IP communications systems are becoming an ever-more critical part of business and consumer communications. As a result, they are increasingly becoming the target for fraudsters, trolls and hackers, requiring a comprehensive security solution. These are the reasons behind the birth of the Session Border Controller. But there is much more to SBCs than security.

1. What is an SBC?
A look at the role of the
Session Border Controller
Alan D. Percy
alan.percy@telcobridges.com
November 2018
1

2. 2
What are the Risks?
• Extortion
• DOS / DDOS Attacks
• Registration Floods
• Malformed SIP Headers
• Call Floods
• Intrusion
• Network Scanning
• Account Hacking
• Theft of Services

3. 3
Agenda
Session Border Controllers
• What are they?
• How do they work?
• How are they used?
• Where to get free
SBC software?
• Where to learn more?

4. 4
Firewall = SBC?
Internet
LAN
WAN
SIP
“A SBC is just a Firewall for SIP, right?”
RTP

5. 5
SIP Server = SBC?
Answer: No – SIP Servers don’t have a B2BUA and have
no media handling security

6. 6
Other Needs?
• SIP-aware Security
• Resolve SIP incompatibility
issues
• Convert media formats
• Facilitate call recording
• Measure voice/video quality
• Call Routing
• Billing By Korolev Alexandr
RFC 3261

7. What is a SBC?
Local Area
Network
Network
Border
Wide Area
Network SBC
• Anywhere two SIP networks intersect
• Software-based “Network Function”
• Most often between a WAN and a LAN
SIP SIP

8. Topology Hiding
Network
Border
Internet SBC
Application
10.X.X.X
34.Y.Y.Y
“Back to Back User Agent”
B2BUA

9. DOS/DDOS/Intrusion Prevention
Network
Border
Internet SBC
Application
Detects and deflects
DOS/DDOS and Registration Floods

10. Encryption Demarcation
Network
Border
Service
Provider SBC
Application
Clear
Encrypted
Encryption of session control (SIP/TLS)
and/or media (SRTP)

11. 11
NAT Traversal
Tasks:
 NAT Detection
 Address Translation
 NAT Pinhole Maintenance
SMB/Enterprise
IAD/Router
NAT
Service Provider
Application
SBC
192.x.x.x 34.x.x.x
SIP

12. Media Services
• Codec conversion (Transcoding)
• Tones and Announcements
• Legal Intercept
• Voice quality measurement
Network
Border
Service
Provider SBC
Application
G.711
G.729
Law
Enforcement

13. SIP Interoperability
Service
Provider
Network
Border
Privacy modification SIP From: Alice SIP From: Anonymous
SIP X-Header : Op-A SIP P-Header: No-charge
Custom header
SIP SIP-I  Carrier Interoperability
Protocol
conversion
 Multi-vendor Compatibility
 Privacy enforcement
Service
Provider
Digit Manipulation SIP To: 555-1212 SIP To: +1 800 555-1212  Privacy enforcement
SBC

14. Traffic Management & Routing
• Call Rate Limiting
• Load Balancing
• Route by called/calling #
• Route by availability
• External/Custom/Third-party Algorithms
SBC
SIP Traffic

15. 15
How does a SBC work?
Functions of a Session Border Controller
• Security
• Intrusion Protection
• “Line Rate” Inspection
• Topology Hiding
• B2BUA Interoperability
• Media Services
• Routing/Traffic Mgmt.
• More…
Session Border Controller
Functions
Intrusion
Detection
& Security
B2BUA Routing
Media

16. USE CASES
16

17. 17
Use Cases - Peering
Tasks:
 Call routing
 Mediation
 Billing functions
Retail Service Provider
SoftSwitch
Wholesale VoIP Provider
SBC
SBC
Billing

18. 18
Use Cases – Access
Tasks:
 DOS/DDOS Protection
 NAT Traversal
 SIP Registration screening
 Analytics and Billing
 QOS Monitoring & Reporting
SMB/Enterprise
IAD/Router
Service Provider
Softswitch
SBC
Billing

19. 19
Use Cases – Redundancy
Tasks:
 Failure Detection
 Traffic Redirection and Routing
 Performance Measurement
Service Provider
SBC
SBC
Wholesale
Provider(s)

20. 20
Use Cases – CPaaS Providers
Tasks:
 SIP Trunking Interoperability
 FQDN Mapping
 Intelligent Call Routing
 Media By-pass
 Cloud Hosted
Cloud-based Communications Provider as a Service (CPaaS)
SIP Trunking
Provider(s)
CPaaS
SBC

21. Emergence of the E-SBC
Service Provider SBC
• Protect service provider’s network
• High density / Large capacity
• Billing Interfaces
• NAT Traversal
• SIP Trunking and Access
• Central Office / Cloud Deployment
• 1+1 Redundancy
• Legal Intercept (CALEA)
• Wireline and Wireless SPs
• Sold through Systems Integrators
Enterprise SBC
21
• Protect enterprise’s network
• Low to medium density
• Quality of Service measurement
• Intrusion Protection
• UC or IP-PBX Interoperabililty
• Customer Premises (CPE)
• Lower cost
• SIPREC for Call Recording
• Mid-market and Enterprises
• Sold through Resellers/Channels

22. 22
Use Cases – E-SBC
Tasks:
 Security
 SIP Trunking Interoperability
 ANI/Caller-ID Substitution
 Cause Code Mapping
IP-PBX / UC / Contact Center with SIP Trunking
SIP Trunking
Provider(s)
UC or
Contact Center
SBC

23. 23
Use Cases – E-SBC
Tasks:
 Security
 SIP Trunking Interoperability
 Registration Forwarding
IP-PBX / UC / Contact Center with SIP Trunking and Remote Users
SIP Trunking
Provider(s)
UC or
Contact Center
SBC
Work-at-home users
SBC

24. DEPLOYMENT
METHODS
24

25. 25
SBCs “Back in the Day”
• SBCs were based on specialized
“purpose-built” hardware platforms
• Packet processing H/W
• DSP Modules
• DC Power
• High Availability in hardware

26. Changing Economics
“Old Way”
Hardware-centric
Proprietary appliances
EOL Hardware
Capital Expenditure + Maintenance
“Cloud Way”
26
Software-centric
COTS Hardware, Virtual or Cloud
Software-as-a-Service
“Pay-as-you-Grow”
TCO
Years
TCO
Years

27. 27
SBCs as Software
“Service providers have been deploying session
border controllers (SBCs) predominantly as
standalone devices, but by 2019 they will
increasingly implement SBCs as software in
virtualized environments and on commercial
servers…”, Diane Myers, IHS Markit
Source: IHS Markit’s IMS and SBC Strategies and Vendor
Leadership Service Provider Survey, September 2019

28. 28
SBC Deployment Models – COTS
• Highest performance and scale
• Most predictable performance
• Scales down to small CPE appliances
• Required dedicated hardware

29. 29
SBC Deployment Models - Virtualized
• Deployed in CPE, Data Center, Private and Public
Cloud

30. 30
SBC Deployment Models - VNF
• Deployed as a Virtualized
Network Function (VNF)
• Core of a Service Provider
or
Edge of a SP network on
uCPE
• Managed by Orchestration
S/W
SBC

31. 31
SBC Deployment Models - Cloud
• “Pay as you Grow”
• Variety of platform choices
and operating systems
• Flexible scaling

32. 32
Introducing…
Learn more at: www.FreeSBC.com

33. 33
Congratulations!
• You now know enough to
be dangerous!
• How do you continue
your knowledge?

34. 34
More on SBCs at The SIP School

35. 35
Learn More…

36. 36
Q&A
The SIP School
www.thesipschool.com
Free copy of SBC software:
www.freesbc.com
Other Recorded webinars at:
freesbc.com/video-library
Q/A?