idnits 2.17.1 draft-ietf-siprec-protocol-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (October 2, 2012) is 4221 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-22) exists of draft-ietf-siprec-metadata-07 == Outdated reference: A later version (-12) exists of draft-ietf-siprec-architecture-06 -- Obsolete informational reference (is this intentional?): RFC 6222 (Obsoleted by RFC 7022) Summary: 0 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPREC L. Portman 3 Internet-Draft NICE Systems 4 Intended status: Standards Track H. Lum, Ed. 5 Expires: April 5, 2013 Genesys 6 C. Eckel 7 Cisco 8 A. Johnston 9 Avaya 10 A. Hutton 11 Siemens Enterprise 12 Communications 13 October 2, 2012 15 Session Recording Protocol 16 draft-ietf-siprec-protocol-07 18 Abstract 20 This document specifies the use of the Session Initiation Protocol 21 (SIP), the Session Description Protocol (SDP), and the Real Time 22 Protocol (RTP) for delivering real-time media and metadata from a 23 Communication Session (CS) to a recording device. The Session 24 Recording Protocol specifies the use of SIP, SDP, and RTP to 25 establish a Recording Session (RS) between the Session Recording 26 Client (SRC), which is on the path of the CS, and a Session Recording 27 Server (SRS) at the recording device. 29 Status of this Memo 31 This Internet-Draft is submitted in full conformance with the 32 provisions of BCP 78 and BCP 79. 34 Internet-Drafts are working documents of the Internet Engineering 35 Task Force (IETF). Note that other groups may also distribute 36 working documents as Internet-Drafts. The list of current Internet- 37 Drafts is at http://datatracker.ietf.org/drafts/current/. 39 Internet-Drafts are draft documents valid for a maximum of six months 40 and may be updated, replaced, or obsoleted by other documents at any 41 time. It is inappropriate to use Internet-Drafts as reference 42 material or to cite them other than as "work in progress." 44 This Internet-Draft will expire on April 5, 2013. 46 Copyright Notice 48 Copyright (c) 2012 IETF Trust and the persons identified as the 49 document authors. All rights reserved. 51 This document is subject to BCP 78 and the IETF Trust's Legal 52 Provisions Relating to IETF Documents 53 (http://trustee.ietf.org/license-info) in effect on the date of 54 publication of this document. Please review these documents 55 carefully, as they describe your rights and restrictions with respect 56 to this document. Code Components extracted from this document must 57 include Simplified BSD License text as described in Section 4.e of 58 the Trust Legal Provisions and are provided without warranty as 59 described in the Simplified BSD License. 61 Table of Contents 63 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 64 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 65 3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 66 4. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 67 5. Overview of operations . . . . . . . . . . . . . . . . . . . . 5 68 5.1. Delivering recorded media . . . . . . . . . . . . . . . . 5 69 5.2. Delivering recording metadata . . . . . . . . . . . . . . 7 70 5.3. Receiving recording indications and providing 71 recording preferences . . . . . . . . . . . . . . . . . . 8 72 6. SIP Handling . . . . . . . . . . . . . . . . . . . . . . . . . 9 73 6.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 10 74 6.1.1. Initiating a Recording Session . . . . . . . . . . . . 10 75 6.1.2. SIP extensions for recording indication and 76 preference . . . . . . . . . . . . . . . . . . . . . . 10 77 6.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 11 78 6.3. Procedures for Recording-aware User Agents . . . . . . . . 11 79 7. SDP Handling . . . . . . . . . . . . . . . . . . . . . . . . . 12 80 7.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 12 81 7.1.1. SDP handling in RS . . . . . . . . . . . . . . . . . . 12 82 7.1.1.1. Handling media stream updates . . . . . . . . . . 13 83 7.1.2. Recording indication in CS . . . . . . . . . . . . . . 14 84 7.1.3. Recording preference in CS . . . . . . . . . . . . . . 15 85 7.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 15 86 7.3. Procedures for Recording-aware User Agents . . . . . . . . 17 87 7.3.1. Recording indication . . . . . . . . . . . . . . . . . 17 88 7.3.2. Recording preference . . . . . . . . . . . . . . . . . 18 89 8. RTP Handling . . . . . . . . . . . . . . . . . . . . . . . . . 19 90 8.1. RTP Mechanisms . . . . . . . . . . . . . . . . . . . . . . 19 91 8.1.1. RTCP . . . . . . . . . . . . . . . . . . . . . . . . . 19 92 8.1.2. RTP Profile . . . . . . . . . . . . . . . . . . . . . 19 93 8.1.3. SSRC . . . . . . . . . . . . . . . . . . . . . . . . . 20 94 8.1.4. CSRC . . . . . . . . . . . . . . . . . . . . . . . . . 20 95 8.1.5. SDES . . . . . . . . . . . . . . . . . . . . . . . . . 21 96 8.1.5.1. CNAME . . . . . . . . . . . . . . . . . . . . . . 21 97 8.1.6. Keepalive . . . . . . . . . . . . . . . . . . . . . . 21 98 8.1.7. RTCP Feedback Messages . . . . . . . . . . . . . . . . 21 99 8.1.7.1. Full Intra Request . . . . . . . . . . . . . . . . 22 100 8.1.7.2. Picture Loss Indicator . . . . . . . . . . . . . . 22 101 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request . 22 102 8.1.8. Symmetric RTP/RTCP for Sending and Receiving . . . . . 23 103 8.2. Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 23 104 8.2.1. SRC acting as an RTP Translator . . . . . . . . . . . 24 105 8.2.1.1. Forwarding Translator . . . . . . . . . . . . . . 25 106 8.2.1.2. Transcoding Translator . . . . . . . . . . . . . . 25 107 8.2.2. SRC acting as an RTP Mixer . . . . . . . . . . . . . . 26 108 8.2.3. SRC acting as an RTP Endpoint . . . . . . . . . . . . 26 109 8.3. RTP Session Usage by SRC . . . . . . . . . . . . . . . . . 27 110 8.3.1. SRC Using Multiple m-lines . . . . . . . . . . . . . . 27 111 8.3.2. SRC Using SSRC Multiplexing . . . . . . . . . . . . . 28 112 8.3.3. SRC Using Mixing . . . . . . . . . . . . . . . . . . . 29 113 9. Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 114 9.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 30 115 9.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 32 116 9.2.1. Formal Syntax . . . . . . . . . . . . . . . . . . . . 34 117 10. Persistent Recording . . . . . . . . . . . . . . . . . . . . . 34 118 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34 119 11.1. Registration of Option Tags . . . . . . . . . . . . . . . 34 120 11.1.1. siprec Option Tag . . . . . . . . . . . . . . . . . . 35 121 11.1.2. record-aware Option Tag . . . . . . . . . . . . . . . 35 122 11.2. Registration of media feature tags . . . . . . . . . . . . 35 123 11.2.1. src feature tag . . . . . . . . . . . . . . . . . . . 35 124 11.2.2. srs feature tag . . . . . . . . . . . . . . . . . . . 36 125 11.3. New Content-Disposition Parameter Registrations . . . . . 36 126 11.4. Media Type Registration . . . . . . . . . . . . . . . . . 36 127 11.4.1. Registration of MIME Type application/rs-metadata . . 36 128 11.4.2. Registration of MIME Type 129 application/rs-metadata-request . . . . . . . . . . . 37 130 11.5. SDP Attributes . . . . . . . . . . . . . . . . . . . . . . 37 131 11.5.1. 'record' SDP Attribute . . . . . . . . . . . . . . . . 37 132 11.5.2. 'recordpref' SDP Attribute . . . . . . . . . . . . . . 37 133 12. Security Considerations . . . . . . . . . . . . . . . . . . . 38 134 12.1. Authentication and Authorization . . . . . . . . . . . . . 38 135 12.2. RTP handling . . . . . . . . . . . . . . . . . . . . . . . 39 136 12.3. Metadata . . . . . . . . . . . . . . . . . . . . . . . . . 39 137 12.4. Storage and playback . . . . . . . . . . . . . . . . . . . 40 138 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 40 139 14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 40 140 14.1. Normative References . . . . . . . . . . . . . . . . . . . 40 141 14.2. Informative References . . . . . . . . . . . . . . . . . . 41 142 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 42 144 1. Introduction 146 This document specifies the mechanism to record a Communication 147 Session (CS) by delivering real-time media and metadata from the CS 148 to a recording device. In accordance to the architecture 149 [I-D.ietf-siprec-architecture], the Session Recording Protocol 150 specifies the use of SIP, SDP, and RTP to establish a Recording 151 Session (RS) between the Session Recording Client (SRC), which is on 152 the path of the CS, and a Session Recording Server (SRS) at the 153 recording device. 155 SIP is also used to deliver metadata to the recording device, as 156 specified in [I-D.ietf-siprec-metadata]. Metadata is information 157 that describes recorded media and the CS to which they relate. 159 The Session Recording Protocol intends to satisfy the SIP-based Media 160 Recording requirements listed in [RFC6341]. 162 In addition to the Session Recording Protocol, this document 163 specifies extensions for user agents that are participants in a CS to 164 receive recording indications and to provide preferences for 165 recording. 167 2. Terminology 169 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 170 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 171 document are to be interpreted as described in [RFC2119]. 173 3. Definitions 175 This document refers to the core definitions provided in the 176 architecture document [I-D.ietf-siprec-architecture]. 178 The RTP Handling section uses the definitions provided in "RTP: A 179 Transport Protocol for Real-Time Application" [RFC3550]. 181 4. Scope 183 The scope of the Session Recording Protocol includes the 184 establishment of the recording sessions and the reporting of the 185 metadata. The scope also includes extensions supported by User 186 Agents participating in the CS such as indication of recording. The 187 user agents need not be recording-aware in order to participate in a 188 CS being recorded. 190 The following items, which are not an exhaustive list, do not 191 represent the protocol itself and are considered out of the scope of 192 the Session Recording Protocol: 194 o Delivering recorded media in real-time as the CS media 196 o Specifications of criteria to select a specific CS to be recorded 197 or triggers to record a certain CS in the future 199 o Recording policies that determine whether the CS should be 200 recorded and whether parts of the CS are to be recorded 202 o Retention policies that determine how long a recording is stored 204 o Searching and accessing the recorded media and metadata 206 o Policies governing how CS users are made aware of recording 208 o Delivering additional recording session metadata through non-SIP 209 mechanism 211 5. Overview of operations 213 This section is informative and provides a description of recording 214 operations. 216 Section 5 provides the procedures for establishing a recording 217 session between a SRC and a SRS. Section 6 describes the SDP in a 218 recording session. Section 7 describes the RTP handling in a 219 recording session. Section 8 describes the mechanism to deliver 220 recording metadata from the SRC to the SRS. 222 Section 10 describes the procedures for user agents participating in 223 a CS to receive recording indications and to provide preferences for 224 recording. 226 As mentioned in the architecture document 227 [I-D.ietf-siprec-architecture], there are a number of types of call 228 flows based on the location of the Session Recording Client. The 229 following sample call flows provide a quick overview of the 230 operations between the SRC and the SRS. 232 5.1. Delivering recorded media 234 When a SIP Back-to-back User Agent (B2BUA) with SRC functionality 235 routes a call from UA(A) to UA(B), the SRC has access to the media 236 path between the user agents. When the SRC is aware that it should 237 be recording the conversation, the SRC can cause the B2BUA to bridge 238 the media between UA(A) and UA(B). The SRC then establishes the 239 Recording Session with the SRS and sends replicated media towards the 240 SRS. 242 An endpoint may also have SRC functionality, where the endpoint 243 itself establishes the Recording Session to the SRS. Since the 244 endpoint has access to the media in the Communication Session, the 245 endpoint can send replicated media towards the SRS. 247 The following is a sample call flow that shows the SRC establishing a 248 recording session towards the SRS. The call flow is essentially 249 identical when the SRC is a B2BUA or as the endpoint itself. Note 250 that the SRC can choose when to establish the Recording Session 251 independent of the Communication Session, even though the following 252 call flow suggests that the SRC is establishing the Recording Session 253 (message #5) after the Communication Session is established. 255 UA A SRC UA B SRS 256 |(1)CS INVITE | | | 257 |------------->| | | 258 | |(2)CS INVITE | | 259 | |---------------------->| | 260 | | (3) 200 OK | | 261 | |<----------------------| | 262 | (4) 200 OK | | | 263 |<-------------| | | 264 | |(5)RS INVITE with SDP | | 265 | |--------------------------------------------->| 266 | | | (6) 200 OK with SDP | 267 | |<---------------------------------------------| 268 |(7)CS RTP | | | 269 |=============>|======================>| | 270 |<=============|<======================| | 271 | |(8)RS RTP | | 272 | |=============================================>| 273 | |=============================================>| 274 |(9)CS BYE | | | 275 |------------->| | | 276 | |(10)CS BYE | | 277 | |---------------------->| | 278 | |(11)RS BYE | | 279 | |--------------------------------------------->| 280 | | | | 282 Figure 1: Basic recording call flow 284 The above call flow can also apply to the case of a centralized 285 conference with a mixer. For clarity, ACKs to INVITEs and 200 OKs to 286 BYEs are not shown. The conference focus can provide the SRC 287 functionality since the conference focus has access to all the media 288 from each conference participant. When a recording is requested, the 289 SRC delivers the metadata and the media streams to the SRS. Since 290 the conference focus has access to a mixer, the SRC may choose to mix 291 the media streams from all participants as a single mixed media 292 stream towards the SRS. 294 An SRC can use a single recording session to record multiple 295 communication sessions. Every time the SRC wants to record a new 296 call, the SRC updates the recording session with a new SDP offer to 297 add new recorded streams to the recording session, and 298 correspondingly also update the metadata for the new call. 300 An SRS can also establish a recording session to an SRC, although it 301 is beyond the scope of this document to define how an SRS would 302 specify which calls to record. 304 5.2. Delivering recording metadata 306 The SRC is responsible for the delivery of metadata to the SRS. The 307 SRC may provide an initial metadata snapshot about recorded media 308 streams in the initial INVITE content in the recording session. 309 Subsequent metadata updates can be represented as a stream of events 310 in UPDATE or reINVITE requests sent by the SRC. These metadata 311 updates are normally incremental updates to the initial metadata 312 snapshot to optimize on the size of updates, however, the SRC may 313 also decide to send a new metadata snapshot anytime. 315 Metadata is transported in the body of INVITE or UPDATE messages. 316 Certain metadata, such as the attributes of the recorded media stream 317 are located in the SDP of the recording session. 319 The SRS has the ability to send a request to the SRC to request for a 320 new metadata snapshot update from the SRC. This can happen when the 321 SRS fails to understand the current stream of incremental updates for 322 whatever reason, for example, when SRS loses the current state due to 323 internal failure. The SRS may optionally attach a reason along with 324 the snapshot request. This request allows both SRC and SRS to 325 synchronize the states with a new metadata snapshot so that further 326 metadata incremental updates will be based on the latest metadata 327 snapshot. Similar to the metadata content, the metadata snapshot 328 request is transported as content in UPDATE or INVITE sent by the SRS 329 in the recording session. 331 SRC SRS 332 | | 333 |(1) INVITE (metadata snapshot) | 334 |---------------------------------------------------->| 335 | (2)200 OK | 336 |<----------------------------------------------------| 337 |(3) ACK | 338 |---------------------------------------------------->| 339 |(4) RTP | 340 |====================================================>| 341 |====================================================>| 342 |(5) UPDATE (metadata update 1) | 343 |---------------------------------------------------->| 344 | (6) 200 OK | 345 |<----------------------------------------------------| 346 |(7) UPDATE (metadata update 2) | 347 |---------------------------------------------------->| 348 | (8) 200 OK | 349 |<----------------------------------------------------| 350 | (9) UPDATE (metadata snapshot request) | 351 |<----------------------------------------------------| 352 | (10) 200 OK | 353 |---------------------------------------------------->| 354 | (11) INVITE (metadata snapshot 2 + SDP offer) | 355 |---------------------------------------------------->| 356 | (12) 200 OK (SDP answer) | 357 |<----------------------------------------------------| 358 | (13) UPDATE (metadata update 1 based on snapshot 2) | 359 |---------------------------------------------------->| 360 | (14) 200 OK | 361 |<----------------------------------------------------| 363 Figure 2: Delivering metadata via SIP UPDATE 365 5.3. Receiving recording indications and providing recording 366 preferences 368 The SRC is responsible to provide recording indications to the 369 participants in the CS. User agents that are recording-aware 370 supports receiving recording indications with new SDP attribute 371 a=record and the recording-aware UA can also set recording preference 372 in the CS with a new SDP attribute a=recordpref. The recording 373 attribute is a declaration by the SRC in the CS to indicate whether 374 recording is taking place. The recording preference attribute is a 375 declaration by the recording-aware UA in the CS to indicate the 376 recording preference. 378 To illustrate how the attributes are used, if a UA (A) is initiating 379 a call to UA (B) and UA (A) is also an SRC that is performing the 380 recording, then UA (A) provides the recording indication in the SDP 381 offer with a=record:on. Since UA (A) is the SRC, UA (A) receives the 382 recording indication from the SRC directly. When UA (B) receives the 383 SDP offer, UA (B) will see that recording is happening on the other 384 endpoint of this session. Since UA (B) is not an SRC and does not 385 provide any recording preference, the SDP answer does not contain 386 a=record nor a=recordpref. 388 UA A UA B 389 (SRC) | 390 | | 391 | [SRC recording starts] | 392 |(1) INVITE (SDP offer + a=record:on) | 393 |---------------------------------------------------->| 394 | (2) 200 OK (SDP answer) | 395 |<----------------------------------------------------| 396 |(3) ACK | 397 |---------------------------------------------------->| 398 |(4) RTP | 399 |<===================================================>| 400 | | 401 | [UA B wants to set preference to no recording] | 402 | (5) INVITE (SDP offer + a=recordpref:off) | 403 |<----------------------------------------------------| 404 | [SRC honors the preference and stops recording] | 405 |(6) 200 OK (SDP answer + a=record:off) | 406 |---------------------------------------------------->| 407 | (7) ACK | 408 |<----------------------------------------------------| 410 Figure 3: Recording indication and recording preference 412 After the call is established and recording is in progress, UA (B) 413 later decides to change the recording preference to no recording and 414 sends a reINVITE with the a=recordpref attribute. It is up to the 415 SRC to honor the preference, and in this case SRC decides to stop the 416 recording and updates the recording indication in the SDP answer. 418 6. SIP Handling 419 6.1. Procedures at the SRC 421 6.1.1. Initiating a Recording Session 423 A recording session is a SIP session with specific extensions 424 applied, and these extensions are listed in the procedures for SRC 425 and SRS below. When an SRC or an SRS receives a SIP session that is 426 not a recording session, it is up to the SRC or the SRS to determine 427 what to do with the SIP session. 429 The SRC can initiate a recording session by sending a SIP INVITE 430 request to the SRS. The SRC and the SRS are identified in the From 431 and To headers, respectively. 433 The SRC MUST include the '+sip.src' feature tag in the Contact URI, 434 defined in this specification as an extension to [RFC3840], for all 435 recording sessions. An SRS uses the presence of the '+sip.src' 436 feature tag in dialog creating and modifying requests and responses 437 to confirm that the dialog being created is for the purpose of a 438 Recording Session. In addition, when an SRC sends a REGISTER request 439 to a registrar, the SRC MUST include the '+sip.src' feature tag to 440 indicate the that it is a SRC. 442 Since SIP Caller Preferences extensions are optional to implement for 443 routing proxies, there is no guarantee that a recording session will 444 be routed to an SRC or SRS. A new options tag is introduced: 445 "siprec". As per [RFC3261], only an SRC or an SRS can accept this 446 option tag in a recording session. An SRC MUST include the "siprec" 447 option tag in the Require header when initiating a Recording Session 448 so that UA's which do not support the session recording protocol 449 extensions will simply reject the INVITE request with a 420 Bad 450 Extension. 452 When an SRC receives a new INVITE, the SRC MUST only consider the SIP 453 session as a recording session when both the '+sip.srs' feature tag 454 and 'siprec' option tag are included in the INVITE request. 456 6.1.2. SIP extensions for recording indication and preference 458 For the communication session, the SRC MUST provide recording 459 indication to all participants in the CS. A participant UA in a CS 460 can indicate that it is recording-aware by providing the "record- 461 aware" option tag, and the SRC MUST provide recording indications in 462 the new SDP a=record attribute described in the SDP Handling section. 463 In the absence of the "record-aware" option tag, meaning that the 464 participant UA is not recording-aware, an SRC MUST provide recording 465 indications through other means such as playing a tone inband, if the 466 SRC is required to do so (e.g. based on policies). 468 An SRC in the CS may also indicate itself as a session recording 469 client by including the '+sip.src' feature tag. A recording-aware 470 participant can learn that a SRC is in the CS, and can set the 471 recording preference for the CS with the new SDP a=recordpref 472 attribute described in the SDP Handling section below. 474 6.2. Procedures at the SRS 476 When an SRS receives a new INVITE, the SRS MUST only consider the SIP 477 session as a recording session when both the '+sip.src' feature tag 478 and 'siprec' option tag are included in the INVITE request. 480 The SRS can initiate a recording session by sending a SIP INVITE 481 request to the SRC. The SRS and the SRC are identified in the From 482 and To headers, respectively. 484 The SRS MUST include the '+sip.srs' feature tag in the Contact URI, 485 as per [RFC3840], for all recording sessions. An SRC uses the 486 presence of this feature tag in dialog creating and modifying 487 requests and responses to confirm that the dialog being created is 488 for the purpose of a Recording Session (REQ-30). In addition, when 489 an SRS sends a REGISTER request to a registrar, the SRS MUST include 490 the '+sip.srs' feature tag to indicate that it is a SRS. 492 An SRS MUST include the "siprec" option tag in the Require header as 493 per [RFC3261] when initiating a Recording Session so that UA's which 494 do not support the session recording protocol extensions will simply 495 reject the INVITE request with a 420 Bad Extension. 497 6.3. Procedures for Recording-aware User Agents 499 A recording-aware user agent is a participant in the CS that supports 500 the SIP and SDP extensions for receiving recording indication and for 501 requesting recording preferences for the call. A recording-aware UA 502 MUST indicate that it can accept reporting of recording indication 503 provided by the SRC with a new option tag "record-aware" when 504 initiating or establishing a CS, meaning including the "record-aware" 505 tag in the Supported header in the initial INVITE request or 506 response. 508 A recording-aware UA MUST be prepared to provide recording indication 509 to the end user through an appropriate user interface an indication 510 whether recording is on, off, or paused for each medium. Some user 511 agents that are automatons (e.g. IVR, media server, PSTN gateway) 512 may not have a user interface to render recording indication. When 513 such user agent indicates recording awareness, the UA SHOULD render 514 recording indication through other means, such as passing an inband 515 tone on the PSTN gateway, putting the recording indication in a log 516 file, or raising an application event in a VoiceXML dialog. These 517 user agents MAY also choose not to indicate recording awareness, 518 thereby relying on whatever mechanism an SRC chooses to indicate 519 recording, such as playing a tone inband. 521 7. SDP Handling 523 7.1. Procedures at the SRC 525 The SRC and SRS follows the SDP offer/answer model in [RFC3264]. The 526 procedures for SRC and SRS describe the conventions used in a 527 recording session. 529 7.1.1. SDP handling in RS 531 Since the SRC does not expect to receive media from the SRS, the SRC 532 typically sets each media stream of the SDP offer to only send media, 533 by qualifying them with the a=sendonly attribute, according to the 534 procedures in [RFC3264]. 536 The SRC sends recorded streams of participants to the SRS, and the 537 SRC MUST provide a label attribute (a=label), as per [RFC4574], on 538 each media stream in order to identify the recorded stream with the 539 rest of the metadata. The a=label attribute identifies each recorded 540 media stream, and the label name is mapped to the Media Stream 541 Reference in the metadata as per [I-D.ietf-siprec-metadata]. The 542 scope of the a=label attribute only applies to the SDP and Metadata 543 conveyed in the bodies of the SIP request or response that the label 544 appeared in. Note that a recorded stream is distinct from a CS 545 stream; the metadata provides a list of participants that contributes 546 to each recorded stream. 548 The following is an example of SDP offer from SRC with both audio and 549 video recorded streams. Note that the following example contain 550 unfolded lines longer than 72 characters. These are captured between 551 tags. 553 v=0 554 o=SRC 2890844526 2890844526 IN IP4 198.51.100.1 555 s=- 556 c=IN IP4 198.51.100.1 557 t=0 0 558 m=audio 12240 RTP/AVP 0 4 8 559 a=sendonly 560 a=label:1 561 m=video 22456 RTP/AVP 98 562 a=rtpmap:98 H264/90000 563 564 a=fmtp:98 profile-level-id=42A01E; 565 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 566 567 a=sendonly 568 a=label:2 569 m=audio 12242 RTP/AVP 0 4 8 570 a=sendonly 571 a=label:3 572 m=video 22458 RTP/AVP 98 573 a=rtpmap:98 H264/90000 574 575 a=fmtp:98 profile-level-id=42A01E; 576 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 577 578 a=sendonly 579 a=label:4 581 Figure 4: Sample SDP offer from SRC with audio and video streams 583 7.1.1.1. Handling media stream updates 585 Over the lifetime of a recording session, the SRC can add and remove 586 recorded streams from the recording session for various reasons. For 587 example, when a CS stream is added or removed from the CS, or when a 588 CS is created or terminated if a recording session handles multiple 589 CSes. To remove a recorded stream from the recording session, the 590 SRC sends a new SDP offer where the port of the media stream to be 591 removed is set to zero, according to the procedures in [RFC3264]. To 592 add a recorded stream to the recording session, the SRC sends a new 593 SDP offer by adding a new media stream description or by reusing an 594 old media stream which had been previously disabled, according to the 595 procedures in [RFC3264]. 597 The SRC can temporarily discontinue streaming and collection of 598 recorded media from the SRC to the SRS for reason such as masking the 599 recording. In this case, the SRC sends a new SDP offer and sets the 600 media stream to inactive (a=inactive) for each recorded stream to be 601 paused, as per the procedures in [RFC3264]. To resume streaming and 602 collection of recorded media, the SRC sends a new SDP offer and sets 603 the media streams with a=sendonly attribute. Note that when a CS 604 stream is muted/unmuted, this information is conveyed in the metadata 605 by the SRC. The SRC SHOULD NOT modify the media stream with 606 a=inactive for mute since this operation is reserved for pausing the 607 RS media. 609 7.1.2. Recording indication in CS 611 While there are existing mechanisms for providing an indication that 612 a CS is being recorded, these mechanisms are usually delivered on the 613 CS media streams such as playing an in-band tone or an announcement 614 to the participants. A new 'record' SDP attribute is introduced to 615 allow the SRC to indicate recording state to a recording-aware UA in 616 CS. 618 The 'record' SDP attribute appears at the media level or session 619 level in either SDP offer or answer. When the attribute is applied 620 at the session level, the indication applies to all media streams in 621 the SDP. When the attribute is applied at the media level, the 622 indication applies to the media stream only, and that overrides the 623 indication if also set at the session level. Whenever the recording 624 indication needs to change, such as termination of recording, then 625 the SRC MUST initiate a reINVITE or UPDATE to update the SDP a=record 626 attribute. 628 The following is the ABNF of the 'record' attribute: 630 attribute /= record-attr 632 ; attribute defined in RFC 4566 634 record-attr = "record:" indication 636 indication = "on" / "off" / "paused" 638 on Recording is in progress. 640 off No recording is in progress. 642 paused Recording is in progress by media is paused. 644 7.1.3. Recording preference in CS 646 When the SRC receives the a=recordpref SDP in an SDP offer or answer, 647 the SRC chooses to honor the preference to record based on local 648 policy at the SRC. Whether or not the SRC honors the recording 649 preference, the SRC MUST update the a=record attribute to indicate 650 the current state of the recording (on/off/paused). 652 7.2. Procedures at the SRS 654 The SRS only receives RTP streams from the SRC, the SDP answer 655 normally sets each media stream to receive media, by setting them 656 with the a=recvonly attribute, according to the procedures of 657 [RFC3264]. When the SRS is not ready to receive a recorded stream, 658 the SRS sets the media stream as inactive in the SDP offer or answer 659 by setting it with a=inactive attribute, according to the procedures 660 of [RFC3264]. When the SRS is ready to receive recorded streams, the 661 SRS sends a new SDP offer and sets the media streams with a=recvonly 662 attribute. 664 The following is an example of SDP answer from SRS for the SDP offer 665 from the above sample. Note that the following example contain 666 unfolded lines longer than 72 characters. These are captured between 667 tags. 669 v=0 670 o=SRS 0 0 IN IP4 198.51.100.20 671 s=- 672 c=IN IP4 198.51.100.20 673 t=0 0 674 m=audio 10000 RTP/AVP 0 4 8 675 a=recvonly 676 a=label:1 677 m=video 10002 RTP/AVP 98 678 a=rtpmap:98 H264/90000 679 680 a=fmtp:98 profile-level-id=42A01E; 681 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 682 683 a=recvonly 684 a=label:2 685 m=audio 10004 RTP/AVP 0 4 8 686 a=recvonly 687 a=label:3 688 m=video 10006 RTP/AVP 98 689 a=rtpmap:98 H264/90000 690 691 a=fmtp:98 profile-level-id=42A01E; 692 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 693 694 a=recvonly 695 a=label:4 697 Figure 5: Sample SDP answer from SRS with audio and video streams 699 Over the lifetime of a recording session, the SRS can remove recorded 700 streams from the recording session for various reasons. To remove a 701 recorded stream from the recording session, the SRS sends a new SDP 702 offer where the port of the media stream to be removed is set to 703 zero, according to the procedures in [RFC3264]. 705 The SRS SHOULD NOT add recorded streams in the recording session when 706 SRS sends a new SDP offer. Similarly, when the SRS starts a 707 recording session, the SRS SHOULD initiate the INVITE without an SDP 708 offer to let the SRC generate the SDP offer with recorded streams. 710 The following sequence diagram shows an example where the SRS is 711 initially not ready to receive recorded streams, and later updates 712 the recording session when the SRS is ready to record. 714 SRC SRS 715 | | 716 |(1) INVITE (SDP offer) | 717 |---------------------------------------------------->| 718 | [not ready to record] 719 | (2)200 OK with SDP inactive | 720 |<----------------------------------------------------| 721 |(3) ACK | 722 |---------------------------------------------------->| 723 | ... | 724 | [ready to record] 725 | (4) re-INVITE with SDP recvonly | 726 |<----------------------------------------------------| 727 |(5)200 OK with SDP sendonly | 728 |---------------------------------------------------->| 729 | (6) ACK | 730 |<----------------------------------------------------| 731 |(7) RTP | 732 |====================================================>| 733 | ... | 734 |(8) BYE | 735 |---------------------------------------------------->| 736 | (9) OK | 737 |<----------------------------------------------------| 739 Figure 6: SRS responding to offer with a=inactive 741 7.3. Procedures for Recording-aware User Agents 743 7.3.1. Recording indication 745 When a recording-aware UA receives an SDP offer or answer that 746 includes the a=record attribute, the UA MUST provide the recording 747 indication to the end user whether the recording is on, off, or 748 paused for each medium based on the most recently received a=record 749 SDP attribute for that medium. 751 If a call is traversed through one or more SIP B2BUA, and it happens 752 that there are more than one SRC in the call path, the recording 753 indication attribute does not provide any hint as to which SRC is 754 performing the recording, meaning the endpoint only knows that the 755 call is being recorded. This attribute is also not used as an 756 indication to negotiate which SRC in the call path will perform 757 recording and is not used as a request to start/stop recording if 758 there are multiple SRCs in the call path. 760 7.3.2. Recording preference 762 A participant in a CS MAY set the recording preference in the CS to 763 be recorded or not recorded at session establishment or during the 764 session. A new 'recordpref' SDP attribute is introduced, and the 765 participant in CS may set this recording preference atrribute in any 766 SDP offer/answer at session establishment time or during the session. 767 The SRC is not required to honor the recording preference from a 768 participant based on local policies at the SRC, and the participant 769 can learn the recording indication through the a=record SDP attribute 770 as described in the above section. 772 The SDP a=recordpref attribute can appear at the media level or 773 session level and can appear in an SDP offer or answer. When the 774 attribute is applied at the session level, the recording preference 775 applies to all media stream in the SDP. When the attribute is 776 applied at the media level, the recording preference applies to the 777 media stream only, and that overrides the recording preference if 778 also set at the session level. The user agent can change the 779 recording preference by changing the a=recordpref attribute in 780 subsequent SDP offer or answer. The absence of the a=recordpref 781 attribute in the SDP indicates that the UA has no recording 782 preference. 784 The following is the ABNF of the recordpref attribute: 786 attribute /= recordpref-attr 788 ; attribute defined in RFC 4566 790 recordpref-attr = "a=recordpref:" pref 792 pref = "on" / "off" / "pause" / "nopreference" 794 on Sets the preference to record if it has not already been started. 795 If the recording is currently paused, the preference is to resume 796 recording. 798 off Sets the preference for no recording. If recording has already 799 been started, then the preference is to stop the recording. 801 pause If the recording is currently in progress, sets the preference 802 to pause the recording. 804 nopreference To indicate that the UA has no preference on recording. 806 8. RTP Handling 808 This section provides recommendations and guidelines for RTP and RTCP 809 in the context of SIPREC. In order to communicate most effectively, 810 the Session Recording Client (SRC), the Session Recording Server 811 (SRS), and any Recording aware User Agents (UAs) SHOULD utilize the 812 mechanisms provided by RTP in a well-defined and predicable manner. 813 It is the goal of this document to make the reader aware of these 814 mechanisms and provide recommendations and guidelines. 816 8.1. RTP Mechanisms 818 This section briefly describes important RTP/RTCP constructs and 819 mechanisms that are particularly useful within the content of SIPREC. 821 8.1.1. RTCP 823 The RTP data transport is augmented by a control protocol (RTCP) to 824 allow monitoring of the data delivery. RTCP, as defined in 825 [RFC3550], is based on the periodic transmission of control packets 826 to all participants in the RTP session, using the same distribution 827 mechanism as the data packets. Support for RTCP is REQUIRED, per 828 [RFC3550], and it provides, among other things, the following 829 important functionality in relation to SIPREC: 831 1) Feedback on the quality of the data distribution 833 This feedback from the receivers may be used to diagnose faults in 834 the distribution. As such, RTCP is a well-defined and efficient 835 mechanism for the SRS to inform the SRC, and for the SRC to inform 836 Recording aware UAs, of issues that arise with respect to the 837 reception of media that is to be recorded. 839 2) Carries a persistent transport-level identifier for an RTP source 840 called the canonical name or CNAME 842 The SSRC identifier may change if a conflict is discovered or a 843 program is restarted; in which case receivers can use the CNAME to 844 keep track of each participant. Receivers may also use the CNAME to 845 associate multiple data streams from a given participant in a set of 846 related RTP sessions, for example to synchronize audio and video. 847 Synchronization of media streams is also facilitated by the NTP and 848 RTP timestamps included in RTCP packets by data senders. 850 8.1.2. RTP Profile 852 The RECOMMENDED RTP profiles for the SRC, SRS, and Recording aware 853 UAs are "Extended Secure RTP Profile for Real-time Transport Control 854 Protocol (RTCP)-Based Feedback (RTP/SAVPF)", [RFC5124] when using 855 encrypted RTP streams, and "Extended RTP Profile for Real-time 856 Transport Control Protocol (RTCP)-Based Feedback (RTP/AVPF)", 857 [RFC4585] when using non encrypted media streams. However, as this 858 is not a requirement, some implementations may use "The Secure Real- 859 time Transport Protocol (SRTP)", [RFC3711] and "RTP Profile for Audio 860 and Video Conferences with Minimal Control", AVP [RFC3551]. 861 Therefore, it is RECOMMENDED that the SRC, SRS, and Recording aware 862 UAs not rely entirely on SAVPF or AVPF for core functionality that 863 may be at least partially achievable using SAVP and AVP. 865 AVPF and SAVPF provide an improved RTCP timer model that allows more 866 flexible transmission of RTCP packets in response to events, rather 867 than strictly according to bandwidth. AVPF based codec control 868 messages provide efficient mechanisms for an SRC, SRS, and Recording 869 aware UAs to handle events such as scene changes, error recovery, and 870 dynamic bandwidth adjustments. These messages are discussed in more 871 detail later in this document. 873 SAVP and SAVPF provide media encryption, integrity protection, replay 874 protection, and a limited form of source authentication. They do not 875 contain or require a specific keying mechanism. 877 8.1.3. SSRC 879 The synchronization source (SSRC), as defined in [RFC3550] is carried 880 in the RTP header and in various fields of RTCP packets. It is a 881 random 32-bit number that is required to be globally unique within an 882 RTP session. It is crucial that the number be chosen with care in 883 order that participants on the same network or starting at the same 884 time are not likely to choose the same number. Guidelines regarding 885 SSRC value selection and conflict resolution are provided in 886 [RFC3550]. 888 The SSRC may also be used to separate different sources of media 889 within a single RTP session. For this reason as well as for conflict 890 resolution, it is important that the SRC, SRS, and Recording aware 891 UAs handle changes in SSRC values and properly identify the reason of 892 the change. The CNAME values carried in RTCP facilitate this 893 identification. 895 8.1.4. CSRC 897 The contributing source (CSRC), as defined in [RFC3550], identifies 898 the source of a stream of RTP packets that has contributed to the 899 combined stream produced by an RTP mixer. The mixer inserts a list 900 of the SSRC identifiers of the sources that contributed to the 901 generation of a particular packet into the RTP header of that packet. 903 This list is called the CSRC list. It is RECOMMENDED that a SRC or 904 Recording aware UA, when acting a mixer, sets the CSRC list 905 accordingly, and that the SRC and SRS interpret the CSRC list 906 appropriately when received. 908 8.1.5. SDES 910 The Source Description (SDES), as defined in [RFC3550], contains an 911 SSRC/CSRC identifier followed by a list of zero or more items, which 912 carry information about the SSRC/CSRC. End systems send one SDES 913 packet containing their own source identifier (the same as the SSRC 914 in the fixed RTP header). A mixer sends one SDES packet containing a 915 chunk for each contributing source from which it is receiving SDES 916 information, or multiple complete SDES packets if there are more than 917 31 such sources. 919 8.1.5.1. CNAME 921 The Canonical End-Point Identifier (CNAME), as defined in [RFC3550], 922 provides the binding from the SSRC identifier to an identifier for 923 the source (sender or receiver) that remains constant. It is 924 important the SRC and Recording aware UAs generate CNAMEs 925 appropriately and that the SRC and SRS interpret and use them for 926 this purpose. Guidelines for generating CNAME values are provided in 927 "Guidelines for Choosing RTP Control Protocol (RTCP) Canonical Names 928 (CNAMEs)" [RFC6222]. 930 8.1.6. Keepalive 932 It is anticipated that media streams in SIPREC may exist in an 933 inactive state for extended periods of times for any of a number of 934 valid reasons. In order for the bindings and any pinholes in NATs/ 935 firewalls to remain active during such intervals, it is RECOMMENDED 936 that the SRC, SRS, and Recording aware UAs follow the keep-alive 937 procedure recommended in "Application Mechanism for Keeping Alive the 938 NAT Mappings Associated to RTP/RTP Control Protocol (RTCP) Flows" 939 [RFC6263] for all RTP media streams. 941 8.1.7. RTCP Feedback Messages 943 "Codec Control Messages in the RTP Audio-Visual Profile with Feedback 944 (AVPF)" [RFC5104] specifies extensions to the messages defined in 945 AVPF [RFC4585]. Support for and proper usage of these messages is 946 important to SRC, SRS, and Recording aware UA implementations. Note 947 that these messages are applicable only when using the AVFP or SAVPF 948 RTP profiles 950 8.1.7.1. Full Intra Request 952 A Full Intra Request (FIR) Command, when received by the designated 953 media sender, requires that the media sender sends a Decoder Refresh 954 Point at the earliest opportunity. Using a decoder refresh point 955 implies refraining from using any picture sent prior to that point as 956 a reference for the encoding process of any subsequent picture sent 957 in the stream. 959 Decoder refresh points, especially Intra or IDR pictures for H.264 960 video codecs, are in general several times larger in size than 961 predicted pictures. Thus, in scenarios in which the available bit 962 rate is small, the use of a decoder refresh point implies a delay 963 that is significantly longer than the typical picture duration. 965 8.1.7.1.1. SIP INFO for FIR 967 "XML Schema for Media Control" [RFC5168] defines an Extensible Markup 968 Language (XML) Schema for video fast update. Implementations are 969 discouraged from using the method described except for backward 970 compatibility purposes. Implementations SHOULD use FIR messages 971 instead. 973 8.1.7.2. Picture Loss Indicator 975 Picture Loss Indication (PLI), as defined in [RFC4585], informs the 976 encoder of the loss of an undefined amount of coded video data 977 belonging to one or more pictures. Using the FIR command to recover 978 from errors is explicitly disallowed, and instead the PLI message 979 SHOULD be used. FIR SHOULD be used only in situations where not 980 sending a decoder refresh point would render the video unusable for 981 the users. Examples where sending FIR is appropriate include a 982 multipoint conference when a new user joins the conference and no 983 regular decoder refresh point interval is established, and a video 984 switching MCU that changes streams. 986 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request 988 A receiver, translator, or mixer uses the Temporary Maximum Media 989 Stream Bit Rate Request (TMMBR) to request a sender to limit the 990 maximum bit rate for a media stream to the provided value. 991 Appropriate use of TMMBR facilitates rapid adaptation to changes in 992 available bandwidth. 994 8.1.7.3.1. Renegotiation of SDP bandwidth attribute 996 If it is likely that the new value indicated by TMMBR will be valid 997 for the remainder of the session, the TMMBR sender is expected to 998 perform a renegotiation of the session upper limit using the session 999 signaling protocol. Therefore for SIPREC, implementations are 1000 RECOMMENDED to use TMMBR for temporary changes, and renegotiation of 1001 bandwidth via SDP offer/answer for more permanent changes. 1003 8.1.8. Symmetric RTP/RTCP for Sending and Receiving 1005 Within an SDP offer/answer exchange, RTP entities choose the RTP and 1006 RTCP transport addresses (i.e., IP addresses and port numbers) on 1007 which to receive packets. When sending packets, the RTP entities may 1008 use the same source port or a different source port as those signaled 1009 for receiving packets. When the transport address used to send and 1010 receive RTP is the same, it is termed "symmetric RTP" [RFC4961]. 1011 Likewise, when the transport address used to send and receive RTCP is 1012 the same, it is termed "symmetric RTCP" [RFC4961]. 1014 When sending RTP, it is REQUIRED to use symmetric RTP. When sending 1015 RTCP, it is REQUIRED to use symmetric RTCP. Although an SRS will not 1016 normally send RTP, it will send RTCP as well as receive RTP and RTCP. 1017 Likewise, although an SRC will not normally receive RTP from the SRS, 1018 it will receive RTCP as well as send RTP and RTCP. 1020 Note: Symmetric RTP and symmetric RTCP are different from RTP/RTCP 1021 multiplexing [RFC5761]. 1023 8.2. Roles 1025 An SRC has the task of gathering media from the various UAs in one or 1026 more Communication Sessions (CSs) and forwarding the information to 1027 the SRS within the context of a corresponding Recording Session (RS). 1028 There are numerous ways in which an SRC may do this is, including but 1029 not limited to, appearing as a UA within a CS, or as a B2BUA between 1030 UAs within a CS. 1032 (Recording Session) +---------+ 1033 +------------SIP------->| | 1034 | +------RTP/RTCP----->| SRS | 1035 | | +-- Metadata -->| | 1036 | | | +---------+ 1037 v v | 1038 +---------+ 1039 | SRC | 1040 |---------| (Communication Session) +---------+ 1041 | |<----------SIP---------->| | 1042 | UA-A | | UA-B | 1043 | |<-------RTP/RTCP-------->| | 1044 +---------+ +---------+ 1046 Figure 7: UA as SRC 1048 (Recording Session) +---------+ 1049 +------------SIP------->| | 1050 | +------RTP/RTCP----->| SRS | 1051 | | +-- Metadata -->| | 1052 | | | +---------+ 1053 v v | 1054 +---------+ 1055 | SRC | 1056 +---------+ |---------| +---------+ 1057 | |<----SIP----->| |<----SIP----->| | 1058 | UA-A | | B2BUA | | UA-B | 1059 | |<--RTP/RTCP-->| |<--RTP/RTCP-->| | 1060 +---------+ +---------+ +---------+ 1061 |_______________________________________________| 1062 (Communication Session) 1064 Figure 8: B2BUA as SRC 1066 The following subsections define a set of roles an SRC may choose to 1067 play based on its position with respect to a UA within a CS, and an 1068 SRS within an RS. A CS and a corresponding RS are independent 1069 sessions; therefore, an SRC may play a different role within a CS 1070 than it does within the corresponding RS. 1072 8.2.1. SRC acting as an RTP Translator 1074 The SRC may act as a translator, as defined in [RFC3550]. A defining 1075 characteristic of a translator is that it forwards RTP packets with 1076 their SSRC identifier intact. There are two types of translators, 1077 one that simply forwards, and another that performs transcoding 1078 (e.g., from one codec to another) in addition to forwarding. 1080 8.2.1.1. Forwarding Translator 1082 When acting as a forwarding translator, RTP received as separate 1083 streams from different sources (e.g., from different UAs with 1084 different SSRCs) cannot be mixed by the SRC and MUST be sent 1085 separately to the SRS. All RTCP reports MUST be passed by the SRC 1086 between the UAs and the SRS, such that the UAs and SRS are able to 1087 detect any SSRC collisions. 1089 RTCP Sender Reports generated by a UA sending a stream MUST be 1090 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1091 MUST be forwarded to the relevant UA. 1093 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1094 from other UAs participating in the CS, and one from the SRS 1095 participating in the RS. A Recording aware UA SHOULD be prepared to 1096 process the RTCP Receiver Reports from the SRS, whereas a recording 1097 unaware UA may discard such RTCP packets as not of relevance. 1099 If SRTP is used on both the CS and the RS, decryption and/or re- 1100 encryption may occur. For example, if different keys are used, it 1101 will occur. If the same keys are used, it need not occur. 1102 Section 12 provides additional information on SRTP and keying 1103 mechanisms. 1105 If packet loss occurs, either from the UA to the SRC or from the SRC 1106 to the SRS, the SRS SHOULD detect and attempt to recover from the 1107 loss. The SRC does not play a role in this other than forwarding the 1108 associated RTP and RTCP packets. 1110 8.2.1.2. Transcoding Translator 1112 When acting as a transcoding translator, an SRC MAY perform 1113 transcoding (e.g., from one codec to another), and this may result in 1114 a different rate of packets between what the SRC receives and what 1115 the SRC sends. As when acting as a forwarding translator, RTP 1116 received as separate streams from different sources (e.g., from 1117 different UAs with different SSRCs) cannot be mixed by the SRC and 1118 MUST be sent separately to the SRS. All RTCP reports MUST be passed 1119 by the SRC between the UAs and the SRS, such that the UAs and SRS are 1120 able to detect any SSRC collisions. 1122 RTCP Sender Reports generated by a UA sending a stream MUST be 1123 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1124 MUST be forwarded to the relevant UA. The SRC may need to manipulate 1125 the RTCP Receiver Reports to take account of any transcoding that has 1126 taken place. 1128 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1129 from other UAs participating in the CS, and one from the SRS 1130 participating in the RS. A Recording aware UA SHOULD be prepared to 1131 process the RTCP Receiver Reports from the SRS, whereas a recording 1132 unaware UA may discard such RTCP packets as not of relevance. 1134 If SRTP is used on both the CS and the RS, decryption and/or re- 1135 encryption may occur. For example, if different keys are used, it 1136 will occur. If the same keys are used, it need not occur. 1137 Section 12 provides additional information on SRTP and keying 1138 mechanisms. 1140 If packet loss occurs, either from the UA to the SRC or from the SRC 1141 to the SRS, the SRS SHOULD detect and attempt to recover from the 1142 loss. The SRC does not play a role in this other than forwarding the 1143 associated RTP and RTCP packets. 1145 8.2.2. SRC acting as an RTP Mixer 1147 In the case of the SRC acting as a RTP mixer, as defined in 1148 [RFC3550], the SRC combines RTP streams from different UA and sends 1149 them towards the SRS using its own SSRC. The SSRCs from the 1150 contributing UA SHOULD be conveyed as CSRCs identifiers within this 1151 stream. The SRC may make timing adjustments among the received 1152 streams and generate its own timing on the stream sent to the SRS. 1153 Optionally an SRC acting as a mixer can perform transcoding, and can 1154 even cope with different codings received from different UAs. RTCP 1155 Sender Reports and Receiver Reports are not forwarded by an SRC 1156 acting as mixer, but there are requirements for forwarding RTCP 1157 Source Description (SDES) packets. The SRC generates its own RTCP 1158 Sender and Receiver reports toward the associated UAs and SRS. 1160 The use of SRTP between the SRC and the SRS for the RS is independent 1161 of the use of SRTP between the UAs and SRC for the CS. Section 12 1162 provides additional information on SRTP and keying mechanisms. 1164 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1165 and attempt to recover from the loss. If packet loss occurs from the 1166 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1167 loss. 1169 8.2.3. SRC acting as an RTP Endpoint 1171 The case of the SRC acting as an RTP endpoint, as defined in 1172 [RFC3550], is similar to the mixer case, except that the RTP session 1173 between the SRC and the SRS is considered completely independent from 1174 the RTP session that is part of the CS. The SRC can, but need not, 1175 mix RTP streams from different participants prior to sending to the 1176 SRS. RTCP between the SRC and the SRS is completely independent of 1177 RTCP on the CS. 1179 The use of SRTP between the SRC and the SRS for the RS is independent 1180 of the use of SRTP between the UAs and SRC for the CS. Section 12 1181 provides additional information on SRTP and keying mechanisms. 1183 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1184 and attempt to recover from the loss. If packet loss occurs from the 1185 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1186 loss. 1188 8.3. RTP Session Usage by SRC 1190 There are multiple ways that an SRC may choose to deliver recorded 1191 media to an SRS. In some cases, it may use a single RTP session for 1192 all media within the RS, whereas in others it may use multiple RTP 1193 sessions. The following subsections provide examples of basic RTP 1194 session usage by the SRC, including a discussion of how the RTP 1195 constructs and mechanisms covered previously are used. An SRC may 1196 choose to use one or more of the RTP session usages within a single 1197 RS. The set of RTP session usages described is not meant to be 1198 exhaustive. 1200 8.3.1. SRC Using Multiple m-lines 1202 When using multiple m-lines, an SRC includes each m-line in an SDP 1203 offer to the SRS. The SDP answer from the SRS MUST include all 1204 m-lines, with any rejected m-lines indicated with a zero port, per 1205 [RFC3264]. Having received the answer, the SRC starts sending media 1206 to the SRS as indicated in the answer. Alternatively, if the SRC 1207 deems the level of support indicated in the answer to be 1208 unacceptable, it may initiate another SDP offer/answer exchange in 1209 which an alternative RTP session usage is negotiated. 1211 In order to preserve the mapping of media to participant within the 1212 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1213 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1214 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1215 SSRC within the RS. In doing to, the SRC may act as an RTP 1216 translator or as an RTP endpoint. 1218 The following figure illustrates a case in which each UA represents a 1219 participant contributing two RTP sessions (e.g. one for audio and one 1220 for video), each with a single SSRC. The SRC acts as an RTP 1221 translator and delivers the media to the SRS using four RTP sessions, 1222 each with a single SSRC. The CNAME and SSRC values used by the UAs 1223 within their media streams are preserved in the media streams from 1224 the SRC to the SRS. 1226 +---------+ 1227 +------------SSRC Aa--->| | 1228 | + --------SSRC Av--->| | 1229 | | +------SSRC Ba--->| SRS | 1230 | | | +---SSRC Bv--->| | 1231 | | | | +---------+ 1232 | | | | 1233 | | | | 1234 +---------+ +----------+ +---------+ 1235 | |---SSRC Aa-->| SRC |<--SSRC Ba---| | 1236 | UA-A | |(CNAME-A, | | UA-B | 1237 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1238 +---------+ +----------+ +---------+ 1240 Figure 9: SRC Using Multiple m-lines 1242 8.3.2. SRC Using SSRC Multiplexing 1244 When using SSRC multiplexing, an SRC multiplexes RTP packets of the 1245 same media type from multiple RTP sessions into a single RTP session 1246 with multiple SSRC values. The SRC includes one m-line for each RTP 1247 session in an SDP offer to the SRS. The SDP answer from the SRS MUST 1248 include all m-lines, with any rejected m-lines indicated with the 1249 zero port, per [RFC3264]. Having received the answer, the SRC starts 1250 sending media to the SRS as indicated in the answer. 1252 In order to preserve the mapping of media to participant within the 1253 CSs in the RS, the SRC SHOULD map each unique combination of CNAME/ 1254 SSRC within the CSs to a unique SSRC within the RS. The CNAMEs used 1255 in the CSs are not preserved within the RS. The SRS relies on the 1256 SIPREC metadata to determine the participants included within each 1257 multiplexed stream. The SRC MUST avoid SSRC collisions, rewriting 1258 SSRCs if necessary. In doing to, the SRC acts as an RTP endpoint. 1260 In the event the SRS does not support SSRC multiplexing, the SRC 1261 becomes aware of this when it receives RTCP receiver reports from the 1262 SRS indicating the absence of any packets for one or more of the 1263 multiplexed SSRC values. If the SRC deems the level of support 1264 indicated in the RTCP receiver report to be unacceptable, it may 1265 initiate another SDP offer/answer exchange in which an alternative 1266 RTP session usage is negotiated. 1268 The following figure illustrates a case in which each UA represents a 1269 participant contributing two RTP sessions (e.g. one for audio and 1270 another for video), each with a single SSRC. The SRC delivers the 1271 media to the SRS using two RTP sessions, multiplexing one stream with 1272 the same media type from each participant into a single RTP session 1273 containing two SSRCs. The SRC uses its own CNAME and SSRC values, 1274 but it preserves the mapping of unique CNAME/SSRC used by the UAs 1275 within their media streams in the media streams from the SRC to the 1276 SRS. 1278 +---------+ 1279 | | 1280 +-----SSRC SAa,SBa--->| | 1281 | +-SSRC SAv,SBv--->| SRS | 1282 | | | | 1283 | | +---------+ 1284 | | 1285 | | 1286 +---------+ +----------+ +---------+ 1287 | |---SSRC Aa-->| SRC |<--SSRC Ba---| | 1288 | UA-A | |(CNAME-S) | | UA-B | 1289 |(CNAME-A)|---SSRC Av-->| |<--SSRC Bv---|(CNAME-B)| 1290 +---------+ +----------+ +---------+ 1292 Figure 10: SRC Using SSRC Multiplexing 1294 8.3.3. SRC Using Mixing 1296 When using mixing, the SRC combines RTP streams from different 1297 participants and sends them towards the SRS using its own SSRC. The 1298 SSRCs from the contributing participants SHOULD be conveyed as CSRCs 1299 identifiers. The SRC includes one m-line for each RTP session in an 1300 SDP offer to the SRS. The SDP answer from the SRS MUST include all 1301 m-lines, with any rejected m-lines indicated with the zero port, per 1302 [RFC3264]. Having received the answer, the SRC starts sending media 1303 to the SRS as indicated in the answer. 1305 In order to preserve the mapping of media to participant within the 1306 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1307 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1308 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1309 SSRC within the RS. The SRC MUST avoid SSRC collisions, rewriting 1310 SSRCs if necessary when used as CSRCs in the RS. In doing to, the 1311 SRC acts as an RTP mixer. 1313 In the event the SRS does not support this usage of CSRC values, it 1314 relies entirely on the SIPREC metadata to determine the participants 1315 included within each mixed stream. 1317 The following figure illustrates a case in which each UA represents a 1318 participant contributing two RTP sessions (e.g. one for audio and one 1319 for video), each with a single SSRC. The SRC acts as an RTP mixer 1320 and delivers the media to the SRS using two RTP sessions, mixing 1321 media from each participant into a single RTP session containing a 1322 single SSRC and two CSRCs. 1324 SSRC Sa +---------+ 1325 +-------CSRC Aa,Ba--->| | 1326 | | | 1327 | SSRC Sa | SRS | 1328 | +---CSRC Av,Bv--->| | 1329 | | +---------+ 1330 | | 1331 +----------+ 1332 +---------+ | SRC | +---------+ 1333 | |---SSRC Aa-->|(CNAME-S, |<--SSRC Ba---| | 1334 | UA-A | | CNAME-A, | | UA-B | 1335 |(CNAME-A)|---SSRC Aa-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1336 +---------+ +----------+ +---------+ 1338 Figure 11: SRC Using Mixing 1340 9. Metadata 1342 9.1. Procedures at the SRC 1344 The SRC MUST deliver metadata to the SRS in a recording session; the 1345 timing of which SRC sends the metadata depends on when the metadata 1346 becomes available. Metadata SHOULD be provided by the SRC in the 1347 initial INVITE request when establishing the recording session, and 1348 subsequent metadata updates can be provided by the SRC in reINVITE 1349 and UPDATE requests ([RFC3311]) and responses in the recording 1350 session. There are cases that metadata is not available in the 1351 initial INVITE request sent by the SRC, for example, when a recording 1352 session is established in the absence of a communication session, and 1353 the SRC would update the recording session with metadata whenever 1354 metadata becomes available. 1356 Certain metadata attributes are contained in the SDP, and others are 1357 contained in a new content type "application/rs-metadata". The 1358 format of the metadata is described as part of the mechanism in 1359 [I-D.ietf-siprec-metadata]. A new "disposition-type" of Content- 1360 Disposition is defined for the purpose of carrying metadata and the 1361 value is "recording-session". The "recording-session" value 1362 indicates that the "application/rs-metadata" content contains 1363 metadata to be handled by the SRS, and the disposition can be carried 1364 in either INVITE or UPDATE requests or responses sent by the SRC. 1366 Metadata sent by the SRC can be categorized as either a full metadata 1367 snapshot or partial update. A full metadata snapshot describes all 1368 the recorded streams and all metadata associated with the recording 1369 session. When the SRC sends a full metadata snapshot, the SRC MUST 1370 send an INVITE or an UPDATE request ([RFC3311]) with an SDP offer and 1371 the "recording-session" disposition. A partial update represents an 1372 incremental update since the last metadata update sent by the SRC. A 1373 partial update sent by the SRC can be an INVITE request or response 1374 with an SDP offer, or an INVITE/UPDATE request or response containing 1375 a "recording-session" disposition, or an INVITE request containing 1376 both an SDP offer and the "recording-session" disposition. 1378 The following is an example of a full metadata snapshot sent by the 1379 SRC in the initial INVITE request: 1381 INVITE sip:recorder@example.com SIP/2.0 1382 Via: SIP/2.0/TCP src.example.com;branch=z9hG4bKdf6b622b648d9 1383 From: ;tag=35e195d2-947d-4585-946f-098392474 1384 To: 1385 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1386 CSeq: 101 INVITE 1387 Max-Forwards: 70 1388 Require: siprec 1389 Accept: application/sdp, application/rs-metadata, 1390 application/rs-metadata-request 1391 Contact: ;+sip.src 1392 Content-Type: multipart/mixed;boundary=foobar 1393 Content-Length: [length] 1395 --foobar 1396 Content-Type: application/sdp 1398 v=0 1399 o=SRS 2890844526 2890844526 IN IP4 198.51.100.1 1400 s=- 1401 c=IN IP4 198.51.100.1 1402 t=0 0 1403 m=audio 12240 RTP/AVP 0 4 8 1404 a=sendonly 1405 a=label:1 1407 --foobar 1408 Content-Type: application/rs-metadata 1409 Content-Disposition: recording-session 1411 [metadata content] 1413 Figure 12: Sample INVITE request for the recording session 1415 9.2. Procedures at the SRS 1417 The SRS receives metadata updates from the SRC in INVITE and UPDATE 1418 requests. Since the SRC can send partial updates based on the 1419 previous update, the SRS needs to keep track of the sequence of 1420 updates from the SRC. 1422 In the case of an internal failure at the SRS, the SRS may fail to 1423 recognize a partial update from the SRC. The SRS may be able to 1424 recover from the internal failure by requesting for a full metadata 1425 snapshot from the SRC. Certain errors, such as syntax errors or 1426 semantic errors in the metadata information, are likely caused by an 1427 error on the SRC side, and it is likely the same error will occur 1428 again even when a full metadata snapshot is requested. In order to 1429 avoid repeating the same error, the SRS can simply terminate the 1430 recording session when a syntax error or semantic error is detected 1431 in the metadata. 1433 When the SRS explicitly requests for a full metadata snapshot, the 1434 SRS MUST send an UPDATE request without an SDP offer. A metadata 1435 snapshot request contains a content with the content disposition type 1436 "recording-session". Note that the SRS MAY generate an INVITE 1437 request without an SDP offer but this MUST NOT include a metadata 1438 snapshot request. The format of the content is "application/ 1439 rs-metadata-request", and the body format is chosen to be a simple 1440 text-based format. The following shows an example: 1442 UPDATE sip:2000@src.exmaple.com SIP/2.0 1443 Via: SIP/2.0/UDP srs.example.com;branch=z9hG4bKdf6b622b648d9 1444 To: ;tag=35e195d2-947d-4585-946f-098392474 1445 From: ;tag=1234567890 1446 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1447 CSeq: 1 UPDATE 1448 Max-Forwards: 70 1449 Require: siprec 1450 Contact: ;+sip.srs 1451 Accept: application/sdp, application/rs-metadata 1452 Content-Disposition: recording-session 1453 Content-Type: application/rs-metadata-request 1454 Content-Length: [length] 1456 SRS internal error 1458 Figure 13: Metadata Request 1460 The SRS MAY include the reason why a metadata snapshot request is 1461 being made to the SRC in the reason line. This reason line is free 1462 form text, mainly designed for logging purposes on the SRC side. The 1463 processing of the content by the SRC is entirely optional since the 1464 content is for logging only, and the snapshot request itself is 1465 indicated by the use of the application/rs-metadata-request content 1466 type. 1468 When the SRC receives the request for a metadata snapshot, the SRC 1469 MUST provide a full metadata snapshot in a separate INVITE or UPDATE 1470 transaction, along with an SDP offer. All subsequent metadata 1471 updates sent by the SRC MUST be based on the new metadata snapshot. 1473 9.2.1. Formal Syntax 1475 The formal syntax for the application/rs-metadata-request MIME is 1476 described below using the augmented Backus-Naur Form (BNF) as 1477 described in [RFC5234]. 1479 snapshot-request = srs-reason-line CRLF 1481 srs-reason-line = [TEXT-UTF8-TRIM] 1483 10. Persistent Recording 1485 Persistent recording is a specific use case outlined in REQ-005 or 1486 Use Case 4 in [RFC6341], where a recording session can be established 1487 in the absence of a communication session. The SRC continuously 1488 records media in a recording session to the SRS even in the absence 1489 of a CS for all user agents that are part of persistent recording. 1490 By allocating recorded streams and continuously sending recorded 1491 media to the SRS, the SRC does not have to prepare new recorded 1492 streams with new SDP offer when a new communication session is 1493 created and also does not impact the timing of the CS. The SRC only 1494 needs to update the metadata when new communication sessions are 1495 created. 1497 When there is no communication sessions running on the devices with 1498 persistent recording, there is no recorded media to stream from the 1499 SRC to the SRS. In certain environments where Network Address 1500 Translator (NAT) is used, typically a minimum of flow activity is 1501 required to maintain the NAT binding for each port opened. Agents 1502 that support Interactive Connectivity Establishment (ICE) solves this 1503 problem. For non-ICE agents, in order not to lose the NAT bindings 1504 for the RTP/RTCP ports opened for the recorded streams, the SRC and 1505 SRS SHOULD follow the recommendations provided in [RFC6263] to 1506 maintain the NAT bindings. 1508 11. IANA Considerations 1510 11.1. Registration of Option Tags 1512 This specification registers two option tags. The required 1513 information for this registration, as specified in [RFC3261], is as 1514 follows. 1516 11.1.1. siprec Option Tag 1518 Name: siprec 1520 Description: This option tag is for identifying the SIP session 1521 for the purpose of recording session only. This is typically not 1522 used in a Supported header. When present in a Require header in a 1523 request, it indicates that the UAS MUST be either a SRC or SRS 1524 capable of handling the contexts of a recording session. 1526 11.1.2. record-aware Option Tag 1528 Name: record-aware 1530 Description: This option tag is to indicate the ability for the 1531 user agent to receive recording indicators in media level or 1532 session level SDP. When present in a Supported header, it 1533 indicates that the UA can receive recording indicators in media 1534 level or session level SDP. 1536 11.2. Registration of media feature tags 1538 This document registers two new media feature tags in the SIP tree 1539 per the process defined in [RFC2506] and [RFC3840] 1541 11.2.1. src feature tag 1543 Media feature tag name: sip.src 1545 ASN.1 Identifier: 25 1547 Summary of the media feature indicated by this tag: This feature 1548 tag indicates that the user agent is a Session Recording Client 1549 for the purpose for Recording Session. 1551 Values appropriate for use with this feature tag: boolean 1553 The feature tag is intended primarily for use in the following 1554 applications, protocols, services, or negotiation mechanisms: This 1555 feature tag is only useful for a Recording Session. 1557 Examples of typical use: Routing the request to a Session 1558 Recording Server. 1560 Security Considerations: Security considerations for this media 1561 feature tag are discussed in Section 11.1 of RFC 3840. 1563 11.2.2. srs feature tag 1565 Media feature tag name: sip.srs 1567 ASN.1 Identifier: 26 1569 Summary of the media feature indicated by this tag: This feature 1570 tag indicates that the user agent is a Session Recording Server 1571 for the purpose for Recording Session. 1573 Values appropriate for use with this feature tag: boolean 1575 The feature tag is intended primarily for use in the following 1576 applications, protocols, services, or negotiation mechanisms: This 1577 feature tag is only useful for a Recording Session. 1579 Examples of typical use: Routing the request to a Session 1580 Recording Client. 1582 Security Considerations: Security considerations for this media 1583 feature tag are discussed in Section 11.1 of RFC 3840. 1585 11.3. New Content-Disposition Parameter Registrations 1587 This document registers a new "disposition-type" value in Content- 1588 Disposition header: recording-session. 1590 recording-session the body describes the metadata information about 1591 the recording session 1593 11.4. Media Type Registration 1595 11.4.1. Registration of MIME Type application/rs-metadata 1597 This document registers the application/rs-metadata MIME media type 1598 in order to describe the recording session metadata. This media type 1599 is defined by the following information: 1601 Media type name: application 1603 Media subtype name: rs-metadata 1605 Required parameters: none 1607 Options parameters: none 1609 11.4.2. Registration of MIME Type application/rs-metadata-request 1611 This document registers the application/rs-metadata-request MIME 1612 media type in order to describe a recording session metadata snapshot 1613 request. This media type is defined by the following information: 1615 Media type name: application 1617 Media subtype name: rs-metadata-request 1619 Required parameters: none 1621 Options parameters: none 1623 11.5. SDP Attributes 1625 This document registers the following new SDP attributes. 1627 11.5.1. 'record' SDP Attribute 1629 Contact names: Leon Portman leon.portman@nice.com, Henry Lum 1630 henry.lum@genesyslab.com 1632 Attribute name: record 1634 Long form attribute name: Recording Indication 1636 Type of attribute: session or media level 1638 Subject to charset: no 1640 This attribute provides the recording indication for the session or 1641 media stream. 1643 Allowed attribute values: on, off, paused 1645 11.5.2. 'recordpref' SDP Attribute 1647 Contact names: Leon Portman leon.portman@nice.com, Henry Lum 1648 henry.lum@genesyslab.com 1650 Attribute name: recordpref 1652 Long form attribute name: Recording Preference 1654 Type of attribute: session or media level 1656 Subject to charset: no 1657 This attribute provides the recording preference for the session or 1658 media stream. 1660 Allowed attribute values: on, off, pause, nopreference 1662 12. Security Considerations 1664 The recording session is fundamentally a standard SIP dialog 1665 [RFC3261], therefore, the recording session can reuse any of the 1666 existing SIP security mechanism available for securing, session 1667 signaling, the recorded media as well as metadata. The use cases and 1668 requirements document [RFC6341] outlines the general security 1669 considerations, and the following describe specific security 1670 recommendations. 1672 The SRC and SRS MUST support SIPS and TLS as per [RFC5630]. The 1673 Recording Session SHOULD be at least as secure as the Communication 1674 Session, meaning using at least the same strength of cipher suite as 1675 the CS if the CS is secured. For example, if the CS uses SIPS for 1676 signalling and RTP/SAVP for media, then the RS does not downgrade the 1677 level of security in the RS to SIP or plain RTP since doing so will 1678 mean an automatic security downgrade for the CS. In deployments 1679 where the SRC and the SRS are in the same administrative domain and 1680 the same physical switch that prevents outside user access, some SRC 1681 may choose lower the level of security when establishing the 1682 recording session. While physically securing the SRC and SRS may 1683 prevent an outside attacker from accessing important call recordings, 1684 this still does not prevent from an inside attacker from accessing 1685 the internal network to gain access to the call recordings. 1687 12.1. Authentication and Authorization 1689 The recording session reuses the SIP mechanism to challenge requests 1690 that is based on HTTP authentication. The mechanism relies on 401 1691 and 407 SIP responses as well as other SIP header fields for carrying 1692 challenges and credentials. 1694 At the transport level, the recording session uses TLS authentication 1695 to validate the authenticity of the SRC and SRS. The SRC and SRS 1696 MUST implement TLS mutual authentication for establishing the 1697 recording session, and whether the SRC/SRS chooses to use 1698 authentication is a deployment decision. In deployments where the 1699 SRC and the SRS are in the same administrative domain, the deployment 1700 may choose not to authenticate each other or only to have SRC 1701 authenticate the SRS as there is an inherent trust relation between 1702 the SRC and the SRS when they are hosted in the same administrative 1703 domain. In deployments where the SRS can be hosted on a different 1704 administrative domain, then it is important to perform mutual 1705 authentication to ensure the authenticity of both the SRC and the SRS 1706 before transmitting any recorded media. The risk of not 1707 authenticating the SRS is that the recording may be sent to a 1708 compromised SRS and that sensitive call recording will be obtained by 1709 an attacker. On the other hand, the risk of not authenticating the 1710 SRC is that an SRS will be willingly accept any call recording from 1711 an unknown SRC and allow potential forgery of call recordings. 1713 The SRS may have its own set of recording policies to authorize 1714 recording requests from the SRC. The use of recording policies is 1715 outside the scope of the Session Recording Protocol. 1717 12.2. RTP handling 1719 In many scenarios it will be critical that the media transported 1720 between the SRC and SRS to be protected. Media encryption is an 1721 important element in the overall SIPREC solution; therefore SRC and 1722 SRS MUST support RTP/SAVP [RFC3711] and RTP/SAVPF [RFC5124]. RTP/ 1723 SAVP and RTP/SAVPF provide media encryption, integrity protection, 1724 replay protection, and a limited form of source authentication. They 1725 do not contain or require a specific keying mechanism. 1727 When RTP/SAVP or RTP/SAVPF is used, RS can choose to use the same or 1728 different security keys than the ones used in the CS. Some SRCs are 1729 designed to simply replicate RTP packets from the CS media stream to 1730 the SRS, and the SRC will be reusing the same keys as the CS. In 1731 this case, the SRC MUST secure the SDP with SDP Security Descriptions 1732 (SDES) [RFC4568] in the RS with at least the same level of security 1733 as the CS. The risk of lowering the level of security in the RS for 1734 this case is that it will effectively become a downgrade attack on 1735 the CS since the same key is used for both CS and RS. 1737 For SRCs that perform transcoding or mixing of media before sending 1738 to the SRS, the SRC MUST negotiate a different security key than the 1739 one being used in the CS, to ensure that the security in the CS is 1740 not compromised by the SRC when reusing the same security key. 1742 12.3. Metadata 1744 Metadata contains sensitive information such as the address of record 1745 of the participants and other extension data placed by the SRC. It 1746 is essential to protect the content of the metadata in the RS. Since 1747 metadata is a content type transmitted in SIP signalling, metadata 1748 SHOULD be protected at the transport level by SIPS/TLS. 1750 12.4. Storage and playback 1752 While storage and playback of the call recording is beyond the scope 1753 of this document, it is worthwhile to mention here that it is also 1754 important for the recording storage and playback to provide a level 1755 of security that is comparable to the communication session. It 1756 would defeat the purpose of securing both the communication session 1757 and the recording session mentioned in the previous sections if the 1758 recording can be easily played back with a simple unsecured HTTP 1759 interface without any form of authentication or authorization. 1761 13. Acknowledgements 1763 We want to thank John Elwell, Paul Kyzivat, Partharsarathi R, Ram 1764 Mohan R, Hadriel Kaplan, Adam Roach, Miguel Garcia, Thomas Stach, 1765 Muthu Perumal, Dan Wing, and Magnus Westerlund for their valuable 1766 comments and inputs to this document. 1768 14. References 1770 14.1. Normative References 1772 [I-D.ietf-siprec-metadata] 1773 R, R., Ravindran, P., and P. Kyzivat, "Session Initiation 1774 Protocol (SIP) Recording Metadata", 1775 draft-ietf-siprec-metadata-07 (work in progress), 1776 July 2012. 1778 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1779 Requirement Levels", BCP 14, RFC 2119, March 1997. 1781 [RFC2506] Holtman, K., Mutz, A., and T. Hardie, "Media Feature Tag 1782 Registration Procedure", BCP 31, RFC 2506, March 1999. 1784 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 1785 A., Peterson, J., Sparks, R., Handley, M., and E. 1786 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 1787 June 2002. 1789 [RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model 1790 with Session Description Protocol (SDP)", RFC 3264, 1791 June 2002. 1793 [RFC3840] Rosenberg, J., Schulzrinne, H., and P. Kyzivat, 1794 "Indicating User Agent Capabilities in the Session 1795 Initiation Protocol (SIP)", RFC 3840, August 2004. 1797 [RFC4574] Levin, O. and G. Camarillo, "The Session Description 1798 Protocol (SDP) Label Attribute", RFC 4574, August 2006. 1800 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 1801 Specifications: ABNF", STD 68, RFC 5234, January 2008. 1803 14.2. Informative References 1805 [I-D.ietf-siprec-architecture] 1806 Hutton, A., Portman, L., Jain, R., and K. Rehor, "An 1807 Architecture for Media Recording using the Session 1808 Initiation Protocol", draft-ietf-siprec-architecture-06 1809 (work in progress), September 2012. 1811 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 1812 UPDATE Method", RFC 3311, October 2002. 1814 [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. 1815 Jacobson, "RTP: A Transport Protocol for Real-Time 1816 Applications", STD 64, RFC 3550, July 2003. 1818 [RFC3551] Schulzrinne, H. and S. Casner, "RTP Profile for Audio and 1819 Video Conferences with Minimal Control", STD 65, RFC 3551, 1820 July 2003. 1822 [RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. 1823 Norrman, "The Secure Real-time Transport Protocol (SRTP)", 1824 RFC 3711, March 2004. 1826 [RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session 1827 Description Protocol (SDP) Security Descriptions for Media 1828 Streams", RFC 4568, July 2006. 1830 [RFC4585] Ott, J., Wenger, S., Sato, N., Burmeister, C., and J. Rey, 1831 "Extended RTP Profile for Real-time Transport Control 1832 Protocol (RTCP)-Based Feedback (RTP/AVPF)", RFC 4585, 1833 July 2006. 1835 [RFC4961] Wing, D., "Symmetric RTP / RTP Control Protocol (RTCP)", 1836 BCP 131, RFC 4961, July 2007. 1838 [RFC5104] Wenger, S., Chandra, U., Westerlund, M., and B. Burman, 1839 "Codec Control Messages in the RTP Audio-Visual Profile 1840 with Feedback (AVPF)", RFC 5104, February 2008. 1842 [RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for 1843 Real-time Transport Control Protocol (RTCP)-Based Feedback 1844 (RTP/SAVPF)", RFC 5124, February 2008. 1846 [RFC5168] Levin, O., Even, R., and P. Hagendorf, "XML Schema for 1847 Media Control", RFC 5168, March 2008. 1849 [RFC5630] Audet, F., "The Use of the SIPS URI Scheme in the Session 1850 Initiation Protocol (SIP)", RFC 5630, October 2009. 1852 [RFC5761] Perkins, C. and M. Westerlund, "Multiplexing RTP Data and 1853 Control Packets on a Single Port", RFC 5761, April 2010. 1855 [RFC6222] Begen, A., Perkins, C., and D. Wing, "Guidelines for 1856 Choosing RTP Control Protocol (RTCP) Canonical Names 1857 (CNAMEs)", RFC 6222, April 2011. 1859 [RFC6263] Marjou, X. and A. Sollaud, "Application Mechanism for 1860 Keeping Alive the NAT Mappings Associated with RTP / RTP 1861 Control Protocol (RTCP) Flows", RFC 6263, June 2011. 1863 [RFC6341] Rehor, K., Portman, L., Hutton, A., and R. Jain, "Use 1864 Cases and Requirements for SIP-Based Media Recording 1865 (SIPREC)", RFC 6341, August 2011. 1867 Authors' Addresses 1869 Leon Portman 1870 NICE Systems 1871 8 Hapnina 1872 Ra'anana 43017 1873 Israel 1875 Email: leon.portman@nice.com 1877 Henry Lum (editor) 1878 Genesys 1879 1380 Rodick Road, Suite 201 1880 Markham, Ontario L3R4G5 1881 Canada 1883 Email: henry.lum@genesyslab.com 1884 Charles Eckel 1885 Cisco 1886 170 West Tasman Drive 1887 San Jose, CA 95134 1888 United States 1890 Email: eckelcu@cisco.com 1892 Alan Johnston 1893 Avaya 1894 St. Louis, MO 63124 1896 Email: alan.b.johnston@gmail.com 1898 Andrew Hutton 1899 Siemens Enterprise Communications 1900 Brickhill Street 1901 Milton Keynes MK15 0DJ 1902 United Kingdom 1904 Email: andrew.hutton@siemens-enterprise.com