Multimedia networking Voice/data integration

Transcription

1 Multimedia networking Voice/data integration Presentation_ID 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 1 1 Agenda XXth Century voice = Analog thentime Division Multiplexing (TDM) XXIst Century voice packetization Quality of service Signalling Issues with NAT Security 3 1

2 Loop Start Signaling On-hook, open loop Off-hook, close loop BELL BELL Station Loop (Local or Station) T R DC Current PBX or Central Office + 48v + 48v Ring on-hook Ans off-hook BELL BELL!! Ringing + 48v 5 Echo in Voice Networks Listener Talker Delay in the network Talker Echo Listener Echo 6 2

3 Echo Is Always Present - 50 High Loss Echo Loss (db) Echo Is Unnoticeable Echo Is a Problem Low Loss - 10 ~20 ~200 Echo Path Delay (ms) 7 Speech and the Telephone Network 3700Hz voice bandwidth Power / Volume Human Ear Response Telephone Network 300Hz 3400Hz 4kHz 16kHz Frequency / Pitch 8 3

4 Mean Opinion Score Source Channel Simulation Impairment Codec X Nowadays, a chicken leg is a rare dish Rating Speech Quality Level of Distortion 5 Excellent Imperceptible 4 Good Just perceptible but not annoying 3 Fair Perceptible and slightly annoying 2 Poor Annoying but not objectionable 1 Unsatisfactory Very annoying and objectionable MOS of 4.0 = Toll Quality 9 Agenda XX Century voice XXI Century voice packetization Quality of service Signalling Issues with NAT Security 11 4

5 IP Phones QoS in phones - standard 802.1p/q Integrated Ethernet switching Easy access to new world features IPv6 GigaEthernet Video IEEE 802.1x 12 Inline Power: IEEE 802.3AF IP phone are power hungry and you do not want to have a 220V power cable => get power through the UTP cable 10/100 Ethernet without Inline Power 13 5

6 Agenda XXth Century voice XXIst Century voice Packetization Quality of service Signalling Issues with NAT Security 14 Analogue to Digital Voice Pulse Code Modulation Nyquist Theorem Analogueue Audio Source B/W = 300 to 4000Hz Sampling Stage 1 sample = 8 bits; 8000 samples/sec = 64,000 bit/s Digital Audio Stream 15 6

7 Speech Compression Techniques Overview 16 Subjective Quality (MOS) Hybrid Coders (LD-CELP & CS-ACELP) Vocoders (Older Technology) Waveform Coders (ADPCM) Kbps Score Quality Description of Impairment Excellent Good Fair Poor Bad Imperceptible Just Perceptible, not Annoying Perceptible and Slightly Annoying Annoying but not Objectionable Very Annoying and Objectionable Source: A.M. Kondoz, Digital Speech Coding for Low Bit-Rate Communications Systems,

8 RTP/RTCP RFCs 1889/1890 End-to-end network transport function Payload type identification voice, video, compression type Sequence numbering Time stamping Delivery monitoring RTCP (Real-Time Control Protocol) 4 Bytes V E R CC M Payload Type Sequence Number 4 Bytes 4 Bytes RTP Timestamp Synchronization Source (SSRC) ID 19 Bandwidth Per IP Call 8kbit/s of compressed voice IP Header (20) UDP (8) RTP (12) Header is 40 bytes 26 kbps of bandwidth per call Compressing RTP Header gives

9 Agenda XXth Century voice XXIst Century voice Packetization Quality of service Signalling Issues with NAT Security 22 Delay and Voice Sender Receiver Network First Bit Transmitted A A Last Bit Received Processing Delay Network Transit Delay End-to-End Delay Processing Delay t 23 9

10 Delay Variation Jitter SenderA ReceiverB Network C B A Sender Transmits d2 d1 t C B A B Receives Jitter D2 = d2 D1 = d1 t 24 Delay and Jitter Delay and jitter are generated when a packet is stored and forwarded: by router and switches Delay is also generated by links 1 microsecond every 200 Km Jitter is also caused by burst Jitter requires play-back buffers Adding more delay

11 Differentiated Services Finance Manager Remote Campus Classification Enforcement Campus Backbone Classification Multimedia Training Servers 27 Version Length Packet Classification Layers ToS 1 Byte 3 bits called IP Precedence for differentiated services (DiffServ may use 6 D.S. bits plus 2 for flow ctrl) Len ID offset TTL Proto FCS IP-SA IP-DA Data 6 diff serv code points + 2 for flow control Version Length Traffic Class 1 Byte Flow Label Len Next Hdr Hop Limit IP-SA IP-DA Data 3 bits used for COS (user priority) PREAM. SFD DA SA TAG 4 Bytes PT DATA FCS 28 11

12 Evolving Business Requirements Business Requirements Will Evolve and Expand over Time 4-Class Model Realtime Signaling / Control 8-Class Model Voice Interactive Video Streaming Video Call Signaling 12-Class Model Voice Realtime Interactive Multimedia Conferencing Broadcast Video Multimedia Streaming Call Signaling Critical Data Best Effort Network Control Critical Data Best Effort Scavenger Network Control Network Management Transactional Data Bulk Data Best Effort Scavenger Time 29 Collaboration & Presence Presence augmented Instant Messaging Who is on-line Are they busy? Where are they? All of this pieces of information Can be automated Crucial for quick and efficient interaction

13 Collaboration & Teleconference High-speed, ubiquitous Internet allows Cheap (Internet based) communications Visual interaction Sharing slides, documents Seeing others on video Working on the same document 32 Collaboration and Telepresence 33 13

14 New Application Requirements The Impact of HD on the Network User demand for HD video has a major impact on the network (H.264) 720p HD video requires twice as much bandwidth as (H.323) DVD (H.264) 1080p HD video requires twice as much bandwidth as (H.264) 720p 35 Agenda 36 14

15 SIP: Session Initiated Protocol SIP is another VoIP signaling protocol Web like Text format messages Similar to HTTP Fast call setup Run over UDP or TCP SIP proxies are the equivalent of H.323 gatekeepers 39 SIP Basics SIP is a peer-to-peer protocol where end-devices (User Agents - UAs) initiate sessions SIP defines the signaling mechanism SIP works for voice, video, instant messaging SIP uses IETF protocols HTTP 1.1 Session Description Protocol (SDP) media (RTP) name resolution & mobility (DHCP & DNS) application encoding (MIME) SIP is ASCII text-based:- implementation & debugging 40 15

16 VoIP Architecture Based on Session Initiation Protocol Old Phone network Internet or private IP network 3) External voice SIP Trunk SIP Proxy Extensio n IP Address :db8::abba:babe 1) SIP registration SIP Clients! Ext: 2000 IP: ) Voice Ext: 6000 IP: 2001:db8::abba:babe 41 VoIP Pricing... SIP: Session Initiation Protocol Used to allow only authenticated device SIP Proxy Register the IP address of a phone extension SIP Trunk: gateway to classical analog voice SIP proxy: free software (Asterisk) on an existing server SIP trunk: cheap calls fixed price for Europe 5 EUR/month SIP client on mobile/pc: free SIP physical IP phones: 100 EUR 42 16

17 SIP Commands/Responses Commands Responses INVITE CONNECTED BYE UNREGISTER REGISTER 1XX Information 2XX Success 3XX Redirection 4XX Client Error 5XX Server Error 6XX Global Failure 43 SIP Call Flow SIP Phone INVITE 3xx Redirect Redirect Server Or SIP proxy SIP UA / GW INVITE to Address Returned in Contact: of 3XX response 100 Trying 180 Ringing 200 OK ACK BYE 200 OK 44 17

18 Web Real Time Communication = WebRTC IETF & W3C work supported by Google, Mozilla, Opera Do peer-to-peer communication IN the browser Goal is interoperation of browsers and applications Big $$$ involved in codec licenses... Relies on DTLS (SSL for UDP), SCTP, STUN,... (see later) Source: Creative Commons, Feyd-Aran 45 What Is (or or 9-9-9)? A simple, easy to remember telephone number that allows automated call routing to the local public safety agency, based on where you are calling from In some jurisdictions (North America) there are many different destinations; source routed Mostly ubiquitous for residential service Varying degrees of deployment globally Enhanced in North America European Union current efforts to converge on India currently has country-wide rollout of

19 Legacy Architecture Smart Network Dumb Endpoints OSI Model Layer 7 Mydialtone PhoneCompany, Inc. The End Device Location Layer 3 Mynetwork Layer 1/2 Mywires PhoneCompany, Inc. PhoneCompany, Inc. 48 Internet Architecture Dumb Network Smart Endpoints OSI Model Layer 7 Application Location/Presence.com Location Common Point The End Device I Think I ll Advertise My Location Layer 3 Network Layer 2 Access ISP, Inc. Last Mile, Inc. Location 49 19

20 VPN to Corporate Problem: The Global Road Warrior Hotel in Chicago 112, What s That? Chicago, Where s That? Internet Corporate HQ in Paris How Do I Route This One? Chicago PSAP This issue Must be solved! 50 SIP Routing Based on UAC s Location Alice Outbound Proxy INVITE w/ SDP and Location SIP Routing based on Location urn:service:sos is not globally unique If LoST query done by UA, may be as a Route header Though not sure yet Proxy MUST learn UAC s location, determine where UAC is, then Route the call to the proper Public Safety Answering Point (PSAP) * Short form means not enough room here INVITE sips:urn:service:sos SIP/2.0 Via: SIP/2.0/TLS pc33.atlanta.com;branch=z9hg4bk74 Max-Forwards: 70 From: Alice <sip:alice@atlanta.com>;tag=9fxced76sl To: <sip:urn:service:sos> Call-ID: @pc33.atlanta.com CSeq: INVITE Geolocation: <cid:alice123@atlanta.example.com> Route: <sips:psap1@orlando.fl.gov;lr> Contact: <sip:alice@atlanta.com> Content-Type: multipart/mixed; boundary=0a0 Content-Length: a0 Content-Type: application/sdp v=0 o=alice IN IP4 atlanta.com c=in IP t=0 0 m=audio RTP/AVP 0 a=rtpmap:0 PCMU/ a0 Content-Type: application/pidf+xml (short form*) <gml:location> <gml:coordinates>28.44n 81.46W </gml:coordinates> </gml:location> <method>802.11</method> <provided-by> --0a

21 Agenda 52 Network Address Translation: IP at Home IPv4 addresses are scarce and close to exhaustion Network Address Translation helps ! Internet! ! ADSL or Cable modem:! 1 IPv4 address! WiFi ʻRouterʼ! Multiplex all inside! Hosts over the ISP address! ADSL Modem! 53 21

22 Different NAT Behaviors... Good reading: The Internet Protocol Journal, Volume 7, Number 3 by Geoff Huston 54 Symmetric NAT 55 22

23 Full Cone NAT 56 What is STUN/ICE? STUN Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NAT) STUN (RFC3489) is a request/response protocol Response contains IP address and UDP port of request Allows client behind a NAT to find out its public address, the type of NAT it is behind and the internet side port associated by the NAT Example application: Googletalk ICE Interactive Connectivity Establishment Defines a standardized method for SIP-enabled clients to determine a set of IP addresses where clients can establish contact behind firewall Leverages STUN to collect IP addresses Example: MSN Live Messenger 57 23

24 STUN Overview Simple Traversal of UDP through NAT RFC 3489 Client-server protocol Allows a client behind a NAT find out its public address the internet side port associated by NAT with a particular local port type of NAT it is behind This information is used for UDP communication between two hosts that are both behind NAT routers. Free implementation of STUN client/server 58 STUN Operation STUN server located on the public Internet. Using 2 addresses and 2 ports. STUN STUN usages binding discovery, NAT keepalives STUN messages are sent on the very same ports that RTP will use latter First 2 bits allow to differentiate between STUN and RTP STUN Server NAT2 NAT1 STUN Client Public Internet Private Net 2 Private Net

25 Interactive Connectivity Establishment (ICE) Overview offer-answer model for media streams through NAT. use of STUN and its relay extension TURN in a specific methodology which avoids many of the pitfalls of using any one alone. Each agent can have its own STUN server, or they can be the same ICE agents (endpoints) discover their topologies to find a path or paths by which they can communicate. Agents L and R are capable of engaging in an offer/answer exchange SDP messages to set up a media session between L and R. Exchange will occur through a SIP server Gathering Candidate Addresses each agent has a variety of candidate transport addresses: directly attached network interface A translated address on the public side of a NAT (a "server reflexive" address) The address of a media relay the agent is using Could be IPv4 or IPv6 or both 61 25

26 Example Stun Srvr Binding discovery usage :3478 NAT Agent L Agent R 2001:db8:bad::f00d 62 Connectivity Checks Local Order highest to lowest priority candidates Sends them to R over the signaling channel in the SDP offer. When R receives the offer: same gathering process responds with its own ordered list of candidates. sorts the candidate pairs in priority order. Sends checks on each candidate pair in priority order. Both acknowledge checks received from the other agent

27 Agenda 64 Voice and Data Threat Models Merge IP Telephony inherits IP data network threat models: Reconnaissance, DoS, host vulnerability exploit, surveillance, hijacking, identity, theft, misuse, etc. QoS requirements of IP Telephony increase exposure to DoS attacks that affect: Delay, jitter, packet loss, bandwidth PC endpoints typically require user authentication, phones typically allow any user (exceptions: access/billing codes, Class of Service) 65 27

28 Securing the IP Telephony Itself Plain SIP/SCCP protocols: No authentication No integrity No confidentiality Secure SIP/SCCP protocols With authentication: using X.509 certificates With integrity and confidentiality Rely on cryptographically secure protocols Secure firmware and configuration with RSA signatures 70 Protecting Signaling TLS: Transport Layer Security Supports any application protocol HTTP SCCP SIP LDAP TLS TCP IP Needs secure method to exchange shared secret Bi-directional PKI pairs for mutual authentication Shared secret exchanged using RSA Computes Hashed Message Authentication Code (HMAC) Allows MD5 or SHA1 Conventional cryptography using shared secret DES, 3DES, AES RC2, RC4 IDEA 71 28

29 Authentication and Encryption Basics Protecting the Signaling TLS is the transport for signed (RSA), authenticated (HMAC- SHA1) and encrypted (AES-128) signaling (1) 72 SRTP: Secure RTP RFC 3711 for transport of secure media Uses AES-128 for both authentication and encryption High throughput, low packet expansion V P X CC M PT sequence number timestamp synchronization source (SSRC) identifier contributing sources (CCRC) identifiers RTP extension (optional) RTP payload SRTP MKI -- 0 bytes for voice Authentication tag -- 4 bytes for voice Encrypted portion Authenticated portion 73 29

30 Authentication and Encryption Basics Protecting the Media Streams CTL Client CAPF SRTP is the transport for authenticated and encrypted (AES-128) media (2) 74 Final Words IP Telephony is now a proven technology SIP is the standard IP Telephony can be secured 77 30