SIP edu Open SER in an academic environment

SIP. edu : Open. SER in an academic environment Open. SER SUMMIT - VON – Berlin 2006

Agenda n Introduction q q n SIP. edu at INRIA q n n INRIA The SIP. edu project Access control with RADIUS Expected limitations and problems Future improvements

INRIA n n French National Institute for Research in Computer Science and Control Fundamental and applied research in various fields q q n Networking Multimedia Software security Modeling living structures and mechanisms 5000 people in 6 locations

The SIP. edu project n n n Started in late 2003, from an Internet 2 organization initiative Aims to connect academic institutions with SIP Two prerequisites q A user e-mail to phone number mapping mechanism n q Integrate with an existing PBX to make non-SIP phones reachable n n SIP address ~= email address Not necessarily IP enabled More than 250, 000 people reachable q MIT, Harvard University, Yale, . .

SIP. edu : target architecture

SIP. edu at INRIA n n n DNS SRV records to our SIP proxy : Open. SER version 1. 0. 1 Directory : Open. LDAP q n SIP PBX gateway : Asterisk + Cisco router q n Gathers the information for all INRIA members 12 channels to the existing PBX : TENOVIS

SIP. edu at INRIA : the picture

Available services n “sip: first. last@inria. fr” URIs that map with regular E. 164 extensions at INRIA q n Accessible to anyone from the Internet “sip: 0123456789@inria. fr” URIs, to call external E. 164 extensions q Restricted to INRIA’s members n RADIUS based access control

Sample call flow to a numeric extension n To initiate a call to PSTN extension 0123456789, Alice types “sip: 0123456789@inria. fr" into her SIP user agent (UA); q DNS SRV query q Sent to INRIA’s SIP proxy n The proxy detects a numeric extension, and triggers the RADIUS authentication process n The proxy re-writes the INVITE to INVITE sip: 0123456789@asterisk. inria. fr, which it sends to the Asterisk server; n Asterisk rings extension 0123456789 through the PSTN gateway and PBX.

SIP and RADIUS : user password storage n Two alternatives q Clear text format n n q Insecure Regular authentication database cannot be used Digest-HA 1: MD 5(username: realm: password) n n n User password is kept opaque to the admin Stored information is still sensitive Regular authentication database cannot be used

The key role of Open. SER n Call processing logic q n n Modular software architecture Many database/protocols connectors q n Not that easy to handle but powerful RADIUS, SQL, Jabber, . . External scripting integration q In our SIP. edu architecture, the LDAP information retrieval process is a shell script launched by Open. SER

Expected limitations and problems n n NAT issues SPIT (SPam over IP Telephony) q Use inter-domain TLS? Open. SER already addresses those issues

Future improvements n n Enable RADIUS authorization by implementing group checking Integrate with our Jabber based IM presence solution Already possible with Open. SER