Specifying Media Privacy Requirements in SIP

1
Specifying Media Privacy Requirements in SIP

• Ron Shacham
• Henning Schulzrinne
• hgs,rs2194_at_cs.columbia.edu
• Dept. of Computer Science
• Columbia University

2
Overview

• Motivation
• Speakerphones, output devices and session
  mobility can compromise a call participants
  privacy.
• Unauthorized recording.
• Goals
• Allow users to specify privacy demanded from the
  other device
• whether recording of the session is allowed
• at call setup and anytime during the call.
• Scope While a device may be unable to enforce
  requirements, they provide clear indication of
  intent
• similar to GEOPRIV embedded handling instructions
  (distribution and retention)

3
Applications

• Proxy only routes the call to a device that has
  the right level of privacy
• Disallow the other call participant from
  transferring the call to a public device, turning
  on his speakerphone, or recording the call
• Force the other participants device to retrieve
  the session from a public device when the
  conversation becomes more private

4
Privacy Definitions

• Privacy levels
• 1 only device user may access the media
• 2 anyone in the device users organization
  (school, company, circle of friends, etc.) may
  access the media
• 3 anyone may access the media
• A device may have multiple privacy levels, based
  on different settings
• A phone has level 1 when the receiver Is used,
  level 2 when speakerphone is used.
• Privacy levels of a device may change based on
  its surroundings
• If nobody else is in the room, even speakerphone
  has level 1, but when somebody walks in, it
  changes to level 2 or level 3.

5
Protocol ExtensionsCaller Preferences

• New feature preference privacy
• Accept-Contact privacy1require
• causes the proxy server to only route the call to
  a device on which only the user can view or hear
• The device must respect this level of privacy
  (e.g., no speakerphone or transfer to a public
  device) for the duration of the call, unless it
  is updated through SDP mechanism

6
Protocol ExtensionsSDP Attributes

• Session-level attributes only
• May be used at call setup or in mid-call
  re-INVITE
• Privacy
• arequired-privacyuser demands that the other
  device not make media available to anyone besides
  the user
• aprovided-privacyuser expresses that no other
  user has access to the media
• When required-privacy is used in an offer, the
  answer must include the provided-privacy
  attribute with a value within the required range.
  The device must respect this level for the
  duration of the call, unless it is updated.
• Recording
• anorecord disallows recording of the session
• When used in an offer, answer must also contain
  this attribute value.

7
Extension preconditions

• Use SIP preconditions to establish mutually
  acceptable media privacy
• Is this sufficiently useful to be implemented?

8
Open Issues

• Useful enough?
• Need Require header to ensure that old systems
  dont unintentionally pretend that they are
  honoring the media privacy request
• Privacy ? Sharing?