Secure SIP Signaling

[FDS: https://intranet.genesys.com/pages/viewpage.action?pageId=68330919]

Starting with version 8.1.103.08, SIP Server supports the secure SIP signaling schema or sips, in accordance with RFC 5630.

When enabled, SIP Server forms the Request-URI, headers From, To, and Contact to include the sips schema while sending a SIP message to a device that requires that sips schema. The header Via of the message will contain the transport TLS. While generating a response to an incoming message containing the sips schema, SIP Server forms the header Contact to include sips.

If the Request-URI containing the sips schema also contains the transport parameter transport=tcp or transport=tls, communication will be established in secure TLS over TCP.

SIP Server applies the sips schema rules selectively, per leg basis. In other words, if one SIP peer must communicate in secure SIP signaling while another SIP peer does not support it, SIP Server is able to interconnect these peers using their supported protocol. However, devices communicating with SIP Server using the sips schema must be configured to enforce the sips schema.

Examples

Example of the INVITE message with the sips schema arrived to SIP Server:

INVITE sips:5000@172.21.83.50:5314;transport=TCP SIP/2.0
From: "7789"<sips:7789@172.21.83.24>;tag=74cc50-185315ac-13c4-55013-38-2147ec74-38
To: <sips:5000@172.21.83.50:5314>
Call-ID: 75b148-185315ac-13c4-55013-38-4004bd76-38
CSeq: 1 INVITE
Via: SIP/2.0/TLS 172.21.83.24:5061;branch=z9hG4bK-38-dd24-c4644b6
Max-Forwards: 70
Supported: replaces,100rel,eventlist,timer
Allow: REGISTER, INVITE, ACK, BYE, REFER, NOTIFY, CANCEL, INFO, OPTIONS, PRACK, SUBSCRIBE, UPDATE, PUBLISH
User-Agent: AUDC-IPPhone/2.2.12.172 (420HD-Rev1; 00908F567540)
Contact: <sips:7789@172.21.83.24:5061;transport=TCP>
Session-Expires: 1800
Min-SE: 90
Content-Type: application/sdp
Content-Length: 299
...

Example of the 200 OK SIP Server response with the sips schema:

SIP/2.0 200 OK
From: "7789"<sips:7789@172.21.83.24>;tag=74cc50-185315ac-13c4-55013-38-2147ec74-38
To: <sips:5000@172.21.83.50:5314>;tag=EBDFD947-8988-4831-9FFF-051C3B626FFA-2
Call-ID: 75b148-185315ac-13c4-55013-38-4004bd76-38
CSeq: 1 INVITE
Via: SIP/2.0/TLS 172.21.83.24:5061;branch=z9hG4bK-38-dd24-c4644b6;received=172.21.83.24
Contact: <sips:5000@172.21.83.50:5314;transport=TCP>
X-Genesys-CallUUID: 8AH5H0H7054R93EBKC9ICTN8A8000001
Allow: INVITE, ACK, PRACK, CANCEL, BYE, REFER, INFO, MESSAGE, NOTIFY, OPTIONS
User-Agent: PolycomVVX-VVX_300-UA/5.2.0.8330
Allow-Events: conference,talk,hold
Accept-Language: en
Session-Expires: 1800;refresher=uas
Supported: uui,timer
Content-Type: application/sdp
Content-Length: 193
 ... 

Feature Configuration

Device Configuration Options Explicit configuration of schema Schema "sips" could be configured on next CME DN objects:

Trunk DN Extension ACD Position VoIP DN with service-type "softswitch" Schema "sips" is set inside option contact preceding IP address or hostname of the DN.

Transport parameter may be configured inside option contact following hostport of the contact.

If schema "sips" is configured any of these transport parameter may be set:

transport=tls transport=tcp transport absent. Note. Absence of transport means TLS over TCP. This is different compare to schema "sip" where it means UDP. Disregarding of the presence of transport parameter inside option contact for schema "sips" communication always is conducted by TLS over TCP.

Examples of contact values with "sips" schema.

sips:192.168.8.57;transport=tcp sips:fly.genesyslab.com;transport=tls sips:ant.genesyslab.com

Enforcing "sips:" schema by SIP registration

Self registered DNs are configured in Genesys CME with option contact="*". When incoming SIP REGISTER request from corresponding end point has schema "sips", SIP Server will make any future communication with that end point with schema "sips". Parameter transport during communication will be taken out of SIP REGISTER request.

Feature Limitations

As far as SIP proxy does not support schema "sips" yet, implementation of this feature will not cover deployments with SIP Proxy.

SIP Server guarantees consistency in using sips schema only if configuration and incoming traffic matches. In other words trunk through which INVITE with sips arrives should have sips schema configured and self registered DN must have option contact ="*" configured.

This development does not assume testing of communication with media server over sips.