RFC 7206
Requirements for an End-to-End Session Identification in IP-Based Multimedia Communication Networks
RFC 7206 🎀 Requirements for an End-to-End Session Identifier in IP-Based Multimedia Communication Networks
okay bestie, so this is RFC 7206 🌸. It's an Informational doc, which means it's not a standards-track spec. It's published for info and vibes 🧚. It was written in May 2014 and the ISSN is 2070-1721. The authors are P. Jones, G. Salgueiro, J. Polk, L. Liess, and H. Kaplan 💜, from Cisco Systems, Deutsche Telekom, and Oracle. The header doesn't list it as obsoleting or updating any other RFC, so it's a standalone moment ✨.
Abstract
this doc lays out the requirements for an end-to-end session identifier in IP-based multimedia communication networks 💖. the identifier would let endpoints, intermediate devices, and management and monitoring systems identify a session end-to-end across multiple SIP devices, hops, and administrative domains 🦋.
Status of This Memo
okay so this is not an Internet Standards Track specification 🙈. it's published for informational purposes only.
this doc is a product of the Internet Engineering Task Force (IETF) 🌈. it represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 👑. not every doc the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 if you want the deets 💅.
info about the current status of this doc, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc7206 🫶.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved ✨.
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication 📜. please review these docs carefully, because they spell out your rights and restrictions with respect to this doc 🧐. Code Components extracted from this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🫶.
Table of Contents
1. Introduction ....................................................3
2. Conventions Used in This Document ...............................3
3. Terminology .....................................................4
3.1. What Does the Session Identifier Identify? .................4
3.2. Communication Session ......................................5
3.3. End-to-End .................................................6
4. Session Identifier Use Cases ....................................6
4.1. End-to-End Identification of a Communication Session .......6
4.2. Protocol Interworking ......................................6
4.3. Traffic Monitoring .........................................7
4.4. Tracking Transferred Sessions ..............................7
4.5. Session Signal Logging .....................................8
4.6. Identifier Syntax ..........................................8
4.7. 3PCC Use Case ..............................................9
5. Requirements for the End-to-End Session Identifier ..............9
6. Related Work in Other Standards Organizations ..................10
6.1. Coordination with the ITU-T ...............................10
6.2. Requirements within 3GPP ..................................11
7. Security Considerations ........................................11
8. Acknowledgments ................................................12
9. Contributors ...................................................12
10. References ....................................................12
10.1. Normative References .....................................12
10.2. Informative References ...................................121. Introduction 🌷
IP-based multimedia communication systems like SIP [1] and H.323 [2] have a "call identifier" that is globally unique 💜. the identifier is meant to represent an end-to-end communication session, from the originating device all the way to the terminating device ✨. it's super useful for troubleshooting, session tracking, and so forth 🔥.
but here's the tea ☕: a bunch of factors mean the current call identifiers in SIP and H.323 aren't suitable for end-to-end session identification 💀. the biggest one is that the syntax for the call identifier is different between the two protocols. that makes it impossible for call identifiers to be exchanged end-to-end when a network uses both of these session protocols 😭.
another reason is that in real-world deployments, devices like Back-to-Back User Agents (B2BUAs) often change the values as the session signaling passes through 🙈. this is true even when only one session protocol is used, so it's not just a side effect of protocol interworking 💅.
and lastly, identifiers that could have been used end-to-end stop working when sessions get manipulated through supplementary service interactions 🦋. for example, when a session is transferred, or when a private branch exchange (PBX) joins or merges two communication sessions locally, the end-to-end properties of the currently defined identifiers are lost 😤.
this document specifies the requirements for an end-to-end session identifier in IP-based multimedia communication networks 💖. this identifier would enable endpoints, intermediate devices, and management and monitoring systems to identify a session end-to-end across multiple SIP devices, hops, and administrative domains 🫶.
2. Conventions Used in This Document 📖
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [3] when they appear in ALL CAPS 🎀. these words may also appear in this document in lower case as plain English words, without their normative meanings 🌸.
3. Terminology 🧚
3.1. What Does the Session Identifier Identify? 💭
the identifier this document puts requirements on, the session identifier, identifies a set of signaling messages associated with exactly two endpoints ✨. from each endpoint's perspective, those messages relate to a single invocation of a communication application 💅.
how the endpoints figure out which signaling messages share a given identifier (basically, what counts as a single invocation of a communication application) is intentionally left loosely defined 🙈.
"call" is often used as an example of such an invocation for voice and video communication, but different protocols and deployments define the scope of a "call" in different ways 🦋. for instance, some systems would count all the activity between all three parties in a transfer as a single "call" 😳.
similarly, "session" is often used as an example of such an invocation, but this term is overloaded: it describes both signaling and media-level interaction 🌈. a single invocation of the communication application, as described above, may involve multiple RTP "sessions" as described by RFC 3550 [4], and possibly even multiple concurrent sessions 🔥.
in this document, unless otherwise qualified, the term "communication session", or simply "session", refers only to the set of signaling messages identified by the common session identifier 💖. that is, a "session" is a set of signaling messages associated with exactly two endpoints that, from each endpoint's perspective, are related to a single invocation of a communication application 🫶.
the requirements in this document put some constraints on what an endpoint will consider the same, or a different, invocation of a communication session 🎀. they also make sure that related sessions (as this document uses the term) can be correlated using only the session identifiers for each session 🧚. again, what makes a "related" session is intentionally left loosely defined 🙈.
the definition considers messages associated with exactly two endpoints, instead of messages sent between two endpoints, so that intermediaries that create messages on an endpoint's behalf are covered 💅. it's possible that an endpoint may not see all of the messages in a session (as this document uses the term) associated with it 👀.
this definition, along with the constraints from the requirements in this document, makes it possible to specify an identifier that lets the two endpoints use two entirely different protocols (and so potentially have different ideas of what a single invocation means), or use two applications that have different ideas of what a single invocation means 🦋✨.
3.2. Communication Session 📞
a communication session may exist between two SIP User Agents (UAs) and may pass through one or more intermediary devices, including B2BUAs or SIP proxies 💜. for example:
UA A Middlebox(es) UA B
SIP message(s) -------[]---[]-------> SIP message(s)
SIP message(s) <-----[]---[]------- SIP message(s)
Figure 1: Communication Session through Middlebox(es)the following are examples of acceptable communication sessions, as described in Section 3.1. this list isn't exhaustive 🌸:
- A call directly between two user agents
- A call between two user agents with one or more SIP middleboxes in the signaling path
- A call between two user agents that was initiated using third-party call control (3PCC) [5]
- A call between two user agents (e.g., between Alice and Carol) that results from a different communication session (e.g., Alice and Bob), where one of those user agents (Alice) is transferred to another user agent (Carol) using a REFER request or a re-INVITE request ✨
the following are not considered communication sessions 🙅♀️:
- A call between any two user agents where two or more user agents are engaged in a conference call via a conference focus:
- each call between the user agent and the conference focus would be a communication session, and
- each of these is a distinct communication session.
- A call between three user agents (e.g., Alice, Bob, and Carol) where the first user agent (Alice) ad hoc conferences the other two user agents (Bob and Carol):
- The call between Alice and Bob would be one communication session.
- The call between Alice and Carol would be a different communication session.
3.3. End-to-End 🌍
"end-to-end" in this document means the communication session from the point of origin, passing through any number of intermediaries, to the ultimate point of termination 🛤️. it's recognized that legacy devices may not support the end-to-end session identifier 🙈. since such an endpoint won't create a session identifier, an intermediary device that does support this identifier can inject one into the session signaling 💖.
4. Session Identifier Use Cases ✨
Part 1 ends right here, bestie 🦋. Part 2 picks up with the use cases.
4.1. End-to-End Identification of a Communication Session
okay so, for SIP messaging that either doesn't involve SIP servers or only involves SIP proxies, the Call-ID header field value is enough to tell each SIP message apart inside a transaction (see Section 17 of [1]) or a dialog (see Section 12 of [1]) 💅. But that stops being true once B2BUAs or Session Border Controllers (SBCs) [6] show up in the signaling path between User Agents (UAs) 😭. So we need a way to identify each communication session through a single SIP header field, no matter which kinds of SIP servers are sitting between the UAs ✨. For messages that create a dialog, each message within the same dialog MUST use the same session identifier 🫶.
Derived Requirements: All Requirements in Section 5.
4.2. Protocol Interworking
A communication session might start on an H.323 [2] endpoint, pass through an SBC, and then finally land on a terminating SIP user agent 🧚. It works the other way too: a call could start on a SIP user agent and end up on an H.323 endpoint 🔄. It MUST be possible to identify these sessions end-to-end across the whole mix of devices, networks, or administrative domains 👑.
It is anticipated that the ITU-T will define protocol elements for H.323 to make the end-to-end signaling possible 🌈.
Derived Requirements: REQ5, REQ7 (Section 5).
4.3. Traffic Monitoring
Picture this: UA A and UA B are chatting over SIP, with a SIP B2BUA in the middle as a middlebox owned by a SIP service provider 👀. For privacy reasons, the B2BUA rewrites the SIP header fields that would reveal info about the SIP users, devices, or domain identities 🙈. Meanwhile, the provider has an external device monitoring and logging all SIP traffic going to and from the B2BUA 📝. When a customer reports a failure, or something sketchy happens (like theft of service), the provider has to dig through logs from the past several days or weeks and piece together the messages that belonged to one end-to-end SIP session 🕵️♀️.
For this scenario, we must consider three particular use cases:
a) UAs A and B support the end-to-end session identifier.
Derived Requirements: REQ1, REQ3, REQ4, REQ6.
b) Only UA A supports the end-to-end session identifier; UA B does not.
Derived Requirements: REQ1, REQ3, REQ4, REQ5, REQ6.
c) UAs A and B do not support the end-to-end session identifier.
Derived Requirements: REQ1, REQ3, REQ4, REQ5, REQ6.
4.4. Tracking Transferred Sessions
Tracking which SIP messages belonged to the same call across transactions is hard, especially with supplementary services like call transfer or call join 🔀. We need to be able to track communication sessions as they get transferred, one side at a time, until the session is done (i.e., until a BYE is sent) 📞✨.
Derived Requirements: REQ1, REQ2, REQ9.
4.5. Session Signal Logging
Searching SIP messages after the fact to figure out which ones were part of the same transaction or call is painful when B2BUAs and SBCs are involved 😩. Linking more than one Call-ID together is tricky, because basically every SIP header field value on one side of the B2BUA or SBC is probably going to be different from the other side 🙃. If there are multiple B2BUAs and/or SBCs in the path, you get more than two sets of header field values, and that's even more of a mess 🌀. A shared header field value that every SIP entity carries would make debugging, communication tracking (like for security purposes in the case of theft of service), and so on way easier 🍓.
Derived Requirements: REQ1, REQ3, REQ5, REQ6.
4.6. Identifier Syntax
A syntax that's too lax (e.g., one that allows special characters or a very long identifier) would make it hard to encode the identifier in other protocols 🙃. So the syntax of the identifier should be reasonably constrained 💖.
Derived Requirement: REQ8.
4.7. 3PCC Use Case
Third-party call control is when an entity creates a call where the actual talking happens between two or more parties other than the one who set up the call 📞. For example, a B2BUA acting as a third-party controller could set up a call between two SIP UAs using 3PCC procedures as described in Section 4.1 of RFC 3725 [5]. The flow goes like this:
A Controller B
|(1) INVITE no SDP | |
|<------------------| |
|(2) 200 offer1 | |
|------------------>| |
| |(3) INVITE offer1 |
| |------------------>|
| |(4) 200 OK answer1 |
| |<------------------|
| |(5) ACK |
| |------------------>|
|(6) ACK answer1 | |
|<------------------| |
|(7) RTP | |
|.......................................|Figure 2: Session Identifier 3PCC Scenario
Such a flow must result in a single session identifier being used for the communication session between UA A and UA B. This use case does not extend to three SIP UAs 🚫.
Derived Requirement: REQ9.
5. Requirements for the End-to-End Session Identifier ✨
The following requirements are derived from the use cases and additional constraints regarding the construction of the identifier 📋.
- REQ1: It MUST be possible for an administrator, or an external device that monitors the SIP traffic, to use the identifier to find those dialogs, transactions, and messages that were at some point components of a single end-to-end SIP session (e.g., parts of the same call) 🔍.
- REQ2: It MUST be possible to correlate two end-to-end sessions when a session is transferred, or when two different sessions are joined together via an intermediary (e.g., a PBX) 🔗.
- REQ3: The solution MUST require that the identifier, if present, passes unchanged through SIP B2BUAs or other intermediaries 🫡.
- REQ4: The identifier MUST NOT reveal any information related to any SIP user, device, or domain identity 🙈. Additionally, it MUST NOT be possible to correlate a set of session identifiers produced over a period of time with one another, or with a particular user or device 🔒. This includes any IP address, port, hostname, domain name, username, Address-of-Record, Media Access Control (MAC) address, IP address family, transport type, subscriber ID, Call-ID, tags, or other SIP header field or body parts 🚨.
- REQ5: It MUST be possible to identify SIP traffic with an end-to-end session identifier from and to end devices that don't support this new identifier, such as by letting an intermediary inject an identifier into the session signaling 💉.
- REQ6: The identifier SHOULD be unique in time and space, similar to the Call-ID 🦋.
- REQ7: The identifier SHOULD be constructed so that it's suitable for transmission in SIP [1] and H.323 [2] 📨.
- REQ8: The identifier SHOULD use a restricted syntax and length so it can be used in other protocols 🧩.
- REQ9: It MUST be possible to correlate two end-to-end sessions when the sessions are created by a third-party controller using 3PCC procedures as shown in Figure 1 of RFC 3725 [5] 🎀.
6. Related Work in Other Standards Organizations 🌸
6.1. Coordination with the ITU-T
IP multimedia networks are often a mix of session protocols like SIP [1] and H.323 [2] 🌐. A benefit of the session identifier is that it uniquely identifies a communication session end-to-end across session protocol boundaries 💜. So coordinated standardization across Standards Development Organizations (SDOs) is imperative, no cap 🔥.
To make that happen, a parallel effort is underway in the ITU-T to introduce the session identifier for H.323 in a way that's interoperable with the procedures defined by the IETF 🤝.
6.2. Requirements within 3GPP
The Third Generation Partnership Project (3GPP) identified in their Release 9 the need for a session identifier for operation and maintenance purposes, so flows could be correlated in an end-to-end communication session 🛠️. 3GPP TS24.229 [7] points out that the session identifier can be used to correlate SIP messages belonging to the same session 👯. When signaling passes through SIP entities like B2BUAs, the end-to-end session identifier shows that these dialogs belong to the same end-to-end SIP communication session 💖.
7. Security Considerations 🔐
Okay bestie, this part is serious, so read it carefully. ⚠️
The security vulnerabilities, attacks, and threat models affecting other similar SIP identifiers are well documented in RFC 3261 [1]. They are equally applicable to the end-to-end session identifier and are subject to the same mitigating security best practices. Further, storing the session identifier in a log file is also subject to the security considerations specified in RFC 6872 [8].
An end-to-end identifier, if not properly constructed, could leak confidential information that would let someone identify the individual, device, or domain initiating or terminating a communication session 😱. To adhere to REQ4, the solution produced under these requirements MUST take appropriate measures to properly secure and obfuscate sensitive or private information that might allow someone to identify a person, device, or domain 🛡️. This means that the end-to-end session identifier MUST NOT reveal information elements such as the MAC address or IP address 🚫. It is outside the scope of this document to specify the implementation details of such security and privacy measures. Those details may vary with the specific construction mechanism selected for the end-to-end session identifier, so they will be discussed in the document specifying the actual end-to-end identifier 📄.
A key security consideration is making sure an attacker cannot spoof the identifier and effectively make it useless to diagnostic equipment. Diagnostic equipment can't properly correlate signaling messages when duplicate session identifiers exist in the same space and time 💀. To follow REQ6, this end-to-end identifier MUST be sufficiently long and random to prevent it from being guessable, as well as avoid collision with another identifier 🎲. The secure transport of the identifier, the need for authentication, encryption, and so on should be appropriately evaluated based on the network infrastructure, transport domain, and usage scenarios for the end-to-end session identifier 🔑.
8. Acknowledgments 🫶
The authors would like to acknowledge Paul Kyzivat, Christer Holmberg, Charles Eckel, Andy Hutton, Salvatore Loreto, Keith Drage, and Chris Pearce for their contribution and collaboration in developing this document 🙌.
9. Contributors 🌟
Roland Jesske and Parthasarathi Ravindran provided substantial contributions to this document during its initial creation 💅.
10. References 📚
10.1. Normative References
okay these are the must-read ones, bestie 📚🎀
- [1] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.
- [2] Recommendation ITU-T H.323, "Packet-based multimedia communications systems", December 2009.
- [3] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
10.2. Informative References
these are the extra-helpful reads that aren't strictly required but are so worth your time 🦋💖
- [4] Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson, "RTP: A Transport Protocol for Real-Time Applications", STD 64, RFC 3550, July 2003.
- [5] Rosenberg, J., Peterson, J., Schulzrinne, H., and G. Camarillo, "Best Current Practices for Third Party Call Control (3pcc) in the Session Initiation Protocol (SIP)", BCP 85, RFC 3725, April 2004.
- [6] Hautakorpi, J., Ed., Camarillo, G., Penfield, R., Hawrylyshen, A., and M. Bhatia, "Requirements from Session Initiation Protocol (SIP) Session Border Control (SBC) Deployments", RFC 5853, April 2010.
- [7] 3GPP TS 24.229, "IP multimedia call control protocol based on Session Initiation Protocol (SIP) and Session Description Protocol (SDP); Stage 3".
- [8] Gurbani, V., Ed., Burger, E., Ed., Anjali, T., Abdelnur, H., and O. Festor, "The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Information Model", RFC 6872, February 2013.
Authors' Addresses 🫶✨
meet the people who made it all happen, the real ones 💅
Paul E. Jones
Cisco Systems, Inc.
7025 Kit Creek Rd.
Research Triangle Park, NC 27709
USA
Phone: +1 919 476 2048
EMail: paulej@packetizer.com
IM: xmpp:paulej@packetizer.com
Gonzalo Salgueiro
Cisco Systems, Inc.
7025 Kit Creek Rd.
Research Triangle Park, NC 27709
USA
Phone: +1 919 392 3266
EMail: gsalguei@cisco.com
IM: xmpp:gsalguei@cisco.com
James Polk
Cisco Systems, Inc.
3913 Treemont Circle
Colleyville, TX
USA
Phone: +1 817 271 3552
EMail: jmpolk@cisco.com
IM: xmpp:jmpolk@cisco.com
Laura Liess
Deutsche Telekom NP
64295 Darmstadt
Heinrich-Hertz-Str. 3-7
Germany
Phone: +49 6151 268 2761
EMail: laura.liess.dt@gmail.com
Hadriel Kaplan
Oracle
71 Third Ave.
Burlington, MA 01803
USA
EMail: hadriel.kaplan@oracle.com📦 where this page comes from
- ietf: rfc7206 2014-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms