider, the device provider, and the SIP service provider 💀 figure 3 shows this:
--------
/ SIP \
| Service | -> Provides 'user' profile
| Provider | data (e.g., services
\ / configuration)
-------- --------
| / \
| | Device | -> Provides 'device' profile
| | Provider | data (e.g., device specifics)
| \ /
| ---------
| /
| / -------
| / / Local \
| / | Network |
| | | Provider | -> Provides 'local-network' profile
| | \ / data (e.g., bandwidth)
| | -------
| | /
| | /
| | |
===================
( Local Network )
===================
|
|
--------
| Device | -> Needs the 'local-network'
-------- and 'device' profile
/ \
/ \
------ ------
|User A| |User B| -> Users need 'user' profiles
------ ------
Figure 3: Complex Deployment Modeleither way, providers need to deliver the profile data the device needs to take part in their network 🫶 examples include the codecs that can be used and the SIP proxies to connect to for services 🎶 pre-configuring that stuff works if the device always hangs out with the same set of providers 🙌 in every other case, profile delivery has to be automated and consistent across providers 🤖 since plenty of big deployments don't want (or need) pre-configuration, a common configuration framework like the one in this document is really needed 🔥
the first model can be handled by a device pulling profile data from a single provider 💅 the second model means the device has to get profile data from several providers 😭 to cover either one, or anything in between, you need to allow profile delivery from one or more Providers 💖 the framework does this by defining multiple profile types and a set of profile delivery stages to get them 🌈 those get introduced in the subsections below ✨
3.3. Profile Types 🦋
the framework deals with different Providers by allowing multiple profile types 🎀 clients request each profile separately, and can get them from the same Provider or different ones 🧚 a deployment can also pre-configure the device to only request a subset of the specified profile types 💜 the framework specifies three basic profile types:
Local Network Profile: contains configuration data related to the local network the device is directly connected to, provided by the local network provider 🌐
Device Profile: contains configuration data related to a specific device, provided by the device provider 📱
User Profile: contains configuration data related to a specific User, reflecting that user's preferences and the particular services they're subscribed to 👑 it's provided by the SIP service provider 🫶
more profile types might get specified by future IETF work 🔮 but the data models for each profile type are out of scope for this document 🙈
3.4. Profile Delivery Stages 🌸
the framework requires a device to explicitly request profiles 💅 it also requires one or more PDSs to provide the profile data 🧚 the whole process of getting profile data (and any changes after that) breaks down into three stages, called the profile delivery stages ✨
Profile Enrollment: the process where a device requests a profile and, if that works, enrolls with a PDS that can provide it 🎫 a successful enrollment is shown by a notification carrying the profile info (either the contents or the content indirection information) 🔔 depending on the request, this might also set up a subscription to profile change notifications 💖
Profile Content Retrieval: the process where a device fetches profile contents, but only if the enrollment gave it content indirection information 📥
Profile Change Notification: the process where a device gets told about changes to a profile it's enrolled in 🦋 this can deliver modified profile data or new content indirection information 🎁
3.5. Supported Device Types 💅
the examples in this framework mostly connect devices to end users, but that's not the only kind of device that can use it 🌈 devices can be things like SIP Phones or soft clients, with or without user interfaces (the kind that allow device configuration) 📞 they can also be entities in the network that don't talk to any users directly, like gateways and media servers 🎬 or network infrastructure elements like SIP servers 🖧 the framework can be extended to work with those device types 🧩
just so you know, some of those other device types (like network elements) might also be configurable through other mechanisms 🙈 using this framework alongside those other mechanisms is out of scope for this document 🫶
4. Use Cases ✨
okay so this section is a little collection of representative use cases 🎀 it's not trying to be exhaustive, just showing how this framework can be used in SIP deployments 💅 the first one is pretty simple, and the second one is more of a glow-up, like, relatively complex 👑 the vibe is that the framework works in both scenarios, periodt 🦋
for security considerations, go check Sections 5 and 9 🔒 they are not optional reading, bestie 😭
4.1. Simple Deployment Scenario 🌸
okay picture a small private enterprise 🏢 a participating device implements this framework and has been configured, using profile data it got earlier, to request only the device profile 🎯 the device is on the same network as the PDS (so no NAT, lowkey simple 🙈) and it gets its IP configuration using DHCP 🧚 typical communication between the device and the PDS goes through one or more SIP proxies, but that's not required, so it's left out of this little illustration 💜
Figure 4 shows the sequence of events 📊 it starts with device start-up and a successful profile enrollment for the device profile, which results in device profile data ✨ then it shows how a change to that profile data gets delivered through Profile Change Notification 🔥
+----------------------+
+--------+ | Provider's Network |
| Device | | |
| | | |
+--------+ | DHCP PDS |
+----------------------+
| | |
(A) |<============== DHCP =============>| |
| |
| |
| |
(B) |<=========== Profile Enrollment ============>|
| | Profile data
| | is modified
| |
(C) |<============ Profile Change ================|
| Notification |
| |
| |
Figure 4: Use Case 1here's the breakdown of what's happening in Figure 4 🦋
- (A) 🌟 when the device starts up, it gets IP configuration parameters, like an IP address, using DHCP 💖
- (B) 🎀 the device asks for profile enrollment for the device profile 📝 if enrollment works, it gets a notification containing the device profile data 🫶
- (C) 🚨 because the device profile got modified, a profile change notification is sent over to the device, along with the modified profile 💅
4.2. Devices Supporting Multiple Users from Different Service Providers 🧚
okay this one is giving airport kiosk 🛫 a single device lets multiple users get services from different SIP service providers, like a kiosk at an airport 🌈
here's what we're assuming 👑
- Provider A is the device and local network provider for the device, AND the SIP service provider for user A 💅 Provider B is the SIP service provider for user B 🦋
- profile enrollment always results in content indirection information that requires profile content retrieval 📦
- communication between the device and the PDSs is facilitated via one or more SIP proxies (only one is shown in the illustration) 🌸
Figure 5 shows the use case and highlights the communications that matter for the framework in this document 📊
User User
A B +----------------------+ +----------------------+
+--------+ | Provider | | Provider |
| Device | | A | | B |
| | | | | |
+--------+ | DHCP PROXY PDS | | PROXY PDS |
+----------------------+ +----------------------+
| | | | | |
(A) |<====DHCP====>| | | | |
| | | | |
| | | | |
| Profile Enrollment | | | |
(B) |<local-network profile>|<====>| | |
|
| <<Profile content retrieval>>
|
|
| Profile Enrollment | | | |
(C) |<== device profile ==> |<====>| | |
|
| <<Profile content retrieval>>
|
.
.
.
| Profile Enrollment | | | |
(D) |<= user profile (A) => |<====>| | |
| | | | |
|
| <<Profile content retrieval>>
.
[[User A obtains services]]
.
.
.
|
| Profile Enrollment | |
(E) |<=========== user profile (B) ==========>|<=========>|
| | |
| <<Profile content retrieval>>
|
[[User B obtains services]]
Figure 5: Use Case 2here's the play-by-play for Figure 5 🎬
- (A) 🌟 on initialization, the device gets IP configuration parameters using DHCP 💫 that also hands over the local domain information, which helps with local-network profile enrollment 🏠
- (B) 🎀 the device asks for profile enrollment for the local network profile 📝 it gets an enrollment notification with content indirection information from Provider A's PDS 🔗 then the device retrieves the profile (which has useful stuff like firewall port restrictions and available bandwidth) 📶
- (C) 💖 next, the device asks for profile enrollment for the device profile 📝 it gets an enrollment notification that leads to device profile content retrieval 📦 and then the device sets up the user interface for services 🎨
- (D) 🦋 user A, who already has a service relationship with Provider A, tries to communicate through the user interface 💬 the device uses the info the user supplied (including any credential information) and requests profile enrollment for user A's profile 🔐 successful enrollment and profile content retrieval means services for user A 🎉
- (E) 🌙 at a different time, user B, who has a service relationship with Provider B, tries to communicate through the user interface 💅 it enrolls and retrieves user B's profile, and this results in services for user B 🫶
the discovery mechanisms for profile enrollment described by the framework, or the profile data themselves, can lead to outbound proxies that support devices behind NATs, using procedures specified in [RFC5626] ✨
5. Profile Delivery Framework 🔥
okay this section is where the profile delivery framework is specified 📜 it lays out the requirements for the three profile delivery stages introduced in Section 3.4 and also presents the associated security requirements 🔒 it covers things like back-off and retry mechanisms too 🔁
5.1. Profile Delivery Stages 🎀
the three profile delivery stages (enrollment, content retrieval, and change notification) apply separately to each profile type specified for use with this framework 💖 the following subsections give the requirements for each stage 💅
5.1.1. Profile Enrollment ✨
Profile enrollment is the process by means of which a device requests, and receives, profile data. Basically the device going "hi, can I have my settings pls?" 🥹 Each profile type specified in this document requires an independent enrollment request. However, a particular PDS can support enrollment for one or more profile types. 🎀
PDSs and devices MUST implement all of the three profile types. A device that has not been configured otherwise SHOULD try to obtain all the three profile types, in the order specified by this framework. The exceptions are bootstrapping when it SHOULD request the device profile type (see Section 5.3.1) or when it has been explicitly configured with a different order via mechanisms such as previously retrieved profile data or pre-configuration or manual configuration. 💅
Profile enrollment consists of the following operations, in the specified order. Let's go through them 🧚
Enrollment request transmission 📨
Profile enrollment is initiated when the device transmits a SIP SUBSCRIBE request [RFC3265] for the 'ua-profile' event package, specified in Section 6. The profile being requested is indicated using the 'profile-type' parameter. The device MUST transmit the SIP SUBSCRIBE message via configured outbound proxies for the destination domain, or in accordance with RFC 3263 [RFC3263].
The device needs certain data to create an enrollment request, form a Request-URI, and authenticate to the network. This includes the profile provider's domain name and device or user identities and credentials. Such data can be "configured" during device manufacturing, by the user, or via profile data enrollment (see Section 5.3.1). The data can also be "discovered" using the procedures specified by this framework. The "discovered" data can be retained across device resets (but not across factory resets) and such data is referred to as "cached". Thus, data can be configured, discovered, or cached. The following requirements apply. 🫶
- If the device is configured with a specific domain name (for the local network provider or device provider), it MUST NOT attempt "discovery" of the domain name. This is the case when the device is pre-configured (e.g., via a user interface) to be managed by specific entities. 🙅♀️
- The device MUST only use data associated with the provider's domain in an enrollment request. As an example, when the device is requesting a local-network profile in the domain
'example.net', it cannot present a user Address of Record (AoR) associated with the local domain'example.com'. 💀 - The device SHOULD adhere to the following order of data usage: configured, cached, and discovered. An exception is when the device is explicitly configured to use a different order. ✨
Upon failure to obtain the profile using any methods specified in this framework, the device MAY provide a user interface to allow for user intervention. This can result in temporary, one-time data to bootstrap the device. Such temporary data is not considered to be "configured" and SHOULD NOT be cached across resets. The configuration obtained using such data MAY provide the configuration data required for the device to continue functioning normally. 🌸
Devices attempting enrollment MUST comply with the SIP-specific event notification specified in [RFC3265], the event package requirements specified in Section 6.2, and the security requirements specified in Section 5.2. 🔥
Enrollment request admittance 🚪
A PDS or a SIP proxy will receive a transmitted enrollment request. If a SIP infrastructure element receives the request, it will relay it to the authoritative proxy for the domain indicated in the Request-URI (the same way it would handle any other SUBSCRIBE message). The authoritative proxy is required to examine the request (e.g., event package) and transmit it to a PDS capable of addressing the profile enrollment request. 🦋
A PDS receiving the enrollment request SHOULD respond to the request, or proxy it to a PDS that can respond. An exception to responding or proxying the request is when a policy prevents response (e.g., recognition of a denial-of-service (DoS) attack, an invalid device, etc.). The PDS then verifies the identity presented in the request and performs any necessary authentication. Once authentication is successful, the PDS MUST either admit or reject the enrollment request, based on applicable authorization policies. A PDS admitting the enrollment request indicates it via a 2xx-class response, as specified in [RFC3265]. 👑
Refer to Sections 6.6 and 5.2 for more information on subscription request handling and security requirements, respectively. 📚
Enrollment request acceptance 🎉
A PDS that admits the enrollment request verifies applicable policies, identifies the requested profile data and prepares a SIP NOTIFY message to the device. Such a notification can either contain the profile data or contain content indirection information that results in the device performing profile content retrieval. The PDS then transmits the prepared SIP notification. When the device successfully receives and accepts the SIP notification, profile enrollment is complete. 🥳
When it receives the SIP NOTIFY message, indicating successful profile enrollment, the device SHOULD make the new profile effective within the specified time frame, as described in Section 6.2. The exception is when the profile data is delivered via content indirection, and the device cannot obtain the profile data within the specified time frame. ⏰
Once profile enrollment is successful, the PDS MUST consider the device enrolled for the specific profile, for the duration of the subscription. 🎀
5.1.2. Content Retrieval 📥
A successful profile enrollment leads to an initial SIP notification, and may result in subsequent change notifications. Each of these notifications can either contain profile data or content indirection information. If it contains content indirection information, the device is required to retrieve the profile data using the specified content retrieval protocols. This process is termed "profile content retrieval". For information regarding the use of the SIP NOTIFY message body, please refer to Section 6.5. 🍓
Devices and PDSs implementing this framework MUST implement two content retrieval protocols: HTTP and HTTPS, as specified in [RFC2616] and [RFC2818], respectively. Future enhancements or usage of this framework may specify additional or alternative content retrieval protocols. For security requirements and considerations, please refer to Section 5.2. 🔐
5.1.3. Change Notification 🔔
Profile data can change over time. Changes can be initiated by various entities (e.g., via the device, back-office components, and end-user web interfaces) and for various reasons (e.g., change in user preferences and modifications to services). Profiles may also be shared by multiple devices simultaneously. When a profile is changed, the PDS MUST inform all the devices currently enrolled for the specific profile. This process of informing a device of any changes to the profile that it is currently enrolled for is termed change notification. 📣
The PDS provides change notification using a SIP notification (the SIP NOTIFY message, as specified in [RFC3265]). The SIP notification may provide the changes, a revised profile, or content indirection, which contains a pointer to the revised data. When a device successfully receives a profile change notification for an enrolled profile, it MUST act upon the changes prior to the expiration of the 'effective-by' parameter. 🌈
For NOTIFY content, please refer to Section 6.5. 💜
5.1.4. Enrollment Data and Caching 🗂️
The requirements for the contents of the SIP SUBSCRIBE used to request profile enrollment are described in this section. The data required can be configured, cached, or discovered -- depending on the profile type. If the data is not configured, the device MUST use relevant cached data or proceed with data discovery. This section describes the requirements for creating a SIP SUBSCRIBE for enrollment, the caching requirements and how data can be discovered. 🧠
5.1.4.1. Local-Network Profile 🏠
okay so, to make a Subscription URI for the local-network profile, a device needs the local network domain name, the device identifier, and optionally a user AoR with credentials (if one is configured) 💅. Since the device could get initialized in a totally different local network each time, it SHOULD NOT cache the local network domain, the SIP Subscription URI, or the local-network profile data across resets 🙈. The exception is when the device can confirm it's been reinitialized in the same network (using means outside the scope of this document) ✨. So in most cases the device has to discover the local network domain name. It does this by establishing IP connectivity in the local network (like via DHCP or pre-configured IP information) 🌐. Once that's up, the device MUST attempt to use the local network domain obtained via pre-configuration, if there is one. If it isn't pre-configured, it MUST employ dynamic discovery using DHCPv4 ([RFC2132], Domain Name option) or DHCPv6 ([RFC4704]). Once the local network domain is obtained, the device creates the SIP SUBSCRIBE for enrollment as described below 🦋
- The device MUST NOT populate the user part of the Request-URI. The device MUST set the host portion of the Request-URI to the dot-separated concatenation of
"_sipuaconfig"and the local network domain (see example below) 🎀 - If the device has been configured with a user AoR for the local network domain (verified as explained in Section 5.2), the device MUST use it to populate the From field, unless it's configured not to (due to privacy concerns, for example). Otherwise, the device MUST set the From field to a value of
"anonymous@anonymous.invalid"🫶 - The device MUST include the
+sip.instanceparameter within the Contact header, as specified in [RFC5626]. The device MUST ensure that the value of this parameter is the same as the one included in any subsequent profile enrollment request 🔥
For example, if the device requested and received the local domain name via DHCP to be airport.example.net, then the local-network profile SUBSCRIBE Request-URI would look like this:
sip:_sipuaconfig.airport.example.netThe local-network profile SUBSCRIBE Request-URI doesn't have a user part, so the URI stays distinct between the "local" and "device" URIs when the domain is the same for both. This gives a means of routing to the appropriate PDS in domains where there are distinct servers 🧚
The From field is populated with the user AoR, if available. This lets the local network provider propagate user-specific profile data, if there is any 💜. The +sip.instance parameter within the Contact header is set to the device identifier, or specifically, the SIP UA instance. Even though every device may get the same (or similar) local-network profile, the uniqueness of the +sip.instance parameter is an important capability. Having unique instance ID fields lets the management of the local network track devices present in the network and, consequently, manage resources such as bandwidth allocation 📶
5.1.4.2. Device Profile Type 📱
Once associated with a device, the device provider isn't expected to change often. So the device is allowed to, and SHOULD, cache the Subscription URI for the device profile upon successful enrollment ✨. The exceptions are when the device identifier has changed (e.g., new network card), the device provider information has changed (e.g., a user-initiated change), or the device can't obtain its profile using the Subscription URI 🙃. So, when one is available, the device MUST use a cached Subscription URI. If no cached URI is available, then it needs to create a Subscription URI. To create one, the device needs a device identity and the device provider's domain name. Unless it's already configured, the device needs to discover that info and form the Subscription URI. In those cases, the following requirements apply for creating a Subscription URI for requesting the device profile 📝
- The device MUST populate the user part of the Request-URI with the device identifier. The device MUST set the host portion of the Request-URI to the domain name of the device provider. The device identifier format is explained in detail later in this section 🌸
- The device MUST set the From field to a value of
anonymous@<device provider's domain>🫣 - The device MUST include the
"+sip.instance"parameter within the Contact header, as specified in [RFC5626]. The device MUST use the same value as the one presented while requesting the local-network profile 💖
Note that the discovered AoR for the Request-URI can be overridden by a special, provisioned AoR that's unique to the device. In that case, the provisioned AoR is used to form the Request-URI and to populate the From field 🎯
If the device isn't configured with an AoR and needs a domain name to populate the Request-URI and the From field, it can either use a configured domain name (if available) or discover one. The discovery options are described below. The device MUST use the results of each successful discovery process for one enrollment attempt, in the order specified below 👑
- Option 1: Devices that support DHCP MUST attempt to obtain the domain name of the outbound proxy during the DHCP process, using the DHCP option for SIP servers defined in [RFC3361] or [RFC3319] (for IPv4 and IPv6, respectively) 🛰️
- Option 2: Devices that support DHCP MUST attempt to obtain the local IP network domain during the DHCP process (refer to [RFC2132] and [RFC4704]) 🗺️
- Option 3: Devices MUST use the local network domain name (configured or discovered to retrieve the local-network profile), prefixing it with the label
"_sipuaconfig"🏷️
If the device needs to create a Subscription URI and needs to use its device identifier, it MUST use the UUID-based (Universally Unique Identifier) URN representation as specified in [RFC4122]. The following requirements apply 🔐
- When the device has a non-alterable Media Access Control (MAC) address, it SHOULD use the version 1 UUID representation, with the timestamp and clock sequence bits set to a value of
'0'. This allows for easy recognition and uniqueness of MAC-address-based UUIDs. The exception is when the device supports independent device configuration for more than one SIP UA, for example multiple SIP UAs on the same platform 🧩 - If the device can't use a non-alterable device identifier, it SHOULD use an alternative non-alterable device identifier. For example, the International Mobile Equipment Identity (IMEI) for mobile devices 📲
- If the device can't use a non-alterable MAC address, it MUST use the same approach as defining a user agent instance ID in [RFC5626] 🦄
- Note: when the URN is used as the user part of the Request-URI, it MUST be URL escaped, since the colon (":") isn't a legal character in the user part of an addr-spec ([RFC4122]), so it must be escaped 🙈
For example, the instance ID:
urn:uuid:f81d4fae-7ced-11d0-a765-00a0c91e6bf6@example.comwould be escaped to look as follows in a URI:
sip:urn%3auuid%3af81d4fae-7ced-11d0-a765-00a0c91e6bf6@example.comThe ABNF ([RFC5234]) for the UUID representation is provided in [RFC4122] 📚
5.1.4.3. User Profile Type 🙋♀️
To create a Subscription URI to request the user profile on behalf of a user, the device needs to know the user's AoR. This can be configured statically or dynamically on the device (e.g., through user input, or propagated as part of the device profile) ⭐. Just like device profiles, the content and propagation of user profiles may differ based on deployment scenarios (i.e., users belonging to the same domain may -- or may not -- be given the same profile). To create a Subscription URI, the following rules apply 🌈
- The device MUST set the Request-URI to the user AoR 🎯
- The device MUST populate the From field with the user AoR 💅
An authoritative SIP proxy for a SIP provider's network that receives a profile enrollment request for the user profile type will route based on the Event Header field values. That means a subscription to the user's AoR gets routed to the appropriate PDS 🧭
5.2. Securing Profile Delivery 🔐
Profile data can contain sensitive info that needs to be secured, like identities and credentials 🥺. Security involves authentication, data integrity, and data confidentiality. Authentication is the process of verifying that an entity is who it claims to be, like a user AoR presented during profile enrollment 🕵️♀️. Message integrity gives you the assurance that the message contents sent between two entities (like the PDS and the device) haven't been modified in transit. Privacy means the message contents haven't been monitored by unwanted elements in transit 👀. Authentication and data integrity are required to make sure the profile contents were received by a valid entity, from a valid source, and without any modifications in transit. For profiles that contain sensitive data, data confidentiality is also required 💜
For an overview of potential security threats, refer to Section 9. For info on how the device can be configured with identities and credentials, refer to Section 5.3.1. The following subsections provide the security requirements for each profile delivery stage, and they apply to each of the profile types specified by this framework 🫶
5.2.1. Securing Profile Enrollment ✨
okay so profile enrollment can hand over sensitive profile data 🔒 and that's a whole vibe. in those cases the PDS MUST authenticate the device 💅, except during the bootstrapping scenario when the device doesn't have existing credentials yet (see Section 5.3.1 for more on bootstrapping). and the device MUST authenticate the PDS too, so it knows it's getting sensitive stuff from a valid PDS 🫶
to authenticate a device that's been set up with identities and credentials (Section 5.3.1), and that supports profiles with sensitive profile data (see Section 5.3.3), devices and PDSs MUST support digest authentication over Transport Layer Security (TLS), as specified in [RFC3261] 🎀. future enhancements might add other methods, like authentication with X.509 certificates. for the device to authenticate the PDS, the device MUST mutually authenticate with the PDS during digest authentication. so the device challenges the PDS, and the PDS responds with the Authorization header 🦋. sending sensitive profile data also needs data integrity, and that can be handled by configuring the device with a Session Initiation Protocol Secure (SIPS) URI, or by making sure the discovery process during profile enrollment gives it one. the result is TLS establishment ([RFC5246]) 🔐. TLS also stops offline dictionary attacks when digest authentication is in use. so honestly, without TLS, the device MUST NOT respond to any authentication challenges 🙈 it's to be noted that the digest credentials used for getting profile data through this framework may or may not be the same as the ones used for SIP registration (see Section 5.3.1). also, while [RFC3261] considers MD5 a reasonable choice for computing the hash (and that may have been true when it was published), implementers are recommended to use stronger options like SHA-256. check out [FIPS-180-3] and [RFC4634] for more on SHA-256 🌈
when the PDS challenges a profile enrollment request and the device fails, the PDS MAY refuse enrollment, or it can give profile data without the user-specific information (for example, to bootstrap a device as described in Section 5.3.1) 🧚 if the device challenges but fails to authenticate the PDS, it MUST reject the initial notification and retry the profile enrollment process. if the device is configured with a SIPS URI (or discovers one) but TLS establishment fails because the next-hop SIP entity doesn't support TLS, the device SHOULD try the other resolved next-hop SIP entities 🔄 when the device does establish TLS with the next-hop entity, it MUST use the procedures in [RFC2818], Section 3.1, for authentication. the one exception is when it doesn't have any configured info to do that, like a certification authority (CA) certificate, which is the case before bootstrapping. the 'Server Identity' for authentication is always the domain of the next-hop SIP entity 💖 if the device tries validation and it fails, it MUST reject the initial notification and retry profile enrollment. and if there's no SIPS URI for the device and no mechanism for mutual authentication, the PDS MUST NOT present any sensitive profile data in the initial notification, unless the device is being bootstrapped. it MAY still use content indirection to send sensitive profile data 🍓
when a device is being given bootstrapping profile data inside the notification, and that data has sensitive information in it, the SIP Identity header SHOULD be used, as specified in [RFC4474] 👑 this helps with devices that MAY be pre-configured with certificates to validate bootstrapping sources (like a list of allowed domain certificates, or a list of root CA certificates using Public Key Infrastructure (PKI)). when the SIP Identity header is used, the PDS MUST set the host portion of the AoR in the From header to the Provider's domain (the user portion is an entity-specific identifier). and if the device can validate the SIP Identity and that fails, it MUST reject the bootstrapping profile data 🚫
5.2.2. Securing Content Retrieval ✨
the initial or change notifications after a successful enrollment can give a device the requested profile data, or use content indirection to point it at a PCC that can provide the profile data 🎁 this document specifies HTTP and HTTPS as content retrieval protocols.
if the profile comes through content indirection and has sensitive profile data, the PDS MUST use an HTTPS URI for content indirection 🔒 PCCs and devices MUST NOT use HTTP for sensitive profile data, except when bootstrapping a device via the device profile. a device MUST authenticate the PCC as specified in [RFC2818], Section 3.1 💅 a device being given profile data that has sensitive data MUST be authenticated using digest authentication as specified in [RFC2617], with the one exception of a device being bootstrapped for the first time via the device profile. the resulting TLS channel also gives you data integrity and data confidentiality, so it's literally giving security 🛡️
5.2.3. Securing Change Notification ✨
if the device requested enrollment through a SIP subscription with a non-zero 'Expires' parameter, that can also lead to change notifications for the length of the subscription 📬 for change notifications with sensitive profile data, this framework RECOMMENDS using the SIP Identity header as specified in [RFC4474] 💜 when the SIP Identity header is used, the PDS MUST set the host portion of the AoR in the From header to the Provider's domain (the user portion is an entity-specific identifier). this also gives you header and body integrity 🙌 however, for sensitive profile data that needs data confidentiality, if the contact URI the NOTIFY request is going to isn't SIPS, the PDS MUST use content indirection. and the PDS MUST also use content indirection for notifications with sensitive profile data when the profile enrollment wasn't authenticated 🔐
5.3. Additional Considerations 🌸
this section covers the extra considerations, like how a device gets its identities and credentials, back-off and retry methods, guidelines on profile data, and extra profile types 🧚
5.3.1. Bootstrapping Identities and Credentials ✨
when a device requests a profile, the profile delivery server will likely require it to provide an identity (a user AoR) and associated credentials for authentication 🪪 during this process (like digest authentication), the PDS is also required to show its knowledge of the credentials, so mutual authentication happens (see Section 5.2.1). for mutual authentication with the PDS, the device needs to be given the necessary identities and credentials (like a username/password or certificates). this is done through bootstrapping. for a discussion of the security considerations for bootstrapping, see Section 9.2 🎀
bootstrapping a device with the required identities and credentials can be done in one of the following ways:
- Pre-configuration: the device may be pre-configured with identities and associated credentials, like a user AoR and digest password 🍓
- Out-of-band methods: a device or Provider may provide hardware- or software-based credentials, such as Subscriber Identity Module (SIM) cards or Universal Serial Bus (USB) drives 💾
- End-user interface: the end-user may be given the necessary identities and credentials. the end-user can then configure the device using a user interface, or present them when required (like on an IM login screen) 📱
- Using this framework: when a device is initialized, even with no pre-configured info, it can request the local-network and device profiles. for bootstrapping purposes, this framework recommends that the device profile provide one of the following to bootstrap the device:
- profile data that lets the end-user talk to the device provider or SIP service provider using non-SIP methods. for example, the profile data can send the end-user to a web portal to get a subscription. once they get a successful subscription, the end-user or the device can be given the necessary identities and credentials 💻
- content indirection information pointing to a PCC that can provide identities and credentials. for example, picture a device with an X.509 certificate that the PCC can authenticate. in that case, the PCC can use HTTPS to provide identities and associated credentials 🔑
- profile data containing identities and credentials that can be used to bootstrap the device (see Section 5.3.3 for profile data recommendations). this can be used when the device is initialized for the first time, or after a factory reset. this can be considered only when the device is initialized in the Provider's network, for obvious security reasons 🙈
for interoperability, this framework requires PDSs and devices to support the last option above, which is to use this framework. specifically, providing identities and credentials via the profile data MUST be supported ✨
also, AoRs are typically known by the PDSs that serve the domain the AoR indicates, so devices can only present the configured AoRs in their respective domains 🗺️ the exception is federated identities, which let a device use a user's AoR in multiple domains. even within the same domain, the device's domain proxy and the PDS may be in two different realms, so they may be linked to different digest authentication credentials. in those cases, multiple credentials may be configured and linked to the realms where they're used 🌈 this framework specifies only digest authentication for profile enrollment, and the device isn't expected to contain any other credentials. for profile retrieval through content indirection, the device will need to support additional credentials, like X.509 certificates (for TLS). future enhancements can specify additional credential types for profile enrollment and retrieval 🦋
5.3.2. Profile Enrollment Request Attempt ✨
Okay, so this part is about how a device actually tries to enroll for a profile, and it's giving full state machine energy 🧚. A state diagram for a device requesting any specific profile defined by this framework is shown in Figure 6 💖
+------------+
| Initialize |
+-----+------+
|
|
V
+-------------+
| Prepare |
+--------->| Enrollment |<------------------+
| | Request | |
| +------+------+ |
+------+------+ | |
| Failure | Enroll. Req. prepared |
+-->| Handling & | /Send Req |
| | Delay | | |
| +-------------+ V |
| ^ ^ +-------------+ |
| | | | Await | |
| | +--------+ Enrollment | |
| | Timeout, | acceptance | |
| | non-2xx/- +------+------+ |
| | | |
| Timeout 200 OK/- Enrollment
| /Terminate | Timeout/-
| Enrollment V |
| | +--------------+ |
| | | Enrollment | |
| +------------+ accepted | |
Retries Exceeded |(await NOTIFY)| |
/Retry Enrollment +---+------+---+ |
| | | |
| | | |
| NOTIFY w. Content Ind| | NOTIFY w. Profile |
| /Retrieve Profile | | /Accept Profile |
| +------------+ +------------+ |
| | | |
| V V |
| +------------+ +------------+ |
+-----+ Retrieving | Retrieved | Enrollment +---+
,->| Profile +--/Apply Profile-->| Successful |
/ | | |(monitoring)|<--.
Timeout +--+---------+ +--+----+----+ :
/Retry ; ^ | : ;
`------' | NOTIFY w. Cont.Ind | `-------'
+---/Retrieve Profile-----+ NOTIFY w. Profile
/Apply Profile
Figure 6: Device State DiagramAs a little reminder 🎀:
- The timeout for SIP messages is specified by [RFC3261]. In the cases where this is not specified, such as the timeout to wait for the initial notification during profile enrollment, it is left to device implementations or future protocol enhancements.
- The timeout for profile retrieval using content indirection will be as specified by profile retrieval protocols employed. If none exists, it is left to device implementations.
In addition, since profile enrollment is a process unique to this framework, the device MUST follow the enrollment attempt along with exponential back-off and retry mechanisms as indicated in Figure 7. Non-negotiable, bestie 💅
Function for Profile Enrollment ()
Init Function: Iteration i=0
Loop 1: Attempt
Loop 2: For each SIP Subscription URI
Loop 3: For each next-hop SIP entity
- Prepare and transmit Enrollment Request
- Await Enrollment Acceptance and initial NOTIFY
+ If the profile enrollment is successful
= Exit this function()
+ If profile enrollment fails due to an explicit
failure or a timeout as specified in [RFC3261]
= Continue with the next-hop SIP entity (Loop 3)
End Loop: Loop 3
End Loop: Loop 2
(Note: If you are here, profile enrollment did not succeed)
+ Is any valid cached profile data available?
= If yes, use it and continue with Loop 1
+ If the enrollment request is for a non-mandatory profile
= Start profile enrollment for the next profile,
if applicable
- Delay for 2^i*(64*T1); -- this is exponential back-off
- increment i;
- If i>8, reset i=8;
End loop: Loop 1
End Function()
Figure 7: Profile Enrollment Attempt (Pseudo-Code)The pseudo-code above (Figure 7) allows for cached profiles to be used 💜 However, any cached local-network profile MUST NOT be used unless the device can ensure that it is in the same local network that provided the cached data. This framework does not provide any procedures for local network recognition, so that part's on the device 🙈 Any cached device and user profiles MUST only be used in domains with which they are associated. For example, a cached device profile is used only when the associated domain matches the current device provider's domain.
If a PDS wants to invalidate a profile, it may do so by transmitting a NOTIFY with an 'empty profile', i.e., profile instance without any included data (if supported by the profile data model; not to be confused with an empty NOTIFY), or via an explicit profile data element that invalidates the data. A device receiving such a NOTIFY MUST discard the applicable profile (i.e., it cannot even store it in the cache). Additionally, if a factory reset is available and performed on a device, it MUST reset the device to its initial state prior to any configuration. Specifically, the device MUST set the device back to the state when it was originally distributed. Fresh start, no cap 🌸
The order of profile enrollment is important, so don't mix this up! For the profiles specified in this framework, the device MUST enroll in the following default order: local network, device, and user. The pseudo-code presented earlier (Figure 7) differentiates between 'mandatory' and 'non-mandatory' profiles. This distinction is left to profile data definitions.
It is to be noted that this framework does not allow the devices to inform the PDSs of profile retrieval errors such as invalid data. Follow-on standardization activities are expected to address this feature 🦋
5.3.3. Profile Data ✨
This framework does not specify the contents for any profile type. Follow-on standardization activities are expected to address profile contents. However, the framework provides the following requirements and recommendations for profile data definitions, and honestly these are the vibes 🫶
- The device profile type SHOULD specify parameters to configure the identities and credentials for use in scenarios such as bootstrapping (see Section 5.3.1) and run-time modifications to identities and credentials. This framework recommends the device profile provide the identities and credentials due to a couple of reasons. The local-network profile may not always be available, and even if present, may not be controlled by the device provider who controls device configuration to provide services. Further, the device may not have any users configured prior to being bootstrapped, resulting in an absence of user profile requests.
However, this framework does not prevent other profile types from providing identities and credentials to meet deployment needs. For example, the user profile can contain identities and credentials for communicating with specific applications.
- Each profile MUST clearly identify if it may contain any sensitive data. Such profiles MUST also identify the data elements that are considered sensitive, i.e., data that cannot be disclosed to unauthorized parties. As an example, a device profile definition may identify itself as containing sensitive data and indicate data such as device credentials to be sensitive. Keep the secrets secret 🤫
- When the device receives multiple profiles, the contents of each profile type SHOULD only contain data relevant to the entity it represents. As an example, consider a device that obtains all the defined profiles. Information pertaining to the local network is contained in the 'local-network' profile and not the 'user' profile. This does not preclude relevant data about a different entity from being included in a profile type, e.g., the 'device' profile type may contain information about the users allowed to access services via the device. A profile may also contain starting information to obtain subsequent profiles.
- Data overlap SHOULD be avoided across profile types, unless necessary. If data overlap is present, prioritization of the data is left to data definitions. As an example, the device profile may contain the list of codecs to be used by the device and the user profile (for a user on the device) may contain the codecs preferred by the user. Thus, the same data (usable codecs) is present in two profiles. However, the data definitions may indicate that, to function effectively, any codec chosen for communication needs to be present in both the profiles. Codec drama, but make it organised 🎧
5.3.4. Profile Data Frameworks ✨
The framework specified in this document does not address profile data representation, storage, or retrieval protocols. It assumes that the PDS has a PCC based on existing or other Profile Data Frameworks.
While this framework does not impose specific constraints on any such framework, it does allow for the propagation of profile content to the PDS (specifically the PCC). Thus, Profile Data Frameworks or retrieval frameworks used in conjunction with this framework MAY consider techniques for propagating incremental, atomic changes to the PDS. One means for propagating changes to a PDS is XML Configuration Access Protocol (XCAP) ([RFC4825]). Config updates, but make them ✨atomic✨
5.3.5. Additional Profile Types ✨
This document specifies three profile types: local-network, device, and user. However, there may be use cases for additional profile types, e.g., profile types for application specific profile data or to provide enterprise-specific policies. Definition of such additional profile types is not prohibited, but considered out of scope for this document. Such profile definitions MUST specify the order of retrieval with respect to all the other profiles such as the local-network, device, and user profile types defined in this document. So if you add a new profile type, you have to say where it goes in the line-up 👑
5.3.6. Deployment Considerations ✨
okay so this framework was designed with real-world deployments in mind, bestie 🧚 here are some of the big considerations it was built to handle:
Provider relationships:
- The local network provider and the SIP service provider can often be different entities, with no administrative or business relationship with each other. 🏢 they can be totally separate companies that have zero connection to each other!
- There may be multiple SIP service providers involved, one for each service to which a user subscribes (telephony service, instant messaging, etc.). this framework doesn't spell out explicit behavior for that scenario, but it doesn't prohibit it either 🙈
- Each user accessing services via the same device may subscribe to different sets of services, from different service providers. 💅
User-device relationship:
- The relationship between devices and users can be many-to-many (e.g., a particular device may allow for many users to obtain subscription services through it, and individual users may have access to multiple devices). it's giving group project energy 🫶
- Each user may have different preferences for use of services, and presentation of those services in the device user interface. ✨
- Each user may have different personal information applicable to use of the device, either as related to particular services, or independent of them. 🎀
5.4. Support for NATs 🌸
okay, so PDSs that support devices behind NATs, and devices that can be behind NATs, can use the procedures specified in [RFC5626]. The Outbound proxies can be configured or discovered. Clients that support this behavior MUST include the 'outbound' option-tag in a Supported header field value, and add the "ob" parameter, as specified in [RFC5626], within the SIP SUBSCRIBE for profile enrollment. no skipping this part, it's a must-have 🔥
6. Event Package Definition 🎀
the framework in this document proposes and specifies a brand new SIP event package, which [RFC3265] allows. the whole point is that devices can subscribe to specific profile types with PDSs, and the PDSs can notify the devices with the profile data or content indirection information. main character energy 👑
The requirements specified in [RFC3265] apply to this package. The following subsections specify the event package description and the associated requirements. The framework requirements are defined in Section 5.
6.1. Event Package Name 🦋
The name of this package is "ua-profile". This value appears in the Event header field present in SUBSCRIBE and NOTIFY requests for this package, as defined in [RFC3265].
6.2. Event Package Parameters 💜
this package defines the following new parameters for the event header:
"profile-type", "vendor", "model", "version", and "effective-by"
the rules that apply:
- All the new parameters, with the exception of the "effective-by" parameter, MUST only be used in
SUBSCRIBErequests and ignored if they appear inNOTIFYrequests. - The "effective-by" parameter is for use in
NOTIFYrequests only and MUST be ignored if it appears inSUBSCRIBErequests.
the semantics of these new parameters are specified in the following subsections. 🧚
6.2.1. "profile-type" Parameter 🌈
The "profile-type" parameter is used to indicate the token name of the profile type the user agent wants to obtain, and to be notified of later changes. This document defines three logical types of profiles and their token names. They are as follows:
- local-network: specifying the "local-network" type profile means you want profile data, and potentially profile change notifications, specific to the local network. 🌐
- device: specifying the "device" type profile(s) means you want the profile data, and potentially profile change notifications, that are specific to the device or user agent. 📱
- user: specifying the "user" type profile means you want the profile data, and potentially profile change notifications, specific to the user. 👤
The profile type is identified in the Event header parameter: "profile-type". A separate SUBSCRIBE dialog is used for each profile type. So the subscription dialog a NOTIFY arrives on tells you which profile's data is contained in, or referred to by, the NOTIFY message body. The Accept header of the SUBSCRIBE request MUST include the MIME types for all profile content types for which the subscribing user agent wishes to retrieve profiles, or receive change notifications. 💖
In the following syntax definition using ABNF, EQUAL and token are defined in [RFC3261]. It is to be noted that additional profile types may be defined in subsequent documents. ✨
Profile-type = "profile-type" EQUAL profile-value
profile-value = profile-types / token
profile-types = "device" / "user" / "local-network"The "device", "user", or "local-network" token in the profile-type parameter may represent a class or set of profile properties. Follow-on standards that define specific profile contents may find it desirable to define additional tokens for the profile-type parameter. Also, additional content types may be defined along with the profile formats that can be used in the Accept header of the SUBSCRIBE to filter or indicate which data sets of the profile are desired. 🍓
6.2.2. "vendor", "model", and "version" Parameters 🎀
The "vendor", "model", and "version" parameter values are tokens specified by the implementer of the user agent. These parameters MUST be provided in the SUBSCRIBE request for all profile types. The implementer SHOULD use their DNS domain name (e.g., example.com) as the value of the "vendor" parameter so that it is known to be unique, unless there is a good reason not to. Examples of exceptions include: if the vendor does not have an assigned DNS domain name, or if they are using a different vendor's implementation, etc. These parameters are useful to the PDS for affecting the profiles provided. In some scenarios, it is desirable to provide different profiles based upon these parameters. For example, feature property X in a profile may work differently on two versions of the same user agent. This gives the PDS the ability to compensate for those differences, or take advantage of them. 🧠
In the following ABNF defining the syntax, EQUAL and quoted-string are defined in [RFC3261].
Vendor = "vendor" EQUAL quoted-string
Model = "model" EQUAL quoted-string
Version = "version" EQUAL quoted-string6.2.3. "effective-by" Parameter ⭐
The "effective-by" parameter in the Event header of the NOTIFY request specifies the maximum number of seconds before the user agent MUST attempt to make the new profile effective. The "effective-by" parameter MAY be provided in the NOTIFY request for any of the profile types. A value of 0 (zero) indicates that the subscribing user agent MUST attempt to make the profiles effective immediately (despite possible service interruptions). this gives the PDS the power to control exactly when the profile takes effect, which can be huge for resolving an emergency problem or disabling a user agent right now 🚨
If it is absent, the device SHOULD attempt to make the profile data effective at the earliest possible opportunity that does not disrupt any services being offered. The "effective-by" parameter is ignored in all messages other than the NOTIFY request. In the following ABNF, EQUAL and DIGIT are defined in [RFC3261].
Effective-By = "effective-by" EQUAL 1*DIGIT6.2.4. Summary of Event Parameters 📋
The following are example Event headers that may occur in SUBSCRIBE requests. These examples are not intended to be complete SUBSCRIBE requests.
Event: ua-profile;profile-type=device;
vendor="vendor.example.com";model="Z100";version="1.2.3"
Event: ua-profile;profile-type=user;
vendor="premier.example.com";model="trs8000";version="5.5"The following are example Event headers that may occur in NOTIFY requests. These example headers are not intended to be complete SUBSCRIBE requests. (yes the original says SUBSCRIBE here too, it's a little typo moment 🙈)
Event: ua-profile;effective-by=0
Event: ua-profile;effective-by=3600The following table shows the use of Event header parameters in SUBSCRIBE requests for the three profile types:
profile-type || device | user | local-network
=============================================
vendor || m | m | m
model || m | m | m
version || m | m | m
effective-by || | |
m - MUST be provided
s - SHOULD be provided
o - OPTIONAL to be providedNon-specified means that the parameter has no meaning and should be ignored. 🫠
The following table shows the use of Event header parameters in NOTIFY requests for the three profile types:
profile-type || device | user | local-network
=============================================
vendor || | |
model || | |
version || | |
effective-by || o | o | o6.3. SUBSCRIBE Bodies 🌷
This package defines no use of the SUBSCRIBE request body. If present, it SHOULD be ignored. Exceptions include future enhancements to the framework that may specify a use for the SUBSCRIBE request body. 🔮
6.4. Subscription Duration ⏳
The duration of a subscription is specific to SIP deployments, and no specific recommendation is made by this event package. If absent, a value of 86400 seconds (24 hours; 1 day) is RECOMMENDED, since the presence (or absence) of a device subscription is not time critical to the regular functioning of the PDS. chill vibes, the PDS is not stressing about it 😌
It is to be noted that a one-time fetch of a profile, without an ongoing subscription, can be done by setting the 'Expires' parameter to a value of Zero, as specified in [RFC3265]. ✨
6.5. NOTIFY Bodies 📬
The framework that specifies the event package allows the NOTIFY body to contain the profile data, or a pointer to the profile data using content indirection. For profile data delivered via content indirection, i.e., a pointer to a PCC, the Content-ID MIME header, as described in [RFC4483], MUST be used for each profile document URI. At a minimum, the "http:" [RFC2616] and "https:" [RFC2818] URI schemes MUST be supported. Other URI schemes MAY be supported based on the Profile Data Frameworks (examples include FTP [RFC0959], Lightweight Directory Access Protocol (LDAP) [RFC4510], and XCAP [RFC4825] ). 🌐
A non-empty NOTIFY body MUST include a MIME type specified in theAcceptheader of theSUBSCRIBE. Further, if theAcceptheader of theSUBSCRIBEincluded the MIME type message/external-body (indicating support for content indirection), then the PDS MAY use content indirection in the NOTIFY body for providing the profiles. 🫶
6.6. Notifier Processing of SUBSCRIBE Requests
okay so when a SUBSCRIBE goes through, the Notifier sends back a NOTIFY that has either the profile contents or a pointer to them (that's content indirection 🔗). The SUBSCRIBE SHOULD be authenticated or sent over an integrity protected SIP communications channel 🔐. The exceptions are when the Subscriber's identity is unknown and the Notifier is set up to accept those requests anyway 🙈
The Notifier MAY also authenticate SUBSCRIBE messages even when the NOTIFY is only going to hold a pointer to profile data ✨ How the data sent through content indirection gets secured is covered in Section 9 🛡️
If the profile type named in the "profile-type" Event header parameter is unavailable, or the Notifier is configured not to provide it, the Notifier SHOULD return a 404 response to the SUBSCRIBE request 💀 If the specific user or device is unknown, the Notifier MAY accept the subscription. Otherwise it may reject it with a 403 response 🚫
6.7. Notifier Generation of NOTIFY Requests
As specified in [RFC3265], the Notifier MUST always send a NOTIFY request upon accepting a subscription 📬 If the device or user is unknown and the Notifier decides to accept the subscription anyway, the Notifier MAY either respond with profile data (like default profile data) or provide no profile information at all, which is an empty NOTIFY 🫧
If the identity in the From header of the SUBSCRIBE is a known identity, and the requested profile information is available (as in the "profile-type" parameter of the Event header), the Notifier SHOULD send a NOTIFY with profile data 💖 Profile data MAY be sent as profile contents, or via content indirection if the content indirection MIME type was included in the Accept header 🎀 The Notifier MUST NOT use any scheme that wasn't indicated in the "schemes" Contact header field. Not me using a mystery scheme 🙅♀️
The Notifier MAY say when the new profiles must be made effective by the Subscriber, by giving a maximum time in seconds (zero or more) in the "effective-by" Event header parameter ⏰
If the SUBSCRIBE came in over an integrity protected SIP communications channel, the Notifier SHOULD send the NOTIFY back over that same channel 🔁
6.8. Subscriber Processing of NOTIFY Requests
A Subscriber to this event package MUST follow the NOTIFY request processing behavior specified in [RFC3265] 📖 If the Notifier gave an effective time (using the "effective-by" Event header parameter), the Subscriber SHOULD try to make the profiles effective within that time ⏱️ The exceptions are deployments that prohibit this in certain cases, like when emergency sessions are in progress 🚨 When profile data can't be applied within the recommended time frame and that affects device behavior, any actions to be taken SHOULD be defined by the profile data definitions. By default, the Subscriber is RECOMMENDED to make the profiles effective as soon as possible ✨
When accepting content indirection, the Subscriber MUST always support "http:" or "https:" and be ready to accept NOTIFY messages with those URI schemes 🌐 If the Subscriber wants to support alternative URI schemes, each MUST be indicated in the "schemes" Contact header field parameter, as defined in [RFC4483] 🧩 The Subscriber MUST also be prepared to receive a NOTIFY request with no body. The subscriber MUST NOT reject a NOTIFY request with no body 🙅♀️ And the subscription dialog MUST NOT be terminated by an empty NOTIFY, i.e., one with no body 🫶
Not rejecting an empty NOTIFY is non-negotiable bestie 😭 Don't let the dialog die over it.
6.9. Handling of Forked Requests
This event package only allows one dialog to be created from an initial SUBSCRIBE request, as described in Section 4.4.9 of [RFC3265] 🦋 It does not support creating multiple subscriptions using forked SUBSCRIBE requests 🙈
6.10. Rate of Notifications
The rate of notifications for the profiles in this framework is deployment specific, but it's expected to be infrequent 🐢 So the event package specification doesn't set any throttling or minimum period between NOTIFY requests 🌸
6.11. State Agents
State agents are not applicable to this event package 💅
7. Examples
This section gives examples, along with sample SIP message bodies, that are relevant to this framework 🧚 Both examples come from the use case in Section 4.1, specifically the request for the device profile. The examples are informative only, so don't treat them as the rulebook 🍓
7.1. Example 1: Device Requesting Profile
This example shows the detailed message flows between the device and the SIP service provider's network, for requesting and retrieving the profile. The flow uses the device profile as the example 📱
The following are assumed for this example:
- The device is assumed to have established local network connectivity. NAT and firewall considerations are assumed to have been handled by the SIP service provider 🏠
- The examples are snapshots only. They don't show all the interactions between the device and the service provider's network, and none between the entities inside the SIP service provider's network 📸
- All SIP communication with the SIP service provider happens via a SIP proxy 🔀
- HTTP over TLS is assumed to be the Content Retrieval method used (any suitable alternative can be used as well) 🔐
The flow diagram and an explanation of the messages come next 👀
+----------------------+
+--------+ | SIP Service Provider |
| Device | | |
|(SIP UA)| | SIP PDS HTTP |
+--------+ | PROXY Server |
| |
+----------------------+
| | | |
| | | |
| SUBSCRIBE | | |
(SReq)|--------device profile--------->| | |
| |------>| |
| |200 OK | |
| 200 OK |<------| |
(SRes)|<-------------------------------| | |
| | | |
| | NOTIFY| |
| NOTIFY (Content Indirection)|<------| |
(NTFY)|<-------------------------------| | |
| 200 OK | | |
(NRes)|------------------------------->|200 OK | |
| |------>| |
| |
| |
| |
|<<<<<<<<<<<<< TLS establishment >>>>>>>>>>>>>|
| |
| HTTP Request |
(XReq)|---------------------------------------------->|
| |
| HTTP Response |
(XRes)|<----------------------------------------------|
| |(SReq) the device sends a request for the 'device' profile using the SIP SUBSCRIBE, utilizing the event package specified in this framework 💌
- Note: Some of the header fields (e.g., SUBSCRIBE, Event, Via) are continued on a separate line due to format constraints of this document.
SUBSCRIBE sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB
@example.com SIP/2.0
Event: ua-profile;profile-type=device;vendor="vendor.example.net";
model="Z100";version="1.2.3"
From: anonymous@example.com;tag=1234
To: sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB@example.com
Call-ID: 3573853342923422@192.0.2.44
CSeq: 2131 SUBSCRIBE
Contact: sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB
@192.168.1.44
;+sip.instance="<urn:uuid:00000000-0000-0000-0000-123456789AB0>"
;schemes="http,https"
Via: SIP/2.0/TCP 192.0.2.41;
branch=z9hG4bK6d6d35b6e2a203104d97211a3d18f57a
Accept: message/external-body, application/x-z100-device-profile
Content-Length: 0(SRes) the SUBSCRIBE request is received by a SIP proxy in the service provider's network, which passes it on to the PDS. The PDS accepts it and responds with a 200 OK 🎉
- Note: The device and the SIP proxy may have established a secure communications channel (e.g., TLS).
(NTFY) after that, the PDS transmits a SIP NOTIFY message that indicates the profile location 📍
- Note: Some of the fields (e.g., content-type) are continued on a separate line due to format constraints of this document.
NOTIFY sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB
@192.168.1.44 SIP/2.0
Event: ua-profile;effective-by=3600
From: sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB@example.com
;tag=abca
To: sip:urn%3auuid%3a00000000-0000-1000-0000-00FF8D82EDCB@example.com
;tag=1234
Call-ID: 3573853342923422@192.0.2.44
CSeq: 322 NOTIFY
Via: SIP/2.0/UDP 192.0.2.3;
branch=z9hG4bK1e3effada91dc37fd5a0c95cbf6767d0
MIME-Version: 1.0
Content-Type: message/external-body; access-type="URL";
expiration="Mon, 01 Jan 2010 09:00:00 UTC";
URL="http://example.com/z100-000000000000.html";
size=9999;
hash=10AB568E91245681AC1B
Content-Type: application/x-z100-device-profile
Content-ID: <39EHF78SA@example.com>
.
.
.(NRes) the device accepts the NOTIFY and responds with a 200 OK 🙌
(XReq) once the necessary secure communications channel is set up, the device sends an HTTP request to the HTTP server named in the NOTIFY 🚀
(XRes) the HTTP server responds to the request with an HTTP response containing the profile contents 🎁
7.2. Example 2: Device Obtaining Change Notification 💖
okay so this one is my fave 🫶 it shows a user (X) using services on two devices at once (think a PC and a PDA, multimedia stuff on both), and they have a UI where they can change their user profile. main character energy 💅
Here's what we're assuming:
- The devices (A & B) get their necessary profiles from the same SIP service provider.
- The SIP service provider also has a user interface that lets the user change preferences that affect the user profile.
The flow diagram and the message walkthrough are right below ✨
- Note: this example only shows user X's profile being retrieved, but a device can also request and retrieve other profiles (e.g., local-network, device) 🌸
----- -----
|User |_________| UI* | * = User Interface
| X | | |
----- -----
/ \
/ \
/ \ +----------------------+
+--------+ +--------+ | SIP Service Provider |
| Device | | Device | | |
| A | | B | | SIP PDS HTTP |
+--------+ +--------+ | PROXY Server |
+----------------------+
| | | |
| | | |
(A-EX)|<=Enrolls for User X's profile=>|<=====>| |
| | | |
| |
(A-RX)|<===Retrieves User X's profile================>|
| |
| | | | |
| | Enrolls for | | |
| (B-EX)|<== User X's ==>|<=====>| |
| | profile | | |
| | | | |
| | |
| (B-RX)|<= Retrieves User X's profile=>|
| |
| | |
| (HPut)|---------------------->|
| | |
| (HRes)|<----------------------|
| |
| | | |
| | NOTIFY| |
| NOTIFY |<------| |
(A-NT)|<-------------------------------| | |
| 200 OK | | |
(A-RS)|------------------------------->|200 OK | |
| |------>| |
| |
| | | NOTIFY| |
| | NOTIFY |<------| |
| (B-NT)|<---------------| | |
| | 200 OK | | |
| (B-RS)|--------------->|200 OK | |
| | |------>| |
| |
| |
(A-RX)|<===Retrieves User X's profile================>|
| |
| | |
| | |
| (B-RX)|<= Retrieves User X's profile=>|
| | |Here's what each step means:
- (A-EX) Device A discovers, enrolls, and gets notifications about user X's profile. 🔍
- (A-RX) Device A retrieves user X's profile. 📥
- (B-EX) Device B discovers, enrolls, and gets notifications about user X's profile. 🔍
- (B-RX) Device B retrieves user X's profile. 📥
- (HPut) Changes the user makes through the user interface get uploaded to the HTTP server. ⬆️
- Note: the Unique Identifier (UI) itself can act as a device and subscribe to user X's profile. That's not what happens in this example, though 🙈
- (HRes) The HTTP server accepts the changes. ✅
- (A-NT) PDS sends a NOTIFY message to device A telling it the profile changed. Here's a sample message:
- Note: some of the fields (e.g., Via) are split across lines because of how this document has to be formatted 📏
NOTIFY sip:userX@192.0.2.44 SIP/2.0
Event: ua-profile;effective-by=3600
From: sip:userX@sip.example.net;tag=abcd
To: sip:userX@sip.example.net.net;tag=1234
Call-ID: 3573853342923422@192.0.2.44
CSeq: 322 NOTIFY
Via: SIP/2.0/UDP 192.0.2.3;
branch=z9hG4bK1e3effada91dc37fd5a0c95cbf6767d1
MIME-Version: 1.0
Content-Type: message/external-body; access-type="URL";
expiration="Mon, 01 Jan 2010 09:00:00 UTC";
URL="http://www.example.com/user-x-profile.html";
size=9999;
hash=123456789AAABBBCCCDD
.
.
.- (A-RS) Device A accepts the NOTIFY and sends back a 200 OK. 🎉
- (B-NT) PDS sends a NOTIFY message to device B telling it the profile changed. Here's a sample message:
- Note: some of the fields (e.g., Via) are split across lines because of how this document has to be formatted 📏
NOTIFY sip:userX@192.0.2.43 SIP/2.0
Event: ua-profile;effective-by=3600
From: sip:userX@sip.example.net;tag=abce
To: sip:userX@sip.example.net.net;tag=1234
Call-ID: 3573853342923422@192.0.2.43
CSeq: 322 NOTIFY
Via: SIP/2.0/UDP 192.0.2.3;
branch=z9hG4bK1e3effada91dc37fd5a0c95cbf6767d2
MIME-Version: 1.0
Content-Type: message/external-body; access-type="URL";
expiration="Mon, 01 Jan 2010 09:00:00 UTC";
URL="http://www.example.com/user-x-profile.html";
size=9999;
hash=123456789AAABBBCCCDD
.
.
.- (B-RS) Device B accepts the NOTIFY and sends back a 200 OK. 🎀
- (A-RX) Device A retrieves the updated profile for user X. 📥
- (B-RX) Device B retrieves the updated profile for user X. 📥
8. IANA Considerations ✨
okay so IANA has registered a SIP event package, some event header parameters, and SIP configuration profile types. the details are in the subsections below 🦋
8.1. SIP Event Package 🌈
this spec registers a new event package, the way [RFC3265] defines it. here's the registration:
- Package Name:
ua-profile - Package or Template-Package: This is a package
- Published Document: RFC 6080
- Persons to Contact: Daniel Petrie <dan.ietf@SIPez.com>, Sumanth Channabasappa <sumanth@cablelabs.com>
- New event header parameters: profile-type, vendor, model, version, effective-by (The profile-type parameter has predefined values. The new event header parameters do not.)
the new stuff gets added to the IANA SIP "Header Field Parameters and Parameter Values" registry like this:
Predefined
Header Field Parameter Name Values Reference
---------------------------- --------------- ---------- ---------
Event profile-type Yes [RFC6080]
Event vendor No [RFC6080]
Event model No [RFC6080]
Event version No [RFC6080]
Event effective-by No [RFC6080]8.2. Registry of SIP Configuration Profile Types 🍓
IANA has registered new SIP configuration profile types at http://www.iana.org in the "SIP Configuration Profile Types" registry.
the registration procedure is "Specification Required", as explained in "Guidelines for Writing an IANA Considerations Section in RFCs" ([RFC5226]).
Registrations with the IANA MUST include the profile type, and a published document that describes its purpose and usage. 📝
since this document specifies three SIP configuration profile types, the initial IANA registration contains the info in the table below:
Profile Type Reference
-------------- ---------
local-network [RFC6080]
device [RFC6080]
user [RFC6080]9. Security Considerations 🔐✨
okay bestie, this section is where the framework gets serious 💅. The framework in this document lays out profile delivery stages, an event package, and three profile types so devices can grab their profiles. The stages are enrollment, content retrieval, and change notification 🦋. The event package helps with enrollment and change notifications. Each profile type lets a device retrieve its profile from a PDS that belongs to a specific provider 🎀.
Enrollment is where a device asks for a profile and, if it works out, gets enrolled with a PDS 🌸. To send that request, the device leans on configured, cached, or discovered data, like provider domain names, identities, and credentials 💜. The device either uses configured outbound proxies or finds the next-hop entity with [RFC3263], which can end up being a SIP proxy or the PDS itself. Then it sends the request. If a SIP proxy gets the request, it uses the Request-URI and the event header contents to route it to a PDS, possibly hopping through other SIP proxies first 🧚.
When a PDS gets an enrollment request, it can challenge any identity in it or just admit the enrollment ✨. Authorization rules then decide whether the enrollment is accepted. If it is, the PDS sends an initial notification with either the profile data or content indirection information 🔥. The profile data can be generic (shared across multiple devices) or specific to an entity, like the device or a user 🍓. If it's entity-specific, it might carry sensitive stuff like credentials, and if that leaks, things can get ugly fast 💀. We're talking impersonation attacks (rogue sessions getting set up), theft of service (if services can be obtained), and zombie attacks 😭. It is super important for the device to make sure the PNC and the PCC are authentic, because if someone impersonates the SIP service provider, that can lead to DoS and man-in-the-middle (MITM) attacks 🚨.
Profile content retrieval is how a device pulls profile data through content indirection from a PCC 🌈. This communication happens over one of many profile delivery protocols or frameworks, like HTTP or HTTPS as specified in this document. But the profile data that comes back has the same concerns as data sent in a profile notification, so similar threats show up 👀. For example, there are DoS attacks (rogue devices flooding the PCC with requests for one specific profile) and attempts to push bad data onto the PCC (which is easier if the location and format are already known) 🙈. So for any sensitive profile data, the entity requesting it MUST be authenticated 🔒. It's also important for the requesting entity to authenticate the profile source through content indirection, and to make sure the sensitive data is protected with data integrity 🫶. If the data shouldn't be disclosed to unauthorized parties, data confidentiality is required too 👑.
Here come the subsections, one for each profile type 🍓.
9.1. Local-Network Profile
A local network may or may not support local-network profiles as specified in this framework, like a home router might not 🏠. Even when it does, the PDS might only have one generic local-network profile that it hands to every device that asks for it. A PDS like that may not implement any authentication requirements or TLS 🙃.
On the flip side, some deployments need the entities (the device and the PDS) to authenticate each other before enrollment can succeed 💪. These networks may pre-configure user identities on the devices and allow user-specific local-network profiles. In those networks, the PDS will support digest authentication, and the devices are configured with user identities and credentials as covered in Section 5.3.1 🔑. If sensitive profile data is being sent, the user identity is a SIPS URI, which results in TLS with the next-hop (and that next-hop is authenticated), and digest authentication is used by both the PDS and the device 🦋.
This framework supports both of these use cases, plus anything in between ✨. That said, devices getting local-network profiles from an unauthenticated PDS are warned about potential MITM or PDS impersonation attacks 🚨. The framework says a device MUST reject sensitive data, like credentials, that comes from unauthenticated local-network sources 🙅♀️. It also doesn't allow devices to respond to authentication challenges when there's no TLS on all hops, which happens when you're using a SIPS URI 🔐. Answering unauthenticated challenges opens the door to dictionary attacks that can reveal weak passwords 😬. The only exception to accepting sensitive data without authenticating the PDS is bootstrapping (see Section 5.3.1). In bootstrapping, the methods used need to be aware of threats like impersonation 👀.
SIP Identity is handy for a device that wants to validate notifications when there's no secure channel like TLS and a SIPS URI is in use 💖. In those cases, the device can check the SIP Identity header to verify where the profile notification came from, and where the profile data came from when content indirection isn't used 🧚. But having the header doesn't guarantee the data is valid 😭. The header verifies the source and confirms data integrity, but data from an undesired source can still be invalid. For example, the outbound proxy info could be wrong, which results in DoS 💀. So devices asking for the local-network profile from unknown networks need to be ready to throw away information that would stop them from retrieving other required profiles 🗑️.
9.2. Device Profile
Device profiles are all about device-specific configuration 🎀. They might be given to unknown devices that are trying to get profiles for things like trials, self-subscription (which is not the same as [RFC3265]), and emergency services [PHONEBCP] 🚑.
This framework lets the device profile be used to bootstrap a device 🥾. That bootstrapping profile data might have enough info to connect to a Provider. For example, it could let the device talk to a device provider, which allows trial or self-subscription services through visual or audio interfaces (like interactive voice response), or through customer service reps 📞. The profile data might also give the device a choice of device providers and let the end-user pick one 💜. It might include identities and credentials (temporary or long-term) that can be used to get more profile data from the network 🔑.
This framework recommends that the PDS use the SIP Identity header ✨. But to validate that header, the device needs to be pre-configured with the allowable domains or certificates to check against (for example, using PKI) 🛡️. If it isn't, the device can still guarantee header and body integrity as long as the profile data contains the domain certificate, though the data could still be invalid or malicious 🙈. In those situations, devices with user interfaces can get confirmation from the user who's bootstrapping the device, confirming the header and body integrity 🙋♀️. But when the SIP Identity header is missing, or the device can't validate it, the bootstrapping data is unauthenticated and comes with no integrity protection 😱. That bootstrapping data may only contain temporary credentials (a SIPS URI and digest credentials) that let the device reconnect to the network with data integrity and data confidentiality, before it gets long-term credentials 🔁. Devices like this are totally at the mercy of the network they request the device profile from 🥺. If they get initialized in a rogue network, or a rogue PDS hijacks them, the end-user could end up without the device working properly or, worse, with unwanted operation 💀.
To help with this, the device provider can give the end-user temporary credentials (like passwords entered through an interface) or permanent credentials (like a USB device) for connectivity 🔐. If either of those methods is used, those credentials MUST be quickly replaced with large-entropy credentials, which keeps the impact of dictionary attacks small 🧠. Future enhancements to this framework may define device capabilities that allow authentication without any provider-specific configuration. For example, X.509 certificates using PKI could let any provider with access to the CA certificate do the authentication 🌟. Another option is for the device to be pre-configured with credentials for use with content indirection mechanisms. In that case, a PDS can use a secure content indirection mechanism, like HTTPS, to deliver the bootstrapping data 🎁.
Once a device is tied to a device provider, the device profile is vital for the device to work 🚀. The device profile can hold important operational stuff like the users who are allowed access (a white-list or black-list), user credentials (if needed), and other sensitive info 📋. So it's necessary to make sure that any device profile with sensitive info comes from an authenticated source, has integrity protection, and gets delivered to an authenticated device 🔒. For sensitive info like credentials, data confidentiality is required too 🫶. The framework says devices may only get sensitive info from authenticated entities, except while they're being bootstrapped 🙅♀️. If notifications need data confidentiality, the device provider can configure the device with a SIPS URI during profile enrollment, and use it as the Subscription URI 📡. The framework also requires a PDS that's presenting sensitive profile data to use digest authentication, so the data only goes to an authenticated entity 🎯. And authentication for profile retrieval through content indirection for sensitive profiles is done with HTTPS using HTTP digest 🌸.
9.3. User Profile
Devices can only request user profiles for users that a SIP service provider already knows 🧑💻. PDSs are required to reject user profile enrollment requests for any users that aren't known in the network 🚫.
For known user AoRs that are allowed to get profiles, the security considerations are pretty similar to the device profile's, except for bootstrapping ✨. Bestie, that's the whole security section, and it's giving very thorough energy 💖.
10. Acknowledgements ✨
Okay bestie, a huge thank you to everyone who read and commented on the many, many versions of this doc 🫶 The detailed comments came from Jonathan Rosenberg, Henning Schulzrinne, Cullen Jennings, Rohan Mahy, Rich Schaaf, Volker Hilt, Adam Roach, Hisham Khartabil, Henry Sinnreich, Martin Dolly, John Elwell, Elliot Eichen, Robert Liao, Dale Worley, Francois Audet, Roni Even, Jason Fischl, Josh Littlefield, and Nhut Nguyen. Literal legends 👑
The final revisions came out of design team discussions, and the editor gives extra love to these design team members for their reviews and specific contributions to different sections: Josh Littlefield (Overview, Section 6), Peter Blatherwick (Section 6), Cullen Jennings (Security), Sam Ganesan (Section 6), and Mary Barnes (layout, Section 6) 💖
More reviews and general contributions came from the design team members Martin Dolly, Jason Fischl, Alvin Jiang, and Francois Audet 🌸
The SIPPING WG folks were so helpful too 🦋 Thanks to John Elwell, Donald Lukacs, Roni Even, David Robbins, Shida Schubert, and Eugene Nechamkin for the reviews, comments, and recommendations. The editor also gives a special shoutout to the SIPPING WG for their comments, with Keith Drage (restructuring proposal) and John Elwell (numerous reviews and recommendations) getting their own spotlight 🎀
Peter Koch gets props for expert DNS advice 🧚
And finally, the chairs (Mary Barnes and Gonzalo Camarillo) deserve all the flowers 💐 for running things, along with the past and current Area Directors (Cullen Jennings, Jon Peterson, and Robert Sparks) for facilitating discussions, reviews, and contributions. The expert reviewers from the IESG (Peter McCann and Catherine Meadows) also get a big 🫶 for their help.
11. References ✨
11.1. Normative References
[FIPS-180-3]National Institute of Standards and Technology (NIST), "Secure Hash Standard (SHS)", FIPS PUB 180-3, October 2008.[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.[RFC2616]Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.[RFC2617]Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June 1999.[RFC2818]Rescorla, E., "HTTP Over TLS", RFC 2818, May 2000.[RFC3261]Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.[RFC3263]Rosenberg, J. and H. Schulzrinne, "Session Initiation Protocol (SIP): Locating SIP Servers", RFC 3263, June 2002.[RFC3265]Roach, A., "Session Initiation Protocol (SIP)-Specific Event Notification", RFC 3265, June 2002.[RFC3319]Schulzrinne, H. and B. Volz, "Dynamic Host Configuration Protocol (DHCPv6) Options for Session Initiation Protocol (SIP) Servers", RFC 3319, July 2003.[RFC3361]Schulzrinne, H., "Dynamic Host Configuration Protocol (DHCP-for-IPv4) Option for Session Initiation Protocol (SIP) Servers", RFC 3361, August 2002.[RFC4122]Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, July 2005.[RFC4474]Peterson, J. and C. Jennings, "Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)", RFC 4474, August 2006.[RFC4483]Burger, E., "A Mechanism for Content Indirection in Session Initiation Protocol (SIP) Messages", RFC 4483, May 2006.[RFC4704]Volz, B., "The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN) Option", RFC 4704, October 2006.[RFC5226]Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.[RFC5234]Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, January 2008.[RFC5246]Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.[RFC5626]Jennings, C., Mahy, R., and F. Audet, "Managing Client-Initiated Connections in the Session Initiation Protocol (SIP)", RFC 5626, October 2009.
11.2. Informative References
[PHONEBCP]Rosen, B. and J. Polk, "Best Current Practice for Communications Services in support of Emergency Calling", Work in Progress, October 2010.[RFC0959]Postel, J. and J. Reynolds, "File Transfer Protocol", STD 9, RFC 959, October 1985.[RFC2132]Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor Extensions", RFC 2132, March 1997.[RFC4510]Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map", RFC 4510, June 2006.[RFC4634]Eastlake, D. and T. Hansen, "US Secure Hash Algorithms (SHA and HMAC-SHA)", RFC 4634, July 2006.[RFC4825]Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, May 2007.
Authors' Addresses ✨
Here's where to find the authors 💜
Daniel Petrie
SIPez LLC
246A Park Ave
Arlington, MA 02476
USA
EMail: dan.ietf@SIPez.com
URI: http://www.SIPez.com/
Sumanth Channabasappa (editor)
CableLabs
858 Coal Creek Circle
Louisville, CO 80027
USA
EMail: sumanth@cablelabs.com
URI: http://www.cablelabs.com/And that's a wrap on RFC 6080 🌈✨💅
📦 where this page comes from
- ietf: rfc6080 2011-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms