idnits 2.17.1 draft-ietf-siprec-protocol-16.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (May 1, 2015) is 3281 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-22) exists of draft-ietf-siprec-metadata-17 Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPREC L. Portman 3 Internet-Draft NICE Systems 4 Intended status: Standards Track H. Lum, Ed. 5 Expires: November 2, 2015 Genesys 6 C. Eckel 7 Cisco 8 A. Johnston 9 Avaya 10 A. Hutton 11 Unify 12 May 1, 2015 14 Session Recording Protocol 15 draft-ietf-siprec-protocol-16 17 Abstract 19 This document specifies the use of the Session Initiation Protocol 20 (SIP), the Session Description Protocol (SDP), and the Real Time 21 Protocol (RTP) for delivering real-time media and metadata from a 22 Communication Session (CS) to a recording device. The Session 23 Recording Protocol specifies the use of SIP, SDP, and RTP to 24 establish a Recording Session (RS) between the Session Recording 25 Client (SRC), which is on the path of the CS, and a Session Recording 26 Server (SRS) at the recording device. This document considers only 27 active recording, where the SRC purposefully streams media to an SRS 28 and all participating user agents are notified of the recording. 29 Passive recording, where a recording device detects media directly 30 from the network (e.g., using port-mirroring techniques), is outside 31 the scope of this document. In addition, lawful intercept is outside 32 the scope of this document. 34 Status of This Memo 36 This Internet-Draft is submitted in full conformance with the 37 provisions of BCP 78 and BCP 79. 39 Internet-Drafts are working documents of the Internet Engineering 40 Task Force (IETF). Note that other groups may also distribute 41 working documents as Internet-Drafts. The list of current Internet- 42 Drafts is at http://datatracker.ietf.org/drafts/current/. 44 Internet-Drafts are draft documents valid for a maximum of six months 45 and may be updated, replaced, or obsoleted by other documents at any 46 time. It is inappropriate to use Internet-Drafts as reference 47 material or to cite them other than as "work in progress." 48 This Internet-Draft will expire on November 2, 2015. 50 Copyright Notice 52 Copyright (c) 2015 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the Simplified BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 68 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 69 3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 70 4. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 71 5. Overview of operations . . . . . . . . . . . . . . . . . . . 5 72 5.1. Delivering recorded media . . . . . . . . . . . . . . . . 5 73 5.2. Delivering recording metadata . . . . . . . . . . . . . . 7 74 5.3. Receiving recording indications and providing recording 75 preferences . . . . . . . . . . . . . . . . . . . . . . . 8 76 6. SIP Handling . . . . . . . . . . . . . . . . . . . . . . . . 10 77 6.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 10 78 6.1.1. Initiating a Recording Session . . . . . . . . . . . 10 79 6.1.2. SIP extensions for recording indication and 80 preference . . . . . . . . . . . . . . . . . . . . . 10 81 6.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 11 82 6.3. Procedures for Recording-aware User Agents . . . . . . . 11 83 7. SDP Handling . . . . . . . . . . . . . . . . . . . . . . . . 12 84 7.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 12 85 7.1.1. SDP handling in RS . . . . . . . . . . . . . . . . . 12 86 7.1.1.1. Handling media stream updates . . . . . . . . . . 13 87 7.1.2. Recording indication in CS . . . . . . . . . . . . . 14 88 7.1.3. Recording preference in CS . . . . . . . . . . . . . 15 89 7.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 15 90 7.3. Procedures for Recording-aware User Agents . . . . . . . 17 91 7.3.1. Recording indication . . . . . . . . . . . . . . . . 17 92 7.3.2. Recording preference . . . . . . . . . . . . . . . . 18 93 8. RTP Handling . . . . . . . . . . . . . . . . . . . . . . . . 19 94 8.1. RTP Mechanisms . . . . . . . . . . . . . . . . . . . . . 19 95 8.1.1. RTCP . . . . . . . . . . . . . . . . . . . . . . . . 19 96 8.1.2. RTP Profile . . . . . . . . . . . . . . . . . . . . . 20 97 8.1.3. SSRC . . . . . . . . . . . . . . . . . . . . . . . . 20 98 8.1.4. CSRC . . . . . . . . . . . . . . . . . . . . . . . . 21 99 8.1.5. SDES . . . . . . . . . . . . . . . . . . . . . . . . 21 100 8.1.5.1. CNAME . . . . . . . . . . . . . . . . . . . . . . 21 101 8.1.6. Keepalive . . . . . . . . . . . . . . . . . . . . . . 21 102 8.1.7. RTCP Feedback Messages . . . . . . . . . . . . . . . 22 103 8.1.7.1. Full Intra Request . . . . . . . . . . . . . . . 22 104 8.1.7.2. Picture Loss Indicator . . . . . . . . . . . . . 22 105 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request . 23 106 8.1.8. Symmetric RTP/RTCP for Sending and Receiving . . . . 23 107 8.2. Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 24 108 8.2.1. SRC acting as an RTP Translator . . . . . . . . . . . 25 109 8.2.1.1. Forwarding Translator . . . . . . . . . . . . . . 25 110 8.2.1.2. Transcoding Translator . . . . . . . . . . . . . 25 111 8.2.2. SRC acting as an RTP Mixer . . . . . . . . . . . . . 26 112 8.2.3. SRC acting as an RTP Endpoint . . . . . . . . . . . . 27 113 8.3. RTP Session Usage by SRC . . . . . . . . . . . . . . . . 27 114 8.3.1. SRC Using Multiple m-lines . . . . . . . . . . . . . 27 115 8.3.2. SRC Using Mixing . . . . . . . . . . . . . . . . . . 28 116 8.4. RTP Session Usage by SRS . . . . . . . . . . . . . . . . 29 117 9. Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . 30 118 9.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 30 119 9.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 32 120 9.2.1. Formal Syntax . . . . . . . . . . . . . . . . . . . . 34 121 10. Persistent Recording . . . . . . . . . . . . . . . . . . . . 34 122 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34 123 11.1. Registration of Option Tags . . . . . . . . . . . . . . 35 124 11.1.1. siprec Option Tag . . . . . . . . . . . . . . . . . 35 125 11.1.2. record-aware Option Tag . . . . . . . . . . . . . . 35 126 11.2. Registration of media feature tags . . . . . . . . . . . 35 127 11.2.1. src feature tag . . . . . . . . . . . . . . . . . . 35 128 11.2.2. srs feature tag . . . . . . . . . . . . . . . . . . 36 129 11.3. New Content-Disposition Parameter Registrations . . . . 36 130 11.4. Media Type Registration . . . . . . . . . . . . . . . . 36 131 11.4.1. Registration of MIME Type application/rs-metadata- 132 request . . . . . . . . . . . . . . . . . . . . . . 36 133 11.5. SDP Attributes . . . . . . . . . . . . . . . . . . . . . 37 134 11.5.1. 'record' SDP Attribute . . . . . . . . . . . . . . . 37 135 11.5.2. 'recordpref' SDP Attribute . . . . . . . . . . . . . 37 136 12. Security Considerations . . . . . . . . . . . . . . . . . . . 38 137 12.1. Authentication and Authorization . . . . . . . . . . . . 38 138 12.2. RTP handling . . . . . . . . . . . . . . . . . . . . . . 39 139 12.3. Metadata . . . . . . . . . . . . . . . . . . . . . . . . 40 140 12.4. Storage and playback . . . . . . . . . . . . . . . . . . 40 141 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 40 142 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 40 143 14.1. Normative References . . . . . . . . . . . . . . . . . . 40 144 14.2. Informative References . . . . . . . . . . . . . . . . . 41 145 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 43 147 1. Introduction 149 This document specifies the mechanism to record a Communication 150 Session (CS) by delivering real-time media and metadata from the CS 151 to a recording device. In accordance to the architecture [RFC7245], 152 the Session Recording Protocol specifies the use of SIP, SDP, and RTP 153 to establish a Recording Session (RS) between the Session Recording 154 Client (SRC), which is on the path of the CS, and a Session Recording 155 Server (SRS) at the recording device. SIP is also used to deliver 156 metadata to the recording device, as specified in 157 [I-D.ietf-siprec-metadata]. Metadata is information that describes 158 recorded media and the CS to which they relate. The Session 159 Recording Protocol intends to satisfy the SIP-based Media Recording 160 requirements listed in [RFC6341]. In addition to the Session 161 Recording Protocol, this document specifies extensions for user 162 agents that are participants in a CS to receive recording indications 163 and to provide preferences for recording. 165 This document considers only active recording, where the SRC 166 purposefully streams media to an SRS and all participating user 167 agents are notified of the recording. Passive recording, where a 168 recording device detects media directly from the network (e.g., using 169 port-mirroring techniques), is outside the scope of this document. 170 In addition, lawful intercept is outside the scope of this document, 171 in accordance with [RFC2804]. 173 2. Terminology 175 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 176 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 177 document are to be interpreted as described in [RFC2119]. 179 3. Definitions 181 This document refers to the core definitions provided in the 182 architecture document [RFC7245]. 184 The RTP Handling section uses the definitions provided in "RTP: A 185 Transport Protocol for Real-Time Application" [RFC3550]. 187 4. Scope 189 The scope of the Session Recording Protocol includes the 190 establishment of the recording sessions and the reporting of the 191 metadata. The scope also includes extensions supported by User 192 Agents participating in the CS such as indication of recording. The 193 user agents need not be recording-aware in order to participate in a 194 CS being recorded. 196 The following items, which are not an exhaustive list, do not 197 represent the protocol itself and are considered out of the scope of 198 the Session Recording Protocol: 200 o Delivering recorded media in real-time as the CS media 202 o Specifications of criteria to select a specific CS to be recorded 203 or triggers to record a certain CS in the future 205 o Recording policies that determine whether the CS should be 206 recorded and whether parts of the CS are to be recorded 208 o Retention policies that determine how long a recording is stored 210 o Searching and accessing the recorded media and metadata 212 o Policies governing how CS users are made aware of recording 214 o Delivering additional recording session metadata through non-SIP 215 mechanism 217 5. Overview of operations 219 This section is informative and provides a description of recording 220 operations. 222 Section 6 describes the SIP communication in a recording session 223 between an SRC and an SRS, and the procedures for recording-aware 224 user agents participating in a CS. Section 7 describes the SDP in a 225 recording session, and the procedures for recording indications and 226 recording preferences. Section 8 describes the RTP handling in a 227 recording session. Section 9 describes the mechanism to deliver 228 recording metadata from the SRC to the SRS. 230 As mentioned in the architecture document [RFC7245], there are a 231 number of types of call flows based on the location of the Session 232 Recording Client. The following sample call flows provide a quick 233 overview of the operations between the SRC and the SRS. 235 5.1. Delivering recorded media 237 When a SIP Back-to-Back User Agent (B2BUA) with SRC functionality 238 routes a call from UA(A) to UA(B), the SRC has access to the media 239 path between the user agents. When the SRC is aware that it should 240 be recording the conversation, the SRC can cause the B2BUA to bridge 241 the media between UA(A) and UA(B). The SRC then establishes the 242 Recording Session with the SRS and sends replicated media towards the 243 SRS. 245 An endpoint may also have SRC functionality, where the endpoint 246 itself establishes the Recording Session to the SRS. Since the 247 endpoint has access to the media in the Communication Session, the 248 endpoint can send replicated media towards the SRS. 250 The following is a sample call flow that shows the SRC establishing a 251 recording session towards the SRS. The call flow is essentially 252 identical when the SRC is a B2BUA or as the endpoint itself. Note 253 that the SRC can choose when to establish the Recording Session 254 independent of the Communication Session, even though the following 255 call flow suggests that the SRC is establishing the Recording Session 256 (message #5) after the Communication Session is established. 258 UA A SRC UA B SRS 259 |(1)CS INVITE | | | 260 |------------->| | | 261 | |(2)CS INVITE | | 262 | |---------------------->| | 263 | | (3) 200 OK | | 264 | |<----------------------| | 265 | (4) 200 OK | | | 266 |<-------------| | | 267 | |(5)RS INVITE with SDP | | 268 | |--------------------------------------------->| 269 | | | (6) 200 OK with SDP | 270 | |<---------------------------------------------| 271 |(7)CS RTP | | | 272 |=============>|======================>| | 273 |<=============|<======================| | 274 | |(8)RS RTP | | 275 | |=============================================>| 276 | |=============================================>| 277 |(9)CS BYE | | | 278 |------------->| | | 279 | |(10)CS BYE | | 280 | |---------------------->| | 281 | |(11)RS BYE | | 282 | |--------------------------------------------->| 283 | | | | 285 Figure 1: Basic recording call flow 287 The above call flow can also apply to the case of a centralized 288 conference with a mixer. For clarity, ACKs to INVITEs and 200 OKs to 289 BYEs are not shown. The conference focus can provide the SRC 290 functionality since the conference focus has access to all the media 291 from each conference participant. When a recording is requested, the 292 SRC delivers the metadata and the media streams to the SRS. Since 293 the conference focus has access to a mixer, the SRC may choose to mix 294 the media streams from all participants as a single mixed media 295 stream towards the SRS. 297 An SRC can use a single recording session to record multiple 298 communication sessions. Every time the SRC wants to record a new 299 call, the SRC updates the recording session with a new SDP offer to 300 add new recorded streams to the recording session, and 301 correspondingly also update the metadata for the new call. 303 An SRS can also establish a recording session to an SRC, although it 304 is beyond the scope of this document to define how an SRS would 305 specify which calls to record. 307 5.2. Delivering recording metadata 309 The SRC is responsible for the delivery of metadata to the SRS. The 310 SRC may provide an initial metadata snapshot about recorded media 311 streams in the initial INVITE content in the recording session. 312 Subsequent metadata updates can be represented as a stream of events 313 in UPDATE or reINVITE requests sent by the SRC. These metadata 314 updates are normally incremental updates to the initial metadata 315 snapshot to optimize on the size of updates. However, the SRC may 316 also decide to send a new metadata snapshot any time. 318 Metadata is transported in the body of INVITE or UPDATE messages. 319 Certain metadata, such as the attributes of the recorded media 320 stream, are located in the SDP of the recording session. 322 The SRS has the ability to send a request to the SRC to request for a 323 new metadata snapshot update from the SRC. This can happen when the 324 SRS fails to understand the current stream of incremental updates for 325 whatever reason, for example, when SRS loses the current state due to 326 internal failure. The SRS may optionally attach a reason along with 327 the snapshot request. This request allows both SRC and SRS to 328 synchronize the states with a new metadata snapshot so that further 329 metadata incremental updates will be based on the latest metadata 330 snapshot. Similar to the metadata content, the metadata snapshot 331 request is transported as content in UPDATE or INVITE sent by the SRS 332 in the recording session. 334 SRC SRS 335 | | 336 |(1) INVITE (metadata snapshot) | 337 |---------------------------------------------------->| 338 | (2)200 OK | 339 |<----------------------------------------------------| 340 |(3) ACK | 341 |---------------------------------------------------->| 342 |(4) RTP | 343 |====================================================>| 344 |====================================================>| 345 |(5) UPDATE (metadata update 1) | 346 |---------------------------------------------------->| 347 | (6) 200 OK | 348 |<----------------------------------------------------| 349 |(7) UPDATE (metadata update 2) | 350 |---------------------------------------------------->| 351 | (8) 200 OK | 352 |<----------------------------------------------------| 353 | (9) UPDATE (metadata snapshot request) | 354 |<----------------------------------------------------| 355 | (10) 200 OK | 356 |---------------------------------------------------->| 357 | (11) INVITE (metadata snapshot 2 + SDP offer) | 358 |---------------------------------------------------->| 359 | (12) 200 OK (SDP answer) | 360 |<----------------------------------------------------| 361 | (13) UPDATE (metadata update 1 based on snapshot 2) | 362 |---------------------------------------------------->| 363 | (14) 200 OK | 364 |<----------------------------------------------------| 366 Figure 2: Delivering metadata via SIP UPDATE 368 5.3. Receiving recording indications and providing recording 369 preferences 371 The SRC is responsible to provide recording indications to the 372 participants in the CS. A recording-aware UA supports receiving 373 recording indications via the SDP attribute a=record, and it can 374 specify a recording preference in the CS by including the SDP 375 attribute a=recordpref. The recording attribute is a declaration by 376 the SRC in the CS to indicate whether recording is taking place. The 377 recording preference attribute is a declaration by the recording- 378 aware UA in the CS to indicate its recording preference. A UA that 379 does not want to be recorded may still be notified recording is 380 occurring for a number of reasons (e.g. it was not capable of 381 indicating its preference, its preference was ignored, etc.) If this 382 occurs, the UA's only mechanism to avoid being recorded is to 383 terminate its participation in the session. 385 To illustrate how the attributes are used, if a UA (A) is initiating 386 a call to UA (B) and UA (A) is also an SRC that is performing the 387 recording, then UA (A) provides the recording indication in the SDP 388 offer with a=record:on. Since UA (A) is the SRC, UA (A) receives the 389 recording indication from the SRC directly. When UA (B) receives the 390 SDP offer, UA (B) will see that recording is happening on the other 391 endpoint of this session. Since UA (B) is not an SRC and does not 392 provide any recording preference, the SDP answer does not contain 393 a=record nor a=recordpref. 395 UA A UA B 396 (SRC) | 397 | | 398 | [SRC recording starts] | 399 |(1) INVITE (SDP offer + a=record:on) | 400 |---------------------------------------------------->| 401 | (2) 200 OK (SDP answer) | 402 |<----------------------------------------------------| 403 |(3) ACK | 404 |---------------------------------------------------->| 405 |(4) RTP | 406 |<===================================================>| 407 | | 408 | [UA B wants to set preference to no recording] | 409 | (5) INVITE (SDP offer + a=recordpref:off) | 410 |<----------------------------------------------------| 411 | [SRC honors the preference and stops recording] | 412 |(6) 200 OK (SDP answer + a=record:off) | 413 |---------------------------------------------------->| 414 | (7) ACK | 415 |<----------------------------------------------------| 417 Figure 3: Recording indication and recording preference 419 After the call is established and recording is in progress, UA (B) 420 later decides to change the recording preference to no recording and 421 sends a reINVITE with the a=recordpref attribute. It is up to the 422 SRC to honor the preference, and in this case SRC decides to stop the 423 recording and updates the recording indication in the SDP answer. 425 6. SIP Handling 427 6.1. Procedures at the SRC 429 6.1.1. Initiating a Recording Session 431 A recording session is a SIP session with specific extensions 432 applied, and these extensions are listed in the procedures for SRC 433 and SRS below. When an SRC or an SRS receives a SIP session that is 434 not a recording session, it is up to the SRC or the SRS to determine 435 what to do with the SIP session. 437 The SRC can initiate a recording session by sending a SIP INVITE 438 request to the SRS. The SRC and the SRS are identified in the From 439 and To headers, respectively. 441 The SRC MUST include the '+sip.src' feature tag in the Contact URI, 442 defined in this specification as an extension to [RFC3840], for all 443 recording sessions. An SRS uses the presence of the '+sip.src' 444 feature tag in dialog creating and modifying requests and responses 445 to confirm that the dialog being created is for the purpose of a 446 Recording Session. In addition, when an SRC sends a REGISTER request 447 to a registrar, the SRC MAY include the '+sip.src' feature tag to 448 indicate the that it is an SRC. 450 Since SIP Caller Preferences extensions are optional to implement for 451 routing proxies, there is no guarantee that a recording session will 452 be routed to an SRC or SRS. A new options tag is introduced: 453 "siprec". As per [RFC3261], only an SRC or an SRS can accept this 454 option tag in a recording session. An SRC MUST include the "siprec" 455 option tag in the Require header when initiating a Recording Session 456 so that UA's which do not support the session recording protocol 457 extensions will simply reject the INVITE request with a 420 Bad 458 Extension. 460 When an SRC receives a new INVITE, the SRC MUST only consider the SIP 461 session as a recording session when both the '+sip.srs' feature tag 462 and 'siprec' option tag are included in the INVITE request. 464 6.1.2. SIP extensions for recording indication and preference 466 For the communication session, the SRC MUST provide recording 467 indication to all participants in the CS. A participant UA in a CS 468 can indicate that it is recording-aware by providing the "record- 469 aware" option tag, and the SRC MUST provide recording indications in 470 the new SDP a=record attribute described in the SDP Handling section. 471 In the absence of the "record-aware" option tag, meaning that the 472 participant UA is not recording-aware, an SRC MUST provide recording 473 indications through other means, such as playing a tone in-band, 474 having a signed participant contract in place, etc. 476 An SRC in the CS may also indicate itself as a session recording 477 client by including the '+sip.src' feature tag. A recording-aware 478 participant can learn that an SRC is in the CS, and can set the 479 recording preference for the CS with the new SDP a=recordpref 480 attribute described in the SDP Handling section below. 482 6.2. Procedures at the SRS 484 When an SRS receives a new INVITE, the SRS MUST only consider the SIP 485 session as a recording session when both the '+sip.src' feature tag 486 and 'siprec' option tag are included in the INVITE request. 488 The SRS can initiate a recording session by sending a SIP INVITE 489 request to the SRC. The SRS and the SRC are identified in the From 490 and To headers, respectively. 492 The SRS MUST include the '+sip.srs' feature tag in the Contact URI, 493 as per [RFC3840], for all recording sessions. An SRC uses the 494 presence of this feature tag in dialog creating and modifying 495 requests and responses to confirm that the dialog being created is 496 for the purpose of a Recording Session (REQ-30). In addition, when 497 an SRS sends a REGISTER request to a registrar, the SRS SHOULD 498 include the '+sip.srs' feature tag to indicate that it is an SRS. 500 An SRS MUST include the "siprec" option tag in the Require header as 501 per [RFC3261] when initiating a Recording Session so that UA's which 502 do not support the session recording protocol extensions will simply 503 reject the INVITE request with a 420 Bad Extension. 505 6.3. Procedures for Recording-aware User Agents 507 A recording-aware user agent is a participant in the CS that supports 508 the SIP and SDP extensions for receiving recording indication and for 509 requesting recording preferences for the call. A recording-aware UA 510 MUST indicate that it can accept reporting of recording indication 511 provided by the SRC with a new option tag "record-aware" when 512 initiating or establishing a CS, meaning including the "record-aware" 513 tag in the Supported header in the initial INVITE request or 514 response. 516 A recording-aware UA MUST provide a recording indication to the end 517 user through an appropriate user interface, indicating whether 518 recording is on, off, or paused for each medium. Appropriate user 519 interfaces may include real-time notification or previously 520 established agreements that use of the device is subject to 521 recording. Some user agents that are automatons (e.g. IVR, media 522 server, PSTN gateway) may not have a user interface to render 523 recording indication. When such user agent indicates recording 524 awareness, the UA SHOULD render recording indication through other 525 means, such as passing an in-band tone on the PSTN gateway, putting 526 the recording indication in a log file, or raising an application 527 event in a VoiceXML dialog. These user agents MAY also choose not to 528 indicate recording awareness, thereby relying on whatever mechanism 529 an SRC chooses to indicate recording, such as playing a tone in-band. 531 7. SDP Handling 533 7.1. Procedures at the SRC 535 The SRC and SRS follows the SDP offer/answer model in [RFC3264]. The 536 procedures for SRC and SRS describe the conventions used in a 537 recording session. 539 7.1.1. SDP handling in RS 541 Since the SRC does not expect to receive media from the SRS, the SRC 542 typically sets each media stream of the SDP offer to only send media, 543 by qualifying them with the a=sendonly attribute, according to the 544 procedures in [RFC3264]. 546 The SRC sends recorded streams of participants to the SRS, and the 547 SRC MUST provide a label attribute (a=label), as per [RFC4574], on 548 each media stream in order to identify the recorded stream with the 549 rest of the metadata. The a=label attribute identifies each recorded 550 media stream, and the label name is mapped to the Media Stream 551 Reference in the metadata as per [I-D.ietf-siprec-metadata]. The 552 scope of the a=label attribute only applies to the SDP and Metadata 553 conveyed in the bodies of the SIP request or response that the label 554 appeared in. Note that a recorded stream is distinct from a CS 555 stream; the metadata provides a list of participants that contributes 556 to each recorded stream. 558 The following is an example SDP offer from SRC with both audio and 559 video recorded streams. Note that the following example contains 560 unfolded lines longer than 72 characters. These are captured between 561 tags. 563 v=0 564 o=SRC 2890844526 2890844526 IN IP4 198.51.100.1 565 s=- 566 c=IN IP4 198.51.100.1 567 t=0 0 568 m=audio 12240 RTP/AVP 0 4 8 569 a=sendonly 570 a=label:1 571 m=video 22456 RTP/AVP 98 572 a=rtpmap:98 H264/90000 573 574 a=fmtp:98 profile-level-id=42A01E; 575 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 576 577 a=sendonly 578 a=label:2 579 m=audio 12242 RTP/AVP 0 4 8 580 a=sendonly 581 a=label:3 582 m=video 22458 RTP/AVP 98 583 a=rtpmap:98 H264/90000 584 585 a=fmtp:98 profile-level-id=42A01E; 586 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 587 588 a=sendonly 589 a=label:4 591 Figure 4: Sample SDP offer from SRC with audio and video streams 593 7.1.1.1. Handling media stream updates 595 Over the lifetime of a recording session, the SRC can add and remove 596 recorded streams from the recording session for various reasons. For 597 example, when a CS stream is added or removed from the CS, or when a 598 CS is created or terminated if a recording session handles multiple 599 CSes. To remove a recorded stream from the recording session, the 600 SRC sends a new SDP offer where the port of the media stream to be 601 removed is set to zero, according to the procedures in [RFC3264]. To 602 add a recorded stream to the recording session, the SRC sends a new 603 SDP offer by adding a new media stream description or by reusing an 604 old media stream which had been previously disabled, according to the 605 procedures in [RFC3264]. 607 The SRC can temporarily discontinue streaming and collection of 608 recorded media from the SRC to the SRS for reasons such as masking 609 the recording. In this case, the SRC sends a new SDP offer and sets 610 the media stream to inactive (a=inactive) for each recorded stream to 611 be paused, as per the procedures in [RFC3264]. To resume streaming 612 and collection of recorded media, the SRC sends a new SDP offer and 613 sets the media stream to sendonly (a=sendonly). Note that a CS 614 itself may change the media stream direction by updating the SDP, for 615 example, by setting a=inactive for SDP hold. Media stream direction 616 changes in CS are conveyed in the metadata by the SRC. When a CS 617 media stream is changed to/from inactive, the effect on the 618 corresponding RS media stream is governed by SRC policy. The SRC MAY 619 have a local policy to pause an RS media stream when the 620 corresponding CS media stream is inactive, or it MAY leave the RS 621 media stream as sendonly. 623 7.1.2. Recording indication in CS 625 While there are existing mechanisms for providing an indication that 626 a CS is being recorded, these mechanisms are usually delivered on the 627 CS media streams such as playing an in-band tone or an announcement 628 to the participants. A new 'record' SDP attribute is introduced to 629 allow the SRC to indicate recording state to a recording-aware UA in 630 CS. 632 The 'record' SDP attribute appears at the media level or session 633 level in either SDP offer or answer. When the attribute is applied 634 at the session level, the indication applies to all media streams in 635 the SDP. When the attribute is applied at the media level, the 636 indication applies to the media stream only, and that overrides the 637 indication if also set at the session level. Whenever the recording 638 indication needs to change, such as termination of recording, then 639 the SRC MUST initiate a reINVITE or UPDATE to update the SDP a=record 640 attribute. 642 The following is the ABNF of the 'record' attribute: 644 attribute =/ record-attr 645 ; attribute defined in RFC 4566 647 record-attr = "record:" indication 648 indication = "on" / "off" / "paused" 650 on: Recording is in progress. 652 off: No recording is in progress. 654 paused: Recording is in progress but media is paused. 656 7.1.3. Recording preference in CS 658 When the SRC receives the a=recordpref SDP in an SDP offer or answer, 659 the SRC chooses to honor the preference to record based on local 660 policy at the SRC. If the SRC makes a change in recording state, the 661 SRC MUST report the new recording state in the a=record attribute in 662 the SDP answer or in a subsequent SDP offer. 664 7.2. Procedures at the SRS 666 Typically the SRS only receives RTP streams from the SRC; therefore, 667 the SDP offer/answer from the SRS normally sets each media stream to 668 receive media, by setting them with the a=recvonly attribute, 669 according to the procedures of [RFC3264]. When the SRS is not ready 670 to receive a recorded stream, the SRS sets the media stream as 671 inactive in the SDP offer or answer by setting it with a=inactive 672 attribute, according to the procedures of [RFC3264]. When the SRS is 673 ready to receive recorded streams, the SRS sends a new SDP offer and 674 sets the media streams with a=recvonly attribute. 676 The following is an example of SDP answer from SRS for the SDP offer 677 from the above sample. Note that the following example contain 678 unfolded lines longer than 72 characters. These are captured between 679 tags. 681 v=0 682 o=SRS 0 0 IN IP4 198.51.100.20 683 s=- 684 c=IN IP4 198.51.100.20 685 t=0 0 686 m=audio 10000 RTP/AVP 0 687 a=recvonly 688 a=label:1 689 m=video 10002 RTP/AVP 98 690 a=rtpmap:98 H264/90000 691 692 a=fmtp:98 profile-level-id=42A01E; 693 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 694 695 a=recvonly 696 a=label:2 697 m=audio 10004 RTP/AVP 0 698 a=recvonly 699 a=label:3 700 m=video 10006 RTP/AVP 98 701 a=rtpmap:98 H264/90000 702 703 a=fmtp:98 profile-level-id=42A01E; 704 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 705 706 a=recvonly 707 a=label:4 709 Figure 5: Sample SDP answer from SRS with audio and video streams 711 Over the lifetime of a recording session, the SRS can remove recorded 712 streams from the recording session for various reasons. To remove a 713 recorded stream from the recording session, the SRS sends a new SDP 714 offer where the port of the media stream to be removed is set to 715 zero, according to the procedures in [RFC3264]. 717 The SRS MUST NOT add recorded streams in the recording session when 718 SRS sends a new SDP offer. Similarly, when the SRS starts a 719 recording session, the SRS MUST initiate the INVITE without an SDP 720 offer to let the SRC generate the SDP offer with recorded streams. 722 The following sequence diagram shows an example where the SRS is 723 initially not ready to receive recorded streams, and later updates 724 the recording session when the SRS is ready to record. 726 SRC SRS 727 | | 728 |(1) INVITE (SDP offer) | 729 |---------------------------------------------------->| 730 | [not ready to record] 731 | (2)200 OK with SDP inactive | 732 |<----------------------------------------------------| 733 |(3) ACK | 734 |---------------------------------------------------->| 735 | ... | 736 | [ready to record] 737 | (4) re-INVITE with SDP recvonly | 738 |<----------------------------------------------------| 739 |(5)200 OK with SDP sendonly | 740 |---------------------------------------------------->| 741 | (6) ACK | 742 |<----------------------------------------------------| 743 |(7) RTP | 744 |====================================================>| 745 | ... | 746 |(8) BYE | 747 |---------------------------------------------------->| 748 | (9) OK | 749 |<----------------------------------------------------| 751 Figure 6: SRS responding to offer with a=inactive 753 7.3. Procedures for Recording-aware User Agents 755 7.3.1. Recording indication 757 When a recording-aware UA receives an SDP offer or answer that 758 includes the a=record attribute, the UA MUST provide the recording 759 indication to the end user whether the recording is on, off, or 760 paused for each medium based on the most recently received a=record 761 SDP attribute for that medium. 763 When a CS is traversed through multiple UAs such as a B2BUA or a 764 conference focus, each UA involved in the CS that is aware that the 765 CS is being recorded MUST provide the recording indication through 766 the a=record attribute to all other parties in the CS. 768 It is possible that more than one SRC is in the call path of the same 769 CS, but the recording indication attribute does not provide any hint 770 as to which SRC or how many SRCs are recording. An endpoint knows 771 only that the call is being recorded. Furthermore, this attribute is 772 not used as a request for a specific SRC to start/stop recording. 774 7.3.2. Recording preference 776 A participant in a CS MAY set the recording preference in the CS to 777 be recorded or not recorded at session establishment or during the 778 session. A new 'recordpref' SDP attribute is introduced, and the 779 participant in CS may set this recording preference attribute in any 780 SDP offer/answer at session establishment time or during the session. 781 The SRC is not required to honor the recording preference from a 782 participant based on local policies at the SRC, and the participant 783 can learn the recording indication through the a=record SDP attribute 784 as described in the above section. 786 The SDP a=recordpref attribute can appear at the media level or 787 session level and can appear in an SDP offer or answer. When the 788 attribute is applied at the session level, the recording preference 789 applies to all media stream in the SDP. When the attribute is 790 applied at the media level, the recording preference applies to the 791 media stream only, and that overrides the recording preference if 792 also set at the session level. The user agent can change the 793 recording preference by changing the a=recordpref attribute in 794 subsequent SDP offer or answer. The absence of the a=recordpref 795 attribute in the SDP indicates that the UA has no recording 796 preference. 798 The following is the ABNF of the recordpref attribute: 800 attribute =/ recordpref-attr 801 ; attribute defined in RFC 4566 803 recordpref-attr = "a=recordpref:" pref 804 pref = "on" / "off" / "pause" / "nopreference" 806 on: Sets the preference to record if it has not already been 807 started. If the recording is currently paused, the preference is 808 to resume recording. 810 off: Sets the preference for no recording. If recording has already 811 been started, then the preference is to stop the recording. 813 pause: If the recording is currently in progress, sets the 814 preference to pause the recording. 816 nopreference: To indicate that the UA has no preference on 817 recording. 819 8. RTP Handling 821 This section provides recommendations and guidelines for RTP and RTCP 822 in the context of SIPREC. In order to communicate most effectively, 823 the Session Recording Client (SRC), the Session Recording Server 824 (SRS), and any Recording aware User Agents (UAs) should utilize the 825 mechanisms provided by RTP in a well-defined and predicable manner. 826 It is the goal of this document to make the reader aware of these 827 mechanisms and provide recommendations and guidelines. 829 8.1. RTP Mechanisms 831 This section briefly describes important RTP/RTCP constructs and 832 mechanisms that are particularly useful within the content of SIPREC. 834 8.1.1. RTCP 836 The RTP data transport is augmented by a control protocol (RTCP) to 837 allow monitoring of the data delivery. RTCP, as defined in 838 [RFC3550], is based on the periodic transmission of control packets 839 to all participants in the RTP session, using the same distribution 840 mechanism as the data packets. Support for RTCP is REQUIRED, per 841 [RFC3550], and it provides, among other things, the following 842 important functionality in relation to SIPREC: 844 1) Feedback on the quality of the data distribution 846 This feedback from the receivers may be used to diagnose faults in 847 the distribution. As such, RTCP is a well-defined and efficient 848 mechanism for the SRS to inform the SRC, and for the SRC to inform 849 Recording aware UAs, of issues that arise with respect to the 850 reception of media that is to be recorded. 852 2) Carries a persistent transport-level identifier for an RTP source 853 called the canonical name or CNAME 855 The SSRC identifier may change if a conflict is discovered or a 856 program is restarted; in which case receivers can use the CNAME to 857 keep track of each participant. Receivers may also use the CNAME to 858 associate multiple data streams from a given participant in a set of 859 related RTP sessions, for example to synchronize audio and video. 860 Synchronization of media streams is also facilitated by the NTP and 861 RTP timestamps included in RTCP packets by data senders. 863 8.1.2. RTP Profile 865 The RECOMMENDED RTP profiles for the SRC, SRS, and Recording aware 866 UAs are "Extended Secure RTP Profile for Real-time Transport Control 867 Protocol (RTCP)-Based Feedback (RTP/SAVPF)", [RFC5124] when using 868 encrypted RTP streams, and "Extended RTP Profile for Real-time 869 Transport Control Protocol (RTCP)-Based Feedback (RTP/AVPF)", 870 [RFC4585] when using non encrypted media streams. However, as these 871 are not requirements, some implementations may use "The Secure Real- 872 time Transport Protocol (SRTP)", [RFC3711] and "RTP Profile for Audio 873 and Video Conferences with Minimal Control", AVP [RFC3551]. 874 Therefore, it is RECOMMENDED that the SRC, SRS, and Recording aware 875 UAs not rely entirely on SAVPF or AVPF for core functionality that 876 may be at least partially achievable using SAVP and AVP. 878 AVPF and SAVPF provide an improved RTCP timer model that allows more 879 flexible transmission of RTCP packets in response to events, rather 880 than strictly according to bandwidth. AVPF based codec control 881 messages provide efficient mechanisms for an SRC, SRS, and Recording 882 aware UAs to handle events such as scene changes, error recovery, and 883 dynamic bandwidth adjustments. These messages are discussed in more 884 detail later in this document. 886 SAVP and SAVPF provide media encryption, integrity protection, replay 887 protection, and a limited form of source authentication. They do not 888 contain or require a specific keying mechanism. 890 8.1.3. SSRC 892 The synchronization source (SSRC), as defined in [RFC3550] is carried 893 in the RTP header and in various fields of RTCP packets. It is a 894 random 32-bit number that is required to be globally unique within an 895 RTP session. It is crucial that the number be chosen with care in 896 order that participants on the same network or starting at the same 897 time are not likely to choose the same number. Guidelines regarding 898 SSRC value selection and conflict resolution are provided in 899 [RFC3550]. 901 The SSRC may also be used to separate different sources of media 902 within a single RTP session. For this reason as well as for conflict 903 resolution, it is important that the SRC, SRS, and Recording aware 904 UAs handle changes in SSRC values and properly identify the reason of 905 the change. The CNAME values carried in RTCP facilitate this 906 identification. 908 8.1.4. CSRC 910 The contributing source (CSRC), as defined in [RFC3550], identifies 911 the source of a stream of RTP packets that has contributed to the 912 combined stream produced by an RTP mixer. The mixer inserts a list 913 of the SSRC identifiers of the sources that contributed to the 914 generation of a particular packet into the RTP header of that packet. 915 This list is called the CSRC list. It is RECOMMENDED that an SRC or 916 Recording aware UA, when acting as a mixer, sets the CSRC list 917 accordingly, and that the SRC and SRS interpret the CSRC list 918 appropriately when received. 920 8.1.5. SDES 922 The Source Description (SDES), as defined in [RFC3550], contains an 923 SSRC/CSRC identifier followed by a list of zero or more items, which 924 carry information about the SSRC/CSRC. End systems send one SDES 925 packet containing their own source identifier (the same as the SSRC 926 in the fixed RTP header). A mixer sends one SDES packet containing a 927 chunk for each contributing source from which it is receiving SDES 928 information, or multiple complete SDES packets if there are more than 929 31 such sources. 931 The ability to identify individual contributing sources is important 932 in the content of SIPREC. Metadata [I-D.ietf-siprec-metadata] 933 provides a mechanism to achieve this at the signaling level. SDES 934 provides a mechanism at the RTP level. 936 8.1.5.1. CNAME 938 The Canonical End-Point Identifier (CNAME), as defined in [RFC3550], 939 provides the binding from the SSRC identifier to an identifier for 940 the source (sender or receiver) that remains constant. It is 941 important the SRC and Recording aware UAs generate CNAMEs 942 appropriately and that the SRC and SRS interpret and use them for 943 this purpose. Guidelines for generating CNAME values are provided in 944 "Guidelines for Choosing RTP Control Protocol (RTCP) Canonical Names 945 (CNAMEs)" [RFC7022]. 947 8.1.6. Keepalive 949 It is anticipated that media streams in SIPREC may exist in an 950 inactive state for extended periods of times for any of a number of 951 valid reasons. In order for the bindings and any pinholes in NATs/ 952 firewalls to remain active during such intervals, it is RECOMMENDED 953 that the SRC, SRS, and Recording aware UAs follow the keep-alive 954 procedure recommended in "Application Mechanism for Keeping Alive the 955 NAT Mappings Associated to RTP/RTP Control Protocol (RTCP) Flows" 956 [RFC6263] for all RTP media streams. 958 8.1.7. RTCP Feedback Messages 960 "Codec Control Messages in the RTP Audio-Visual Profile with Feedback 961 (AVPF)" [RFC5104] specifies extensions to the messages defined in 962 AVPF [RFC4585]. Support for and proper usage of these messages is 963 important to SRC, SRS, and Recording aware UA implementations. Note 964 that these messages are applicable only when using the AVFP or SAVPF 965 RTP profiles 967 8.1.7.1. Full Intra Request 969 A Full Intra Request (FIR) Command, when received by the designated 970 media sender, requires that the media sender sends a Decoder Refresh 971 Point at the earliest opportunity. Using a decoder refresh point 972 implies refraining from using any picture sent prior to that point as 973 a reference for the encoding process of any subsequent picture sent 974 in the stream. 976 Decoder refresh points, especially Intra or IDR pictures for H.264 977 video codecs, are in general several times larger in size than 978 predicted pictures. Thus, in scenarios in which the available bit 979 rate is small, the use of a decoder refresh point implies a delay 980 that is significantly longer than the typical picture duration. 982 8.1.7.1.1. SIP INFO for FIR 984 "XML Schema for Media Control" [RFC5168] defines an Extensible Markup 985 Language (XML) Schema for video fast update. Implementations are 986 discouraged from using the method described except for backward 987 compatibility purposes. Implementations SHOULD use FIR messages 988 instead. 990 To make sure a common mechanism exists between the SRC and SRS, the 991 SRS MUST support both mechanisms (FIR and SIP INFO), using FIR when 992 negotiated successfully with the SRC, and using SIP INFO otherwise. 994 8.1.7.2. Picture Loss Indicator 996 Picture Loss Indication (PLI), as defined in [RFC4585], informs the 997 encoder of the loss of an undefined amount of coded video data 998 belonging to one or more pictures. [RFC4585] recommends using PLI 999 instead of FIR to recover from errors. FIR is appropriate only in 1000 situations where not sending a decoder refresh point would render the 1001 video unusable for the users. Examples where sending FIR is 1002 appropriate include a multipoint conference when a new user joins the 1003 conference and no regular decoder refresh point interval is 1004 established, and a video switching MCU that changes streams. 1006 Appropriate use of PLI and FIR is important to ensure with minimum 1007 overhead that the recorded video is usable (e.g. the necessary 1008 reference frames exist for a player to render the recorded video). 1010 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request 1012 A receiver, translator, or mixer uses the Temporary Maximum Media 1013 Stream Bit Rate Request (TMMBR) to request a sender to limit the 1014 maximum bit rate for a media stream to the provided value. 1015 Appropriate use of TMMBR facilitates rapid adaptation to changes in 1016 available bandwidth. 1018 8.1.7.3.1. Renegotiation of SDP bandwidth attribute 1020 If it is likely that the new value indicated by TMMBR will be valid 1021 for the remainder of the session, the TMMBR sender is expected to 1022 perform a renegotiation of the session upper limit using the session 1023 signaling protocol. Therefore for SIPREC, implementations are 1024 RECOMMENDED to use TMMBR for temporary changes, and renegotiation of 1025 bandwidth via SDP offer/answer for more permanent changes. 1027 8.1.8. Symmetric RTP/RTCP for Sending and Receiving 1029 Within an SDP offer/answer exchange, RTP entities choose the RTP and 1030 RTCP transport addresses (i.e., IP addresses and port numbers) on 1031 which to receive packets. When sending packets, the RTP entities may 1032 use the same source port or a different source port as those signaled 1033 for receiving packets. When the transport address used to send and 1034 receive RTP is the same, it is termed "symmetric RTP" [RFC4961]. 1035 Likewise, when the transport address used to send and receive RTCP is 1036 the same, it is termed "symmetric RTCP" [RFC4961]. 1038 When sending RTP, it is REQUIRED to use symmetric RTP. When sending 1039 RTCP, it is REQUIRED to use symmetric RTCP. Although an SRS will not 1040 normally send RTP, it will send RTCP as well as receive RTP and RTCP. 1041 Likewise, although an SRC will not normally receive RTP from the SRS, 1042 it will receive RTCP as well as send RTP and RTCP. 1044 Note: Symmetric RTP and symmetric RTCP are different from RTP/RTCP 1045 multiplexing [RFC5761]. 1047 8.2. Roles 1049 An SRC has the task of gathering media from the various UAs in one or 1050 more Communication Sessions (CSs) and forwarding the information to 1051 the SRS within the context of a corresponding Recording Session (RS). 1052 There are numerous ways in which an SRC may do this, including but 1053 not limited to, appearing as a UA within a CS, or as a B2BUA between 1054 UAs within a CS. 1056 (Recording Session) +---------+ 1057 +------------SIP------->| | 1058 | +------RTP/RTCP----->| SRS | 1059 | | +-- Metadata -->| | 1060 | | | +---------+ 1061 v v | 1062 +---------+ 1063 | SRC | 1064 |---------| (Communication Session) +---------+ 1065 | |<----------SIP---------->| | 1066 | UA-A | | UA-B | 1067 | |<-------RTP/RTCP-------->| | 1068 +---------+ +---------+ 1070 Figure 7: UA as SRC 1072 (Recording Session) +---------+ 1073 +------------SIP------->| | 1074 | +------RTP/RTCP----->| SRS | 1075 | | +-- Metadata -->| | 1076 | | | +---------+ 1077 v v | 1078 +---------+ 1079 | SRC | 1080 +---------+ |---------| +---------+ 1081 | |<----SIP----->| |<----SIP----->| | 1082 | UA-A | | B2BUA | | UA-B | 1083 | |<--RTP/RTCP-->| |<--RTP/RTCP-->| | 1084 +---------+ +---------+ +---------+ 1085 |_______________________________________________| 1086 (Communication Session) 1088 Figure 8: B2BUA as SRC 1090 The following subsections define a set of roles an SRC may choose to 1091 play based on its position with respect to a UA within a CS, and an 1092 SRS within an RS. A CS and a corresponding RS are independent 1093 sessions; therefore, an SRC may play a different role within a CS 1094 than it does within the corresponding RS. 1096 8.2.1. SRC acting as an RTP Translator 1098 The SRC may act as a translator, as defined in [RFC3550]. A defining 1099 characteristic of a translator is that it forwards RTP packets with 1100 their SSRC identifier intact. There are two types of translators, 1101 one that simply forwards, and another that performs transcoding 1102 (e.g., from one codec to another) in addition to forwarding. 1104 8.2.1.1. Forwarding Translator 1106 When acting as a forwarding translator, RTP received as separate 1107 streams from different sources (e.g., from different UAs with 1108 different SSRCs) cannot be mixed by the SRC and MUST be sent 1109 separately to the SRS. All RTCP reports MUST be passed by the SRC 1110 between the UAs and the SRS, such that the UAs and SRS are able to 1111 detect any SSRC collisions. 1113 RTCP Sender Reports generated by a UA sending a stream MUST be 1114 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1115 MUST be forwarded to the relevant UA. 1117 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1118 from other UAs participating in the CS, and one from the SRS 1119 participating in the RS. A UA SHOULD process the RTCP Receiver 1120 Reports from the SRS if it is recording-aware. 1122 If SRTP is used on both the CS and the RS, decryption and/or re- 1123 encryption may occur. For example, if different keys are used, it 1124 will occur. If the same keys are used, it need not occur. 1125 Section 12 provides additional information on SRTP and keying 1126 mechanisms. 1128 If packet loss occurs, either from the UA to the SRC or from the SRC 1129 to the SRS, the SRS SHOULD detect and attempt to recover from the 1130 loss. The SRC does not play a role in this other than forwarding the 1131 associated RTP and RTCP packets. 1133 8.2.1.2. Transcoding Translator 1135 When acting as a transcoding translator, an SRC MAY perform 1136 transcoding (e.g., from one codec to another), and this may result in 1137 a different rate of packets between what the SRC receives on the CS 1138 and what the SRC sends on the RS. As when acting as a forwarding 1139 translator, RTP received as separate streams from different sources 1140 (e.g., from different UAs with different SSRCs) cannot be mixed by 1141 the SRC and MUST be sent separately to the SRS. All RTCP reports 1142 MUST be passed by the SRC between the UAs and the SRS, such that the 1143 UAs and SRS are able to detect any SSRC collisions. 1145 RTCP Sender Reports generated by a UA sending a stream MUST be 1146 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1147 MUST be forwarded to the relevant UA. The SRC may need to manipulate 1148 the RTCP Receiver Reports to take account of any transcoding that has 1149 taken place. 1151 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1152 from other UAs participating in the CS, and one from the SRS 1153 participating in the RS. A Recording aware UA SHOULD be prepared to 1154 process the RTCP Receiver Reports from the SRS, whereas a recording 1155 unaware UA may discard such RTCP packets as not of relevance. 1157 If SRTP is used on both the CS and the RS, decryption and/or re- 1158 encryption may occur. For example, if different keys are used, it 1159 will occur. If the same keys are used, it need not occur. 1160 Section 12 provides additional information on SRTP and keying 1161 mechanisms. 1163 If packet loss occurs, either from the UA to the SRC or from the SRC 1164 to the SRS, the SRS SHOULD detect and attempt to recover from the 1165 loss. The SRC does not play a role in this other than forwarding the 1166 associated RTP and RTCP packets. 1168 8.2.2. SRC acting as an RTP Mixer 1170 In the case of the SRC acting as a RTP mixer, as defined in 1171 [RFC3550], the SRC combines RTP streams from different UAs and sends 1172 them towards the SRS using its own SSRC. The SSRCs from the 1173 contributing UA SHOULD be conveyed as CSRCs identifiers within this 1174 stream. The SRC may make timing adjustments among the received 1175 streams and generate its own timing on the stream sent to the SRS. 1176 Optionally an SRC acting as a mixer can perform transcoding, and can 1177 even cope with different codings received from different UAs. RTCP 1178 Sender Reports and Receiver Reports are not forwarded by an SRC 1179 acting as mixer, but there are requirements for forwarding RTCP 1180 Source Description (SDES) packets. The SRC generates its own RTCP 1181 Sender and Receiver reports toward the associated UAs and SRS. 1183 The use of SRTP between the SRC and the SRS for the RS is independent 1184 of the use of SRTP between the UAs and SRC for the CS. Section 12 1185 provides additional information on SRTP and keying mechanisms. 1187 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1188 and attempt to recover from the loss. If packet loss occurs from the 1189 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1190 loss. 1192 8.2.3. SRC acting as an RTP Endpoint 1194 The case of the SRC acting as an RTP endpoint, as defined in 1195 [RFC3550], is similar to the mixer case, except that the RTP session 1196 between the SRC and the SRS is considered completely independent from 1197 the RTP session that is part of the CS. The SRC can, but need not, 1198 mix RTP streams from different participants prior to sending to the 1199 SRS. RTCP between the SRC and the SRS is completely independent of 1200 RTCP on the CS. 1202 The use of SRTP between the SRC and the SRS for the RS is independent 1203 of the use of SRTP between the UAs and SRC for the CS. Section 12 1204 provides additional information on SRTP and keying mechanisms. 1206 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1207 and attempt to recover from the loss. If packet loss occurs from the 1208 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1209 loss. 1211 8.3. RTP Session Usage by SRC 1213 There are multiple ways that an SRC may choose to deliver recorded 1214 media to an SRS. In some cases, it may use a single RTP session for 1215 all media within the RS, whereas in others it may use multiple RTP 1216 sessions. The following subsections provide examples of basic RTP 1217 session usage by the SRC, including a discussion of how the RTP 1218 constructs and mechanisms covered previously are used. An SRC may 1219 choose to use one or more of the RTP session usages within a single 1220 RS. For the purpose of base interoperability between SRC and SRS, an 1221 SRC MUST support separate m-lines in SDP, one per CS media direction. 1222 The set of RTP session usages described is not meant to be 1223 exhaustive. 1225 8.3.1. SRC Using Multiple m-lines 1227 When using multiple m-lines, an SRC includes each m-line in an SDP 1228 offer to the SRS. The SDP answer from the SRS MUST include all 1229 m-lines, with any rejected m-lines indicated with a zero port, per 1230 [RFC3264]. Having received the answer, the SRC starts sending media 1231 to the SRS as indicated in the answer. Alternatively, if the SRC 1232 deems the level of support indicated in the answer to be 1233 unacceptable, it may initiate another SDP offer/answer exchange in 1234 which an alternative RTP session usage is negotiated. 1236 In order to preserve the mapping of media to participant within the 1237 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1238 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1239 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1240 SSRC within the RS. In doing so, the SRC may act as an RTP 1241 translator or as an RTP endpoint. 1243 The following figure illustrates a case in which each UA represents a 1244 participant contributing two RTP sessions (e.g. one for audio and one 1245 for video), each with a single SSRC. The SRC acts as an RTP 1246 translator and delivers the media to the SRS using four RTP sessions, 1247 each with a single SSRC. The CNAME and SSRC values used by the UAs 1248 within their media streams are preserved in the media streams from 1249 the SRC to the SRS. 1251 +---------+ 1252 +------------SSRC Aa--->| | 1253 | + --------SSRC Av--->| | 1254 | | +------SSRC Ba--->| SRS | 1255 | | | +---SSRC Bv--->| | 1256 | | | | +---------+ 1257 | | | | 1258 | | | | 1259 +---------+ +----------+ +---------+ 1260 | |---SSRC Aa-->| SRC |<--SSRC Ba---| | 1261 | UA-A | |(CNAME-A, | | UA-B | 1262 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1263 +---------+ +----------+ +---------+ 1265 Figure 9: SRC Using Multiple m-lines 1267 8.3.2. SRC Using Mixing 1269 When using mixing, the SRC combines RTP streams from different 1270 participants and sends them towards the SRS using its own SSRC. The 1271 SSRCs from the contributing participants SHOULD be conveyed as CSRCs 1272 identifiers. The SRC includes one m-line for each RTP session in an 1273 SDP offer to the SRS. The SDP answer from the SRS MUST include all 1274 m-lines, with any rejected m-lines indicated with the zero port, per 1275 [RFC3264]. Having received the answer, the SRC starts sending media 1276 to the SRS as indicated in the answer. 1278 In order to preserve the mapping of media to participant within the 1279 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1280 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1281 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1282 SSRC within the RS. The SRC MUST avoid SSRC collisions, rewriting 1283 SSRCs if necessary when used as CSRCs in the RS. In doing so, the 1284 SRC acts as an RTP mixer. 1286 In the event the SRS does not support this usage of CSRC values, it 1287 relies entirely on the SIPREC metadata to determine the participants 1288 included within each mixed stream. 1290 The following figure illustrates a case in which each UA represents a 1291 participant contributing two RTP sessions (e.g. one for audio and one 1292 for video), each with a single SSRC. The SRC acts as an RTP mixer 1293 and delivers the media to the SRS using two RTP sessions, mixing 1294 media from each participant into a single RTP session containing a 1295 single SSRC and two CSRCs. 1297 SSRC Sa +---------+ 1298 +-------CSRC Aa,Ba--->| | 1299 | | | 1300 | SSRC Sv | SRS | 1301 | +---CSRC Av,Bv--->| | 1302 | | +---------+ 1303 | | 1304 +----------+ 1305 +---------+ | SRC | +---------+ 1306 | |---SSRC Aa-->|(CNAME-S, |<--SSRC Ba---| | 1307 | UA-A | | CNAME-A, | | UA-B | 1308 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1309 +---------+ +----------+ +---------+ 1311 Figure 10: SRC Using Mixing 1313 8.4. RTP Session Usage by SRS 1315 An SRS that supports recording an audio CS MUST support SRC usage of 1316 separate audio m-lines in SDP, one per CS media direction. An SRS 1317 that supports recording a video CS MUST support SRC usage of separate 1318 video m-lines in SDP, one per CS media direction. Therefore, for an 1319 SRS supporting a typical audio call, the SRS has to support receiving 1320 at least two audio m-lines. For an SRS supporting a typical audio 1321 and video call, the SRS has to support receiving at least four total 1322 m-lines in the SDP, two audio m-lines and two video m-lines. 1324 These requirements allow an SRS to be implemented that supports video 1325 only, without requiring support for audio recording. They also allow 1326 an SRS to be implemented that supports recording only one direction 1327 of one stream in a CS; for example, an SRS designed to record 1328 security monitoring cameras that only send (not receive) video 1329 without any audio. These requirements were not written to prevent 1330 other modes being implemented and used, such as using a single m-line 1331 and mixing the separate audio streams together. Rather, the 1332 requirements were written to provide a common base mode to implement 1333 for the sake of interoperability. It is important to note that an 1334 SRS implementation supporting the common base may not record all 1335 media streams in a CS if a participant supports more than one m-line 1336 in a video call, such as one for camera and one for presentation. 1337 SRS implementations may support other modes as well, but have to at 1338 least support the ones above such that they interoperate in the 1339 common base mode for basic interoperability. 1341 9. Metadata 1343 Some metadata attributes are contained in SDP, and others are 1344 contained in a new content type "application/rs-metadata". The 1345 format of the metadata is described as part of the mechanism in 1346 [I-D.ietf-siprec-metadata]. A new "disposition-type" of Content- 1347 Disposition is defined for the purpose of carrying metadata. The 1348 value is "recording-session", which indicates the "application/rs- 1349 metadata" content contains metadata to be handled by the SRS. 1351 9.1. Procedures at the SRC 1353 The SRC MUST send metadata to the SRS in an RS. The SRC SHOULD send 1354 metadata as soon as it becomes available and whenever it changes. 1355 Cases in which an SRC may be justified in waiting temporarily before 1356 sending metadata include: 1358 o waiting for previous metadata exchange to complete (i.e. cannot 1359 send another SDP offer until previous offer/answer completes, and 1360 may prefer not to send an UPDATE during this time either). 1362 o constraining the signaling rate on the RS. 1364 o sending metadata when key events occur rather than for every event 1365 that has any impact on metadata. 1367 o desire to suppress certain metadata out of concern for privacy or 1368 perceived lack of need for it to be included in the recording. 1370 Metadata sent by the SRC is categorized as either a full metadata 1371 snapshot or a partial update. A full metadata snapshot describes all 1372 metadata associated with the RS. The SRC MAY send a full metadata 1373 snapshot at any time. The SRC MAY send a partial update only if a 1374 full metadata snapshot has been sent previously. 1376 The SRC MAY send metadata (either a full metadata snapshot or a 1377 partial update) in an INVITE request, an UPDATE request [RFC3311], or 1378 an 200 response to an offerless INVITE from the SRS. If the metadata 1379 contains a reference to any SDP labels, the request containing the 1380 metadata MUST also contain an SDP offer that defines those labels. 1382 When a SIP message contains both an SDP offer and metadata, the 1383 request body MUST have content type "multipart/mixed", with one 1384 subordinate body part containing the SDP offer and another containing 1385 the metadata. When a SIP message contains only an SDP offer or 1386 metadata, the "multipart/mixed" container is optional. 1388 The SRC SHOULD include a full metadata snapshot in the initial INVITE 1389 request establishing the RS. If metadata is not yet available (e.g 1390 an RS established in absence of a CS), the SRC SHOULD send a full 1391 metadata snapshot as soon as metadata becomes available. 1393 If the SRC receives a snapshot request from the SRS, it MUST 1394 immediately send a full metadata snapshot. 1396 The following is an example of a full metadata snapshot sent by the 1397 SRC in the initial INVITE request: 1399 INVITE sip:recorder@example.com SIP/2.0 1400 Via: SIP/2.0/TCP src.example.com;branch=z9hG4bKdf6b622b648d9 1401 From: ;tag=35e195d2-947d-4585-946f-09839247 1402 To: 1403 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1404 CSeq: 101 INVITE 1405 Max-Forwards: 70 1406 Require: siprec 1407 Accept: application/sdp, application/rs-metadata-request 1408 Contact: ;+sip.src 1409 Content-Type: multipart/mixed;boundary=foobar 1410 Content-Length: [length] 1412 --foobar 1413 Content-Type: application/sdp 1415 v=0 1416 o=SRS 2890844526 2890844526 IN IP4 198.51.100.1 1417 s=- 1418 c=IN IP4 198.51.100.1 1419 t=0 0 1420 m=audio 12240 RTP/AVP 0 4 8 1421 a=sendonly 1422 a=label:1 1424 --foobar 1425 Content-Type: application/rs-metadata 1426 Content-Disposition: recording-session 1428 [metadata content] 1430 Figure 11: Sample INVITE request for the recording session 1432 9.2. Procedures at the SRS 1434 The SRS receives metadata updates from the SRC in INVITE and UPDATE 1435 requests. Since the SRC can send partial updates based on the 1436 previous update, the SRS needs to keep track of the sequence of 1437 updates from the SRC. 1439 In the case of an internal failure at the SRS, the SRS may fail to 1440 recognize a partial update from the SRC. The SRS may be able to 1441 recover from the internal failure by requesting for a full metadata 1442 snapshot from the SRC. Certain errors, such as syntax errors or 1443 semantic errors in the metadata information, are likely caused by an 1444 error on the SRC side, and it is likely the same error will occur 1445 again even when a full metadata snapshot is requested. In order to 1446 avoid repeating the same error, the SRS can simply terminate the 1447 recording session when a syntax error or semantic error is detected 1448 in the metadata. 1450 The SRS MAY explicitly request a full metadata snapshot by sending an 1451 UPDATE request. This request MUST contain a body with content 1452 disposition type "recording-session", and MUST NOT contain an SDP 1453 body. The SRS MUST NOT request a full metadata snapshot in an UPDATE 1454 response or in any other SIP transaction. The format of the content 1455 is "application/rs-metadata-request", and the body format is a simple 1456 text-based format. The following shows an example: 1458 UPDATE sip:2000@src.exmaple.com SIP/2.0 1459 Via: SIP/2.0/UDP srs.example.com;branch=z9hG4bKdf6b622b648d9 1460 To: ;tag=35e195d2-947d-4585-946f-098392474 1461 From: ;tag=1234567890 1462 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1463 CSeq: 1 UPDATE 1464 Max-Forwards: 70 1465 Require: siprec 1466 Contact: ;+sip.srs 1467 Accept: application/sdp, application/rs-metadata 1468 Content-Disposition: recording-session 1469 Content-Type: application/rs-metadata-request 1470 Content-Length: [length] 1472 SRS internal error 1474 Figure 12: Metadata Request 1476 The SRS MAY include the reason why a metadata snapshot request is 1477 being made to the SRC in the reason line. This reason line is free 1478 form text, mainly designed for logging purposes on the SRC side. The 1479 processing of the content by the SRC is entirely optional since the 1480 content is for logging only, and the snapshot request itself is 1481 indicated by the use of the application/rs-metadata-request content 1482 type. 1484 When the SRC receives a request for a metadata snapshot, it MUST 1485 immediately provide a full metadata snapshot in a separate INVITE or 1486 UPDATE transaction. Any subsequent partial updates will not be 1487 dependent on any metadata sent prior to this full metadata snapshot. 1489 The metadata received by the SRS can contain ID elements used to 1490 cross reference one element to another. An element containing the 1491 definition of an ID, and an element containing a reference to that ID 1492 will often be received from the same SRC. It is also valid for those 1493 elements to be received from different SRCs, for example, when each 1494 endpoint in the same CS act as an SRC to record the call and a common 1495 ID refers to the same CS. The SRS MUST NOT consider this an error. 1497 9.2.1. Formal Syntax 1499 The formal syntax for the application/rs-metadata-request MIME is 1500 described below using the augmented Backus-Naur Form (BNF) as 1501 described in [RFC5234]. 1503 snapshot-request = srs-reason-line CRLF 1504 srs-reason-line = [TEXT-UTF8-TRIM] 1505 ; TEXT-UTF8-TRIM defined in RFC3261 1507 10. Persistent Recording 1509 Persistent recording is a specific use case outlined in REQ-005 or 1510 Use Case 4 in [RFC6341], where a recording session can be established 1511 in the absence of a communication session. The SRC continuously 1512 records media in a recording session to the SRS even in the absence 1513 of a CS for all user agents that are part of persistent recording. 1514 By allocating recorded streams and continuously sending recorded 1515 media to the SRS, the SRC does not have to prepare new recorded 1516 streams with new SDP offer when a new communication session is 1517 created and also does not impact the timing of the CS. The SRC only 1518 needs to update the metadata when new communication sessions are 1519 created. 1521 When there is no communication session running on the devices with 1522 persistent recording, there is no recorded media to stream from the 1523 SRC to the SRS. In certain environments where Network Address 1524 Translator (NAT) is used, typically a minimum of flow activity is 1525 required to maintain the NAT binding for each port opened. Agents 1526 that support Interactive Connectivity Establishment (ICE) solves this 1527 problem. For non-ICE agents, in order not to lose the NAT bindings 1528 for the RTP/RTCP ports opened for the recorded streams, the SRC and 1529 SRS SHOULD follow the recommendations provided in [RFC6263] to 1530 maintain the NAT bindings. 1532 11. IANA Considerations 1533 11.1. Registration of Option Tags 1535 This specification registers two option tags. The required 1536 information for this registration, as specified in [RFC3261], is as 1537 follows. 1539 11.1.1. siprec Option Tag 1541 Name: siprec 1543 Description: This option tag is for identifying the SIP session is 1544 for the purpose of a recording session. This is typically not 1545 used in a Supported header. When present in a Require header in a 1546 request, it indicates that the UAS is either an SRC or SRS capable 1547 of handling a recording session. 1549 11.1.2. record-aware Option Tag 1551 Name: record-aware 1553 Description: This option tag is to indicate the ability for the 1554 user agent to receive recording indicators in media level or 1555 session level SDP. When present in a Supported header, it 1556 indicates that the UA can receive recording indicators in media 1557 level or session level SDP. 1559 11.2. Registration of media feature tags 1561 This document registers two new media feature tags in the SIP tree 1562 per the process defined in [RFC2506] and [RFC3840] 1564 11.2.1. src feature tag 1566 Media feature tag name: sip.src 1568 ASN.1 Identifier: 25 1570 Summary of the media feature indicated by this tag: This feature 1571 tag indicates that the user agent is a Session Recording Client 1572 for the purpose for Recording Session. 1574 Values appropriate for use with this feature tag: boolean 1576 The feature tag is intended primarily for use in the following 1577 applications, protocols, services, or negotiation mechanisms: This 1578 feature tag is only useful for a Recording Session. 1580 Examples of typical use: Routing the request to a Session 1581 Recording Server. 1583 Security Considerations: Security considerations for this media 1584 feature tag are discussed in Section 11.1 of RFC 3840. 1586 11.2.2. srs feature tag 1588 Media feature tag name: sip.srs 1590 ASN.1 Identifier: 26 1592 Summary of the media feature indicated by this tag: This feature 1593 tag indicates that the user agent is a Session Recording Server 1594 for the purpose for Recording Session. 1596 Values appropriate for use with this feature tag: boolean 1598 The feature tag is intended primarily for use in the following 1599 applications, protocols, services, or negotiation mechanisms: This 1600 feature tag is only useful for a Recording Session. 1602 Examples of typical use: Routing the request to a Session 1603 Recording Client. 1605 Security Considerations: Security considerations for this media 1606 feature tag are discussed in Section 11.1 of RFC 3840. 1608 11.3. New Content-Disposition Parameter Registrations 1610 This document registers a new "disposition-type" value in Content- 1611 Disposition header: recording-session. 1613 recording-session: The body describes either: 1615 * metadata about the recording session 1617 * reason for metadata snapshot request 1619 as determined by the MIME value indicated in the Content-Type. 1621 11.4. Media Type Registration 1623 11.4.1. Registration of MIME Type application/rs-metadata-request 1625 This document registers the application/rs-metadata-request MIME 1626 media type in order to describe a recording session metadata snapshot 1627 request. This media type is defined by the following information: 1629 Media type name: application 1631 Media subtype name: rs-metadata-request 1633 Required parameters: none 1635 Options parameters: none 1637 11.5. SDP Attributes 1639 This document registers the following new SDP attributes. 1641 11.5.1. 'record' SDP Attribute 1643 Contact names: Leon Portman leon.portman@gmail.com, Henry Lum 1644 henry.lum@genesyslab.com 1646 Attribute name: record 1648 Long form attribute name: Recording Indication 1650 Type of attribute: session or media level 1652 Subject to charset: no 1654 This attribute provides the recording indication for the session or 1655 media stream. 1657 Allowed attribute values: on, off, paused 1659 11.5.2. 'recordpref' SDP Attribute 1661 Contact names: Leon Portman leon.portman@nice.com, Henry Lum 1662 henry.lum@genesyslab.com 1664 Attribute name: recordpref 1666 Long form attribute name: Recording Preference 1668 Type of attribute: session or media level 1670 Subject to charset: no 1672 This attribute provides the recording preference for the session or 1673 media stream. 1675 Allowed attribute values: on, off, pause, nopreference 1677 12. Security Considerations 1679 The recording session is fundamentally a standard SIP dialog 1680 [RFC3261], therefore, the recording session can reuse any of the 1681 existing SIP security mechanisms available for securing the session 1682 signaling, the recorded media, and the metadata. The use cases and 1683 requirements document [RFC6341] outlines the general security 1684 considerations, and this document describes specific security 1685 recommendations. 1687 The SRC and SRS MUST support SIP with TLS and MAY support SIPS with 1688 TLS as per [RFC5630]. The Recording Session SHOULD be at least as 1689 secure as the Communication Session, meaning using at least the same 1690 strength of cipher suite as the CS if the CS is secured. For 1691 example, if the CS uses SIPS for signaling and RTP/SAVP for media, 1692 then the RS should not downgrade the level of security in the RS to 1693 SIP or plain RTP since doing so will mean an automatic security 1694 downgrade for the CS. In deployments where the SRC and the SRS are 1695 in the same administrative domain and the same physical switch that 1696 prevents outside user access, some SRCs may choose to lower the level 1697 of security when establishing a recording session. While physically 1698 securing the SRC and SRS may prevent an outside attacker from 1699 accessing important call recordings, this still does not prevent an 1700 inside attacker from accessing the internal network to gain access to 1701 the call recordings. 1703 12.1. Authentication and Authorization 1705 At the transport level, the recording session uses TLS authentication 1706 to validate the authenticity of the SRC and SRS. The SRC and SRS 1707 MUST implement TLS mutual authentication for establishing the 1708 recording session. Whether the SRC/SRS chooses to use TLS mutual 1709 authentication is a deployment decision. In deployments where the 1710 SRC and the SRS are in the same administrative domain, the SRC and 1711 SRS may choose not to authenticate each other, or to have the SRC 1712 authenticate the SRS only, as there is an inherent trust relation 1713 between the SRC and the SRS when they are hosted in the same 1714 administrative domain. In deployments where the SRS can be hosted on 1715 a different administrative domain, it is important to perform mutual 1716 authentication to ensure the authenticity of both the SRC and the SRS 1717 before transmitting any recorded media. The risk of not 1718 authenticating the SRS is that the recording may be sent to a 1719 compromised SRS and that a sensitive call recording will be obtained 1720 by an attacker. On the other hand, the risk of not authenticating 1721 the SRC is that an SRS will accept calls from an unknown SRC and 1722 allow potential forgery of call recordings. 1724 There may be scenarios in which the signaling between the SRC and SRS 1725 is not direct, e.g. a SIP proxy exists between the SRC and the SRS. 1726 In such scenarios, each hop is subject to the TLS mutual 1727 authentication constraint and transitive trust at each hop is 1728 utilized. Additionally, an SRC or SRS may use other existing SIP 1729 mechanisms available, including but not limited to, Digest 1730 Authentication [RFC3261], Asserted Identity [RFC3325], and Connected 1731 Identity [RFC4916]. 1733 The SRS may have its own set of recording policies to authorize 1734 recording requests from the SRC. The use of recording policies is 1735 outside the scope of the Session Recording Protocol. 1737 12.2. RTP handling 1739 In many scenarios it will be critical for the media transported 1740 between the SRC and the SRS to be protected. Media encryption is an 1741 important element in the overall SIPREC solution; therefore the SRC 1742 and the SRS MUST support RTP/SAVP [RFC3711] and RTP/SAVPF [RFC5124]. 1743 RTP/SAVP and RTP/SAVPF provide media encryption, integrity 1744 protection, replay protection, and a limited form of source 1745 authentication. They do not contain or require a specific keying 1746 mechanism. At a minimum, the SRC and SRS MUST support the SDP 1747 Security Descriptions (SDES) key negotiation mechanism [RFC4568]. 1748 For cases in which DTLS-SRTP is used to encrypt a CS media stream, an 1749 SRC may use SRTP Encrypted Key Transport (EKT) 1750 [I-D.ietf-avt-srtp-ekt] in order to use SRTP-SDES in the RS without 1751 needing to re-encrypt the media. 1753 When RTP/SAVP or RTP/SAVPF is used, an SRC can choose to use the same 1754 or different keys in the RS than the ones used in the CS. Some SRCs 1755 are designed to simply replicate RTP packets from a CS media stream 1756 to the SRS, in which case the SRC will use the same key in the RS as 1757 used in the CS. In this case, the SRC MUST secure the SDP containing 1758 the keying material in the RS with at least the same level of 1759 security as in the CS. The risk of lowering the level of security in 1760 the RS is that it will effectively become a downgrade attack on the 1761 CS since the same key is used for both CS and RS. 1763 SRCs that decrypt an encrypted CS media stream and re-encrypt it when 1764 sending it to the SRS MUST use a different key for the RS media 1765 stream than what is used for the CS media stream, to ensure that it 1766 is not possible for someone who has the key for the CS media stream 1767 to access recorded data they are not authorized to access. 1769 12.3. Metadata 1771 Metadata contains sensitive information such as the address of record 1772 of the participants and other extension data placed by the SRC. It 1773 is essential to protect the content of the metadata in the RS. Since 1774 metadata is a content type transmitted in SIP signaling, metadata 1775 SHOULD be protected at the transport level by SIPS/TLS. 1777 12.4. Storage and playback 1779 While storage and playback of the call recording is beyond the scope 1780 of this document, it is worthwhile to mention here that it is also 1781 important for the recording storage and playback to provide a level 1782 of security that is comparable to the communication session. It 1783 would defeat the purpose of securing both the communication session 1784 and the recording session mentioned in the previous sections if the 1785 recording can be easily played back with a simple unsecured HTTP 1786 interface without any form of authentication or authorization. 1788 13. Acknowledgements 1790 We want to thank John Elwell, Paul Kyzivat, Partharsarathi R, Ram 1791 Mohan R, Hadriel Kaplan, Adam Roach, Miguel Garcia, Thomas Stach, 1792 Muthu Perumal, Dan Wing, and Magnus Westerlund for their valuable 1793 comments and inputs to this document. 1795 14. References 1797 14.1. Normative References 1799 [I-D.ietf-siprec-metadata] 1800 R, R., Ravindran, P., and P. Kyzivat, "Session Initiation 1801 Protocol (SIP) Recording Metadata", draft-ietf-siprec- 1802 metadata-17 (work in progress), February 2015. 1804 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1805 Requirement Levels", BCP 14, RFC 2119, March 1997. 1807 [RFC2506] Holtman, K., Mutz, A., and T. Hardie, "Media Feature Tag 1808 Registration Procedure", BCP 31, RFC 2506, March 1999. 1810 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 1811 A., Peterson, J., Sparks, R., Handley, M., and E. 1812 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 1813 June 2002. 1815 [RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model 1816 with Session Description Protocol (SDP)", RFC 3264, June 1817 2002. 1819 [RFC3840] Rosenberg, J., Schulzrinne, H., and P. Kyzivat, 1820 "Indicating User Agent Capabilities in the Session 1821 Initiation Protocol (SIP)", RFC 3840, August 2004. 1823 [RFC4574] Levin, O. and G. Camarillo, "The Session Description 1824 Protocol (SDP) Label Attribute", RFC 4574, August 2006. 1826 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 1827 Specifications: ABNF", STD 68, RFC 5234, January 2008. 1829 14.2. Informative References 1831 [I-D.ietf-avt-srtp-ekt] 1832 Wing, D., McGrew, D., and K. Fischer, "Encrypted Key 1833 Transport for Secure RTP", draft-ietf-avt-srtp-ekt-03 1834 (work in progress), October 2011. 1836 [RFC2804] IAB and IESG, "IETF Policy on Wiretapping", RFC 2804, May 1837 2000. 1839 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 1840 UPDATE Method", RFC 3311, October 2002. 1842 [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private 1843 Extensions to the Session Initiation Protocol (SIP) for 1844 Asserted Identity within Trusted Networks", RFC 3325, 1845 November 2002. 1847 [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. 1848 Jacobson, "RTP: A Transport Protocol for Real-Time 1849 Applications", STD 64, RFC 3550, July 2003. 1851 [RFC3551] Schulzrinne, H. and S. Casner, "RTP Profile for Audio and 1852 Video Conferences with Minimal Control", STD 65, RFC 3551, 1853 July 2003. 1855 [RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. 1856 Norrman, "The Secure Real-time Transport Protocol (SRTP)", 1857 RFC 3711, March 2004. 1859 [RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session 1860 Description Protocol (SDP) Security Descriptions for Media 1861 Streams", RFC 4568, July 2006. 1863 [RFC4585] Ott, J., Wenger, S., Sato, N., Burmeister, C., and J. Rey, 1864 "Extended RTP Profile for Real-time Transport Control 1865 Protocol (RTCP)-Based Feedback (RTP/AVPF)", RFC 4585, July 1866 2006. 1868 [RFC4916] Elwell, J., "Connected Identity in the Session Initiation 1869 Protocol (SIP)", RFC 4916, June 2007. 1871 [RFC4961] Wing, D., "Symmetric RTP / RTP Control Protocol (RTCP)", 1872 BCP 131, RFC 4961, July 2007. 1874 [RFC5104] Wenger, S., Chandra, U., Westerlund, M., and B. Burman, 1875 "Codec Control Messages in the RTP Audio-Visual Profile 1876 with Feedback (AVPF)", RFC 5104, February 2008. 1878 [RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for 1879 Real-time Transport Control Protocol (RTCP)-Based Feedback 1880 (RTP/SAVPF)", RFC 5124, February 2008. 1882 [RFC5168] Levin, O., Even, R., and P. Hagendorf, "XML Schema for 1883 Media Control", RFC 5168, March 2008. 1885 [RFC5630] Audet, F., "The Use of the SIPS URI Scheme in the Session 1886 Initiation Protocol (SIP)", RFC 5630, October 2009. 1888 [RFC5761] Perkins, C. and M. Westerlund, "Multiplexing RTP Data and 1889 Control Packets on a Single Port", RFC 5761, April 2010. 1891 [RFC6263] Marjou, X. and A. Sollaud, "Application Mechanism for 1892 Keeping Alive the NAT Mappings Associated with RTP / RTP 1893 Control Protocol (RTCP) Flows", RFC 6263, June 2011. 1895 [RFC6341] Rehor, K., Portman, L., Hutton, A., and R. Jain, "Use 1896 Cases and Requirements for SIP-Based Media Recording 1897 (SIPREC)", RFC 6341, August 2011. 1899 [RFC7022] Begen, A., Perkins, C., Wing, D., and E. Rescorla, 1900 "Guidelines for Choosing RTP Control Protocol (RTCP) 1901 Canonical Names (CNAMEs)", RFC 7022, September 2013. 1903 [RFC7245] Hutton, A., Portman, L., Jain, R., and K. Rehor, "An 1904 Architecture for Media Recording Using the Session 1905 Initiation Protocol", RFC 7245, May 2014. 1907 Authors' Addresses 1909 Leon Portman 1910 NICE Systems 1911 22 Zarhin Street 1912 P.O. Box 690 1913 Ra'anana 4310602 1914 Israel 1916 Email: leon.portman@gmail.com 1918 Henry Lum (editor) 1919 Genesys 1920 1380 Rodick Road, Suite 201 1921 Markham, Ontario L3R4G5 1922 Canada 1924 Email: henry.lum@genesyslab.com 1926 Charles Eckel 1927 Cisco 1928 170 West Tasman Drive 1929 San Jose, CA 95134 1930 United States 1932 Email: eckelcu@cisco.com 1934 Alan Johnston 1935 Avaya 1936 St. Louis, MO 63124 1938 Email: alan.b.johnston@gmail.com 1940 Andrew Hutton 1941 Unify 1942 Brickhill Street 1943 Milton Keynes MK15 0DJ 1944 United Kingdom 1946 Email: andrew.hutton@unify.com