Session Border Controller
Encyclopedia
A session border controller (SBC) is a device regularly deployed in Voice over Internet Protocol (VoIP) networks to exert control over the signaling
Signalling (telecommunications)
In telecommunication, signaling has the following meanings:*the use of signals for controlling communications...

 and usually also the media streams involved in setting up, conducting, and tearing down telephone calls or other interactive media communications.

SBC's original deployments were focused on the borders between two service provider networks in a peering environment. This role has now expanded to include significant deployments between a service provider's access network and a backbone network to provide service to residential and/or enterprise customers.

Functions

SBCs commonly maintain full session state and offer the following functions:
  • Security
    Network security
    In the field of networking, the area of network security consists of the provisions and policies adopted by the network administrator to prevent and monitor unauthorized access, misuse, modification, or denial of the computer network and network-accessible resources...

     – protect the network and other devices from:
  • Malicious attacks such as a denial-of-service attack
    Denial-of-service attack
    A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...

     (DoS) or distributed DoS
  • Toll fraud via rogue media streams
  • Topology hiding
  • Malformed packet protection
  • Encryption of signaling (via TLS
    Transport Layer Security
    Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide communication security over the Internet...

     and IPSec) and media (SRTP
    Secure Real-time Transport Protocol
    The Secure Real-time Transport Protocol defines a profile of RTP , intended to provide encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications...

    )
  • Connectivity – allow different parts of the network to communicate through the use of a variety of techniques such as:
  • NAT traversal
  • SIP normalization via SIP message and header manipulation
  • IPv4 to IPv6 interworking
  • VPN connectivity
  • Protocol translations between SIP
    Session Initiation Protocol
    The Session Initiation Protocol is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol . The protocol can be used for creating, modifying and terminating two-party or multiparty sessions...

    , SIP-I, H.323
    H.323
    H.323 is a recommendation from the ITU Telecommunication Standardization Sector that defines the protocols to provide audio-visual communication sessions on any packet network...

  • Quality of service
    Quality of service
    The quality of service refers to several related aspects of telephony and computer networks that allow the transport of traffic with special requirements...

     – the QoS policy of a network and prioritization of flows is usually implemented by the SBC. It can include such functions as:
  • Traffic policing
  • Resource allocation
  • Rate limiting
  • Call admission control
  • TOS/DSCP bit setting
  • Regulatory – many times the SBC is expected to provide support for regulatory requirements such as:
  • emergency calls prioritization and
  • lawful interception
    Lawful interception
    Lawful interception is obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence. Such data generally consist of signalling or network management information or, in fewer instances, the content of the communications...

  • Media services – many of the new generation of SBCs also provide built-in digital signal processors (DSPs) to enable them to offer border-based media control and services such as:
  • DTMF relay and interworking
  • Media transcoding
  • Tones and announcements
  • Data and fax interworking
  • Support for voice and video calls
  • Statistics and billing information – since all sessions that pass through the edge of the network pass through the SBC, it is a natural point to gather statistics and usage based information on these sessions.


The term session refers to a communication between two parties – in the context of telephony, this would be a call. Each call consists of one or more call signaling message exchanges that control the call, and one or more call media streams which carry the call's audio, video, or other data along with information of call statistics and quality. Together, these streams make up a session. It is the job of a session border controller to exert influence over the data flows of sessions.

The term border refers to a point of demarcation between one part of a network and another. As a simple example, at the edge of a corporate network, a firewall demarcates the local network (inside the corporation) from the rest of the Internet (outside the corporation). A more complex example is that of a large corporation where different departments have security needs for each location and perhaps for each kind of data. In this case, filtering routers or other network elements are used to control the flow of data streams. It is the job of a session border controller to assist policy administrators in managing the flow of session data across these borders.

The term controller refers to the influence that session border controllers have on the data streams that comprise sessions, as they traverse borders between one part of a network and another. Additionally, session border controllers often provide measurement, access control, and data conversion facilities for the calls they control.

Theory of operation

SBCs are inserted into the signaling and/or media paths between calling and called parties in a VoIP call, predominantly those using the Session Initiation Protocol
Session Initiation Protocol
The Session Initiation Protocol is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol . The protocol can be used for creating, modifying and terminating two-party or multiparty sessions...

 (SIP), H.323
H.323
H.323 is a recommendation from the ITU Telecommunication Standardization Sector that defines the protocols to provide audio-visual communication sessions on any packet network...

, and MGCP call signaling protocols.

In many cases, in order to hide the network topology and protect the service provider or enterprise packet network, the SBC will terminate a received call and initiate a second call leg to the destination party. In technical terms, when used within the SIP protocol, this is defined as being a back-to-back user agent
Back-to-back user agent
A back-to-back user agent is a logical network element in Session Initiation Protocol applications. SIP is a signaling protocol to manage multimedia Voice over Internet Protocol telephone calls...

 (B2BUA). The effect of this behavior is that not only the signaling traffic, but also the media traffic (voice, video) can be controlled by the SBC. In cases where the SBC does not have the capability to provide media services onboard, SBCs are also able to redirect media traffic to a different element elsewhere in the network, for recording, generation of music-on-hold, or other media-related purposes. Conversely, without an SBC, the media traffic travels directly between the VoIP phones, without the in-network call signaling elements having control over their path.

In other cases, the SBC simply modifies the stream of call control (signaling) data involved in each call, perhaps limiting the kinds of calls that can be conducted, changing the codec
Codec
A codec is a device or computer program capable of encoding or decoding a digital data stream or signal. The word codec is a portmanteau of "compressor-decompressor" or, more commonly, "coder-decoder"...

 choices, and so on. Ultimately, SBCs allow the network operators to manage the calls that are made on their networks, fix or change protocols and protocol syntax to achieve interoperability, and also overcome some of the problems that firewalls and network address translators (NATs) present for VoIP calls.

SBCs are often used by corporations along with firewalls and Intrusion Prevention Systems (IPS) to enable VoIP calls to and from a protected enterprise network. VoIP service providers use SBCs to allow the use of VoIP protocols from private networks with Internet
Internet
The Internet is a global system of interconnected computer networks that use the standard Internet protocol suite to serve billions of users worldwide...

 connections using NAT, and also to implement strong security measures that are necessary to maintain a high quality of service. SBCs also replace the function of application-level gateway
Application-level gateway
In the context of computer networking, an application-level gateway consists of a security component that augments a firewall or NAT employed in a computer network...

s. In larger enterprises, SBCs can also be used in conjunction with SIP trunks to provide call control and make routing/policy decisions on how calls are routed through the LAN/WAN. There are often tremendous cost savings associated with routing traffic through the internal IP networks of an enterprise, rather than routing calls through a traditional circuit-switched phone network.

Additionally, some SBCs can allow VoIP calls to be set up between two phones using different VoIP signaling protocols (e.g., SIP, H.323, Megaco
Megaco
Megaco is a gateway control protocol. and an implementation of the Media Gateway Control Protocol architecture for controlling media gateways in Internet Protocol networks and the public switched telephone network...

/MGCP) as well as performing transcoding of the media stream when different codecs are in use. Most SBCs also provide firewall features for VoIP traffic (denial of service protection, call filtering, bandwidth management). Protocol normalization and header manipulation is also commonly provided by SBCs, enabling communication between different vendors and networks.

From an IP Multimedia Subsystem
IP Multimedia Subsystem
The IP Multimedia Subsystem or IP Multimedia Core Network Subsystem is an architectural framework for delivering Internet Protocol multimedia services. It was originally designed by the wireless standards body 3rd Generation Partnership Project , as a part of the vision for evolving mobile...

 (IMS) or 3GPP (3rd Generation Partnership Project) architecture perspective, the SBC is the integration of the P-CSCF and IMS
IMS
-Organizations and institutes:* IMS International Medical Services, a department of the State University Medical Center Freiburg offering services for foreign patients....

-ALG
ALG
ALG may refer to:* Algebra* Algeria* A-League, domestic football league in Australasia* Algonquian languages, from its ISO 639 code* American Laser Games* Americans for Limited Government* Anti-lymphocyte globulin, an immunosuppressive drug...

 at the signaling plane and the IMS Access Gateway at the media plane on the access side. On the interconnect side, the SBC maps to the IBCF, IWF
IWF
IWF is an abbreviation with multiple uses:*IWF Promotions, AKA IWF Premier Pro Wrestling, an independent professional wrestling promotion based in Denver, Colorado* Independent Women's Forum, an equity feminist non-profit organization...

 at the signaling plane and TrGW (Transition Gateway) at the media plane.

From an IMS/TISPAN
TISPAN
The Telecoms & Internet converged Services & Protocols for Advanced Networks is a standardization body of ETSI, specializing in fixed networks and Internet convergence...

 architecture perspective, the SBC is the integration of the P-CSCF and C-BGF functions on the access side, and the IBCF, IWF, THIG, and I-BGF functions on the peering side. Some SBCs can be "decomposed", meaning the signaling functions can be located on a separate hardware platform than the media relay functions - in other words the P-CSCF can be separated from the C-BGF, or the IBCF/IWF can be separated from the I-BGF
BGF
BGF may be:* the IATA airport code for Bangui M'Poko International Airport in the Central African Republic* Black Guerrilla Family* The Bob's Game Forum* The Border Guard Force in Burma....

 functions physically. Standards-based protocol, such as the H.248 Ia profile, can be used by the signaling platform to control the media one while a few SBCs use proprietary protocols.

Controversy

The concept of SBC is controversial to proponents of end-to-end systems and peer-to-peer
Peer-to-peer
Peer-to-peer computing or networking is a distributed application architecture that partitions tasks or workloads among peers. Peers are equally privileged, equipotent participants in the application...

 networking because:
  • SBCs can extend the length of the media path (the way of media packets through the network) significantly. A long media path is undesirable, as it increases the delay of voice packets and the probability of packet loss. Both effects deteriorate the voice/video quality. However, many times there are obstacles to communication such as firewalls between the call parties, and in these cases SBCs offer an efficient method to guide media streams towards an acceptable path between caller and callee; without the SBC the call media would be blocked. Some SBCs can detect if the ends of the call are in the same subnetwork
    Subnetwork
    A subnetwork, or subnet, is a logically visible subdivision of an IP network. The practice of dividing a network into subnetworks is called subnetting....

     and release control of the media enabling it to flow directly between the clients, this is anti-tromboning
    Anti-tromboning
    Anti-tromboning is a feature employed in telecommunication networks, such as voice over IP networks, that optimises the use of the access network and reduces excess processing and traffic...

     or media release. Also, some SBCs can create a media path where none would otherwise be allowed to exist (by virtue of various firewalls and other security apparatus between the two endpoints). Lastly, for specific VoIP network models where the service provider owns the network, SBCs can actually decrease the media path by shortcut routing approaches. For example, a service provider that provides trunking services to several enterprises would usually allocate each enterprise a VPN. It is often desirable to have the option to interconnect the VPN through SBCs. A VPN-aware SBC may perform this function at the edge of the VPN network, rather than sending all the traffic to the core.
  • SBCs historically had the potential to restrict the flow of information between call endpoints, restricting end-to-end transparency. VoIP phones may not be able to use new protocol features unless they are understood by the SBC. However, the more modern and flexible SBCs are able to cope with the majority of new, and unanticipated protocol features.
  • Sometimes End-to-End encryption
    Encryption
    In cryptography, encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information...

     can't be used if the SBC does not have the key, although some portions of the information stream in an encrypted call are not encrypted, and those portions can be used and influenced by the SBC. However, the new generations of SBCs, armed with sufficient computing capacity, are able to offload this encryption function from other elements in the network by terminating SIP-TLS
    Transport Layer Security
    Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide communication security over the Internet...

    , IPsec
    IPsec
    Internet Protocol Security is a protocol suite for securing Internet Protocol communications by authenticating and encrypting each IP packet of a communication session...

    , and/or SRTP
    Secure Real-time Transport Protocol
    The Secure Real-time Transport Protocol defines a profile of RTP , intended to provide encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications...

    . Furthermore, SBCs can actually make calls and other SIP scenarios work when they couldn't have before, by performing specific protocol "normalization" or "fix-up".
  • In most cases, far-end or hosted NAT traversal
    NAT traversal
    NAT traversal is a general term for techniques that establish and maintain Internet protocol connections traversing network address translation gateways. Network address translation breaks end-to-end connectivity. Intercepting and modifying traffic can only be performed transparently in the...

     can be done without SBCs if the VoIP phones support protocols like STUN
    STUN
    STUN is a standardized set of methods, including a network protocol, used in NAT traversal for applications of real-time voice, video, messaging, and other interactive IP communications....

    , TURN
    Traversal Using Relay NAT
    Traversal Using Relays around NAT is a protocol that allows for an element behind a Network address translator or firewall to receive incoming data over TCP or UDP connections. It is most useful for elements behind symmetric NATs or firewalls that wish to be on the receiving end of a connection...

    , ICE
    Interactive Connectivity Establishment
    Interactive Connectivity Establishment is a technique used in computer networking involving network address translators in Internet applications of Voice over Internet Protocol , peer-to-peer communications, video, instant messaging and other interactive media...

    , or Universal Plug and Play
    Universal Plug and Play
    Universal Plug and Play is a set of networking protocols for primarily residential networks without enterprise class devices that permits networked devices, such as personal computers, printers, Internet gateways, Wi-Fi access points and mobile devices to seamlessly discover each other's presence...

     (UPnP).


Most of the controversy surrounding SBCs pertains to whether call control should remain solely with the two endpoints in a call (in service to their owners), or should rather be shared with other network elements owned by the organizations managing various networks involved in connecting the two call endpoints. For example, should call control remain with Alice and Bob
Alice and Bob
The names Alice and Bob are commonly used placeholder names for archetypal characters in fields such as cryptography and physics. The names are used for convenience; for example, "Alice sends a message to Bob encrypted with his public key" is easier to follow than "Party A sends a message to Party...

 (two callers), or should call control be shared with the operators of all the IP networks involved in connecting Alice and Bob's VoIP phones together. The debate of this point is vigorous, almost religious, in nature. Those who want unfettered control in the endpoints only, are greatly frustrated by the various realities of today's networks, such as firewalls, filtering/throttling, and the lack of adoption of a universal VoIP equivalent to the phone number. Those who provide the infrastructure used to connect the call end-points, are typically concerned about overall network performance/quality and want to ensure it is secure against the new series of threats that come with an IP based packet infrastructure. So far, these views have not proven to be reconcilable. Note that it may be required for a third call control element such as an SBC to be inserted in between the two endpoints in order to satisfy local lawful interception regulations.

Lawful intercept and CALEA

An SBC may provide session media (usually RTP
Real-time Transport Protocol
The Real-time Transport Protocol defines a standardized packet format for delivering audio and video over IP networks. RTP is used extensively in communication and entertainment systems that involve streaming media, such as telephony, video teleconference applications, television services and...

) and signaling (often SIP) wiretap services, which can be used by providers to enforce requests for the lawful interception
Lawful interception
Lawful interception is obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence. Such data generally consist of signalling or network management information or, in fewer instances, the content of the communications...

 of network sessions. Standards for the interception of such services are provided by ATIS
Alliance for Telecommunications Industry Solutions
The Alliance for Telecommunications Industry Solutions is a standards organization that develops technical and operational standards for the telecommunication industry. ATIS is headquartered in Washington, D.C....

, TIA
Telecommunications Industry Association
The Telecommunications Industry Association is accredited by the American National Standards Institute to develop voluntary, consensus-based industry standards for a wide variety of ICT products, and currently represents nearly 400 companies...

, CableLabs
CableLabs
Founded in 1988 by cable television operating companies, Cable Television Laboratories, Inc. is a not-for-profit research and development consortium that has cable operators as its members. System operators from around the world are eligible to be members. Members dues are based on revenue...

 and ETSI
European Telecommunications Standards Institute
The European Telecommunications Standards Institute is an independent, non-profit, standardization organization in the telecommunications industry in Europe, with worldwide projection...

, among others.

History and market

The history of SBCs shows that several corporations were involved in creating and popularizing the SBC market segment for carriers and enterprises. The original carrier-oriented SBC companies are (or were, since several have been acquired or are defunct): Sonus Networks
Sonus Networks
Sonus Networks, Inc. is a technology and telecommunications equipment company that provides voice infrastructure solutions for wireless and wireline service providers.-Corporate history:Sonus Networks was founded in 1997....

, Acme Packet
Acme Packet
Acme Packet is a company based in Bedford, Massachusetts which produces and markets Session Border Controllers , multiservice security gateways and session routing proxies . It is a public company incorporated in Delaware...

, Kagoor Networks (acquired in 2005 by Juniper Networks
Juniper Networks
Juniper Networks is an information technology and computer networking products multinational company, founded in 1996. It is head quartered in Sunnyvale, California, USA. The company designs and sells high-performance Internet Protocol network products and services...

 now offering a router-integrated solution), Jasomi Networks
Jasomi Networks
-About:Jasomi Networks was a pioneer in the development of Session Border Controllers , computer network devices that enable, control, and monitor the flow of multimedia data streams across carrier networks, corporate networks, home networks, and the Internet.-History and evolution:The concept for...

 (acquired in 2005 by Ditech Communications, now known as Ditech Networks), Netrake (acquired in 2006 by Audiocodes), Newport Networks
Newport Networks
Newport Networks was a manufacturer of Voice over IP Session Border Controllers , founded by entrepreneur Terry Matthews.Headquartered in Caldicot, near Newport in South Wales, with its R&D facility in High Wycombe, Buckinghamshire, the company's hardware products consisted of the chassis based...

 (now out of business), NexTone (first merged with Reef Point to form Nextpoint, and later purchased by Genband
Genband
GENBAND is a privately held company which makes IP multimedia application and infrastructure products and solutions for fixed wire line, mobile, and cable network service providers. The company was formed in 1999 as General Bandwidth and since 2010 is headquartered in Frisco, Texas.It has major...

), Aravox (acquired in 2003 by Alcatel
Alcatel
Alcatel Mobile Phones is a brand of mobile handsets. It was established in 2004 as a joint venture between Alcatel-Lucent of France and TCL Communication of China....

 and terminated) and Emergent Network Solutions (acquired in 2006 by Stratus Technologies
Stratus Technologies
Stratus Technologies, Inc. a major producer of fault tolerant computer servers. The company was founded in 1980 as Stratus Computer, Inc. in Natick, Massachusetts, and adopted its present name in 1999. The current CEO and president is Dave Laurello. Stratus Technologies, Inc. is a privately held...

 and in 2009 spun off as Stratus Telecommunications). According to Jonathan Rosenberg, the author of RFC 3261 (SIP) and numerous other related RFCs, Dynamicsoft actually developed the first working SBC in conjunction with Aravox, but the product never truly gained marketshare. Five companies also played a major role in delivering enterprise-oriented SBCs: Jasomi Networks with its PeerPoint product line, Nable Communications, Edgewater, Borderware, and Ingate
Ingate
Ingate can refer to:*Ingate Systems*A device used in molding....

.

Of these companies, Newport Networks was the first to have an IPO on the London Stock Exchange's AIM in May 2004 (NNG). Acme Packet followed in October 2006 by floating on the NASDAQ, and is the market segment leader. With the field narrowed by acquisition, NexTone merged with Reefpoint becoming Nextpoint, which was subsequently acquired in 2008 by Genband
Genband
GENBAND is a privately held company which makes IP multimedia application and infrastructure products and solutions for fixed wire line, mobile, and cable network service providers. The company was formed in 1999 as General Bandwidth and since 2010 is headquartered in Frisco, Texas.It has major...

.

At this same time, there emerged the “integrated” SBC where the border control function was integrated into another edge device. The strategy around integrated SBCs was to minimize devices, provide power and packaging savings, and tightly couple complementary functions. The demarcation points where SBCs are located already include IP routers; therefore a logical approach to the proliferation of SBC devices is to integrate the SBC functionality into the already existing routers. Such integration offers savings in the capital and operational costs, reduces floor-space, lowers power consumption and makes managing the network easier. In addition, it allows significant optimization of certain aspects of the network such as VPN
Virtual private network
A virtual private network is a network that uses primarily public telecommunication infrastructure, such as the Internet, to provide remote offices or traveling users access to a central organizational network....

 interconnection and scalability and thus provides significant value in case of distributed network designs. Cisco
Cisco
Cisco may refer to:Companies:*Cisco Systems, a computer networking company* Certis CISCO, corporatised entity of the former Commercial and Industrial Security Corporation in Singapore...

 is a leader in the “integrated” SBC space with its Cisco Unified Border Element (CUBE) product line, addressing campus, branch office, and service provider environments.

The continuing growth of VoIP networks pushes SBCs further to the edge, mandating adaptation in capacity and complexity. As the VoIP network grows and traffic volume increases, more and more sessions are passing through SBC devices. Vendors are addressing these new scale requirements in a variety of ways. Some have developed of separate, load balancing systems to sit in front of SBC clusters. Others, have developed new architectures using the latest generation chipsets offering higher performance SBCs and scalability using service cards.

See also

  • IP Multimedia Subsystem
    IP Multimedia Subsystem
    The IP Multimedia Subsystem or IP Multimedia Core Network Subsystem is an architectural framework for delivering Internet Protocol multimedia services. It was originally designed by the wireless standards body 3rd Generation Partnership Project , as a part of the vision for evolving mobile...

     (IMS)
  • 3GPP Long Term Evolution
    3GPP Long Term Evolution
    3GPP Long Term Evolution, usually referred to as LTE, is a standard for wireless communication of high-speed data for mobile phones and data terminals. It is based on the GSM/EDGE and UMTS/HSPA network technologies, increasing the capacity and speed using new modulation techniques...

     (LTE)
  • Session Initiation Protocol
    Session Initiation Protocol
    The Session Initiation Protocol is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol . The protocol can be used for creating, modifying and terminating two-party or multiparty sessions...

     (SIP)
  • Universal Mobile Telecommunications System
    Universal Mobile Telecommunications System
    Universal Mobile Telecommunications System is a third generation mobile cellular technology for networks based on the GSM standard. Developed by the 3GPP , UMTS is a component of the International Telecommunications Union IMT-2000 standard set and compares with the CDMA2000 standard set for...

     (UMTS)
  • SIP Trunking
    SIP Trunking
    SIP trunking is a Voice over Internet Protocol service based on the Session Initiation Protocol by which Internet telephony service providers deliver telephone services and unified communication to customers equipped with private branch exchange facilities.-Domains:The architecture of SIP...

The source of this article is wikipedia, the free encyclopedia.  The text of this article is licensed under the GFDL.
 
x
OK