A session border controller can best be described as an appliance that sits at the edge of networks. It provides an additional layer of security over the core SIP network and, at the same time, facilitates media flows and incompatible signal interworking. The SBC functions as a back to back user agent taking on the role of the user agent and user agent client for each signal message. While security is no less important, the importance of media components and interoperability cannot be underplayed. The session border controller blends in with the IP Multimedia System. The IMS itself is a multi-layer hierarchical construct that includes, among others, 3GPP IMS technical specification TS 23.228. While hardware session border controllers were the norm today most such solutions are software-based with more functionality such as least cost routing and billing.
Security with session border controller
- Enterprises and service providers usually install an SBC solution with the prime purpose of providing an additional layer of security for the internal network and guard it against attacks.
- Hackers may carry out a scan of the internal network port to footprint the topology and then launch frauds, thefts or denial of service (DoS).
- Hackers may take over a session and impersonate a caller leading to DoS, thefts, and frauds. Eavesdropping is possible wherein an attacker sniffs sessions and packets with malintent.
- Attackers may take over control and reroute a call.
- Malformed packets may be injected and media may be injected leading to frauds and denial of service.
The SBC provides a vital service by hiding internal topology and carrying out Network address traversal. It replaces addresses and extra headers from SIP messages. SBCs can prevent outbound telnet or SSH thereby acting as a guard against hijacking attempts. Further, real-time communication media sessions that are most vulnerable to eavesdropping are modified by the SBC through TLS encryption for SIP and SRTP. It can identify IP Packets from untrusted sources and IP packets for unsupported protocols. The result is the minimization of the DoS threat. Trusted traffic gains precedence over untrusted signals enabling continuity even during a DoS attack. In short, the SBC works alongside the firewall. The latter usually takes care of data security while SBC focuses more on SIP and media signals. How versatile the SBC is can be judged from the fact that it not only keeps a sharp lookout for external threats but also looks inward for attempts at toll fraud or misuse that could cause revenue losses.
Protocol differences
Today’s VoIP networks handle voice traffic as well as video and a variety of other media packets based on various codecs and protocols. Vendors may implement SIP in different ways and this causes mismatches, failures, and outages. Unrecognized SIP headers can cause PBX systems to reject a message or deny access or even cause a system crash. Further, the firewall’s NAT function may disrupt signaling and affect media too. The SBC steps in and carries out normalization in real-time thereby mitigating multi-vendor interoperability problems and service availability. VoIP networks also see fluctuating traffic in which case the SBC also plays the role of balancing bandwidth and managing traffic flows to assure smooth services. Was it not for the SBC’s capability to transcode codecs and validate protocols users would have numerous issues, particularly in today’s unified communication environment? Introduce a session border controller in the network and you have tremendous improvement in the quality of service with seamless connectivity between IPv4/IPv6 and superior SIP normalization, protocol translation, and NAT traversal.
Statistics and billing
While not strictly necessary session border controllers solutions can also include detailed monitoring, recording, and analytics in addition to billing information.
Apart from sitting at the edge of networks, SBC solutions can form the network core to step over internal topology issues or it can be included in a network core to work as a codec transcoder. Two carriers or service providers can have SBCs at each end to handle VoIP traffic in a far better way and deliver a better quality of services in a safe and secure way.
Considering the fact that users require uninterrupted, secure and confidential communications and that more hackers are targeting the increased flow of VoIP traffic the session border controller is indispensable for carriers and service providers. It is also a must-have for business enterprises that use VoIP for unified communications. Asterisk Service offers intelligent SBCs that are future proof and fully capable of extreme performance with built-in redundancy and failsafe features.