IPsec for Signaling

Overview

The SBC Core supports secure SIP signaling in peering environments using the IPsec protocol suite as defined in the table below.

Table 1: IPsec Security Features

The Ribbon IP Security (IPsec) feature provides cryptographic protection by the application of IPsec on a packet-by-packet basis controlled by rules in a Security Policy Database (SPD). These rules are applied to each incoming and outgoing packet, and as a function of source IP address, destination IP address, protocol, source port and destination port produce a directive to discard the packet, bypass the packet (allow it to pass as plaintext), or protect the packet with IPsec according to parameters specified in IPsec Protection Profile. IPsec is implemented using Encapsulating Security Payload (ESP) encapsulation.

During IPsec configuration, a single IP SECURITY POLICY instance is created and assigned to the interfaces group. The IP SECURITY POLICY contains the following databases:

• Security Policy Database (SPD)—An ordered list of "rules" built and configured by operators that specify the type of protection to provide for each packet that is subjected to the rule.
• Internet Key Exchange (IKE) Peer Database (IPD)—A list of peer devices built and configured by operators that defines eligibility and authentication data for protected sessions using IPsec.
• Security Association Database (SAD)—The list of active Security Associations (SAs) created from successful IPsec negotiations between the SBC Core and protected peers. Each SA is the bundle of algorithms and parameters used to encrypt and authenticate a particular flow in one direction. Thus for normal bidirectional traffic, the flows are secured by a pair of security associations. This list is system rather than operator generated.

Each SPD entry (or rule) identifies local and remote peer transport addresses that apply. This entry also establishes three packet protection actions:

• DISCARD—discard the packet
• BYPASS—pass the packet on without modification
• PROTECT—encrypt the packet according to an encryption algorithm that has been mutually agreed to by the session peers

The SPD entry PRECEDENCE establishes that entry's order relative to other entries from 1 to 65535. Each SPD entry references up to three IPsec Protection Profiles that specify an encryption cipher, a maximum time period for maintaining a security association between these peers (the SA "lifetime"), and an anti-replay policy. The three profiles are prioritized from 1 to 3 for use with the SPD entry.

Each IPD entry specifies a remote peer address to use for a protected session. The IPD entry also contains a PRESHARED SECRET (text string), and local and remote identification information. These parameters are all used in the peer-to-peer authentication process. As with SPD entries, IPD entries also reference up to three prioritized IKE Protection Profiles. The IKE profiles specify an encryption cipher, a maximum time period for maintaining security associations, and abandon-session-because-of-error policies. These profiles are also prioritized from 1 to 3 for usage with the IPD entry.

For IPsec Peer configuration details, see IPsec - Peer (EMA) or IPsec Peer - CLI.

IKEv1 Negotiation

An IPsec SA is the result of a successful two stage negotiation between the SBC Core and a peer. The phase 1 negotiation achieves a (bidirectional) IKE SA. The IKE SA provides a channel over which the two peers carry out a phase 2 negotiation. The successful completion of a phase 2 negotiation achieves an IPsec SA pair (two unidirectional SAs) that the peers may use to protect IP traffic between them until the IPsec SA expires or is removed.

In the IKE phase 1 exchange, the PRESHARED SECRET is used by the peers to authenticate one another. In the IKE phase 2 exchange, the packet selectors, the encryption cipher, the integrity cipher, and the SA lifetime are negotiated. If there is a valid intersection between the peers for all of these parameter values, then the phase 2 negotiation is successful and an IPsec SA will result.

When the negotiation is initiated by the peer, the SBC Core behaves as a responder. When SBC initiates the negotiation, it is the active participant in the exchange.
When the SBC Core participates as a responder, an initial IKE message from the peer causes SBC Core to access the IPD to find an entry enabling the authentication of a session between the peers. After a successful IKE phase 1 negotiation, a subsequent (phase 2) proposal from the peer causes SBC to search the SPD to find an entry with parameter values that overlap those values proposed by the peer. The parameter values in this SPD entry that are common to this entry as well as those proposed by the peer, are offered to the remote peer, as a counter proposal. If the peer accepts this counter proposal, then the IKE phase 2 negotiation is successful and an IPsec SA pair that defines a protection scheme for packets flowing between the SIP peer and SBC is established.

When the SBC Core acts as the initiator, an outgoing SIP message from SBC causes the SPD search. The SPD entry that is consequently selected points to a linked IPD entry (identifying the IKE peer) with which to pursue IKE phase 1 and phase 2 negotiations. The successful completion of these negotiations again results in an IPsec SA pair that defines the protection scheme for packets flowing between SBC and the SIP peer.

The following table depicts the impact of 'pfsRequired' state to Quick Mode exchange based on the SBC Core's role.

Table 2: IKEv1 Quick Mode Exchange Results

IKEv2 Support

IKEv2 performs mutual authentication between the SBC Core and its peer, and establishes an IKEv2 Security Association (SA) which includes shared secret information used to establish:

1. A set of cryptographic algorithms used by the SAs to protect the traffic between the SBC Core and the peer
2. CHILD-SAs for Encapsulated Security Payload (ESP) Protocol

All IKE communications consist of pair of messages – a request and a response. The pair is also referred as an exchange. The first exchanges of messages establishing an IKE SA are called the IKE_SA_INIT and IKE_AUTH exchanges; subsequent IKE exchanges are called the CREATE_CHILD_SA or INFORMATIONAL exchanges.

• IKE_SA_INIT: This exchange performs the following functions:

• 1. Negotiates cryptographic algorithms for the IKE-SA
  2. Exchanges nonces
  3. Diffie-Hellman exchange

After this exchange, the SBC Core and its peer generate the key material used to derive the shared symmetric keys for authentication and encryption. These keys are associated with the IKE_SA which is bi-directional. At this point, the SBC and peer have agreed on cryptographic keys, but they have not authenticated each other. 

• IKE_AUTH: This exchange performs the following functions:

• 1. Exchanges identities
  2. Proves knowledge of the secrets related to those identities
  3. Sets up an SA for the first ESP Child SA (IPsec SA pair)

The SBC Core and peer assert their identities (e.g. IP address, fully-qualified domain name) and use pre-shared keys authentication mechanism to prove this assertion. Each peer verifies the other peer’s assertion. Once verified, mutual entity authentication is provided. 

• CREATE_CHILD_SA: This exchange creates new/additional Child SAs and re-keys both IKE SAs and Child SAs.
• INFORMATIONAL: This exchange performs the following functions:
  
  1. Deletes SAs as needed
  2. Reports error conditions
  3. Checks liveliness of the other endpoint

Once the first two mandatory exchanges have completed in their proper order, all subsequent exchanges can occur in any order as necessary. In the common case, there is a single IKE_SA_INIT exchange and a single IKE_AUTH exchange (a total of four messages) to establish the IKE SA and the first Child SA. In exceptional cases, there may be more than one of each of these exchanges.

The following table depicts the impact of 'pfsRequired' state to CREATE_CHILD_SA Exchange based on SBC Core's role during IPSEC SA re-key:

Table 3: IKEv2 CREATE_CHILD_SA Exchange Results

SA Removal

SAs are removable before their lifetime expires using the following methods:

• Globally delete every IKE SA (DELETE...ALL)
• Delete a specific IKE SA by its IKE handle identifier (DELETE...IKE ID...)
• Delete the IPsec SA pair with a given incoming Security Parameter Index value (LOCAL SPI)

SAs are also removable through notification by the peer that an SA is deleted, or as a result of Dead Peer Detection determining that a peer is unresponsive.

If an SA is deleted by one of the above scenarios within 60 seconds of the time that it was initially established, then as a Denial-of-Service protection the SBC Core does not respond to new phase 1 IKE negotiations initiated by that peer for 60 seconds. Otherwise, phase 1 IKE re-negotiations may proceed immediately on a deleted SA.

Initiator and Responder Behavior