A Session Initiation Protocol (SIP) Event Package for Session-Specific Policies
Extracted elements (29)
A subscriber that fails to locate a policy server MAY continue setting up the session without session-specific policies rather than being blocked, to prevent a failed policy server from preventing session establishment. However, such sessions may be blocked by policy enforcement mechanisms.
The "application/media-policy-dataset+xml" format was chosen over direct SDP for SUBSCRIBE bodies because it is more flexible, supports information not expressible in SDP (e.g., target URI), allows encoding both local and remote session descriptions in a single document, and aligns the formats for session-specific and session-independent policies.
The notifier must minimize response time to SUBSCRIBE requests because delay in generating the initial NOTIFY increases call setup latency during an INVITE transaction. Subscriptions can be established while in an INVITE transaction between 200 OK and ACK, so delays would defer ACK transmission.
If the notifier uses the same MIME format in NOTIFY bodies as the subscriber used in the SUBSCRIBE body, the notifier may assume the subscriber supports all format extensions used in the SUBSCRIBE. The notifier SHOULD NOT use extensions beyond those the subscriber demonstrated support for.
Subscribers SHOULD include the remote session description in SUBSCRIBE bodies when available, but SHOULD omit it in subsequent requests if the notifier has signaled via the "local-only" parameter that it does not require the remote description, reducing unnecessary information disclosure.
A SUBSCRIBE request for this event package MUST contain a body describing the SIP session. All subscribers and notifiers MUST support the MIME type "application/media-policy-dataset+xml" as the default format for SUBSCRIBE and NOTIFY bodies.
A subscriber MUST apply the policy decision received in a NOTIFY request to the associated session. If the UA decides not to apply the policy, it MUST NOT set up the session or MUST terminate it, and MUST cancel or reject any pending INVITE transaction.
A subscriber MUST insert the local session description in the SUBSCRIBE body when used with an SDP offer/answer exchange. If no session description is available initially (e.g., empty INVITE), the subscriber MUST refresh the subscription with the session description as soon as it becomes available.
A subscriber MUST NOT terminate a subscription unless it is terminating the associated session or discovers the notifier has been removed from the list of relevant policy servers. A notifier MAY terminate a subscription, for example after sending a final policy denial.
A subscriber MUST refresh the subscription to session-specific policies every time the session description of a session changes, sending a SUBSCRIBE request with the updated session descriptions.
All implementations of this package MUST support TLS and the SIPS URI scheme. Subscribers SHOULD use SIPS URIs when subscribing to session-specific policies so that policies are transmitted over TLS.
All subscriptions to session-specific policies SHOULD be authenticated and authorized before approval. If a UA cannot be authenticated, the policy server MAY provide a generic policy that does not reveal sensitive information.
If a notifier receives insufficient information to make a policy decision, it SHOULD accept the subscription and SHOULD generate a NOTIFY with the "insufficient-info" parameter. The NOTIFY body may be empty or contain hints about missing information.
If the SUBSCRIBE body contained a local session description and the subscription was accepted, the NOTIFY body MUST contain a policy for the local session description. If both local and remote descriptions were included, the NOTIFY MUST contain policies for both.
If the subscriber receives a NOTIFY indicating session rejection and the notifier terminated the subscription, the subscriber SHOULD NOT re-send the same SUBSCRIBE request. It MAY re-subscribe only if at least one aspect of the session has changed.
If the subscriber receives a NOTIFY with the "local-only" parameter, the subscriber SHOULD NOT include the remote session description in subsequent SUBSCRIBE requests within this subscription.
The default subscription duration for the session-specific policy package is two hours. The subscription duration SHOULD be longer than the typical duration of a session, and subscribers MUST refresh the subscription before the last SUBSCRIBE request expires.
The notifier SHOULD terminate the subscription if the policy decision is to reject a session and this decision will not change in the foreseeable future. The notifier SHOULD keep the subscription alive if rejection is temporary and resources may become available soon.
The policy document in a NOTIFY body MUST represent a complete policy decision. Delta or partial policy notifications are not supported in this event package.
The subscriber MUST provide the most recent and as-complete-as-possible session description in the SUBSCRIBE body, including all defined fields of the "application/media-policy-dataset+xml" session information document format, to avoid session rejection due to missing information.
This event package allows creation of only one dialog per initial SUBSCRIBE request (no forking). Notifications SHOULD NOT be generated at a rate of more than once every five seconds.
The event package name defined by this specification is "session-spec-policy". This name is used in the Event header field of SUBSCRIBE and NOTIFY requests to identify subscriptions to session-specific policies.
The "insufficient-info" parameter is an optional event package parameter defined only for NOTIFY requests. It signals that a policy decision could not be made due to insufficient information provided by the subscriber, and MUST be ignored if received in a SUBSCRIBE request.
The "local-only" parameter is an optional event package parameter defined only for NOTIFY requests. It indicates that the remote session description is not required by the notifier and MUST be ignored if received in a SUBSCRIBE request.
This specification registers the SIP event package name "session-spec-policy" in the IANA SIP Event Package registry, based on the procedures defined in RFC 6665. The contact is Volker Hilt at Bell Labs.
Authentication of the policy server SHOULD be performed by verifying the X.509 certificate presented during TLS establishment. The UA SHOULD ensure the identity in the certificate matches the policy server URI. New subscriptions SHOULD trigger UA authentication via X.509 or HTTP Digest.
If end-to-end integrity protection of policy exchange is required, subscriber and notifier MAY use S/MIME; however, this may prevent intermediaries that inspect or modify SIP message bodies from functioning correctly.
Session information transmitted by a UA to a policy server may contain sensitive data (e.g., media encryption keys). Conversely, policy responses may contain sensitive network or SLA information. Both parties MUST NOT include information in policy documents that is sensitive and not needed by the other party.
Session policies can significantly change UA behavior and may be exploited by attackers to compromise a UA — for example, by setting available bandwidth to zero to force session termination or by injecting malicious policy decisions. Policy servers SHOULD be addressable only through SIPS URIs, and both policy server and UA MUST support TLS.