Siemens HiPath 8000 Specifications download pdf (Page 169)

security_features.fm

A31003-H8022-F100-2-7618, October 2006

HiPath 8000 V2.2, Feature Description Guide

14-13

Security Features

TLS Support

● When responding to a 401 (or 407) challenge from the HiPath 8000 in response to any form

of a SIP request, such as a SIP REGISTER or SIP INVITE

Endpoint authentication is performed using HTTP digest authentication over the TLS-secured

link. Refer to Section 16.2, “HTTP Digest Authentication”, on page 16-1.

Within a single administrative domain, server authentication takes place when the TLS

connection is established. In the HiPath 8000, the SIP server is a proxy with a collocated

registrar; because of this, the TLS connection between the SIP endpoint and the server is left

open for the duration of the registration.

When TLS is used for SIP endpoint-server communication, a unilateral authentication is

performed as part of the TLS handshake. On top of the established TLS connection, the SIP

endpoint authenticates towards the server using HTTP digest authentication.

After authentication is successful, subsequent communication is done over an encrypted

connection. The SIP endpoint uses this connection to attempt to register with the server

(without credentials in the first instance). The user ID and password for HTTP digest

authentication are stored in the database of the SIP endpoint device; therefore, the user does

not manually supply the ID and password.

With TLS protection of SIP signaling, the SIP telephone takes on the role of a TLS client and

the HiPath 8000 takes on the role of a TLS server. If the TLS connection fails, the TLS client

detects and re-establishes the connection.

14.17.3 Guidelines for Implementation and Use

● In addition to TLS, the HiPath 8000 also supports TCP and UDP as transport layer options

for SIP signaling protocols. Therefore, SIP over TCP and SIP over UDP are viable

alternatives to SIP over TLS.

● When the SIP URI is used to place a call, it is possible for TLS to be used as the transport

protocol by one SIP endpoint and for a different signaling protocol (such as SIP-Q or

MGCP, with or without signaling security) to be used by the other device.

● The HiPath 8000 supports TLS on the signaling connection between a SIP endpoint and

the SIP signaling manager. Because TLS is applied on a hop-by-hop basis, end-to-end

signaling security is achieved only when all hops of the signaling connection use TLS. End-

to-end TLS security is not guaranteed if the call leaves the local administrative domain.

It is useful to note that during this process, it is the SIP endpoint device, and

not

its

user, that is being authenticated.

1 2 ... 164 165 166 167 168 169 170 171 172 173 174 ... 237 238

No comments

Siemens HiPath 8000 Specifications Page 169