SIP, Security and Session Controllers - White Paper
How can Service Providers Help?
If you are a Service Provider, you are probably well aware of the problems faced by customers who need a public SIP service. The need to connect and to create a public presence has to be weighed against the security implications. The Service Provider is ideally placed to address these issues. Deploying a carrier-class session controller in the access network overcomes a number of issues:
- It solves the traversal problem for all NATs from customer to core
- It provides a secure connection to the user
- It works with existing customer premise equipment
- It controls which customer uses which service
NAT devices are often used in access networks to create more IP addresses. This means that solving NAT traversal just for the customer premise is not a complete answer. The Service Provider must solve the traversal problem for multiple NATs. Placing a session controller between the access and core networks achieves this.
With a Session Controller in place, the service provider can offer services to any customer. The customer does not have to replace any of their equipment. The Session Controller offers a secure, managed public presence for each user. The customer's Firewall can limit outgoing connections to the session controller.
Offering a secure public presence to the customer enhances any service offering. The Service Provider is minimising the visibility and hence exposure of the customer's network. The service becomes a security enhancement rather than a security problem.
Figure 3 - Session Controller in the Access Network
The Newport Networks 1460 session controller is designed for just such duty. All signalling and media passing through the 1460 is policed. This further enhances the security of the connection:
- Packets from unauthorised sources are blocked
- Packets carrying invalid protocols can be blocked
- Media streams can be rate limited
- QoS settings can be policed
This means that the 1460 is effective in limiting the effects of port scanning. Denial of Service (DoS) attacks against clients can be blocked or restricted. This protects both the access network from overload, as well as the customer. The 1460 session controller can offer Service Providers a secure, reliable way of connecting to all customers, even those behind Firewalls, without compromising security.
|
IPsec and VoIP
