idnits 2.17.1 draft-ietf-siprec-protocol-14.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (August 25, 2014) is 3532 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-22) exists of draft-ietf-siprec-metadata-16 Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPREC L. Portman 3 Internet-Draft NICE Systems 4 Intended status: Standards Track H. Lum, Ed. 5 Expires: February 26, 2015 Genesys 6 C. Eckel 7 Cisco 8 A. Johnston 9 Avaya 10 A. Hutton 11 Unify 12 August 25, 2014 14 Session Recording Protocol 15 draft-ietf-siprec-protocol-14 17 Abstract 19 This document specifies the use of the Session Initiation Protocol 20 (SIP), the Session Description Protocol (SDP), and the Real Time 21 Protocol (RTP) for delivering real-time media and metadata from a 22 Communication Session (CS) to a recording device. The Session 23 Recording Protocol specifies the use of SIP, SDP, and RTP to 24 establish a Recording Session (RS) between the Session Recording 25 Client (SRC), which is on the path of the CS, and a Session Recording 26 Server (SRS) at the recording device. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at http://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on February 26, 2015. 45 Copyright Notice 47 Copyright (c) 2014 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (http://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 63 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 64 3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 65 4. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 66 5. Overview of operations . . . . . . . . . . . . . . . . . . . 5 67 5.1. Delivering recorded media . . . . . . . . . . . . . . . . 5 68 5.2. Delivering recording metadata . . . . . . . . . . . . . . 7 69 5.3. Receiving recording indications and providing recording 70 preferences . . . . . . . . . . . . . . . . . . . . . . . 8 71 6. SIP Handling . . . . . . . . . . . . . . . . . . . . . . . . 9 72 6.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 10 73 6.1.1. Initiating a Recording Session . . . . . . . . . . . 10 74 6.1.2. SIP extensions for recording indication and 75 preference . . . . . . . . . . . . . . . . . . . . . 10 76 6.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 11 77 6.3. Procedures for Recording-aware User Agents . . . . . . . 11 78 7. SDP Handling . . . . . . . . . . . . . . . . . . . . . . . . 12 79 7.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 12 80 7.1.1. SDP handling in RS . . . . . . . . . . . . . . . . . 12 81 7.1.1.1. Handling media stream updates . . . . . . . . . . 13 82 7.1.2. Recording indication in CS . . . . . . . . . . . . . 14 83 7.1.3. Recording preference in CS . . . . . . . . . . . . . 15 84 7.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 15 85 7.3. Procedures for Recording-aware User Agents . . . . . . . 17 86 7.3.1. Recording indication . . . . . . . . . . . . . . . . 17 87 7.3.2. Recording preference . . . . . . . . . . . . . . . . 18 88 8. RTP Handling . . . . . . . . . . . . . . . . . . . . . . . . 19 89 8.1. RTP Mechanisms . . . . . . . . . . . . . . . . . . . . . 19 90 8.1.1. RTCP . . . . . . . . . . . . . . . . . . . . . . . . 19 91 8.1.2. RTP Profile . . . . . . . . . . . . . . . . . . . . . 20 92 8.1.3. SSRC . . . . . . . . . . . . . . . . . . . . . . . . 20 93 8.1.4. CSRC . . . . . . . . . . . . . . . . . . . . . . . . 21 94 8.1.5. SDES . . . . . . . . . . . . . . . . . . . . . . . . 21 95 8.1.5.1. CNAME . . . . . . . . . . . . . . . . . . . . . . 21 96 8.1.6. Keepalive . . . . . . . . . . . . . . . . . . . . . . 21 97 8.1.7. RTCP Feedback Messages . . . . . . . . . . . . . . . 22 98 8.1.7.1. Full Intra Request . . . . . . . . . . . . . . . 22 99 8.1.7.2. Picture Loss Indicator . . . . . . . . . . . . . 22 100 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request . 23 101 8.1.8. Symmetric RTP/RTCP for Sending and Receiving . . . . 23 102 8.2. Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 23 103 8.2.1. SRC acting as an RTP Translator . . . . . . . . . . . 24 104 8.2.1.1. Forwarding Translator . . . . . . . . . . . . . . 25 105 8.2.1.2. Transcoding Translator . . . . . . . . . . . . . 25 106 8.2.2. SRC acting as an RTP Mixer . . . . . . . . . . . . . 26 107 8.2.3. SRC acting as an RTP Endpoint . . . . . . . . . . . . 26 108 8.3. Packet Loss . . . . . . . . . . . . . . . . . . . . . . . 27 109 8.4. RTP Session Usage by SRC . . . . . . . . . . . . . . . . 27 110 8.4.1. SRC Using Multiple m-lines . . . . . . . . . . . . . 27 111 8.4.2. SRC Using Mixing . . . . . . . . . . . . . . . . . . 28 112 8.5. RTP Session Usage by SRS . . . . . . . . . . . . . . . . 29 113 9. Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . 30 114 9.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 30 115 9.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 32 116 9.2.1. Formal Syntax . . . . . . . . . . . . . . . . . . . . 34 117 10. Persistent Recording . . . . . . . . . . . . . . . . . . . . 34 118 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34 119 11.1. Registration of Option Tags . . . . . . . . . . . . . . 35 120 11.1.1. siprec Option Tag . . . . . . . . . . . . . . . . . 35 121 11.1.2. record-aware Option Tag . . . . . . . . . . . . . . 35 122 11.2. Registration of media feature tags . . . . . . . . . . . 35 123 11.2.1. src feature tag . . . . . . . . . . . . . . . . . . 35 124 11.2.2. srs feature tag . . . . . . . . . . . . . . . . . . 36 125 11.3. New Content-Disposition Parameter Registrations . . . . 36 126 11.4. Media Type Registration . . . . . . . . . . . . . . . . 36 127 11.4.1. Registration of MIME Type application/rs-metadata- 128 request . . . . . . . . . . . . . . . . . . . . . . 36 129 11.5. SDP Attributes . . . . . . . . . . . . . . . . . . . . . 37 130 11.5.1. 'record' SDP Attribute . . . . . . . . . . . . . . . 37 131 11.5.2. 'recordpref' SDP Attribute . . . . . . . . . . . . . 37 132 12. Security Considerations . . . . . . . . . . . . . . . . . . . 38 133 12.1. Authentication and Authorization . . . . . . . . . . . . 38 134 12.2. RTP handling . . . . . . . . . . . . . . . . . . . . . . 39 135 12.3. Metadata . . . . . . . . . . . . . . . . . . . . . . . . 40 136 12.4. Storage and playback . . . . . . . . . . . . . . . . . . 40 137 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 40 138 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 40 139 14.1. Normative References . . . . . . . . . . . . . . . . . . 40 140 14.2. Informative References . . . . . . . . . . . . . . . . . 41 142 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 43 144 1. Introduction 146 This document specifies the mechanism to record a Communication 147 Session (CS) by delivering real-time media and metadata from the CS 148 to a recording device. In accordance to the architecture [RFC7245], 149 the Session Recording Protocol specifies the use of SIP, SDP, and RTP 150 to establish a Recording Session (RS) between the Session Recording 151 Client (SRC), which is on the path of the CS, and a Session Recording 152 Server (SRS) at the recording device. 154 SIP is also used to deliver metadata to the recording device, as 155 specified in [I-D.ietf-siprec-metadata]. Metadata is information 156 that describes recorded media and the CS to which they relate. 158 The Session Recording Protocol intends to satisfy the SIP-based Media 159 Recording requirements listed in [RFC6341]. 161 In addition to the Session Recording Protocol, this document 162 specifies extensions for user agents that are participants in a CS to 163 receive recording indications and to provide preferences for 164 recording. 166 2. Terminology 168 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 169 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 170 document are to be interpreted as described in [RFC2119]. 172 3. Definitions 174 This document refers to the core definitions provided in the 175 architecture document [RFC7245]. 177 The RTP Handling section uses the definitions provided in "RTP: A 178 Transport Protocol for Real-Time Application" [RFC3550]. 180 4. Scope 182 The scope of the Session Recording Protocol includes the 183 establishment of the recording sessions and the reporting of the 184 metadata. The scope also includes extensions supported by User 185 Agents participating in the CS such as indication of recording. The 186 user agents need not be recording-aware in order to participate in a 187 CS being recorded. 189 The following items, which are not an exhaustive list, do not 190 represent the protocol itself and are considered out of the scope of 191 the Session Recording Protocol: 193 o Delivering recorded media in real-time as the CS media 195 o Specifications of criteria to select a specific CS to be recorded 196 or triggers to record a certain CS in the future 198 o Recording policies that determine whether the CS should be 199 recorded and whether parts of the CS are to be recorded 201 o Retention policies that determine how long a recording is stored 203 o Searching and accessing the recorded media and metadata 205 o Policies governing how CS users are made aware of recording 207 o Delivering additional recording session metadata through non-SIP 208 mechanism 210 5. Overview of operations 212 This section is informative and provides a description of recording 213 operations. 215 Section 6 describes the SIP communication in a recording session 216 between a SRC and a SRS, and the procedures for recording-aware user 217 agents participating in a CS. Section 7 describes the SDP in a 218 recording session, and the procedures for recording indications and 219 recording preferences. Section 8 describes the RTP handling in a 220 recording session. Section 9 describes the mechanism to deliver 221 recording metadata from the SRC to the SRS. 223 As mentioned in the architecture document [RFC7245], there are a 224 number of types of call flows based on the location of the Session 225 Recording Client. The following sample call flows provide a quick 226 overview of the operations between the SRC and the SRS. 228 5.1. Delivering recorded media 230 When a SIP Back-to-Back User Agent (B2BUA) with SRC functionality 231 routes a call from UA(A) to UA(B), the SRC has access to the media 232 path between the user agents. When the SRC is aware that it should 233 be recording the conversation, the SRC can cause the B2BUA to bridge 234 the media between UA(A) and UA(B). The SRC then establishes the 235 Recording Session with the SRS and sends replicated media towards the 236 SRS. 238 An endpoint may also have SRC functionality, where the endpoint 239 itself establishes the Recording Session to the SRS. Since the 240 endpoint has access to the media in the Communication Session, the 241 endpoint can send replicated media towards the SRS. 243 The following is a sample call flow that shows the SRC establishing a 244 recording session towards the SRS. The call flow is essentially 245 identical when the SRC is a B2BUA or as the endpoint itself. Note 246 that the SRC can choose when to establish the Recording Session 247 independent of the Communication Session, even though the following 248 call flow suggests that the SRC is establishing the Recording Session 249 (message #5) after the Communication Session is established. 251 UA A SRC UA B SRS 252 |(1)CS INVITE | | | 253 |------------->| | | 254 | |(2)CS INVITE | | 255 | |---------------------->| | 256 | | (3) 200 OK | | 257 | |<----------------------| | 258 | (4) 200 OK | | | 259 |<-------------| | | 260 | |(5)RS INVITE with SDP | | 261 | |--------------------------------------------->| 262 | | | (6) 200 OK with SDP | 263 | |<---------------------------------------------| 264 |(7)CS RTP | | | 265 |=============>|======================>| | 266 |<=============|<======================| | 267 | |(8)RS RTP | | 268 | |=============================================>| 269 | |=============================================>| 270 |(9)CS BYE | | | 271 |------------->| | | 272 | |(10)CS BYE | | 273 | |---------------------->| | 274 | |(11)RS BYE | | 275 | |--------------------------------------------->| 276 | | | | 278 Figure 1: Basic recording call flow 280 The above call flow can also apply to the case of a centralized 281 conference with a mixer. For clarity, ACKs to INVITEs and 200 OKs to 282 BYEs are not shown. The conference focus can provide the SRC 283 functionality since the conference focus has access to all the media 284 from each conference participant. When a recording is requested, the 285 SRC delivers the metadata and the media streams to the SRS. Since 286 the conference focus has access to a mixer, the SRC may choose to mix 287 the media streams from all participants as a single mixed media 288 stream towards the SRS. 290 An SRC can use a single recording session to record multiple 291 communication sessions. Every time the SRC wants to record a new 292 call, the SRC updates the recording session with a new SDP offer to 293 add new recorded streams to the recording session, and 294 correspondingly also update the metadata for the new call. 296 An SRS can also establish a recording session to an SRC, although it 297 is beyond the scope of this document to define how an SRS would 298 specify which calls to record. 300 5.2. Delivering recording metadata 302 The SRC is responsible for the delivery of metadata to the SRS. The 303 SRC may provide an initial metadata snapshot about recorded media 304 streams in the initial INVITE content in the recording session. 305 Subsequent metadata updates can be represented as a stream of events 306 in UPDATE or reINVITE requests sent by the SRC. These metadata 307 updates are normally incremental updates to the initial metadata 308 snapshot to optimize on the size of updates, however, the SRC may 309 also decide to send a new metadata snapshot anytime. 311 Metadata is transported in the body of INVITE or UPDATE messages. 312 Certain metadata, such as the attributes of the recorded media stream 313 are located in the SDP of the recording session. 315 The SRS has the ability to send a request to the SRC to request for a 316 new metadata snapshot update from the SRC. This can happen when the 317 SRS fails to understand the current stream of incremental updates for 318 whatever reason, for example, when SRS loses the current state due to 319 internal failure. The SRS may optionally attach a reason along with 320 the snapshot request. This request allows both SRC and SRS to 321 synchronize the states with a new metadata snapshot so that further 322 metadata incremental updates will be based on the latest metadata 323 snapshot. Similar to the metadata content, the metadata snapshot 324 request is transported as content in UPDATE or INVITE sent by the SRS 325 in the recording session. 327 SRC SRS 328 | | 329 |(1) INVITE (metadata snapshot) | 330 |---------------------------------------------------->| 331 | (2)200 OK | 332 |<----------------------------------------------------| 333 |(3) ACK | 334 |---------------------------------------------------->| 335 |(4) RTP | 336 |====================================================>| 337 |====================================================>| 338 |(5) UPDATE (metadata update 1) | 339 |---------------------------------------------------->| 340 | (6) 200 OK | 341 |<----------------------------------------------------| 342 |(7) UPDATE (metadata update 2) | 343 |---------------------------------------------------->| 344 | (8) 200 OK | 345 |<----------------------------------------------------| 346 | (9) UPDATE (metadata snapshot request) | 347 |<----------------------------------------------------| 348 | (10) 200 OK | 349 |---------------------------------------------------->| 350 | (11) INVITE (metadata snapshot 2 + SDP offer) | 351 |---------------------------------------------------->| 352 | (12) 200 OK (SDP answer) | 353 |<----------------------------------------------------| 354 | (13) UPDATE (metadata update 1 based on snapshot 2) | 355 |---------------------------------------------------->| 356 | (14) 200 OK | 357 |<----------------------------------------------------| 359 Figure 2: Delivering metadata via SIP UPDATE 361 5.3. Receiving recording indications and providing recording 362 preferences 364 The SRC is responsible to provide recording indications to the 365 participants in the CS. A recording-aware UA supports receiving 366 recording indications via the SDP attribute a=record, and it can 367 specify a recording preference in the CS by including the SDP 368 attribute a=recordpref. The recording attribute is a declaration by 369 the SRC in the CS to indicate whether recording is taking place. The 370 recording preference attribute is a declaration by the recording- 371 aware UA in the CS to indicate the recording preference. 373 To illustrate how the attributes are used, if a UA (A) is initiating 374 a call to UA (B) and UA (A) is also an SRC that is performing the 375 recording, then UA (A) provides the recording indication in the SDP 376 offer with a=record:on. Since UA (A) is the SRC, UA (A) receives the 377 recording indication from the SRC directly. When UA (B) receives the 378 SDP offer, UA (B) will see that recording is happening on the other 379 endpoint of this session. Since UA (B) is not an SRC and does not 380 provide any recording preference, the SDP answer does not contain 381 a=record nor a=recordpref. 383 UA A UA B 384 (SRC) | 385 | | 386 | [SRC recording starts] | 387 |(1) INVITE (SDP offer + a=record:on) | 388 |---------------------------------------------------->| 389 | (2) 200 OK (SDP answer) | 390 |<----------------------------------------------------| 391 |(3) ACK | 392 |---------------------------------------------------->| 393 |(4) RTP | 394 |<===================================================>| 395 | | 396 | [UA B wants to set preference to no recording] | 397 | (5) INVITE (SDP offer + a=recordpref:off) | 398 |<----------------------------------------------------| 399 | [SRC honors the preference and stops recording] | 400 |(6) 200 OK (SDP answer + a=record:off) | 401 |---------------------------------------------------->| 402 | (7) ACK | 403 |<----------------------------------------------------| 405 Figure 3: Recording indication and recording preference 407 After the call is established and recording is in progress, UA (B) 408 later decides to change the recording preference to no recording and 409 sends a reINVITE with the a=recordpref attribute. It is up to the 410 SRC to honor the preference, and in this case SRC decides to stop the 411 recording and updates the recording indication in the SDP answer. 413 6. SIP Handling 414 6.1. Procedures at the SRC 416 6.1.1. Initiating a Recording Session 418 A recording session is a SIP session with specific extensions 419 applied, and these extensions are listed in the procedures for SRC 420 and SRS below. When an SRC or an SRS receives a SIP session that is 421 not a recording session, it is up to the SRC or the SRS to determine 422 what to do with the SIP session. 424 The SRC can initiate a recording session by sending a SIP INVITE 425 request to the SRS. The SRC and the SRS are identified in the From 426 and To headers, respectively. 428 The SRC MUST include the '+sip.src' feature tag in the Contact URI, 429 defined in this specification as an extension to [RFC3840], for all 430 recording sessions. An SRS uses the presence of the '+sip.src' 431 feature tag in dialog creating and modifying requests and responses 432 to confirm that the dialog being created is for the purpose of a 433 Recording Session. In addition, when an SRC sends a REGISTER request 434 to a registrar, the SRC MAY include the '+sip.src' feature tag to 435 indicate the that it is a SRC. 437 Since SIP Caller Preferences extensions are optional to implement for 438 routing proxies, there is no guarantee that a recording session will 439 be routed to an SRC or SRS. A new options tag is introduced: 440 "siprec". As per [RFC3261], only an SRC or an SRS can accept this 441 option tag in a recording session. An SRC MUST include the "siprec" 442 option tag in the Require header when initiating a Recording Session 443 so that UA's which do not support the session recording protocol 444 extensions will simply reject the INVITE request with a 420 Bad 445 Extension. 447 When an SRC receives a new INVITE, the SRC MUST only consider the SIP 448 session as a recording session when both the '+sip.srs' feature tag 449 and 'siprec' option tag are included in the INVITE request. 451 6.1.2. SIP extensions for recording indication and preference 453 For the communication session, the SRC MUST provide recording 454 indication to all participants in the CS. A participant UA in a CS 455 can indicate that it is recording-aware by providing the "record- 456 aware" option tag, and the SRC MUST provide recording indications in 457 the new SDP a=record attribute described in the SDP Handling section. 458 In the absence of the "record-aware" option tag, meaning that the 459 participant UA is not recording-aware, an SRC MUST provide recording 460 indications through other means such as playing a tone in-band, if 461 the SRC is required to do so (e.g. based on policies). 463 An SRC in the CS may also indicate itself as a session recording 464 client by including the '+sip.src' feature tag. A recording-aware 465 participant can learn that a SRC is in the CS, and can set the 466 recording preference for the CS with the new SDP a=recordpref 467 attribute described in the SDP Handling section below. 469 6.2. Procedures at the SRS 471 When an SRS receives a new INVITE, the SRS MUST only consider the SIP 472 session as a recording session when both the '+sip.src' feature tag 473 and 'siprec' option tag are included in the INVITE request. 475 The SRS can initiate a recording session by sending a SIP INVITE 476 request to the SRC. The SRS and the SRC are identified in the From 477 and To headers, respectively. 479 The SRS MUST include the '+sip.srs' feature tag in the Contact URI, 480 as per [RFC3840], for all recording sessions. An SRC uses the 481 presence of this feature tag in dialog creating and modifying 482 requests and responses to confirm that the dialog being created is 483 for the purpose of a Recording Session (REQ-30). In addition, when 484 an SRS sends a REGISTER request to a registrar, the SRS SHOULD 485 include the '+sip.srs' feature tag to indicate that it is a SRS. 487 An SRS MUST include the "siprec" option tag in the Require header as 488 per [RFC3261] when initiating a Recording Session so that UA's which 489 do not support the session recording protocol extensions will simply 490 reject the INVITE request with a 420 Bad Extension. 492 6.3. Procedures for Recording-aware User Agents 494 A recording-aware user agent is a participant in the CS that supports 495 the SIP and SDP extensions for receiving recording indication and for 496 requesting recording preferences for the call. A recording-aware UA 497 MUST indicate that it can accept reporting of recording indication 498 provided by the SRC with a new option tag "record-aware" when 499 initiating or establishing a CS, meaning including the "record-aware" 500 tag in the Supported header in the initial INVITE request or 501 response. 503 A recording-aware UA MUST be prepared to provide a recording 504 indication to the end user through an appropriate user interface, 505 indicating whether recording is on, off, or paused for each medium. 506 Some user agents that are automatons (e.g. IVR, media server, PSTN 507 gateway) may not have a user interface to render recording 508 indication. When such user agent indicates recording awareness, the 509 UA SHOULD render recording indication through other means, such as 510 passing an in-band tone on the PSTN gateway, putting the recording 511 indication in a log file, or raising an application event in a 512 VoiceXML dialog. These user agents MAY also choose not to indicate 513 recording awareness, thereby relying on whatever mechanism an SRC 514 chooses to indicate recording, such as playing a tone in-band. 516 7. SDP Handling 518 7.1. Procedures at the SRC 520 The SRC and SRS follows the SDP offer/answer model in [RFC3264]. The 521 procedures for SRC and SRS describe the conventions used in a 522 recording session. 524 7.1.1. SDP handling in RS 526 Since the SRC does not expect to receive media from the SRS, the SRC 527 typically sets each media stream of the SDP offer to only send media, 528 by qualifying them with the a=sendonly attribute, according to the 529 procedures in [RFC3264]. 531 The SRC sends recorded streams of participants to the SRS, and the 532 SRC MUST provide a label attribute (a=label), as per [RFC4574], on 533 each media stream in order to identify the recorded stream with the 534 rest of the metadata. The a=label attribute identifies each recorded 535 media stream, and the label name is mapped to the Media Stream 536 Reference in the metadata as per [I-D.ietf-siprec-metadata]. The 537 scope of the a=label attribute only applies to the SDP and Metadata 538 conveyed in the bodies of the SIP request or response that the label 539 appeared in. Note that a recorded stream is distinct from a CS 540 stream; the metadata provides a list of participants that contributes 541 to each recorded stream. 543 The following is an example SDP offer from SRC with both audio and 544 video recorded streams. Note that the following example contains 545 unfolded lines longer than 72 characters. These are captured between 546 tags. 548 v=0 549 o=SRC 2890844526 2890844526 IN IP4 198.51.100.1 550 s=- 551 c=IN IP4 198.51.100.1 552 t=0 0 553 m=audio 12240 RTP/AVP 0 4 8 554 a=sendonly 555 a=label:1 556 m=video 22456 RTP/AVP 98 557 a=rtpmap:98 H264/90000 558 559 a=fmtp:98 profile-level-id=42A01E; 560 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 561 562 a=sendonly 563 a=label:2 564 m=audio 12242 RTP/AVP 0 4 8 565 a=sendonly 566 a=label:3 567 m=video 22458 RTP/AVP 98 568 a=rtpmap:98 H264/90000 569 570 a=fmtp:98 profile-level-id=42A01E; 571 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 572 573 a=sendonly 574 a=label:4 576 Figure 4: Sample SDP offer from SRC with audio and video streams 578 7.1.1.1. Handling media stream updates 580 Over the lifetime of a recording session, the SRC can add and remove 581 recorded streams from the recording session for various reasons. For 582 example, when a CS stream is added or removed from the CS, or when a 583 CS is created or terminated if a recording session handles multiple 584 CSes. To remove a recorded stream from the recording session, the 585 SRC sends a new SDP offer where the port of the media stream to be 586 removed is set to zero, according to the procedures in [RFC3264]. To 587 add a recorded stream to the recording session, the SRC sends a new 588 SDP offer by adding a new media stream description or by reusing an 589 old media stream which had been previously disabled, according to the 590 procedures in [RFC3264]. 592 The SRC can temporarily discontinue streaming and collection of 593 recorded media from the SRC to the SRS for reasons such as masking 594 the recording. In this case, the SRC sends a new SDP offer and sets 595 the media stream to inactive (a=inactive) for each recorded stream to 596 be paused, as per the procedures in [RFC3264]. To resume streaming 597 and collection of recorded media, the SRC sends a new SDP offer and 598 sets the media stream to sendonly (a=sendonly). Note that a CS 599 itself may change the media stream direction by updating the SDP, for 600 example, by setting a=inactive for SDP hold. Media stream direction 601 changes in CS are conveyed in the metadata by the SRC. When a CS 602 media stream is changed to/from inactive, the effect on the 603 corresponding RS media stream is governed by SRC policy. The SRC MAY 604 have a local policy to pause an RS media stream when the 605 corresponding CS media stream is inactive, or it MAY leave the RS 606 media stream as sendonly. 608 7.1.2. Recording indication in CS 610 While there are existing mechanisms for providing an indication that 611 a CS is being recorded, these mechanisms are usually delivered on the 612 CS media streams such as playing an in-band tone or an announcement 613 to the participants. A new 'record' SDP attribute is introduced to 614 allow the SRC to indicate recording state to a recording-aware UA in 615 CS. 617 The 'record' SDP attribute appears at the media level or session 618 level in either SDP offer or answer. When the attribute is applied 619 at the session level, the indication applies to all media streams in 620 the SDP. When the attribute is applied at the media level, the 621 indication applies to the media stream only, and that overrides the 622 indication if also set at the session level. Whenever the recording 623 indication needs to change, such as termination of recording, then 624 the SRC MUST initiate a reINVITE or UPDATE to update the SDP a=record 625 attribute. 627 The following is the ABNF of the 'record' attribute: 629 attribute /= record-attr 630 ; attribute defined in RFC 4566 632 record-attr = "record:" indication 633 indication = "on" / "off" / "paused" 635 on: Recording is in progress. 637 off: No recording is in progress. 639 paused: Recording is in progress but media is paused. 641 7.1.3. Recording preference in CS 643 When the SRC receives the a=recordpref SDP in an SDP offer or answer, 644 the SRC chooses to honor the preference to record based on local 645 policy at the SRC. If the SRC makes a change in recording state, the 646 SRC MUST report the new recording state in the a=record attribute in 647 the SDP answer or in a subsequent SDP offer. 649 7.2. Procedures at the SRS 651 Typically the SRS only receives RTP streams from the SRC; therefore, 652 the SDP offer/answer from the SRS normally sets each media stream to 653 receive media, by setting them with the a=recvonly attribute, 654 according to the procedures of [RFC3264]. When the SRS is not ready 655 to receive a recorded stream, the SRS sets the media stream as 656 inactive in the SDP offer or answer by setting it with a=inactive 657 attribute, according to the procedures of [RFC3264]. When the SRS is 658 ready to receive recorded streams, the SRS sends a new SDP offer and 659 sets the media streams with a=recvonly attribute. 661 The following is an example of SDP answer from SRS for the SDP offer 662 from the above sample. Note that the following example contain 663 unfolded lines longer than 72 characters. These are captured between 664 tags. 666 v=0 667 o=SRS 0 0 IN IP4 198.51.100.20 668 s=- 669 c=IN IP4 198.51.100.20 670 t=0 0 671 m=audio 10000 RTP/AVP 0 672 a=recvonly 673 a=label:1 674 m=video 10002 RTP/AVP 98 675 a=rtpmap:98 H264/90000 676 677 a=fmtp:98 profile-level-id=42A01E; 678 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 679 680 a=recvonly 681 a=label:2 682 m=audio 10004 RTP/AVP 0 683 a=recvonly 684 a=label:3 685 m=video 10006 RTP/AVP 98 686 a=rtpmap:98 H264/90000 687 688 a=fmtp:98 profile-level-id=42A01E; 689 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 690 691 a=recvonly 692 a=label:4 694 Figure 5: Sample SDP answer from SRS with audio and video streams 696 Over the lifetime of a recording session, the SRS can remove recorded 697 streams from the recording session for various reasons. To remove a 698 recorded stream from the recording session, the SRS sends a new SDP 699 offer where the port of the media stream to be removed is set to 700 zero, according to the procedures in [RFC3264]. 702 The SRS SHOULD NOT add recorded streams in the recording session when 703 SRS sends a new SDP offer. Similarly, when the SRS starts a 704 recording session, the SRS SHOULD initiate the INVITE without an SDP 705 offer to let the SRC generate the SDP offer with recorded streams. 707 The following sequence diagram shows an example where the SRS is 708 initially not ready to receive recorded streams, and later updates 709 the recording session when the SRS is ready to record. 711 SRC SRS 712 | | 713 |(1) INVITE (SDP offer) | 714 |---------------------------------------------------->| 715 | [not ready to record] 716 | (2)200 OK with SDP inactive | 717 |<----------------------------------------------------| 718 |(3) ACK | 719 |---------------------------------------------------->| 720 | ... | 721 | [ready to record] 722 | (4) re-INVITE with SDP recvonly | 723 |<----------------------------------------------------| 724 |(5)200 OK with SDP sendonly | 725 |---------------------------------------------------->| 726 | (6) ACK | 727 |<----------------------------------------------------| 728 |(7) RTP | 729 |====================================================>| 730 | ... | 731 |(8) BYE | 732 |---------------------------------------------------->| 733 | (9) OK | 734 |<----------------------------------------------------| 736 Figure 6: SRS responding to offer with a=inactive 738 7.3. Procedures for Recording-aware User Agents 740 7.3.1. Recording indication 742 When a recording-aware UA receives an SDP offer or answer that 743 includes the a=record attribute, the UA MUST provide the recording 744 indication to the end user whether the recording is on, off, or 745 paused for each medium based on the most recently received a=record 746 SDP attribute for that medium. 748 When a CS is traversed through multiple UAs such as a B2BUA or a 749 conference focus, each UA involved in the CS that is aware that the 750 CS is being recorded MUST provide the recording indication through 751 the a=record attribute to all other parties in the CS. 753 It is possible that more than one SRC is in the call path of the same 754 CS, but the recording indication attribute does not provide any hint 755 as to which SRC or how many SRCs are recording. An endpoint knows 756 only that the call is being recorded. Furthermore, this attribute is 757 not used as a request for a specific SRC to start/stop recording. 759 7.3.2. Recording preference 761 A participant in a CS MAY set the recording preference in the CS to 762 be recorded or not recorded at session establishment or during the 763 session. A new 'recordpref' SDP attribute is introduced, and the 764 participant in CS may set this recording preference attribute in any 765 SDP offer/answer at session establishment time or during the session. 766 The SRC is not required to honor the recording preference from a 767 participant based on local policies at the SRC, and the participant 768 can learn the recording indication through the a=record SDP attribute 769 as described in the above section. 771 The SDP a=recordpref attribute can appear at the media level or 772 session level and can appear in an SDP offer or answer. When the 773 attribute is applied at the session level, the recording preference 774 applies to all media stream in the SDP. When the attribute is 775 applied at the media level, the recording preference applies to the 776 media stream only, and that overrides the recording preference if 777 also set at the session level. The user agent can change the 778 recording preference by changing the a=recordpref attribute in 779 subsequent SDP offer or answer. The absence of the a=recordpref 780 attribute in the SDP indicates that the UA has no recording 781 preference. 783 The following is the ABNF of the recordpref attribute: 785 attribute /= recordpref-attr 786 ; attribute defined in RFC 4566 788 recordpref-attr = "a=recordpref:" pref 789 pref = "on" / "off" / "pause" / "nopreference" 791 on: Sets the preference to record if it has not already been 792 started. If the recording is currently paused, the preference is 793 to resume recording. 795 off: Sets the preference for no recording. If recording has already 796 been started, then the preference is to stop the recording. 798 pause: If the recording is currently in progress, sets the 799 preference to pause the recording. 801 nopreference: To indicate that the UA has no preference on 802 recording. 804 8. RTP Handling 806 This section provides recommendations and guidelines for RTP and RTCP 807 in the context of SIPREC. In order to communicate most effectively, 808 the Session Recording Client (SRC), the Session Recording Server 809 (SRS), and any Recording aware User Agents (UAs) should utilize the 810 mechanisms provided by RTP in a well-defined and predicable manner. 811 It is the goal of this document to make the reader aware of these 812 mechanisms and provide recommendations and guidelines. 814 8.1. RTP Mechanisms 816 This section briefly describes important RTP/RTCP constructs and 817 mechanisms that are particularly useful within the content of SIPREC. 819 8.1.1. RTCP 821 The RTP data transport is augmented by a control protocol (RTCP) to 822 allow monitoring of the data delivery. RTCP, as defined in 823 [RFC3550], is based on the periodic transmission of control packets 824 to all participants in the RTP session, using the same distribution 825 mechanism as the data packets. Support for RTCP is REQUIRED, per 826 [RFC3550], and it provides, among other things, the following 827 important functionality in relation to SIPREC: 829 1) Feedback on the quality of the data distribution 831 This feedback from the receivers may be used to diagnose faults in 832 the distribution. As such, RTCP is a well-defined and efficient 833 mechanism for the SRS to inform the SRC, and for the SRC to inform 834 Recording aware UAs, of issues that arise with respect to the 835 reception of media that is to be recorded. 837 2) Carries a persistent transport-level identifier for an RTP source 838 called the canonical name or CNAME 840 The SSRC identifier may change if a conflict is discovered or a 841 program is restarted; in which case receivers can use the CNAME to 842 keep track of each participant. Receivers may also use the CNAME to 843 associate multiple data streams from a given participant in a set of 844 related RTP sessions, for example to synchronize audio and video. 845 Synchronization of media streams is also facilitated by the NTP and 846 RTP timestamps included in RTCP packets by data senders. 848 8.1.2. RTP Profile 850 The RECOMMENDED RTP profiles for the SRC, SRS, and Recording aware 851 UAs are "Extended Secure RTP Profile for Real-time Transport Control 852 Protocol (RTCP)-Based Feedback (RTP/SAVPF)", [RFC5124] when using 853 encrypted RTP streams, and "Extended RTP Profile for Real-time 854 Transport Control Protocol (RTCP)-Based Feedback (RTP/AVPF)", 855 [RFC4585] when using non encrypted media streams. However, as this 856 is not a requirement, some implementations may use "The Secure Real- 857 time Transport Protocol (SRTP)", [RFC3711] and "RTP Profile for Audio 858 and Video Conferences with Minimal Control", AVP [RFC3551]. 859 Therefore, it is RECOMMENDED that the SRC, SRS, and Recording aware 860 UAs not rely entirely on SAVPF or AVPF for core functionality that 861 may be at least partially achievable using SAVP and AVP. 863 AVPF and SAVPF provide an improved RTCP timer model that allows more 864 flexible transmission of RTCP packets in response to events, rather 865 than strictly according to bandwidth. AVPF based codec control 866 messages provide efficient mechanisms for an SRC, SRS, and Recording 867 aware UAs to handle events such as scene changes, error recovery, and 868 dynamic bandwidth adjustments. These messages are discussed in more 869 detail later in this document. 871 SAVP and SAVPF provide media encryption, integrity protection, replay 872 protection, and a limited form of source authentication. They do not 873 contain or require a specific keying mechanism. 875 8.1.3. SSRC 877 The synchronization source (SSRC), as defined in [RFC3550] is carried 878 in the RTP header and in various fields of RTCP packets. It is a 879 random 32-bit number that is required to be globally unique within an 880 RTP session. It is crucial that the number be chosen with care in 881 order that participants on the same network or starting at the same 882 time are not likely to choose the same number. Guidelines regarding 883 SSRC value selection and conflict resolution are provided in 884 [RFC3550]. 886 The SSRC may also be used to separate different sources of media 887 within a single RTP session. For this reason as well as for conflict 888 resolution, it is important that the SRC, SRS, and Recording aware 889 UAs handle changes in SSRC values and properly identify the reason of 890 the change. The CNAME values carried in RTCP facilitate this 891 identification. 893 8.1.4. CSRC 895 The contributing source (CSRC), as defined in [RFC3550], identifies 896 the source of a stream of RTP packets that has contributed to the 897 combined stream produced by an RTP mixer. The mixer inserts a list 898 of the SSRC identifiers of the sources that contributed to the 899 generation of a particular packet into the RTP header of that packet. 900 This list is called the CSRC list. It is RECOMMENDED that a SRC or 901 Recording aware UA, when acting a mixer, sets the CSRC list 902 accordingly, and that the SRC and SRS interpret the CSRC list 903 appropriately when received. 905 8.1.5. SDES 907 The Source Description (SDES), as defined in [RFC3550], contains an 908 SSRC/CSRC identifier followed by a list of zero or more items, which 909 carry information about the SSRC/CSRC. End systems send one SDES 910 packet containing their own source identifier (the same as the SSRC 911 in the fixed RTP header). A mixer sends one SDES packet containing a 912 chunk for each contributing source from which it is receiving SDES 913 information, or multiple complete SDES packets if there are more than 914 31 such sources. 916 8.1.5.1. CNAME 918 The Canonical End-Point Identifier (CNAME), as defined in [RFC3550], 919 provides the binding from the SSRC identifier to an identifier for 920 the source (sender or receiver) that remains constant. It is 921 important the SRC and Recording aware UAs generate CNAMEs 922 appropriately and that the SRC and SRS interpret and use them for 923 this purpose. Guidelines for generating CNAME values are provided in 924 "Guidelines for Choosing RTP Control Protocol (RTCP) Canonical Names 925 (CNAMEs)" [RFC7022]. 927 8.1.6. Keepalive 929 It is anticipated that media streams in SIPREC may exist in an 930 inactive state for extended periods of times for any of a number of 931 valid reasons. In order for the bindings and any pinholes in NATs/ 932 firewalls to remain active during such intervals, it is RECOMMENDED 933 that the SRC, SRS, and Recording aware UAs follow the keep-alive 934 procedure recommended in "Application Mechanism for Keeping Alive the 935 NAT Mappings Associated to RTP/RTP Control Protocol (RTCP) Flows" 936 [RFC6263] for all RTP media streams. 938 8.1.7. RTCP Feedback Messages 940 "Codec Control Messages in the RTP Audio-Visual Profile with Feedback 941 (AVPF)" [RFC5104] specifies extensions to the messages defined in 942 AVPF [RFC4585]. Support for and proper usage of these messages is 943 important to SRC, SRS, and Recording aware UA implementations. Note 944 that these messages are applicable only when using the AVFP or SAVPF 945 RTP profiles 947 8.1.7.1. Full Intra Request 949 A Full Intra Request (FIR) Command, when received by the designated 950 media sender, requires that the media sender sends a Decoder Refresh 951 Point at the earliest opportunity. Using a decoder refresh point 952 implies refraining from using any picture sent prior to that point as 953 a reference for the encoding process of any subsequent picture sent 954 in the stream. 956 Decoder refresh points, especially Intra or IDR pictures for H.264 957 video codecs, are in general several times larger in size than 958 predicted pictures. Thus, in scenarios in which the available bit 959 rate is small, the use of a decoder refresh point implies a delay 960 that is significantly longer than the typical picture duration. 962 8.1.7.1.1. SIP INFO for FIR 964 "XML Schema for Media Control" [RFC5168] defines an Extensible Markup 965 Language (XML) Schema for video fast update. Implementations are 966 discouraged from using the method described except for backward 967 compatibility purposes. Implementations SHOULD use FIR messages 968 instead. 970 To make sure a common mechanism exists between the SRC and SRS, the 971 SRS MUST support both mechanisms (FIR and SIP INFO), using FIR when 972 negotiated successfully with the SRC, and using SIP INFO otherwise. 974 8.1.7.2. Picture Loss Indicator 976 Picture Loss Indication (PLI), as defined in [RFC4585], informs the 977 encoder of the loss of an undefined amount of coded video data 978 belonging to one or more pictures. [RFC4585] recommends using PLI 979 instead of FIR to recover from errors. FIR is appropriate only in 980 situations where not sending a decoder refresh point would render the 981 video unusable for the users. Examples where sending FIR is 982 appropriate include a multipoint conference when a new user joins the 983 conference and no regular decoder refresh point interval is 984 established, and a video switching MCU that changes streams. 986 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request 988 A receiver, translator, or mixer uses the Temporary Maximum Media 989 Stream Bit Rate Request (TMMBR) to request a sender to limit the 990 maximum bit rate for a media stream to the provided value. 991 Appropriate use of TMMBR facilitates rapid adaptation to changes in 992 available bandwidth. 994 8.1.7.3.1. Renegotiation of SDP bandwidth attribute 996 If it is likely that the new value indicated by TMMBR will be valid 997 for the remainder of the session, the TMMBR sender is expected to 998 perform a renegotiation of the session upper limit using the session 999 signaling protocol. Therefore for SIPREC, implementations are 1000 RECOMMENDED to use TMMBR for temporary changes, and renegotiation of 1001 bandwidth via SDP offer/answer for more permanent changes. 1003 8.1.8. Symmetric RTP/RTCP for Sending and Receiving 1005 Within an SDP offer/answer exchange, RTP entities choose the RTP and 1006 RTCP transport addresses (i.e., IP addresses and port numbers) on 1007 which to receive packets. When sending packets, the RTP entities may 1008 use the same source port or a different source port as those signaled 1009 for receiving packets. When the transport address used to send and 1010 receive RTP is the same, it is termed "symmetric RTP" [RFC4961]. 1011 Likewise, when the transport address used to send and receive RTCP is 1012 the same, it is termed "symmetric RTCP" [RFC4961]. 1014 When sending RTP, it is REQUIRED to use symmetric RTP. When sending 1015 RTCP, it is REQUIRED to use symmetric RTCP. Although an SRS will not 1016 normally send RTP, it will send RTCP as well as receive RTP and RTCP. 1017 Likewise, although an SRC will not normally receive RTP from the SRS, 1018 it will receive RTCP as well as send RTP and RTCP. 1020 Note: Symmetric RTP and symmetric RTCP are different from RTP/RTCP 1021 multiplexing [RFC5761]. 1023 8.2. Roles 1025 An SRC has the task of gathering media from the various UAs in one or 1026 more Communication Sessions (CSs) and forwarding the information to 1027 the SRS within the context of a corresponding Recording Session (RS). 1028 There are numerous ways in which an SRC may do this, including but 1029 not limited to, appearing as a UA within a CS, or as a B2BUA between 1030 UAs within a CS. 1032 (Recording Session) +---------+ 1033 +------------SIP------->| | 1034 | +------RTP/RTCP----->| SRS | 1035 | | +-- Metadata -->| | 1036 | | | +---------+ 1037 v v | 1038 +---------+ 1039 | SRC | 1040 |---------| (Communication Session) +---------+ 1041 | |<----------SIP---------->| | 1042 | UA-A | | UA-B | 1043 | |<-------RTP/RTCP-------->| | 1044 +---------+ +---------+ 1046 Figure 7: UA as SRC 1048 (Recording Session) +---------+ 1049 +------------SIP------->| | 1050 | +------RTP/RTCP----->| SRS | 1051 | | +-- Metadata -->| | 1052 | | | +---------+ 1053 v v | 1054 +---------+ 1055 | SRC | 1056 +---------+ |---------| +---------+ 1057 | |<----SIP----->| |<----SIP----->| | 1058 | UA-A | | B2BUA | | UA-B | 1059 | |<--RTP/RTCP-->| |<--RTP/RTCP-->| | 1060 +---------+ +---------+ +---------+ 1061 |_______________________________________________| 1062 (Communication Session) 1064 Figure 8: B2BUA as SRC 1066 The following subsections define a set of roles an SRC may choose to 1067 play based on its position with respect to a UA within a CS, and an 1068 SRS within an RS. A CS and a corresponding RS are independent 1069 sessions; therefore, an SRC may play a different role within a CS 1070 than it does within the corresponding RS. 1072 8.2.1. SRC acting as an RTP Translator 1074 The SRC may act as a translator, as defined in [RFC3550]. A defining 1075 characteristic of a translator is that it forwards RTP packets with 1076 their SSRC identifier intact. There are two types of translators, 1077 one that simply forwards, and another that performs transcoding 1078 (e.g., from one codec to another) in addition to forwarding. 1080 8.2.1.1. Forwarding Translator 1082 When acting as a forwarding translator, RTP received as separate 1083 streams from different sources (e.g., from different UAs with 1084 different SSRCs) cannot be mixed by the SRC and MUST be sent 1085 separately to the SRS. All RTCP reports MUST be passed by the SRC 1086 between the UAs and the SRS, such that the UAs and SRS are able to 1087 detect any SSRC collisions. 1089 RTCP Sender Reports generated by a UA sending a stream MUST be 1090 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1091 MUST be forwarded to the relevant UA. 1093 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1094 from other UAs participating in the CS, and one from the SRS 1095 participating in the RS. A Recording aware UA SHOULD be prepared to 1096 process the RTCP Receiver Reports from the SRS, whereas a recording 1097 unaware UA may discard such RTCP packets as not of relevance. 1099 If SRTP is used on both the CS and the RS, decryption and/or re- 1100 encryption may occur. For example, if different keys are used, it 1101 will occur. If the same keys are used, it need not occur. 1102 Section 12 provides additional information on SRTP and keying 1103 mechanisms. 1105 If packet loss occurs, either from the UA to the SRC or from the SRC 1106 to the SRS, the SRS SHOULD detect and attempt to recover from the 1107 loss. The SRC does not play a role in this other than forwarding the 1108 associated RTP and RTCP packets. 1110 8.2.1.2. Transcoding Translator 1112 When acting as a transcoding translator, an SRC MAY perform 1113 transcoding (e.g., from one codec to another), and this may result in 1114 a different rate of packets between what the SRC receives on the CS 1115 and what the SRC sends on the RS. As when acting as a forwarding 1116 translator, RTP received as separate streams from different sources 1117 (e.g., from different UAs with different SSRCs) cannot be mixed by 1118 the SRC and MUST be sent separately to the SRS. All RTCP reports 1119 MUST be passed by the SRC between the UAs and the SRS, such that the 1120 UAs and SRS are able to detect any SSRC collisions. 1122 RTCP Sender Reports generated by a UA sending a stream MUST be 1123 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1124 MUST be forwarded to the relevant UA. The SRC may need to manipulate 1125 the RTCP Receiver Reports to take account of any transcoding that has 1126 taken place. 1128 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1129 from other UAs participating in the CS, and one from the SRS 1130 participating in the RS. A Recording aware UA SHOULD be prepared to 1131 process the RTCP Receiver Reports from the SRS, whereas a recording 1132 unaware UA may discard such RTCP packets as not of relevance. 1134 If SRTP is used on both the CS and the RS, decryption and/or re- 1135 encryption may occur. For example, if different keys are used, it 1136 will occur. If the same keys are used, it need not occur. 1137 Section 12 provides additional information on SRTP and keying 1138 mechanisms. 1140 If packet loss occurs, either from the UA to the SRC or from the SRC 1141 to the SRS, the SRS SHOULD detect and attempt to recover from the 1142 loss. The SRC does not play a role in this other than forwarding the 1143 associated RTP and RTCP packets. 1145 8.2.2. SRC acting as an RTP Mixer 1147 In the case of the SRC acting as a RTP mixer, as defined in 1148 [RFC3550], the SRC combines RTP streams from different UA and sends 1149 them towards the SRS using its own SSRC. The SSRCs from the 1150 contributing UA SHOULD be conveyed as CSRCs identifiers within this 1151 stream. The SRC may make timing adjustments among the received 1152 streams and generate its own timing on the stream sent to the SRS. 1153 Optionally an SRC acting as a mixer can perform transcoding, and can 1154 even cope with different codings received from different UAs. RTCP 1155 Sender Reports and Receiver Reports are not forwarded by an SRC 1156 acting as mixer, but there are requirements for forwarding RTCP 1157 Source Description (SDES) packets. The SRC generates its own RTCP 1158 Sender and Receiver reports toward the associated UAs and SRS. 1160 The use of SRTP between the SRC and the SRS for the RS is independent 1161 of the use of SRTP between the UAs and SRC for the CS. Section 12 1162 provides additional information on SRTP and keying mechanisms. 1164 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1165 and attempt to recover from the loss. If packet loss occurs from the 1166 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1167 loss. 1169 8.2.3. SRC acting as an RTP Endpoint 1171 The case of the SRC acting as an RTP endpoint, as defined in 1172 [RFC3550], is similar to the mixer case, except that the RTP session 1173 between the SRC and the SRS is considered completely independent from 1174 the RTP session that is part of the CS. The SRC can, but need not, 1175 mix RTP streams from different participants prior to sending to the 1176 SRS. RTCP between the SRC and the SRS is completely independent of 1177 RTCP on the CS. 1179 The use of SRTP between the SRC and the SRS for the RS is independent 1180 of the use of SRTP between the UAs and SRC for the CS. Section 12 1181 provides additional information on SRTP and keying mechanisms. 1183 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1184 and attempt to recover from the loss. If packet loss occurs from the 1185 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1186 loss. 1188 8.3. Packet Loss 1190 If packet loss occurs from the UA to the SRC, the SRC, if acting as 1191 an RTP mixer or RTP endpoint, SHOULD detect and attempt to recover 1192 from the loss. If acting as an RTP translator (either forwarding or 1193 transcoding), the SRC does not detect or attempt to recover from the 1194 loss. It simply forwards the associated RTP and RTCP packets. In 1195 such cases, as well as if packet loss occurs from the SRC to the SRS, 1196 the SRS SHOULD detect and attempt to recover from the loss. 1198 8.4. RTP Session Usage by SRC 1200 There are multiple ways that an SRC may choose to deliver recorded 1201 media to an SRS. In some cases, it may use a single RTP session for 1202 all media within the RS, whereas in others it may use multiple RTP 1203 sessions. The following subsections provide examples of basic RTP 1204 session usage by the SRC, including a discussion of how the RTP 1205 constructs and mechanisms covered previously are used. An SRC may 1206 choose to use one or more of the RTP session usages within a single 1207 RS. For the purpose of base interoperability between SRC and SRS, an 1208 SRC MUST support separate m-lines in SDP, one per CS media direction. 1209 The set of RTP session usages described is not meant to be 1210 exhaustive. 1212 8.4.1. SRC Using Multiple m-lines 1214 When using multiple m-lines, an SRC includes each m-line in an SDP 1215 offer to the SRS. The SDP answer from the SRS MUST include all 1216 m-lines, with any rejected m-lines indicated with a zero port, per 1217 [RFC3264]. Having received the answer, the SRC starts sending media 1218 to the SRS as indicated in the answer. Alternatively, if the SRC 1219 deems the level of support indicated in the answer to be 1220 unacceptable, it may initiate another SDP offer/answer exchange in 1221 which an alternative RTP session usage is negotiated. 1223 In order to preserve the mapping of media to participant within the 1224 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1225 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1226 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1227 SSRC within the RS. In doing so, the SRC may act as an RTP 1228 translator or as an RTP endpoint. 1230 The following figure illustrates a case in which each UA represents a 1231 participant contributing two RTP sessions (e.g. one for audio and one 1232 for video), each with a single SSRC. The SRC acts as an RTP 1233 translator and delivers the media to the SRS using four RTP sessions, 1234 each with a single SSRC. The CNAME and SSRC values used by the UAs 1235 within their media streams are preserved in the media streams from 1236 the SRC to the SRS. 1238 +---------+ 1239 +------------SSRC Aa--->| | 1240 | + --------SSRC Av--->| | 1241 | | +------SSRC Ba--->| SRS | 1242 | | | +---SSRC Bv--->| | 1243 | | | | +---------+ 1244 | | | | 1245 | | | | 1246 +---------+ +----------+ +---------+ 1247 | |---SSRC Aa-->| SRC |<--SSRC Ba---| | 1248 | UA-A | |(CNAME-A, | | UA-B | 1249 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1250 +---------+ +----------+ +---------+ 1252 Figure 9: SRC Using Multiple m-lines 1254 8.4.2. SRC Using Mixing 1256 When using mixing, the SRC combines RTP streams from different 1257 participants and sends them towards the SRS using its own SSRC. The 1258 SSRCs from the contributing participants SHOULD be conveyed as CSRCs 1259 identifiers. The SRC includes one m-line for each RTP session in an 1260 SDP offer to the SRS. The SDP answer from the SRS MUST include all 1261 m-lines, with any rejected m-lines indicated with the zero port, per 1262 [RFC3264]. Having received the answer, the SRC starts sending media 1263 to the SRS as indicated in the answer. 1265 In order to preserve the mapping of media to participant within the 1266 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1267 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1268 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1269 SSRC within the RS. The SRC MUST avoid SSRC collisions, rewriting 1270 SSRCs if necessary when used as CSRCs in the RS. In doing to, the 1271 SRC acts as an RTP mixer. 1273 In the event the SRS does not support this usage of CSRC values, it 1274 relies entirely on the SIPREC metadata to determine the participants 1275 included within each mixed stream. 1277 The following figure illustrates a case in which each UA represents a 1278 participant contributing two RTP sessions (e.g. one for audio and one 1279 for video), each with a single SSRC. The SRC acts as an RTP mixer 1280 and delivers the media to the SRS using two RTP sessions, mixing 1281 media from each participant into a single RTP session containing a 1282 single SSRC and two CSRCs. 1284 SSRC Sa +---------+ 1285 +-------CSRC Aa,Ba--->| | 1286 | | | 1287 | SSRC Sv | SRS | 1288 | +---CSRC Av,Bv--->| | 1289 | | +---------+ 1290 | | 1291 +----------+ 1292 +---------+ | SRC | +---------+ 1293 | |---SSRC Aa-->|(CNAME-S, |<--SSRC Ba---| | 1294 | UA-A | | CNAME-A, | | UA-B | 1295 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1296 +---------+ +----------+ +---------+ 1298 Figure 10: SRC Using Mixing 1300 8.5. RTP Session Usage by SRS 1302 An SRS that supports recording an audio CS MUST support SRC usage of 1303 separate audio m-lines in SDP, one per CS media direction. An SRS 1304 that supports recording an video CS MUST support SRC usage of 1305 separate video m-lines in SDP, one per CS media direction. 1306 Therefore, for an SRS supporting a typical audio call, the SRS has to 1307 support receiving at least two audio m-lines. For an SRS supporting 1308 a typical audio and video call, the SRS has to support receiving at 1309 least four total m-lines in the SDP, two audio m-lines and two video 1310 m-lines. 1312 These requirements allow an SRS to be implemented that supports video 1313 only, without requiring support for audio recording. They also allow 1314 an SRS to be implemented that supports recording only one direction 1315 of one stream in a CS; for example, an SRS designed to record 1316 security monitoring cameras that only send (not receive) video 1317 without any audio. These requirements were not written to prevent 1318 other modes being implemented and used, such as using a single m-line 1319 and mixing the separate audio streams together. Rather, the 1320 requirements were written to provide a common base mode to implement 1321 for the sake of interoperability. It is important to note that an 1322 SRS implementation supporting the common base may not record all 1323 media streams in a CS if a participant supports more than one m-line 1324 in a video call, such as one for camera and one for presentation. 1325 SRS implementations may support other modes as well, but have to at 1326 least support the ones above such that they interoperate in the 1327 common base mode for basic interoperability. 1329 9. Metadata 1331 Some metadata attributes are contained in SDP, and others are 1332 contained in a new content type "application/rs-metadata". The 1333 format of the metadata is described as part of the mechanism in 1334 [I-D.ietf-siprec-metadata]. A new "disposition-type" of Content- 1335 Disposition is defined for the purpose of carrying metadata. The 1336 value is "recording-session", which indicates the "application/rs- 1337 metadata" content contains metadata to be handled by the SRS. 1339 9.1. Procedures at the SRC 1341 The SRC MUST send metadata to the SRS in an RS. The SRC SHOULD send 1342 metadata as soon as it becomes available and whenever it changes. 1343 Cases in which an SRC may be justified in waiting temporarily before 1344 sending metadata include: 1346 o waiting for previous metadata exchange to complete (i.e. cannot 1347 send another SDP offer until previous offer/answer completes, and 1348 may prefer not to send an UPDATE during this time either). 1350 o constraining the signaling rate on the RS. 1352 o sending metadata when key events occur rather than for every event 1353 that has any impact on metadata. 1355 o desire to suppress certain metadata out of concern for privacy or 1356 perceived lack of need for it to be included in the recording. 1358 Metadata sent by the SRC is categorized as either a full metadata 1359 snapshot or a partial update. A full metadata snapshot describes all 1360 metadata associated with the RS. The SRC MAY send a full metadata 1361 snapshot at any time. The SRC MAY send a partial update only if a 1362 full metadata snapshot has been sent previously. 1364 The SRC MAY send metadata (either a full metadata snapshot or a 1365 partial update) in an INVITE request, an UPDATE request [RFC3311], or 1366 an 200 response to an offerless INVITE from the SRS. If the metadata 1367 contains a reference to any SDP labels, the request containing the 1368 metadata MUST also contain an SDP offer that defines those labels. 1370 When a SIP message contains both an SDP offer and metadata, the 1371 request body MUST have content type "multipart/mixed", with one 1372 subordinate body part containing the SDP offer and another containing 1373 the metadata. When a SIP message contains only an SDP offer or 1374 metadata, the "multipart/mixed" container is optional. 1376 The SRC SHOULD include a full metadata snapshot in the initial INVITE 1377 request establishing the RS. If metadata is not yet available (e.g 1378 an RS established in absence of a CS), the SRC SHOULD send a full 1379 metadata snapshot as soon as metadata becomes available. 1381 If the SRC receives a snapshot request from the SRS, it MUST 1382 immediately send a full metadata snapshot. 1384 The following is an example of a full metadata snapshot sent by the 1385 SRC in the initial INVITE request: 1387 INVITE sip:recorder@example.com SIP/2.0 1388 Via: SIP/2.0/TCP src.example.com;branch=z9hG4bKdf6b622b648d9 1389 From: ;tag=35e195d2-947d-4585-946f-09839247 1390 To: 1391 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1392 CSeq: 101 INVITE 1393 Max-Forwards: 70 1394 Require: siprec 1395 Accept: application/sdp, application/rs-metadata-request 1396 Contact: ;+sip.src 1397 Content-Type: multipart/mixed;boundary=foobar 1398 Content-Length: [length] 1400 --foobar 1401 Content-Type: application/sdp 1403 v=0 1404 o=SRS 2890844526 2890844526 IN IP4 198.51.100.1 1405 s=- 1406 c=IN IP4 198.51.100.1 1407 t=0 0 1408 m=audio 12240 RTP/AVP 0 4 8 1409 a=sendonly 1410 a=label:1 1412 --foobar 1413 Content-Type: application/rs-metadata 1414 Content-Disposition: recording-session 1416 [metadata content] 1418 Figure 11: Sample INVITE request for the recording session 1420 9.2. Procedures at the SRS 1422 The SRS receives metadata updates from the SRC in INVITE and UPDATE 1423 requests. Since the SRC can send partial updates based on the 1424 previous update, the SRS needs to keep track of the sequence of 1425 updates from the SRC. 1427 In the case of an internal failure at the SRS, the SRS may fail to 1428 recognize a partial update from the SRC. The SRS may be able to 1429 recover from the internal failure by requesting for a full metadata 1430 snapshot from the SRC. Certain errors, such as syntax errors or 1431 semantic errors in the metadata information, are likely caused by an 1432 error on the SRC side, and it is likely the same error will occur 1433 again even when a full metadata snapshot is requested. In order to 1434 avoid repeating the same error, the SRS can simply terminate the 1435 recording session when a syntax error or semantic error is detected 1436 in the metadata. 1438 The SRS MAY explicitly request a full metadata snapshot by sending an 1439 UPDATE request. This request MUST contain a body with content 1440 disposition type "recording-session", and MUST NOT contain an SDP 1441 body. The SRS MUST NOT request a full metadata snapshot in an UPDATE 1442 response or in any other SIP transaction. The format of the content 1443 is "application/rs-metadata-request", and the body format is a simple 1444 text-based format. The following shows an example: 1446 UPDATE sip:2000@src.exmaple.com SIP/2.0 1447 Via: SIP/2.0/UDP srs.example.com;branch=z9hG4bKdf6b622b648d9 1448 To: ;tag=35e195d2-947d-4585-946f-098392474 1449 From: ;tag=1234567890 1450 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1451 CSeq: 1 UPDATE 1452 Max-Forwards: 70 1453 Require: siprec 1454 Contact: ;+sip.srs 1455 Accept: application/sdp, application/rs-metadata 1456 Content-Disposition: recording-session 1457 Content-Type: application/rs-metadata-request 1458 Content-Length: [length] 1460 SRS internal error 1462 Figure 12: Metadata Request 1464 The SRS MAY include the reason why a metadata snapshot request is 1465 being made to the SRC in the reason line. This reason line is free 1466 form text, mainly designed for logging purposes on the SRC side. The 1467 processing of the content by the SRC is entirely optional since the 1468 content is for logging only, and the snapshot request itself is 1469 indicated by the use of the application/rs-metadata-request content 1470 type. 1472 When the SRC receives a request for a metadata snapshot, it MUST 1473 immediately provide a full metadata snapshot in a separate INVITE or 1474 UPDATE transaction. Any subsequent partial updates will not be 1475 dependent on any metadata sent prior to this full metadata snapshot. 1477 The metadata received by the SRS can contain ID elements used to 1478 cross reference one element to another. An element containing the 1479 definition of an ID, and an element containing a reference to that ID 1480 will often be received from the same SRC. It is also valid for those 1481 elements to be received from different SRCs, for example, when each 1482 endpoint in the same CS act as an SRC to record the call and a common 1483 ID refers to the same CS. The SRS MUST NOT consider this an error. 1485 9.2.1. Formal Syntax 1487 The formal syntax for the application/rs-metadata-request MIME is 1488 described below using the augmented Backus-Naur Form (BNF) as 1489 described in [RFC5234]. 1491 snapshot-request = srs-reason-line CRLF 1492 srs-reason-line = [TEXT-UTF8-TRIM] 1493 ; TEXT-UTF8-TRIM defined in RFC3261 1495 10. Persistent Recording 1497 Persistent recording is a specific use case outlined in REQ-005 or 1498 Use Case 4 in [RFC6341], where a recording session can be established 1499 in the absence of a communication session. The SRC continuously 1500 records media in a recording session to the SRS even in the absence 1501 of a CS for all user agents that are part of persistent recording. 1502 By allocating recorded streams and continuously sending recorded 1503 media to the SRS, the SRC does not have to prepare new recorded 1504 streams with new SDP offer when a new communication session is 1505 created and also does not impact the timing of the CS. The SRC only 1506 needs to update the metadata when new communication sessions are 1507 created. 1509 When there is no communication sessions running on the devices with 1510 persistent recording, there is no recorded media to stream from the 1511 SRC to the SRS. In certain environments where Network Address 1512 Translator (NAT) is used, typically a minimum of flow activity is 1513 required to maintain the NAT binding for each port opened. Agents 1514 that support Interactive Connectivity Establishment (ICE) solves this 1515 problem. For non-ICE agents, in order not to lose the NAT bindings 1516 for the RTP/RTCP ports opened for the recorded streams, the SRC and 1517 SRS SHOULD follow the recommendations provided in [RFC6263] to 1518 maintain the NAT bindings. 1520 11. IANA Considerations 1521 11.1. Registration of Option Tags 1523 This specification registers two option tags. The required 1524 information for this registration, as specified in [RFC3261], is as 1525 follows. 1527 11.1.1. siprec Option Tag 1529 Name: siprec 1531 Description: This option tag is for identifying the SIP session 1532 for the purpose of recording session only. This is typically not 1533 used in a Supported header. When present in a Require header in a 1534 request, it indicates that the UAS MUST be either a SRC or SRS 1535 capable of handling the contexts of a recording session. 1537 11.1.2. record-aware Option Tag 1539 Name: record-aware 1541 Description: This option tag is to indicate the ability for the 1542 user agent to receive recording indicators in media level or 1543 session level SDP. When present in a Supported header, it 1544 indicates that the UA can receive recording indicators in media 1545 level or session level SDP. 1547 11.2. Registration of media feature tags 1549 This document registers two new media feature tags in the SIP tree 1550 per the process defined in [RFC2506] and [RFC3840] 1552 11.2.1. src feature tag 1554 Media feature tag name: sip.src 1556 ASN.1 Identifier: 25 1558 Summary of the media feature indicated by this tag: This feature 1559 tag indicates that the user agent is a Session Recording Client 1560 for the purpose for Recording Session. 1562 Values appropriate for use with this feature tag: boolean 1564 The feature tag is intended primarily for use in the following 1565 applications, protocols, services, or negotiation mechanisms: This 1566 feature tag is only useful for a Recording Session. 1568 Examples of typical use: Routing the request to a Session 1569 Recording Server. 1571 Security Considerations: Security considerations for this media 1572 feature tag are discussed in Section 11.1 of RFC 3840. 1574 11.2.2. srs feature tag 1576 Media feature tag name: sip.srs 1578 ASN.1 Identifier: 26 1580 Summary of the media feature indicated by this tag: This feature 1581 tag indicates that the user agent is a Session Recording Server 1582 for the purpose for Recording Session. 1584 Values appropriate for use with this feature tag: boolean 1586 The feature tag is intended primarily for use in the following 1587 applications, protocols, services, or negotiation mechanisms: This 1588 feature tag is only useful for a Recording Session. 1590 Examples of typical use: Routing the request to a Session 1591 Recording Client. 1593 Security Considerations: Security considerations for this media 1594 feature tag are discussed in Section 11.1 of RFC 3840. 1596 11.3. New Content-Disposition Parameter Registrations 1598 This document registers a new "disposition-type" value in Content- 1599 Disposition header: recording-session. 1601 recording-session: The body describes either: 1603 * metadata about the recording session 1605 * reason for metadata snapshot request 1607 as determined by the MIME value indicated in the Content-Type. 1609 11.4. Media Type Registration 1611 11.4.1. Registration of MIME Type application/rs-metadata-request 1613 This document registers the application/rs-metadata-request MIME 1614 media type in order to describe a recording session metadata snapshot 1615 request. This media type is defined by the following information: 1617 Media type name: application 1619 Media subtype name: rs-metadata-request 1621 Required parameters: none 1623 Options parameters: none 1625 11.5. SDP Attributes 1627 This document registers the following new SDP attributes. 1629 11.5.1. 'record' SDP Attribute 1631 Contact names: Leon Portman leon.portman@gmail.com, Henry Lum 1632 henry.lum@genesyslab.com 1634 Attribute name: record 1636 Long form attribute name: Recording Indication 1638 Type of attribute: session or media level 1640 Subject to charset: no 1642 This attribute provides the recording indication for the session or 1643 media stream. 1645 Allowed attribute values: on, off, paused 1647 11.5.2. 'recordpref' SDP Attribute 1649 Contact names: Leon Portman leon.portman@nice.com, Henry Lum 1650 henry.lum@genesyslab.com 1652 Attribute name: recordpref 1654 Long form attribute name: Recording Preference 1656 Type of attribute: session or media level 1658 Subject to charset: no 1660 This attribute provides the recording preference for the session or 1661 media stream. 1663 Allowed attribute values: on, off, pause, nopreference 1665 12. Security Considerations 1667 The recording session is fundamentally a standard SIP dialog 1668 [RFC3261], therefore, the recording session can reuse any of the 1669 existing SIP security mechanisms available for securing the session 1670 signaling, the recorded media, and the metadata. The use cases and 1671 requirements document [RFC6341] outlines the general security 1672 considerations, and this document describes specific security 1673 recommendations. 1675 The SRC and SRS MUST support SIP with TLS and MAY support SIPS with 1676 TLS as per [RFC5630]. The Recording Session SHOULD be at least as 1677 secure as the Communication Session, meaning using at least the same 1678 strength of cipher suite as the CS if the CS is secured. For 1679 example, if the CS uses SIPS for signaling and RTP/SAVP for media, 1680 then the RS should not downgrade the level of security in the RS to 1681 SIP or plain RTP since doing so will mean an automatic security 1682 downgrade for the CS. In deployments where the SRC and the SRS are 1683 in the same administrative domain and the same physical switch that 1684 prevents outside user access, some SRCs may choose to lower the level 1685 of security when establishing a recording session. While physically 1686 securing the SRC and SRS may prevent an outside attacker from 1687 accessing important call recordings, this still does not prevent an 1688 inside attacker from accessing the internal network to gain access to 1689 the call recordings. 1691 12.1. Authentication and Authorization 1693 At the transport level, the recording session uses TLS authentication 1694 to validate the authenticity of the SRC and SRS. The SRC and SRS 1695 MUST implement TLS mutual authentication for establishing the 1696 recording session. Whether the SRC/SRS chooses to use TLS mutual 1697 authentication is a deployment decision. In deployments where the 1698 SRC and the SRS are in the same administrative domain, the SRC and 1699 SRS may choose not to authenticate each other, or to have the SRC 1700 authenticate the SRS only, as there is an inherent trust relation 1701 between the SRC and the SRS when they are hosted in the same 1702 administrative domain. In deployments where the SRS can be hosted on 1703 a different administrative domain, it is important to perform mutual 1704 authentication to ensure the authenticity of both the SRC and the SRS 1705 before transmitting any recorded media. The risk of not 1706 authenticating the SRS is that the recording may be sent to a 1707 compromised SRS and that a sensitive call recording will be obtained 1708 by an attacker. On the other hand, the risk of not authenticating 1709 the SRC is that an SRS will accept calls from an unknown SRC and 1710 allow potential forgery of call recordings. 1712 There may be scenarios in which the signaling between the SRC and SRS 1713 is not direct, e.g. a SIP proxy exists between the SRC and the SRS. 1714 In such scenarios, each hop is subject to the TLS mutual 1715 authentication constraint and transitive trust at each hop is 1716 utilized. Additionally, an SRC or SRS may use other existing SIP 1717 mechanisms available, including but not limited to, Digest 1718 Authentication [RFC3261], Asserted Identity [RFC3325], and Connected 1719 Identity [RFC4916]. 1721 The SRS may have its own set of recording policies to authorize 1722 recording requests from the SRC. The use of recording policies is 1723 outside the scope of the Session Recording Protocol. 1725 12.2. RTP handling 1727 In many scenarios it will be critical for the media transported 1728 between the SRC and the SRS to be protected. Media encryption is an 1729 important element in the overall SIPREC solution; therefore the SRC 1730 and the SRS MUST support RTP/SAVP [RFC3711] and RTP/SAVPF [RFC5124]. 1731 RTP/SAVP and RTP/SAVPF provide media encryption, integrity 1732 protection, replay protection, and a limited form of source 1733 authentication. They do not contain or require a specific keying 1734 mechanism. At a minimum, the SRC and SRS MUST support the SDP 1735 Security Descriptions (SDES) key negotiation mechanism [RFC4568]. 1736 For cases in which DTLS-SRTP is used to encrypt a CS media stream, an 1737 SRC may use SRTP Encrypted Key Transport (EKT) 1738 [I-D.ietf-avt-srtp-ekt] in order to use SRTP-SDES in the RS without 1739 needing to re-encrypt the media. 1741 When RTP/SAVP or RTP/SAVPF is used, an SRC can choose to use the same 1742 or different keys in the RS than the ones used in the CS. Some SRCs 1743 are designed to simply replicate RTP packets from a CS media stream 1744 to the SRS, in which case the SRC will use the same key in the RS as 1745 used in the CS. In this case, the SRC MUST secure the SDP containing 1746 the keying material in the RS with at least the same level of 1747 security as in the CS. The risk of lowering the level of security in 1748 the RS is that it will effectively become a downgrade attack on the 1749 CS since the same key is used for both CS and RS. 1751 SRCs that decrypt an encrypted CS media stream and re-encrypt it when 1752 sending it to the SRS MUST use a different key for the RS media 1753 stream than what is used for the CS media stream, to ensure that it 1754 is not possible for someone who has the key for the CS media stream 1755 to access recorded data they are not authorized to access. 1757 12.3. Metadata 1759 Metadata contains sensitive information such as the address of record 1760 of the participants and other extension data placed by the SRC. It 1761 is essential to protect the content of the metadata in the RS. Since 1762 metadata is a content type transmitted in SIP signaling, metadata 1763 SHOULD be protected at the transport level by SIPS/TLS. 1765 12.4. Storage and playback 1767 While storage and playback of the call recording is beyond the scope 1768 of this document, it is worthwhile to mention here that it is also 1769 important for the recording storage and playback to provide a level 1770 of security that is comparable to the communication session. It 1771 would defeat the purpose of securing both the communication session 1772 and the recording session mentioned in the previous sections if the 1773 recording can be easily played back with a simple unsecured HTTP 1774 interface without any form of authentication or authorization. 1776 13. Acknowledgements 1778 We want to thank John Elwell, Paul Kyzivat, Partharsarathi R, Ram 1779 Mohan R, Hadriel Kaplan, Adam Roach, Miguel Garcia, Thomas Stach, 1780 Muthu Perumal, Dan Wing, and Magnus Westerlund for their valuable 1781 comments and inputs to this document. 1783 14. References 1785 14.1. Normative References 1787 [I-D.ietf-siprec-metadata] 1788 R, R., Ravindran, P., and P. Kyzivat, "Session Initiation 1789 Protocol (SIP) Recording Metadata", draft-ietf-siprec- 1790 metadata-16 (work in progress), August 2014. 1792 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1793 Requirement Levels", BCP 14, RFC 2119, March 1997. 1795 [RFC2506] Holtman, K., Mutz, A., and T. Hardie, "Media Feature Tag 1796 Registration Procedure", BCP 31, RFC 2506, March 1999. 1798 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 1799 A., Peterson, J., Sparks, R., Handley, M., and E. 1800 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 1801 June 2002. 1803 [RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model 1804 with Session Description Protocol (SDP)", RFC 3264, June 1805 2002. 1807 [RFC3840] Rosenberg, J., Schulzrinne, H., and P. Kyzivat, 1808 "Indicating User Agent Capabilities in the Session 1809 Initiation Protocol (SIP)", RFC 3840, August 2004. 1811 [RFC4574] Levin, O. and G. Camarillo, "The Session Description 1812 Protocol (SDP) Label Attribute", RFC 4574, August 2006. 1814 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 1815 Specifications: ABNF", STD 68, RFC 5234, January 2008. 1817 14.2. Informative References 1819 [I-D.ietf-avt-srtp-ekt] 1820 Wing, D., McGrew, D., and K. Fischer, "Encrypted Key 1821 Transport for Secure RTP", draft-ietf-avt-srtp-ekt-03 1822 (work in progress), October 2011. 1824 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 1825 UPDATE Method", RFC 3311, October 2002. 1827 [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private 1828 Extensions to the Session Initiation Protocol (SIP) for 1829 Asserted Identity within Trusted Networks", RFC 3325, 1830 November 2002. 1832 [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. 1833 Jacobson, "RTP: A Transport Protocol for Real-Time 1834 Applications", STD 64, RFC 3550, July 2003. 1836 [RFC3551] Schulzrinne, H. and S. Casner, "RTP Profile for Audio and 1837 Video Conferences with Minimal Control", STD 65, RFC 3551, 1838 July 2003. 1840 [RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. 1841 Norrman, "The Secure Real-time Transport Protocol (SRTP)", 1842 RFC 3711, March 2004. 1844 [RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session 1845 Description Protocol (SDP) Security Descriptions for Media 1846 Streams", RFC 4568, July 2006. 1848 [RFC4585] Ott, J., Wenger, S., Sato, N., Burmeister, C., and J. Rey, 1849 "Extended RTP Profile for Real-time Transport Control 1850 Protocol (RTCP)-Based Feedback (RTP/AVPF)", RFC 4585, July 1851 2006. 1853 [RFC4916] Elwell, J., "Connected Identity in the Session Initiation 1854 Protocol (SIP)", RFC 4916, June 2007. 1856 [RFC4961] Wing, D., "Symmetric RTP / RTP Control Protocol (RTCP)", 1857 BCP 131, RFC 4961, July 2007. 1859 [RFC5104] Wenger, S., Chandra, U., Westerlund, M., and B. Burman, 1860 "Codec Control Messages in the RTP Audio-Visual Profile 1861 with Feedback (AVPF)", RFC 5104, February 2008. 1863 [RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for 1864 Real-time Transport Control Protocol (RTCP)-Based Feedback 1865 (RTP/SAVPF)", RFC 5124, February 2008. 1867 [RFC5168] Levin, O., Even, R., and P. Hagendorf, "XML Schema for 1868 Media Control", RFC 5168, March 2008. 1870 [RFC5630] Audet, F., "The Use of the SIPS URI Scheme in the Session 1871 Initiation Protocol (SIP)", RFC 5630, October 2009. 1873 [RFC5761] Perkins, C. and M. Westerlund, "Multiplexing RTP Data and 1874 Control Packets on a Single Port", RFC 5761, April 2010. 1876 [RFC6263] Marjou, X. and A. Sollaud, "Application Mechanism for 1877 Keeping Alive the NAT Mappings Associated with RTP / RTP 1878 Control Protocol (RTCP) Flows", RFC 6263, June 2011. 1880 [RFC6341] Rehor, K., Portman, L., Hutton, A., and R. Jain, "Use 1881 Cases and Requirements for SIP-Based Media Recording 1882 (SIPREC)", RFC 6341, August 2011. 1884 [RFC7022] Begen, A., Perkins, C., Wing, D., and E. Rescorla, 1885 "Guidelines for Choosing RTP Control Protocol (RTCP) 1886 Canonical Names (CNAMEs)", RFC 7022, September 2013. 1888 [RFC7245] Hutton, A., Portman, L., Jain, R., and K. Rehor, "An 1889 Architecture for Media Recording Using the Session 1890 Initiation Protocol", RFC 7245, May 2014. 1892 Authors' Addresses 1894 Leon Portman 1895 NICE Systems 1896 22 Zarhin Street 1897 P.O. Box 690 1898 Ra'anana 4310602 1899 Israel 1901 Email: leon.portman@gmail.com 1903 Henry Lum (editor) 1904 Genesys 1905 1380 Rodick Road, Suite 201 1906 Markham, Ontario L3R4G5 1907 Canada 1909 Email: henry.lum@genesyslab.com 1911 Charles Eckel 1912 Cisco 1913 170 West Tasman Drive 1914 San Jose, CA 95134 1915 United States 1917 Email: eckelcu@cisco.com 1919 Alan Johnston 1920 Avaya 1921 St. Louis, MO 63124 1923 Email: alan.b.johnston@gmail.com 1925 Andrew Hutton 1926 Unify 1927 Brickhill Street 1928 Milton Keynes MK15 0DJ 1929 United Kingdom 1931 Email: andrew.hutton@unify.com