Implementing Role-Based Authorization Capabilities in Session Initiation Protocol (SIP)

Date The final copy of this thesis has been examined by the signatories, and we find that both the content and the form meet acceptable presentation standards of scholarly work in the above mentioned discipline. iii Abstract Anand Chavali (M.S., Telecommunications) Implementing Role-based Authorization capabilities in the Session Initiation Protocol (SIP) Thesis directed by Professor Douglas Sicker This thesis presents an approach to providing role-based authorization capabilities for the Session Initiation Protocol (SIP). SIP defines various methods for performing authentication. Authorization, however, is not defined explicitly and is generally based on identity. This does not scale well in multi-domain scenarios. In order to facilitate a greater level of granularity and scalability for authorization in SIP, new mechanisms need to be defined. This thesis describes the implementation of role-based authorization capabilities as part of a federation. Federation, or federated management, is an approach where domains share the responsibility of controlling access to their respective resources to users in similarly diverse domains. It is particularly suited to a multi-domain environment and is extremely scalable. Role-based authorization is a paradigm wherein authorization decisions are based on 'role(s)' asserted or assumed by a user rather than the identity of that user. Roles assigned to a user depend on the function performed by that user in the particular organization. For instance, a user may have the role of a faculty member of a particular department, or the manager of a iv certain group. This arrangement enables easier management of authorization, expression of more sophisticated authorization policies, and affords some level of anonymity in certain scenarios. The approach in this paper involves asserting user attributes across domains in a secure manner. Security Assertion Markup Language (SAML) is the protocol chosen for the purpose. User attributes are coded into SAML assertions which are then transported between the SIP entities in different domains. These attributes each describe a role of the user. The agreements that are part of the federation are responsible for negotiating the set of attributes that need to be transferred in any given context. Bindings and profiles are essential components of the solution as they define ways to incorporate SAML in different communication protocols. This paper defines two profiles for using SAML in SIP; describing the transfer of SAML assertions by value or reference. An implementation of an authorization service is presented to execute these profiles. A security analysis of the threat model is also …