A session border controller (SBC) is a network element deployed to protect
SIP based
voice over Internet Protocol
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. The terms Internet t ...
(VoIP) networks.
Early deployments of SBCs were focused on the borders between two service provider networks in a peering environment. This role has now expanded to include significant deployments between a service provider's access network and a backbone network to provide service to residential and/or enterprise customers.
[
The term "session" refers to a communication between two or more parties – in the context of telephony, this would be a call. Each call consists of one or more call signaling message exchanges that control the call, and one or more call media streams which carry the call's audio, video, or other data along with information of call statistics and quality. Together, these streams make up a session. It is the job of a session border controller to exert influence over the data flows of sessions.
The term "border" refers to a point of demarcation between one part of a network and another. As a simple example, at the edge of a corporate network, a firewall demarcates the local network (inside the corporation) from the rest of the Internet (outside the corporation). A more complex example is that of a large corporation where different departments have security needs for each location and perhaps for each kind of data. In this case, filtering routers or other network elements are used to control the flow of data streams. It is the job of a session border controller to assist policy administrators in managing the flow of session data across these borders.
The term "controller" refers to the influence that session border controllers have on the data streams that comprise sessions, as they traverse borders between one part of a network and another. Additionally, session border controllers often provide measurement, access control, and data conversion facilities for the calls they control.
]
Functions
SBCs commonly maintain full session state
State may refer to:
Arts, entertainment, and media Literature
* ''State Magazine'', a monthly magazine published by the U.S. Department of State
* ''The State'' (newspaper), a daily newspaper in Columbia, South Carolina, United States
* ''Our S ...
and offer the following functions:
* Security
Security is protection from, or resilience against, potential harm (or other unwanted coercive change) caused by others, by restraining the freedom of others to act. Beneficiaries (technically referents) of security may be of persons and social ...
– protect the network and other devices from:
** Malicious attacks such as a denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connect ...
(DoS) or distributed DoS
** Toll fraud via rogue media streams
** Malformed packet protection
** Encryption of signaling (via TLS and IPSec
In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...
) and media ( SRTP)
* Connectivity – allow different parts of the network to communicate through the use of a variety of techniques such as:
** NAT traversal
** SIP normalization via SIP message and header manipulation
** IPv4 to IPv6 interworking
** VPN connectivity
** Protocol translations between SIP, SIP-I, H.323
H.323 is a recommendation from the ITU Telecommunication Standardization Sector (ITU-T) that defines the protocols to provide audio-visual communication sessions on any packet network. The H.323 standard addresses call signaling and control, m ...
* Quality of service
Quality of service (QoS) is the description or measurement of the overall performance of a service, such as a telephony or computer network, or a cloud computing service, particularly the performance seen by the users of the network. To quantitat ...
– the QoS policy of a network and prioritization of flows is usually implemented by the SBC. It can include such functions as:
** Traffic policing
** Resource allocation
In economics, resource allocation is the assignment of available resources to various uses. In the context of an entire economy, resources can be allocated by various means, such as markets, or planning.
In project management, resource allocati ...
** Rate limiting
In computer networks, rate limiting is used to control the rate of requests sent or received by a network interface controller. It can be used to prevent DoS attacks and limit web scraping.
Research indicates flooding rates for one zombie machin ...
** Call admission control Call Admission Control (CAC) prevents oversubscription of VoIP networks. CAC is used in the call set-up phase and applies to real-time media traffic as opposed to data traffic. CAC mechanisms complement and are distinct from the capabilities of qua ...
** ToS/ DSCP bit setting
* Regulatory – many times the SBC is expected to provide support for regulatory requirements such as:
** emergency calls prioritization and
** lawful interception Lawful interception (LI) refers to the facilities in telecommunications and telephone networks that allow law enforcement agencies with court orders or other legal authorization to selectively wiretap individual subscribers. Most countries require ...
* Media services – many of the new generation of SBCs also provide built-in digital signal processors (DSPs) to enable them to offer border-based media control and services such as:
** DTMF
Dual-tone multi-frequency signaling (DTMF) is a telecommunication signaling system using the voice-frequency band over telephone lines between telephone equipment and other communications devices and switching centers. DTMF was first developed ...
relay and interworking
** Media transcoding
** Tones and announcements
** Data and fax interworking
** Support for voice and video calls
* Statistics and billing information – since all sessions that pass through the edge of the network pass through the SBC, it is a natural point to gather statistics and usage-based information on these sessions.
With the advent of WebRTC
WebRTC (Web Real-Time Communication) is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication to wor ...
some SBCs have also assumed the role of SIP to WebRTC Gateway and translate SIP. While no one signalling protocol is mandated by the WebRTC specifications, SIP over WebSocket
WebSocket is a computer communications protocol, providing full-duplex communication channels over a single TCP connection. The WebSocket protocol was standardized by the IETF as in 2011. The current API specification allowing web applications ...
s (RFC 7118) is often used partially due to the applicability of SIP to most of the envisaged communication scenarios as well as the availability of open source software such as JsSIP
JsSIP is a library for the programming language JavaScript. It takes advantage of SIP and WebRTC to provide a fully featured SIP endpoint in any website. JsSIP allows any website to get real-time communication features using audio and video. It ...
. In such a case the SBC acts as a gateway between the WebRTC applications and SIP end points.
Applications
SBCs are inserted into the signaling and/or media paths between calling and called parties in a VoIP call, predominantly those using the Session Initiation Protocol
The Session Initiation Protocol (SIP) is a signaling protocol used for initiating, maintaining, and terminating communication sessions that include voice, video and messaging applications. SIP is used in Internet telephony, in private IP telepho ...
(SIP), H.323
H.323 is a recommendation from the ITU Telecommunication Standardization Sector (ITU-T) that defines the protocols to provide audio-visual communication sessions on any packet network. The H.323 standard addresses call signaling and control, m ...
, and MGCP call-signaling protocols.
In many cases the SBC hides the network topology and protects the service provider or enterprise packet networks. The SBC terminates an inbound call and initiates the second call leg to the destination party. In technical terms, when used with the SIP protocol, this defines a back-to-back user agent A back-to-back user agent (B2BUA) is a logical network element in Session Initiation Protocol (SIP) applications., ''SIP: Session Initiation Protocol'', IETF, The Internet Society (2002) SIP is a signaling protocol for managing multimedia Voice ove ...
(B2BUA). The effect of this behavior is that not only the signaling traffic, but also the media traffic (voice, video) is controlled by the SBC. In cases where the SBC does not have the capability to provide media services, SBCs are also able to redirect media traffic to a different element elsewhere in the network, for recording, generation of music-on-hold, or other media-related purposes. Conversely, without an SBC, the media traffic travels directly between the endpoints, without the in-network call signaling elements having control over their path.
In other cases, the SBC simply modifies the stream of call control (signaling) data involved in each call, perhaps limiting the kinds of calls that can be conducted, changing the codec
A codec is a device or computer program that encodes or decodes a data stream or signal. ''Codec'' is a portmanteau of coder/decoder.
In electronic communications, an endec is a device that acts as both an encoder and a decoder on a signal or da ...
choices, and so on. Ultimately, SBCs allow the network operators to manage the calls that are made on their networks, fix or change protocols and protocol syntax to achieve interoperability, and also overcome some of the problems that firewalls and network address translators (NATs) present for VoIP calls.
To show the operation of an SBC, one can compare a simple call establishment sequence with a call establishment sequence with an SBC. In the simplest session establishment sequence with only one proxy between the user agents the proxy’s task is to identify the callee’s location and forward the request to it. The proxy also adds a Via header with its own address to indicate the path that the response should traverse. The proxy does not change any dialog identification information present in the message such as the tag in the From header, the Call-Id or the Cseq. Proxies also do not alter any information in the SIP message bodies. Note that during the session initiation phase the user agents exchange SIP messages with the SDP bodies that include addresses at which the agents expect the media traffic. After successfully finishing the session initiation phase the user agents can exchange the media traffic directly between each other without the involvement of the proxy.
SBCs are designed for many applications and are used by operators and enterprises to achieve a variety of goals. Even the same SBC implementation might act differently depending on its configuration and the use case. Hence, it is not easily possible to describe an exact SBC behavior that would apply to all SBC implementations. In general it is possible to identify certain features that are common to SBCs. For example, most SBCs are implemented as back-to-back user agent.
A B2BUA is a proxy-like server that splits a SIP transaction in two call legs: on the side facing the user agent client (UAC), it acts as server, on the side facing user agent server (UAS) it acts as a client. While a proxy usually keeps only state information related to active transactions, B2BUAs keep state information about active dialogs, e.g., calls. That is, once a proxy receives a SIP request it will save some state information. Once the transaction is over, e.g., after receiving a response, the state information will soon after be deleted. A B2BUA will maintain state information for active calls and only delete this information once the call is terminated.
When an SBC is included in the call path, the SBC acts as a B2BUA that behaves as a user agent server towards the caller and as user agent client towards the callee. In this sense, the SBC actually terminates that call that was generated by the caller and starts a new call towards the callee. The INVITE message sent by the SBC contains no longer a clear reference to the caller. The INVITE sent by the SBC to the proxy includes Via and Contact headers that point to the SBC itself and not the caller. SBCs often also manipulate the dialog identification information listed in the Call-Id and From tag. Further, in case the SBC is configured to also control the media traffic then the SBC also changes the media addressing information included in the c and m lines of the SDP body. Thereby, not only will all SIP messages traverse the SBC but also all audio and video packets. As the INVITE sent by the SBC establishes a new dialog, the SBC also manipulates the message sequence number (CSeq) as well the Max-Forwards value.
Note that the list of header manipulations listed here is only a subset of the possible changes that an SBC might introduce to a SIP message. Furthermore, some SBCs might not do all of the listed manipulations. If the SBC is not expected to control the media traffic then there might be no need to change anything in the SDP body. Some SBCs do not change the dialog identification information and others might even not change the addressing information.
SBCs are often used by corporations along with firewalls and intrusion prevention system
An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically rep ...
s (IPS) to enable VoIP calls to and from a protected enterprise network. VoIP service providers use SBCs to allow the use of VoIP protocols from private networks with Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
connections using NAT, and also to implement strong security measures that are necessary to maintain a high quality of service. SBCs also replace the function of application-level gateway
An application-level gateway (ALG, also known as application layer gateway, application gateway, application proxy, or application-level proxy) is a security component that augments a firewall or NAT employed in a computer network. It allows cust ...
s.[ In larger enterprises, SBCs can also be used in conjunction with SIP trunks to provide call control and make routing/policy decisions on how calls are routed through the LAN/WAN. There are often tremendous cost savings associated with routing traffic through the internal IP networks of an enterprise, rather than routing calls through a traditional circuit-switched phone network.
Additionally, some SBCs can allow VoIP calls to be set up between two phones using different VoIP signaling protocols (e.g., SIP, H.323, ]Megaco
The Gateway Control Protocol (Megaco, H.248) is an implementation of the media gateway control protocol architecture for providing telecommunication services across a converged internetwork consisting of the traditional public switched telephone ...
/MGCP) as well as performing transcoding of the media stream when different codecs are in use. Most SBCs also provide firewall features for VoIP traffic (denial of service
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connect ...
protection, call filtering, bandwidth management). Protocol normalization and header manipulation is also commonly provided by SBCs, enabling communication between different vendors and networks.
From an IP Multimedia Subsystem (IMS) or 3GPP ( 3rd Generation Partnership Project) architecture perspective, the SBC is the integration of the P-CSCF and IMS- ALG at the signaling plane and the IMS Access Gateway at the media plane on the access side. On the interconnect side, the SBC maps to the IBCF, IWF at the signaling plane and TrGW (Transition Gateway) at the media plane.
From an IMS/TISPAN
The Telecoms & Internet converged Services & Protocols for Advanced Networks (TISPAN) is a standardization body of ETSI, specializing in fixed networks and Internet convergence. It was formed in 2003 from the amalgamation of the ETSI bodies Tel ...
architecture perspective, the SBC is the integration of the P- CSCF and C-BGF functions on the access side, and the IBCF, IWF, THIG, and I-BGF functions on the peering side. Some SBCs can be "decomposed", meaning the signaling functions can be located on a separate hardware platform than the media relay functions – in other words the P-CSCF can be separated from the C-BGF, or the IBCF/IWF can be separated from the I-BGF functions physically. Standards-based protocol, such as the H.248 Ia profile, can be used by the signaling platform to control the media one while a few SBCs use proprietary protocols.
Controversy
During its infancy, the concept of SBC was controversial to proponents of end-to-end systems and peer-to-peer
Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers. Peers are equally privileged, equipotent participants in the network. They are said to form a peer-to-peer n ...
networking because:
* SBCs can extend the length of the media path (the way of media packets through the network) significantly. A long media path is undesirable, as it increases the delay of voice packets and the probability of packet loss. Both effects deteriorate the voice/video quality. However, many times there are obstacles to communication such as firewalls between the call parties, and in these cases SBCs offer an efficient method to guide media streams towards an acceptable path between caller and callee; without the SBC the call media would be blocked. Some SBCs can detect if the ends of the call are in the same subnetwork
A subnetwork or subnet is a logical subdivision of an IP network. Updated by RFC 6918. The practice of dividing a network into two or more networks is called subnetting.
Computers that belong to the same subnet are addressed with an identical ...
and release control of the media enabling it to flow directly between the clients, this is anti-tromboning or media release. Also, some SBCs can create a media path where none would otherwise be allowed to exist (by virtue of various firewalls and other security apparatus between the two endpoints). Lastly, for specific VoIP network models where the service provider owns the network, SBCs can actually decrease the media path by shortcut routing approaches. For example, a service provider that provides trunking services to several enterprises would usually allocate each enterprise a VPN. It is often desirable to have the option to interconnect the VPN through SBCs. A VPN-aware SBC may perform this function at the edge of the VPN network, rather than sending all the traffic to the core.
* SBCs can restrict the flow of information between call endpoints, potentially reducing end-to-end transparency. VoIP phones may not be able to use new protocol features unless they are understood by the SBC. However, the SBCs are usually able to cope with the majority of new, and unanticipated protocol features.
* Sometimes end-to-end encryption
End-to-end encryption (E2EE) is a system of communication where only the communicating users can read the messages. In principle, it prevents potential eavesdroppers – including telecommunications service providers, telecom providers, Internet ...
can't be used if the SBC does not have the key, although some portions of the information stream in an encrypted call are not encrypted, and those portions can be used and influenced by the SBC. However, the new generations of SBCs, armed with sufficient computing capacity, are able to offload this encryption function from other elements in the network by terminating SIP- TLS, IPsec
In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...
, and/or SRTP. Furthermore, SBCs can actually make calls and other SIP scenarios work when they couldn't have before, by performing specific protocol "normalization" or "fix-up".
* In most cases, far-end or hosted NAT traversal
Network address translation traversal is a computer networking technique of establishing and maintaining Internet protocol connections across gateways that implement network address translation (NAT).
NAT traversal techniques are required for m ...
can be done without SBCs if the VoIP phones support protocols like STUN, TURN, ICE
Ice is water frozen into a solid state, typically forming at or below temperatures of 0 degrees Celsius or Depending on the presence of impurities such as particles of soil or bubbles of air, it can appear transparent or a more or less opaq ...
, or Universal Plug and Play
Universal Plug and Play (UPnP) is a set of networking protocols that permits networked devices, such as personal computers, printers, Internet gateways, Wi-Fi access points and mobile devices to seamlessly discover each other's presence on the n ...
(UPnP).
Most of the controversy surrounding SBCs pertains to whether call control should remain solely with the two endpoints in a call (in service to their owners), or should rather be shared with other network elements owned by the organizations managing various networks involved in connecting the two call endpoints. For example, should call control remain with Alice and Bob
Alice and Bob are fictional characters commonly used as placeholders in discussions about cryptographic systems and protocols, and in other science and engineering literature where there are several participants in a thought experiment. The A ...
(two callers), or should call control be shared with the operators of all the IP networks involved in connecting Alice and Bob's VoIP phones together. The debate of this point was vigorous, almost religious, in nature. Those who wanted unfettered control in the endpoints only, were also greatly frustrated by the various realities of modern networks, such as firewalls and filtering/throttling. On the other side, network operators are typically concerned about overall network performance, interoperability and quality, and want to ensure it is secure.
Lawful intercept and CALEA
An SBC may provide session media (usually RTP) and signaling (often SIP) wiretap
Telephone tapping (also wire tapping or wiretapping in American English) is the monitoring of telephone and Internet-based conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitorin ...
services, which can be used by providers to enforce requests for the lawful interception Lawful interception (LI) refers to the facilities in telecommunications and telephone networks that allow law enforcement agencies with court orders or other legal authorization to selectively wiretap individual subscribers. Most countries require ...
of network sessions. Standards for the interception of such services are provided by ATIS, TIA
TIA or Tia may refer to:
Aviation
* Tampa International Airport, US, IATA code TPA
* Texas International Airlines, US, ICAO code
* Tirana International Airport Nënë Tereza, Albania, IATA code
* Trans International Airlines, former U.S. airl ...
, CableLabs
Cable Television Laboratories, Inc. (CableLabs) is a nonprofit corporation promoting innovation as a research and development lab founded in 1988 by American cable operators. System operators from around the world are eligible to be members.
Th ...
and ETSI
The European Telecommunications Standards Institute (ETSI) is an independent, not-for-profit, standardization organization in the field of information and communications. ETSI supports the development and testing of global technical standard ...
, among others.
History and market
According to Jonathan Rosenberg, the author of RFC 3261 (SIP) and numerous other related RFCs, Dynamicsoft developed the first working SBC in conjunction with Aravox, but the product never truly gained marketshare. .
Newport Networks was the first to have an IPO on the London Stock Exchange's AIM in May 2004 (NNG), while Cisco has been publicly traded since 1990. Acme Packet followed in October 2006 by floating on the NASDAQ. With the field narrowed by acquisition, NexTone merged with Reefpoint becoming Nextpoint, which was subsequently acquired in 2008 by Genband
Ribbon Communications US LLC is a public company that makes software, IP and optical networking solutions for service providers, enterprises and critical infrastructure sectors. The company was formed in 2017, following the merger of Genband and S ...
. At this same time, there emerged the “integrated” SBC where the border control function was integrated into another edge device. In 2009, Ingate Systems’ Firewall became the first SBC to earn certification from ICSA Labs, a milestone in certifying the VoIP security capabilities of an SBC.
The continuing growth of VoIP networks pushes SBCs further to the edge, mandating adaptation in capacity and complexity. As the VoIP network grows and traffic volume increases, more and more sessions are passing through SBC. Vendors are addressing these new scale requirements in a variety of ways. Some have developed separate, load balancing systems to sit in front of SBC clusters. Others, have developed new architectures using the latest generation chipsets offering higher performance SBCs and scalability using service cards.
See also
*3GPP Long Term Evolution
In telecommunications, long-term evolution (LTE) is a standard for wireless broadband communication for mobile devices and data terminals, based on the GSM/EDGE and UMTS/HSPA standards. It improves on those standards' capacity and speed by usi ...
(LTE)
*Firewall (computing)
In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted ne ...
* IP Multimedia Subsystem (IMS)
*Session Initiation Protocol
The Session Initiation Protocol (SIP) is a signaling protocol used for initiating, maintaining, and terminating communication sessions that include voice, video and messaging applications. SIP is used in Internet telephony, in private IP telepho ...
(SIP)
*SIP Trunking SIP trunking is a voice over Internet Protocol (VoIP) technology and streaming media service based on the Session Initiation Protocol (SIP) by which Internet telephony service providers (ITSPs) deliver telephone services and unified communications t ...
*Universal Mobile Telecommunications System
The Universal Mobile Telecommunications System (UMTS) is a third generation mobile cellular system for networks based on the GSM standard. Developed and maintained by the 3GPP (3rd Generation Partnership Project), UMTS is a component of the Inte ...
(UMTS)
References
{{reflist, refs=
[{{cite IETF
, title=Requirements from SIP (Session Initiation Protocol) Session Border Control Deployments
, rfc=5853
, last1=Hautakorpi
, first1=J.
, last2=Camarillo
, first2=G.
, last3=Penfield
, first3=R.
, last4=Hawrylyshen
, first4=A.
, last5=Bhatia
, first5=M.
, publisher=]IETF
The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and a ...
, date=April 2010
[{{citation
, first1=Henry
, last1=Sinnreich
, first2=Alan B.
, last2=Johnston
, title=Internet Communication Using SIP
, publisher=Wiley
, isbn=978-0-471-77657-4
, year=2001
, page=180 ]
Voice over IP
Computer network security