The SBC Core supports the exchange of SIP signaling over Transport Layer Security (TLS), an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections. Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol. TLS operates just above the transport layer (Layer 4) and provides peer authentication, confidentiality and message integrity.
The SBC supports TLS versions 1.0, 1.1 and 1.2 with server-only authentication (in which only the server is authenticated at the TLS layer) and mutual authentication (in which both the TLS client and server are authenticated at the TLS layer). TLS is an effective measure to a number of threats including theft of service, disruption of service, compromise of confidentiality, and compromise of service integrity.
SIP over TLS may be independently configured on each hop between SIP devices. SIP transport type selection is typically configured via the IP Signaling Profile, and may also be provisioned on the SIP trunk group or identified via a DNS lookup.
If a zone's
sipSigPort is configured for
sip-tls-tcp, SBC increments the configured
portNumber by 1 and uses it as the new port number for SIP over TLS signaling. SBC then opens a TCP socket for SIP over TLS for the new TCP port number.
sipSigPort is configured with a
portNumber of 5060 and
sip-tls-tcp, SBC listens on TCP port 5061 for SIP over TLS.
Usage Scenarios and TLS Roles
The SBC uses SIP over TLS in several scenarios as illustrated in the figure below .
In most scenarios, the SBC Core does not support ECC certificates for TLS Handshake. Specifically, the SBC Core does not support ECC certificates for TLS handshake when it acts as a TLS “server-only,” although it can support the certificates when acting as TLS client in the configured “server-and-client” role.
The table below describes the interrelationship between each of these scenarios, the TLS role (server or client/server), and the authentication requirements.
Between a subscriber SIP User Agent (UA) and an SBC.
This is intended for use in conjunction with authenticated SIP registration. A peer is blocked from using any services until a successful SIP registration is performed. A separate registrar is deployed to challenge and authenticate the registration; this may be a Sonus ASX or other device. The registrar should be configured to require authentication on the registration; however the SBC does not check or enforce this.
Between an enterprise PBX and an SBC.
Mutual TLS authentication for static (non-registering) IP PBX.
Server-only Authentication for registering PBX.
Between a SIP proxy or Back-to-Back User Agent (B2B UA) belonging to another administrative domain and an SBC.
Client or Server
Mutual TLS authentication.
Between an SBC and a SIP proxy or a B2B UA belonging to the same administrative domain.
Client or Server
Mutual TLS authentication
Deployments may involve two or more of the above scenarios and include different transports (SIP over TLS, SIP over TCP, or SIP over UDP) simultaneously on separate legs of the same signaling path.
Cipher suites define a set of ciphers (algorithms used for encrypting data) which allows selection of an appropriate level of security. When a TLS connection is established, the client and server exchange information about which cipher suites they have in common. The following cipher suites are supported:
|Public/Private Key Pair|
Confidentiality Cipher and Mode
The integrity cipher used for the TLS Record protocol.
Authentication mechanism in the TLS Handshake protocol.
Confidentiality cipher and mode for the TLS Record protocol.
Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.
Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.
Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
Confidentiality cipher and mode for TLS Recod with AES256 CBC and SHA384 as hash function.
Confidentiality cipher and mode for TLS Recod with AES256 GCM and SHA384 as hash function.
Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.
Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as hash function.
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.
** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.
Terms used in this table:
RSA – Authentication based on X.509 certificates using RSA public/private key pairs
3DES-EDE – Data Encryption Standard applied three times with Encrypt Decrypt Encrypt
AES-128 – Advanced Encryption Standard (128-bit key length)
CBC – Cipher Block Chaining
SHA – Secure Hash algorithm
When fips-140-2 mode is enabled, do not use
The SBC and its peer devices use X.509 digital certificates to authenticate themselves for TLS. Local certificates in PKSC # 12 format (attesting to the identity of the SBC) and remote Certificate Authority (CA) certificates may be installed on the SBC in a common area (/opt/sonus/external/) where they are available to TLS.