Speermint Working Group                                         R. Penno
Internet Draft                                          Juniper Networks
Intended status: Informational                                  D. Malas
Expires: January 2008                                            Level 3
                                                                 S. Khan
                                                                 Comcast
                                                               A. Uzelac
                                                         Global Crossing
                                                         August 10, 2007

                      SPEERMINT Peering Architecture
                   draft-ietf-speermint-architecture-04


Status of this Memo

   By submitting this Internet-Draft, each author represents that
   any applicable patent or other IPR claims of which he or she is
   aware have been or will be disclosed, and any of which he or she
   becomes aware will be disclosed, in accordance with Section 6 of
   BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html

   This Internet-Draft will expire on January 2008.

Copyright Notice

   Copyright (C) The IETF Trust (2007).

Abstract

   This document defines the SPEERMINT peering architecture, its
   functional components and peering interface functions. It also
  describes the steps taken to establish a session between two peering



Penno                  Expires January 10, 2008                [Page 1]


Internet-Draft      SPEERMINT peering architecture            July 2007


  domains in the context of the functions defined.


Conventions used in this document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC-2119[1]

Table of Contents


   1. Introduction...................................................3
   2. Network Context................................................3
   3. Procedures.....................................................6
   4. Reference SPEERMINT Architecture...............................6
   5. Peer Function Examples.........................................8
      5.1. The Location Function (LF) of an Initiating Provider......8
         5.1.1. Target address analysis..............................8
         5.1.2. User ENUM Lookup.....................................9
         5.1.3. Carrier ENUM lookup.................................10
         5.1.4. Routing Table.......................................10
         5.1.5. SIP DNS Resolution..................................10
         5.1.6. SIP Redirect Server.................................11
      5.2. The Location Function (LF) of a Receiving Provider.......11
         5.2.1. Publish ENUM records................................11
         5.2.2. Publish SIP DNS records.............................11
         5.2.3. Subscribe Notify....................................11
      5.3. Signaling Function (SF)..................................11
      5.4. The Signaling Function (SF) of an Initiating Provider....12
         5.4.1. Setup TLS connection................................12
         5.4.2. IPSec...............................................12
         5.4.3. Co-Location.........................................13
         5.4.4. Send the SIP request................................13
      5.5. The Signaling Function (SF) of an Initiating Provider....14
         5.5.1. Verify TLS connection...............................14
         5.5.2. Receive SIP requests................................14
      5.6. Media Function (MF)......................................15
      5.7. Policy Considerations....................................15
   6. Call Control and Media Control Deployment Options.............16
   7. Address space considerations..................................18
   8. Security Considerations.......................................18
   9. IANA Considerations...........................................18
   10. Acknowledgments..............................................18
   11. References...................................................19
      11.1. Normative References....................................19



Penno                    Expires January 2008                  [Page 2]


Internet-Draft      SPEERMINT peering architecture            July 2007


      11.2. Informative References..................................20
   Author's Addresses...............................................21
   Intellectual Property Statement..................................21
   Disclaimer of Validity...........................................22



1. Introduction


   The objective of this document is to define a reference peering
   architecture in the context of Session PEERing for Multimedia
   INTerconnect (SPEERMINT). In this process, we define the peering
   reference architecture (reference, for short), it's functional
   components, and peering interface functions from the perspective of a
   real-time communications (Voice and Multimedia) IP Service provider
   network.

   This architecture allows the interconnection of two service providers
   in layer 5 peering as defined in the SPEERMINT Requirements [13] and
   Terminology [12] documents for the purpose SIP-based voice and
   multimedia traffic.

   Layer 3 peering is outside the scope of this document. Hence, the
   figures in this document do not show routers so that the focus is on
   Layer 5 protocol aspects.

   This document uses terminology defined in the SPEERMINT Terminology
   document [12].

2. Network Context


   Figure 1 shows an example network context. Two SIP providers can form
   a Layer 5 peer over either the public Internet or private Layer 3
   networks. In addition, two or more providers may form a SIP (Layer 5)
   federation [17] on either the public Internet or private Layer 3
   networks. This document does not make any assumption whether the SIP
   providers directly peer to each other or through Layer 3 transit
   network as per use case of [16].

   Note that Figure 1 allows for the following potential SPEERMINT



Penno                    Expires January 2008                  [Page 3]


Internet-Draft      SPEERMINT peering architecture            July 2007


   peering scenarios:

   o  Enterprise to Enterprise across the public Internet

   o  Enterprise to Service Provider across the public Internet

   o  Service Provider to Service Provider across the public Internet

   o  Enterprise to enterprise across a private Layer 3 network

   o  Enterprise to Service Provider across a private Layer 3 network

   o  Service Provider to Service Provider across a private Layer 3
      network

   The members of a federation may jointly use a set of functions such
   as location peering function, application function, subscriber
   database function, SIP proxies, and/or functions that synthesize
   various SIP and non-SIP based applications. Similarly, two providers
   may jointly use a set of peering functions. The federation functions
   or the peering functions can be either public or private.

























Penno                    Expires January 2008                  [Page 4]


Internet-Draft      SPEERMINT peering architecture            July 2007



                             +-------------------+
                             |     Public        |
                             | Peering Function  |
                             |       or          |
                             |     Public        |
                             |Federation Function|
                             +-------------------+
                                      |
                                    -----
        +-----------+              /     \              +-----------+
        |Enterprise |            --       --            |Enterprise |
        |Provider A |-----------/           \-----------|Provider B |
        +-----------+         --             --         +-----------+
                             /      Public     \
                             |     Internet    |
                             \     (Layer 3)   /
        +-----------+         --             --         +-----------+
        |Service    |-----------\           /-----------|Service    |
        |Provider C |            --       --            |Provider D |
        +-----------+              \_____/              +-----------+
                                      | Layer 3 Peering
                                      | Point (out of scope)
                                    -----
        +-----------+              /     \              +-----------+
        |Enterprise |            --       --            |Enterprise |
        |Provider E |-----------/           \-----------|Provider F |
        +-----------+         --   Service   --         +-----------+
                             /     Provider    \
                             |     Private     |
                             \     Network     /
        +-----------+         --  (Layer 3)  --         +-----------+
        |Service    |-----------\           /-----------|Service    |
        |Provider G |            --       --            |Provider H |
        +-----------+               \____/              +-----------+
                                       |
                             +-------------------+
                             |     Private       |
                             | Peering Function  |
                             |       or          |
                             |Federation Function|
                             +-------------------+

                        Figure 1: SPEERMINT Network Context





Penno                    Expires January 2008                  [Page 5]


Internet-Draft      SPEERMINT peering architecture            July 2007


3. Procedures


   This document assumes that a call from an end user in the initiating
   peer goes through the following steps to establish a call to an end
   user in the receiving peer:

         1. The analysis of a target address.

             a. If the target address represents an intra-VSP resource,
                we go directly to step 4.

         2. the discovery of the receiving peering point address,

         3. the enforcement of authentication and other policy,

         4. the discovery of end user address,

         5. the routing of SIP messages,

         6. the session establishment,

         7. the transfer of media,

         8. and the session termination.

4. Reference SPEERMINT Architecture

   Figure 2 depicts the SPEERMINT architecture and logical functions
   that form the peering between two SIP service providers.
















Penno                    Expires January 2008                  [Page 6]


Internet-Draft      SPEERMINT peering architecture            July 2007



                                 +------+
                                 | DNS, |
                       +---------| Db,  |---------+
                       |         | etc  |         |
                       |         +------+         |
                       |                          |
               ---------------              ---------------
              /               \            /               \
             |                 |          |                 |
             |                 |          |                 |
             |     +------+    |          |     +------+    |
             |     | DNS, |    |          |     | DNS, |    |
             |     | Db,  |    |          |     | Db,  |    |
             |     | etc  |    |          |     | etc  |    |
             |     +------+    |          |     +------+    |
             |                 |          |                 |
             |                 |          |                 |
             |             +---SF--+  +---SF--+             |
             |             |       |  |       |             |
             |             |  SBE  |  |  SBE  |             |
             | Originating |       |  |       | Terminating |
             |             +---SF--+  +---SF--+             |
             |    Domain       |          |       Domain    |
             |             +---MF--+  +---MF--+             |
             |      SSP    |       |  |       |    SSP      |
             |             |  DBE  |  |  DBE  |             |
             |             |       |  |       |             |
             |             +---MF--+  +---MF--+             |
             |                 |          |                 |
             |           +----LF---+  +----LF---+           |
             |     +-LF--|----+    |  |    +----|--LS-+     |
             |     |     |    |    |  |    |    |     |     |
             |     | SM  |    | LS |  | LS |    |  SM |     |
             |     |     |    |    |  |    |    |     |     |
             |     |     +----|----+  +----|----+     |     |
             |     +----------+|          |+----------+     |
             |                 |          |                 |
             |                 |          |                 |
              \               /            \               /
               ---------------              ---------------

                Figure 2: Reference SPEERMINT Architecture

   The procedures presented in Chapter 3 are implemented by a set of
   peering functions:



Penno                    Expires January 2008                  [Page 7]


Internet-Draft      SPEERMINT peering architecture            July 2007



   o  Location Function (LF): Purpose is to develop Session
      Establishment Data (SED) by discovering the Signaling Function
     (SF) and the end user's reachable host (IP address and port). The
      location function is distributed across the Location Server (LS)
      and Session Manager (SM).

   o  Signaling Function (SF): Purpose is to perform SIP call routing,
      to optionally perform termination and re-initiation of call, to
      optionally implement security and policies on SIP messages, and to
      assist in discovery/exchange of parameters to be used by the Media
      Function (MF). The signaling function is located within the
      Signaling Path Border Element (SBE)

   o  Media Function (MF): Purpose is to perform media related function
      such as media transcoding and media security implementation
      between two SIP providers. The media function is located within
      the Data Path Border Element (DBE).

   The intention of defining these functions is to provide a framework
   for design segmentation and allow each one to evolve separately.

5. Peer Function Examples

   This section describes the peering functions in more detail and
   provides some examples on the role they would play in a SIP call in a
   Layer 5 peering scenario.

   Some of the information in the chapter is taken from [14].

5.1. The Location Function (LF) of an Initiating Provider


   Purpose is to develop Session Establishment Data (SED) [12] by
   discovering the Signaling Function (SF), and end user's reachable
   host (IP address and host). The LF of an Initiating provider analyzes
   target address and discovers the next hop signaling function (SF) in
   a peering relationship using DNS, SIP Redirect Server, or a
   functional equivalent database.

5.1.1. Target address analysis




Penno                    Expires January 2008                  [Page 8]


Internet-Draft      SPEERMINT peering architecture            July 2007


   When the initiating provider receives a request to communicate, the
   initiating provider analyzes the target state data to determine
   whether the call needs to be terminated internal or external to its
   network. The analysis method is internal to the provider's policy;
   thus, outside the scope of SPEERMINT. Note that the peer is free to
   consult any manner of private data sources to make this
   determination.

   If the target address does not represent a resource inside the
   initiating peer's administrative domain or federation of domains, the
   initiating provider resolves the call routing data by using the
   Location Function (LF). Examples of the LF are the functions of ENUM,
   Routing Table, SIP DNS, and SIP Redirect Server.

   If the request to communicate is for an im: or pres: URI type, the
   initiating peer follows the procedures in [8].  If the highest
   priority supported URI scheme is sip: or sips:, the initiating peer
   skips to SIP DNS resolution in Section 5.1.5. Likewise, if the target
   address is already a sip: or sips: URI in an external domain, the
   initiating peer skips to SIP DNS resolution in Section 5.1.5.

   If the target address corresponds to a specific E.164 address, the
   peer may need to perform some form of number plan mapping according
   to local policy.  For example, in the United States, a dial string
   beginning "011 44" could be converted to "+44", or in the United
   Kingdom "00 1" could be converted to "+1".  Once the peer has an
   E.164 address, it can use ENUM.

5.1.2. User ENUM Lookup

   If an external E.164 address is the target, the initiating peer
   consults the public "User ENUM" rooted at e164.arpa, according to the
   procedures described in RFC 3761.  The peer MUST query for the
   "E2U+sip" enumservice as described in RFC 3764 [11], but MAY check
   for other enumservices.  The initiating peer MAY consult a cache or
   alternate representation of the ENUM data rather than actual DNS
   queries.  Also, the peer MAY skip actual DNS queries if the
   initiating peer is sure that the target address country code is not
   represented in e164.arpa.  If a sip: or sips: URI is chosen the peer
   skips to Section 5.1.5.




Penno                    Expires January 2008                  [Page 9]


Internet-Draft      SPEERMINT peering architecture            July 2007


   If an im: or pres: URI is chosen for based on an "E2U+im" [10] or
   "E2U+pres" [9] enumserver, the peer follows the procedures for
   resolving these URIs to URIs for specific protocols such a SIP or
   XMPP as described in the previous section.

5.1.3. Carrier ENUM lookup

   Next the initiating peer checks for a carrier-of-record in a carrier
   ENUM domain according to the procedures described in [12].  As in the
   previous step, the peer MAY consult a cache or alternate
   representation of the ENUM data in lieu of actual DNS queries.  The
   peer first checks for records for the "E2U+sip" enumservice, then for
   the "E2U+pstn" enumservice as defined in [21].  If a terminal record
   is found with a sip: or sips: URI, the peer skips to Section 5.1.5,
   otherwise the peer continues processing according to the next
   section.

5.1.4. Routing Table

   If there is no user ENUM records and the initiating peer cannot
   discover the carrier-of-record or if the initiating peer cannot reach
   the carrier-of-record via SIP peering, the initiating peer still
   needs to deliver the call to the PSTN or reject the call.  Note that
   the initiating peer MAY still sends the call to another provider for
   PSTN gateway termination by prior arrangement using a routing table.
   If so, the initiating peer rewrites the Request-URI to address the
   gateway resource in the target provider's domain and MAY forward the
   request on to that provider using the procedures described in the
   remainder of these steps.

5.1.5. SIP DNS Resolution

   Once a sip: or sips: in an external domain is selected as the target,
   the initiating peer MAY apply local policy to decide whether
   forwarding requests to the target domain is acceptable.  If so, the
   initiating peer uses the procedures in RFC 3263 [6] Section 4 to
   determine how to contact the receiving peer.  To summarize the RFC
   3263 procedure: unless these are explicitly encoded in the target
   URI, a transport is chosen using NAPTR records, a port is chosen
   using SRV records, and an address is chosen using A or AAAA records.
   Note that these are queries of records in the global DNS.




Penno                    Expires January 2008                 [Page 10]


Internet-Draft      SPEERMINT peering architecture            July 2007


   When communicating with a public external peer, entities compliant to
   this document MUST only select a TLS-protected transport for
   communication from the initiating peer to the receiving peer.  Note
   that this is a single-hop requirement.  Either peer MAY insist on
   using a sips: URI which asserts that each hop is TLS-protected, but
   this document does not require protection over each hop.

5.1.6. SIP Redirect Server

   A SIP Redirect Server may help in resolving current address of a
   mobile target address.

5.2. The Location Function (LF) of a Receiving Provider

5.2.1. Publish ENUM records

   The receiving peer SHOULD participate by publishing "E2U+sip" and
   "E2U+pstn" records with sip: or sips: URIs wherever a public carrier
   ENUM root is available.  This assumes that the receiving peer wants
   to peer by default.  Even when the receiving peer does not want to
   accept traffic from specific initiating peers, it MAY still reject
   requests on a case-by-case basis.

5.2.2. Publish SIP DNS records

   To receive peer requests, the receiving peer MUST insure that it
   publishes appropriate NAPTR, SRV, and address (A and/or AAAA) records
   in the global DNS that resolve an appropriate transport, port, and
   address to a relevant SIP server.


5.2.3. Subscribe Notify

   Policy function may also be optionally implemented by dynamic
   subscribe, notify, and exchange of policy information and feature
   information among providers [22].

5.3. Signaling Function (SF)

   The purpose of signaling function is to perform routing of SIP
   messages, to optionally perform termination and re-initiation of a
   call, to optionally implement security and policies on SIP messages,
   and to assist in discovery/exchange of parameters to be used by the


Penno                    Expires January 2008                 [Page 11]


Internet-Draft      SPEERMINT peering architecture            July 2007


   Media Function (MF).

   The routing of SIP messages are performed by SIP proxies. The
   optional termination and re-initiation of calls are performed by
   B2BUA.

   Optionally, a SF may perform additional functions such as Session
   Admission Control, SIP Denial of Service protection, SIP Topology
   Hiding, SIP header normalization, and SIP security, privacy and
   encryption.

   The signaling function can also process SDP payloads for media
   information such as media type, bandwidth, and type of codec; then,
   communicate this information to the media function. Signaling
   function may optionally communicate with network layer to pass Layer
   3 related policies [10]

5.4. The Signaling Function (SF) of an Initiating Provider

5.4.1. Setup TLS connection

   Once a transport, port, and address are found, the initiating peer
   will open or find a reusable TLS connection to the peer.  The
   initiating provider MUST verify the server certificate which SHOULD
   be rooted in a well-known certificate authority.  The initiating
   provider MUST be prepared to provide a TLS client certificate upon
   request during the TLS handshake.  The client certificate MUST
   contain a DNS or URI choice type in the subjectAltName which
   corresponds to the domain asserted in the host production of the From
   header URI.  The certificate SHOULD be valid and rooted in a well-
   known certificate authority.

   Note that the client certificate MAY contain a list of entries in the
   subjectAltName, only one of which has to match the domain in the From
   header URI.

5.4.2. IPSec

   In certain deployments the use of IPSec between the signaling
   functions of the originating and terminating domains can be used as a
   security mechanism instead of TLS.



Penno                    Expires January 2008                 [Page 12]


Internet-Draft      SPEERMINT peering architecture            July 2007


5.4.3. Co-Location


   In this scenario the signaling functions are co-located in a
   physically secure location and/or are members of a segregated
   network. In this case messages between the originating and
   terminating domains would be sent as clear text.

5.4.4. Send the SIP request

   Once a TLS connection between the peers is established, the
   initiating peer sends the request.  When sending some requests, the
   initiating peer MUST verify and assert the senders identity using the
   SIP Identity mechanism.

   The domain name in the URI of the From: header MUST be a domain which
   was present in the certificate presented when establishing the TLS
   connection for this request, even if the user part has an anonymous
   value.  If the From header contains the user URI parameter with the
   value of "phone", the user part of the From header URI MUST be a
   complete and valid tel: URI [9] telephone-subscriber production, and
   SHOULD be a global-number.  For example, the following are all
   acceptable, the first three are encouraged:

   From: "John Doe" <john.doe@example.net>
   From: "+12125551212" <+12125551212@example.net;user=phone>
   From: "Anonymous" <anonymous@example.net>
   From: <4092;phone-context=+12125554000@example.net;user=phone>
   From: "5551212" <5551212@example.net>

   The following are not acceptable:

   From: "2125551212" <2125551212@example.net;user=phone>
   From: "Anonymous" <anonymous@anonymous.invalid>

   In addition, for new dialog-forming requests and non-dialog-forming
   requests, the request MUST contain a valid Identity and Identity-Info
   header as described in [12].  The Identity-Info header must present a
   domain name which is represented in the certificate presented when
   establishing the TLS connection over which the request is sent.  The
   initiating peer SHOULD include an Identity header on in-dialog



Penno                    Expires January 2008                 [Page 13]


Internet-Draft      SPEERMINT peering architecture            July 2007


   requests as well, if the From header field value matches an identity
   the initiating peer is willing to assert.

   The initiating peer MAY include any SIP option-tags in Supported,
   Require, or Proxy-Require headers according to procedures in
   standards-track SIP extensions.  Note however that the initiating
   peer MUST be prepared to fallback to baseline SIP functionality as
   defined by the mandatory-to-implement features of RFC 3261, RFC 3263,
   and RFC 3264 [7], except that peers implementing this specification
   MUST implement SIP over TLS using the sip: URI scheme, the SIP
   Identity header, and RFC 4320 [10] non-INVITE transaction fixes.

5.5. The Signaling Function (SF) of an Initiating Provider


5.5.1. Verify TLS connection

   When the receiving peer receives a TLS client hello, it responds with
   its certificate.  The receiving peer certificate SHOULD be valid and
   rooted in a well-known certificate authority.  The receiving peer
   MUST request and verify the client certificate during the TLS
   handshake.

   Once the initiating peer has been authenticated, the receiving peer
   can authorize communication from this peer based on the domain name
   of the peer and the root of its certificate.  This allows two
   authorization models to be used, together or separately.  In the
   domain-based model, the receiving peer can allow communication from
   peers with some trusted administrative domains which use general-
   purpose certificate authorities, without explicitly permitting all
   domains with certificates rooted in the same authority.  It also
   allows a certificate authority (CA) based model where every domain
   with a valid certificate rooted in some list of CAs is automatically
   authorized.

5.5.2. Receive SIP requests

   Once a TLS connection is established, the receiving peer is prepared
   to receive incoming SIP requests.  For new dialog-forming requests
   and out-of-dialog requests, the receiving peer verifies that the
   target (request-URI) is a domain which for which it is responsible.
   (For these requests, there should be no remaining Route header field


Penno                    Expires January 2008                 [Page 14]


Internet-Draft      SPEERMINT peering architecture            July 2007


   values.)  Next the receiving verifies that the Identity header is
   valid, corresponds to the message, corresponds to the Identity-Info
   header, and that the domain in the From header corresponds to one of
   the domains in the TLS client certificate.

   For in-dialog requests, the receiving peer can verify that it
   corresponds to the top-most Route header field value.  The peer also
   validates any Identity header if present.

   The receiving peer MAY reject incoming requests due to local policy.
   When a request is rejected because the initiating peer is not
   authorized to peer, the receiving peer SHOULD respond with a 403
   response with the reason phrase "Unsupported Peer".

5.6. Media Function (MF)


   Examples of the media function is to transform voice payload from one
   coding (e.g., G.711) to another (e.g., EvRC), media relaying, media
   security, privacy, and encryption.

   Editor's Note: This section will be further updated.

5.7. Policy Considerations

   In the context of the SPEERMINT working group when two Layer 5
   devices (e.g., SIP Proxies) peer, there is a need to exchange peering
   policy information. There are specifications in progress in the
   SIPPING working group to define policy exchange between an UA and a
   domain [23] and providing profile data to SIP user agents [24] These
   considerations borrow from both.

   Following the terminology introduced in [12], this package uses the
   terms Peering Session-Independent and Session-Specific policies in
   the following context.

   o  Peering Session-Independent policies include Diffserv Marking,
      Policing, Session Admission Control, domain reachabilities,
      amongst others. The time period between Peering Session-
      Independent policy changes is much greater than the time it takes
      to establish a call.



Penno                    Expires January 2008                 [Page 15]


Internet-Draft      SPEERMINT peering architecture            July 2007


   o  Peering Session-Specific polices includes supported
      connection/call rate, total number of connections/calls available,
      current utilization, amongst others. Peering Session-specific
      policies can change within the time it takes to establish a call.

   These policies can be Peer dependent or independent, creating the
   following peering policy tree definition:

           Peer Independent
              Session dependent
              Session independent
           Peer Dependent
              Session dependent
              Session independent

6. Call Control and Media Control Deployment Options

   The peering functions can either be deployed along the following two
   dimensions depending upon how the signaling function and the media
   function along with IP functions are implemented:

   Composed or Decomposed:  Addresses the question whether the media
   paths must flow through the same physical and geographic nodes as the
   call signaling,

   Centralized or Distributed:  Addresses the question whether the
   logical and physical peering points are in one geographical location
   or distributed to multiple physical locations on the service provider
   network.

   In a composed model, SF and MF functions are implemented in one
   peering logical element.













Penno                    Expires January 2008                 [Page 16]


Internet-Draft      SPEERMINT peering architecture            July 2007


               Provider A                        Provider B
                ----------   .               .   ----------
               /          \  .               .  /          \
              |            | .       _       . |            |
              |       +----+ .     /   \_    . +----+       |
              |       | SF |<-----/     \------| SF |       |
              |       +-+--+ .   /Transit\   . |    |       |
              |         | |  .  /   IP    \  . |    |       |
              |       +-+--+ .  \ Provider|  . |    |       |
              |       | MF |<~~~~\(Option)|~~~~| MF |       |
              |       +----+ .    \      /   . +----+       |
              |            | .     \__ _/    . |            |
               \_________ /  .               .  \________ _/
                ----------                       ----------

                             --- Signal (SIP)
                            ~~~ Bearer (RTP/IP)
                           ... Scope of peering

                 Figure 3: Decomposed v. Collapsed Peering

   The advantage of a collapsed peering architecture is that one-element
   solves all peering issues. Disadvantage examples of this architecture
   are single point failure, bottle neck, and complex scalability.

   In a decomposed model, SF and MF are implemented in separate peering
   logical elements. Signaling functions are implemented in a proxy and
   media functions are implemented in another logical element.  The
   scaling of signaling versus scaling of media may differ between
   applications.  Decomposing allows each to follow a separate migration
   path.

   This model allows the implementation of M:N model where one SF is
   associated with multiple peering MF and one peering MF is associated
   with multiple peering proxies. Generally, a vertical protocol
   associates the relationship between a SF and a MF. This architecture
   reduces the potential of single point failure. This architecture,
   allows separation of the policy decision point and the policy
   enforcement point. An example of disadvantages is the scaling
   complexity because of the M:N relationship and latency due to the
   vertical control messages between entities.





Penno                    Expires January 2008                 [Page 17]


Internet-Draft      SPEERMINT peering architecture            July 2007


7. Address space considerations


   Peering must occur in a common address space, which is defined by the
   federation, which may be entirely on the public Internet, or some
   private address space. The origination or termination networks may or
   may not entirely be in that same address space.  If they are not,
   then a translation (NAT) may be needed before the signaling or media
   is presented to the federation. The only requirement is that all
   entities across the peering interface are reachable.

8. Security Considerations


   In all cases, cryptographic-based security should be maintained as an
   optional requirement between peering providers conditioned on the
   presence or absence of underlying physical security of peer
   connections, e.g. within the same secure physical building.

   In order to maintain a consistent approach, unique and specialized
   security requirements common for the majority of peering
   relationships, should be standardized within the IETF.  These
   standardized methods may enable capabilities such as dynamic peering
   relationships across publicly maintained interconnections.

   TODO:  Address RFC-3552 BCP items.

9. IANA Considerations


   There are no IANA considerations at this time.

10. Acknowledgments

   The working group thanks Sohel Khan for his initial architecture
   draft that helped to initiate work on this draft.

   A significant portion of this draft is taken from [14] with
   permission from the author R. Mahy. The other important contributor
   is Otmar Lendl.





Penno                    Expires January 2008                 [Page 18]


Internet-Draft      SPEERMINT peering architecture            July 2007


11. References

11.1. Normative References

   [1]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
         Levels", BCP 14, RFC 2119, March 1997.

   [2]   Mealling, M. and R. Daniel, "The Naming Authority Pointer
         (NAPTR) DNS Resource Record", RFC 2915, September 2000.

   [3]   Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
         Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP:
         Session Initiation Protocol", RFC 3261, June 2002.

   [4]   Rosenberg, J. and H. Schulzrinne, "Session Initiation Protocol
         (SIP): Locating SIP Servers", RFC 3263, June 2002.

   [5]   Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., and
         T. Wright, "Transport Layer Security (TLS) Extensions", RFC
         4366, April 2006.

   [6]   Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson,
         "RTP: A Transport Protocol for Real-Time Applications", STD 64,
         RFC 3550, July 2003.

   [7]   Peterson, J., Liu, H., Yu, J., and B. Campbell, "Using E.164
         numbers with the Session Initiation Protocol (SIP)", RFC 3824,
         June 2004.

   [8]   Peterson, J., "Address Resolution for Instant Messaging and
         Presence",RFC 3861, August 2004.

   [9]   Peterson, J., "Telephone Number Mapping (ENUM) Service
         Registration for Presence Services", RFC 3953, January 2005.

   [10]  ETSI TS 102 333: " Telecommunications and Internet converged
         Services and Protocols for Advanced Networking (TISPAN); Gate
         control protocol".

   [11]  Peterson, J., "enumservice registration for Session Initiation
         Protocol (SIP) Addresses-of-Record", RFC 3764, April 2004.

   [12]  Livingood, J. and R. Shockey, "IANA Registration for an
         Enumservice Containing PSTN Signaling Information", RFC 4769,
         November 2006.




Penno                    Expires January 2008                 [Page 19]


Internet-Draft      SPEERMINT peering architecture            July 2007


11.2. Informative References

   [13]  Meyer, D., "SPEERMINT Terminology", draft-ietf-speermint-
         terminology-08 (work in progress), Junly 2007.

   [14]  Mule, J-F., "SPEERMINT Requirements for SIP-based VoIP
         Interconnection", draft-ietf-speermint-requirements-02.txt,
         July 2007.

   [15]  Mahy, R., "A Minimalist Approach to Direct Peering", draft-
         mahy-speermint-direct-peering-02.txt, July 2007.

   [16]  Penno, R., et al., "SPEERMINT Routing Architecture Message
         Flows", draft-ietf-speermint-flows-02.txt", April 2007.

   [17]  Lee, Y., "Session Peering Use Case for Cable", draft-lee-
         speermint-use-case-cable-01.txt, June, 2006.

   [18]  Houri, A., et al., "RTC Provisioning Requirements", draft-
         houri-speermint-rtc-provisioning-reqs-00.txt, June, 2006.

   [19]  Habler, M., et al., "A Federation based VOIP Peering
         Architecture", draft-lendl-speermint-federations-03.txt,
         September 2006.

   [20]  Mahy, R., "A Telephone Number Mapping (ENUM) Service
         Registration for Instant Messaging (IM) Services", draft-ietf-
         enum-im-service-03 (work in progress), March 2006.

   [21]  Haberler, M. and R. Stastny, "Combined User and Carrier ENUM in
         the e164.arpa tree", draft-haberler-carrier-enum-03 (work in
         progress), March 2006.

   [22]  Penno, R., Malas D., and Melampy, P., "A Session Initiation
         Protocol (SIP) Event package for Peering", draft-penno-sipping-
         peering-package-00 (work in progress), September 2006.

   [23]  Hollander, D., Bray, T., and A. Layman, "Namespaces in XML",
         W3C REC REC-xml-names-19990114, January 1999.

   [24]  Burger, E (Ed.), "A Mechanism for Content Indirection in
         Session Initiation Protocol (SIP) Messages", RFC 4483, May 2006







Penno                    Expires January 2008                 [Page 20]


Internet-Draft      SPEERMINT peering architecture            July 2007


Author's Addresses


   Mike Hammer
   Cisco Systems
   13615 Dulles Technology Drive
   Herndon, VA 20171
   USA
   Email: mhammer@cisco.com

   Sohel Khan, Ph.D.
   Comcast Cable Communications
   U.S.A
   Email: sohel_khan@cable.comcast.com

   Daryl Malas
   Level 3 Communications LLC
   1025 Eldorado Blvd.
   Broomfield, CO 80021
   USA
   EMail: daryl.malas@level3.com

   Reinaldo Penno (Editor)
   Juniper Networks
   1194 N Mathilda Avenue
   Sunnyvale, CA
   USA
   Email: rpenno@juniper.net

   Adam Uzelac
   Global Crossing
   1120 Pittsford Victor Road
   PITTSFORD, NY 14534
   USA
   Email: adam.uzelac@globalcrossing.com


Intellectual Property Statement

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.


Penno                    Expires January 2008                 [Page 21]


Internet-Draft      SPEERMINT peering architecture            July 2007


   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Disclaimer of Validity

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Copyright Statement

   Copyright (C) The IETF Trust (2007).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

Acknowledgment

   Funding for the RFC Editor function is currently provided by the
   Internet Society.














Penno                    Expires January 2008                 [Page 22]