idnits 2.17.1 draft-ietf-siprec-protocol-18.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (September 25, 2015) is 3135 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-22) exists of draft-ietf-siprec-metadata-18 ** Downref: Normative reference to an Informational RFC: RFC 7245 -- Obsolete informational reference (is this intentional?): RFC 7525 (Obsoleted by RFC 9325) Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPREC L. Portman 3 Internet-Draft NICE Systems 4 Intended status: Standards Track H. Lum, Ed. 5 Expires: March 28, 2016 Genesys 6 C. Eckel 7 Cisco 8 A. Johnston 9 Avaya 10 A. Hutton 11 Unify 12 September 25, 2015 14 Session Recording Protocol 15 draft-ietf-siprec-protocol-18 17 Abstract 19 This document specifies the use of the Session Initiation Protocol 20 (SIP), the Session Description Protocol (SDP), and the Real Time 21 Protocol (RTP) for delivering real-time media and metadata from a 22 Communication Session (CS) to a recording device. The Session 23 Recording Protocol specifies the use of SIP, SDP, and RTP to 24 establish a Recording Session (RS) between the Session Recording 25 Client (SRC), which is on the path of the CS, and a Session Recording 26 Server (SRS) at the recording device. This document considers only 27 active recording, where the SRC purposefully streams media to an SRS 28 and all participating user agents are notified of the recording. 29 Passive recording, where a recording device detects media directly 30 from the network (e.g., using port-mirroring techniques), is outside 31 the scope of this document. In addition, lawful intercept is outside 32 the scope of this document. 34 Status of This Memo 36 This Internet-Draft is submitted in full conformance with the 37 provisions of BCP 78 and BCP 79. 39 Internet-Drafts are working documents of the Internet Engineering 40 Task Force (IETF). Note that other groups may also distribute 41 working documents as Internet-Drafts. The list of current Internet- 42 Drafts is at http://datatracker.ietf.org/drafts/current/. 44 Internet-Drafts are draft documents valid for a maximum of six months 45 and may be updated, replaced, or obsoleted by other documents at any 46 time. It is inappropriate to use Internet-Drafts as reference 47 material or to cite them other than as "work in progress." 48 This Internet-Draft will expire on March 28, 2016. 50 Copyright Notice 52 Copyright (c) 2015 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the Simplified BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 68 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 69 3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 70 4. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 71 5. Overview of operations . . . . . . . . . . . . . . . . . . . 5 72 5.1. Delivering recorded media . . . . . . . . . . . . . . . . 5 73 5.2. Delivering recording metadata . . . . . . . . . . . . . . 8 74 5.3. Receiving recording indications and providing recording 75 preferences . . . . . . . . . . . . . . . . . . . . . . . 9 76 6. SIP Handling . . . . . . . . . . . . . . . . . . . . . . . . 11 77 6.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 11 78 6.1.1. Initiating a Recording Session . . . . . . . . . . . 11 79 6.1.2. SIP extensions for recording indication and 80 preference . . . . . . . . . . . . . . . . . . . . . 11 81 6.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 12 82 6.3. Procedures for Recording-aware User Agents . . . . . . . 12 83 7. SDP Handling . . . . . . . . . . . . . . . . . . . . . . . . 13 84 7.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 13 85 7.1.1. SDP handling in RS . . . . . . . . . . . . . . . . . 13 86 7.1.1.1. Handling media stream updates . . . . . . . . . . 14 87 7.1.2. Recording indication in CS . . . . . . . . . . . . . 15 88 7.1.3. Recording preference in CS . . . . . . . . . . . . . 16 89 7.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 16 90 7.3. Procedures for Recording-aware User Agents . . . . . . . 18 91 7.3.1. Recording indication . . . . . . . . . . . . . . . . 18 92 7.3.2. Recording preference . . . . . . . . . . . . . . . . 19 93 8. RTP Handling . . . . . . . . . . . . . . . . . . . . . . . . 20 94 8.1. RTP Mechanisms . . . . . . . . . . . . . . . . . . . . . 20 95 8.1.1. RTCP . . . . . . . . . . . . . . . . . . . . . . . . 20 96 8.1.2. RTP Profile . . . . . . . . . . . . . . . . . . . . . 21 97 8.1.3. SSRC . . . . . . . . . . . . . . . . . . . . . . . . 21 98 8.1.4. CSRC . . . . . . . . . . . . . . . . . . . . . . . . 22 99 8.1.5. SDES . . . . . . . . . . . . . . . . . . . . . . . . 22 100 8.1.5.1. CNAME . . . . . . . . . . . . . . . . . . . . . . 22 101 8.1.6. Keepalive . . . . . . . . . . . . . . . . . . . . . . 22 102 8.1.7. RTCP Feedback Messages . . . . . . . . . . . . . . . 23 103 8.1.7.1. Full Intra Request . . . . . . . . . . . . . . . 23 104 8.1.7.2. Picture Loss Indicator . . . . . . . . . . . . . 23 105 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request . 24 106 8.1.8. Symmetric RTP/RTCP for Sending and Receiving . . . . 24 107 8.2. Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 25 108 8.2.1. SRC acting as an RTP Translator . . . . . . . . . . . 26 109 8.2.1.1. Forwarding Translator . . . . . . . . . . . . . . 26 110 8.2.1.2. Transcoding Translator . . . . . . . . . . . . . 26 111 8.2.2. SRC acting as an RTP Mixer . . . . . . . . . . . . . 27 112 8.2.3. SRC acting as an RTP Endpoint . . . . . . . . . . . . 28 113 8.3. RTP Session Usage by SRC . . . . . . . . . . . . . . . . 28 114 8.3.1. SRC Using Multiple m-lines . . . . . . . . . . . . . 28 115 8.3.2. SRC Using Mixing . . . . . . . . . . . . . . . . . . 29 116 8.4. RTP Session Usage by SRS . . . . . . . . . . . . . . . . 30 117 9. Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . 31 118 9.1. Procedures at the SRC . . . . . . . . . . . . . . . . . . 31 119 9.2. Procedures at the SRS . . . . . . . . . . . . . . . . . . 33 120 10. Persistent Recording . . . . . . . . . . . . . . . . . . . . 35 121 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35 122 11.1. Registration of Option Tags . . . . . . . . . . . . . . 35 123 11.1.1. siprec Option Tag . . . . . . . . . . . . . . . . . 35 124 11.1.2. record-aware Option Tag . . . . . . . . . . . . . . 36 125 11.2. Registration of media feature tags . . . . . . . . . . . 36 126 11.2.1. src feature tag . . . . . . . . . . . . . . . . . . 36 127 11.2.2. srs feature tag . . . . . . . . . . . . . . . . . . 36 128 11.3. New Content-Disposition Parameter Registrations . . . . 37 129 11.4. Media Type Registration . . . . . . . . . . . . . . . . 37 130 11.5. SDP Attributes . . . . . . . . . . . . . . . . . . . . . 37 131 11.5.1. 'record' SDP Attribute . . . . . . . . . . . . . . . 37 132 11.5.2. 'recordpref' SDP Attribute . . . . . . . . . . . . . 38 133 12. Security Considerations . . . . . . . . . . . . . . . . . . . 38 134 12.1. Authentication and Authorization . . . . . . . . . . . . 39 135 12.2. RTP handling . . . . . . . . . . . . . . . . . . . . . . 39 136 12.3. Metadata . . . . . . . . . . . . . . . . . . . . . . . . 40 137 12.4. Storage and playback . . . . . . . . . . . . . . . . . . 40 138 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 41 139 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 41 140 14.1. Normative References . . . . . . . . . . . . . . . . . . 41 141 14.2. Informative References . . . . . . . . . . . . . . . . . 42 142 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 44 144 1. Introduction 146 This document specifies the mechanism to record a Communication 147 Session (CS) by delivering real-time media and metadata from the CS 148 to a recording device. In accordance with the architecture 149 [RFC7245], the Session Recording Protocol specifies the use of SIP, 150 SDP, and RTP to establish a Recording Session (RS) between the 151 Session Recording Client (SRC), which is on the path of the CS, and a 152 Session Recording Server (SRS) at the recording device. SIP is also 153 used to deliver metadata to the recording device, as specified in 154 [I-D.ietf-siprec-metadata]. Metadata is information that describes 155 recorded media and the CS to which they relate. The Session 156 Recording Protocol intends to satisfy the SIP-based Media Recording 157 requirements listed in [RFC6341]. In addition to the Session 158 Recording Protocol, this document specifies extensions for user 159 agents that are participants in a CS to receive recording indications 160 and to provide preferences for recording. 162 This document considers only active recording, where the SRC 163 purposefully streams media to an SRS and all participating user 164 agents are notified of the recording. Passive recording, where a 165 recording device detects media directly from the network (e.g., using 166 port-mirroring techniques), is outside the scope of this document. 167 In addition, lawful intercept is outside the scope of this document, 168 in accordance with [RFC2804]. 170 2. Terminology 172 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 173 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 174 document are to be interpreted as described in [RFC2119]. 176 3. Definitions 178 This document refers to the core definitions provided in the 179 architecture document [RFC7245]. 181 The RTP Handling section uses the definitions provided in "RTP: A 182 Transport Protocol for Real-Time Application" [RFC3550]. 184 4. Scope 186 The scope of the Session Recording Protocol includes the 187 establishment of the recording sessions and the reporting of the 188 metadata. The scope also includes extensions supported by User 189 Agents participating in the CS such as indication of recording. The 190 user agents need not be recording-aware in order to participate in a 191 CS being recorded. 193 The following items, which are not an exhaustive list, do not 194 represent the protocol itself and are considered out of the scope of 195 the Session Recording Protocol: 197 o Delivering recorded media in real-time as the CS media 199 o Specifications of criteria to select a specific CS to be recorded 200 or triggers to record a certain CS in the future 202 o Recording policies that determine whether the CS should be 203 recorded and whether parts of the CS are to be recorded 205 o Retention policies that determine how long a recording is stored 207 o Searching and accessing the recorded media and metadata 209 o Policies governing how CS users are made aware of recording 211 o Delivering additional recording session metadata through a non-SIP 212 mechanism 214 5. Overview of operations 216 This section is informative and provides a description of recording 217 operations. 219 Section 6 describes the SIP communication in a recording session 220 between an SRC and an SRS, and the procedures for recording-aware 221 user agents participating in a CS. Section 7 describes the SDP in a 222 recording session, and the procedures for recording indications and 223 recording preferences. Section 8 describes the RTP handling in a 224 recording session. Section 9 describes the mechanism to deliver 225 recording metadata from the SRC to the SRS. 227 As mentioned in the architecture document [RFC7245], there are a 228 number of types of call flows based on the location of the Session 229 Recording Client. The following sample call flows provide a quick 230 overview of the operations between the SRC and the SRS. 232 5.1. Delivering recorded media 234 When a SIP Back-to-Back User Agent (B2BUA) with SRC functionality 235 routes a call from UA(A) to UA(B), the SRC has access to the media 236 path between the user agents. When the SRC is aware that it should 237 be recording the conversation, the SRC can cause the B2BUA to relay 238 the media between UA(A) and UA(B). The SRC then establishes the 239 Recording Session with the SRS and sends replicated media towards the 240 SRS. 242 An endpoint may also have SRC functionality, where the endpoint 243 itself establishes the Recording Session to the SRS. Since the 244 endpoint has access to the media in the Communication Session, the 245 endpoint can send replicated media towards the SRS. 247 The following example call flows shows an SRC establishing a 248 recording session towards an SRS. The first call flow illustrates 249 UA(A) acting as the SRC. The second illustrates a B2BUA acting as 250 the SRC. Note that the SRC can choose when to establish the 251 Recording Session independent of the Communication Session, even 252 though the following call flows suggest that the SRC is establishing 253 the Recording Session (message #5) after the Communication Session is 254 established. 256 UA A/SRC UA B SRS 257 |(1)CS INVITE | | 258 |---------------------->| | 259 | (2) 200 OK | | 260 |<----------------------| | 261 | | | 262 |(3)RS INVITE with SDP | | 263 |--------------------------------------------->| 264 | | (4) 200 OK with SDP | 265 |<---------------------------------------------| 266 |(5)CS RTP | | 267 |======================>| | 268 |<======================| | 269 |(6)RS RTP | | 270 |=============================================>| 271 |=============================================>| 272 | | | 273 |(7)CS BYE | | 274 |---------------------->| | 275 |(8)RS BYE | | 276 |--------------------------------------------->| 277 | | | 279 Figure 1: Basic recording call flow with UA as SRC 281 UA A SRC UA B SRS 282 |(1)CS INVITE | | | 283 |------------->| | | 284 | |(2)CS INVITE | | 285 | |---------------------->| | 286 | | (3) 200 OK | | 287 | |<----------------------| | 288 | (4) 200 OK | | | 289 |<-------------| | | 290 | |(5)RS INVITE with SDP | | 291 | |--------------------------------------------->| 292 | | | (6) 200 OK with SDP | 293 | |<---------------------------------------------| 294 |(7)CS RTP | | | 295 |=============>|======================>| | 296 |<=============|<======================| | 297 | |(8)RS RTP | | 298 | |=============================================>| 299 | |=============================================>| 300 |(9)CS BYE | | | 301 |------------->| | | 302 | |(10)CS BYE | | 303 | |---------------------->| | 304 | |(11)RS BYE | | 305 | |--------------------------------------------->| 306 | | | | 308 Figure 2: Basic recording call flow with B2BUA as SRC 310 The above call flow can also apply to the case of a centralized 311 conference with a mixer. For clarity, ACKs to INVITEs and 200 OKs to 312 BYEs are not shown. The conference focus can provide the SRC 313 functionality since the conference focus has access to all the media 314 from each conference participant. When a recording is requested, the 315 SRC delivers the metadata and the media streams to the SRS. Since 316 the conference focus has access to a mixer, the SRC may choose to mix 317 the media streams from all participants as a single mixed media 318 stream towards the SRS. 320 An SRC can use a single recording session to record multiple 321 communication sessions. Every time the SRC wants to record a new 322 call, the SRC updates the recording session with a new SDP offer to 323 add new recorded streams to the recording session, and 324 correspondingly also update the metadata for the new call. 326 An SRS can also establish a recording session to an SRC, although it 327 is beyond the scope of this document to define how an SRS would 328 specify which calls to record. 330 5.2. Delivering recording metadata 332 The SRC is responsible for the delivery of metadata to the SRS. The 333 SRC may provide an initial metadata snapshot about recorded media 334 streams in the initial INVITE content in the recording session. 335 Subsequent metadata updates can be represented as a stream of events 336 in UPDATE [RFC3311] or reINVITE requests sent by the SRC. These 337 metadata updates are normally incremental updates to the initial 338 metadata snapshot to optimize on the size of updates. However, the 339 SRC may also decide to send a new metadata snapshot any time. 341 Metadata is transported in the body of INVITE or UPDATE messages. 342 Certain metadata, such as the attributes of the recorded media 343 stream, are located in the SDP of the recording session. 345 The SRS has the ability to send a request to the SRC to request for a 346 new metadata snapshot update from the SRC. This can happen when the 347 SRS fails to understand the current stream of incremental updates for 348 whatever reason, for example, when the SRS loses the current state 349 due to internal failure. The SRS may optionally attach a reason 350 along with the snapshot request. This request allows both SRC and 351 SRS to synchronize the states with a new metadata snapshot so that 352 further metadata incremental updates will be based on the latest 353 metadata snapshot. Similar to the metadata content, the metadata 354 snapshot request is transported as content in UPDATE or INVITE sent 355 by the SRS in the recording session. 357 SRC SRS 358 | | 359 |(1) INVITE (metadata snapshot 1) | 360 |---------------------------------------------------->| 361 | (2)200 OK | 362 |<----------------------------------------------------| 363 |(3) ACK | 364 |---------------------------------------------------->| 365 |(4) RTP | 366 |====================================================>| 367 |====================================================>| 368 |(5) UPDATE (metadata update 1) | 369 |---------------------------------------------------->| 370 | (6) 200 OK | 371 |<----------------------------------------------------| 372 |(7) UPDATE (metadata update 2) | 373 |---------------------------------------------------->| 374 | (8) 200 OK | 375 |<----------------------------------------------------| 376 | (9) UPDATE (metadata snapshot request) | 377 |<----------------------------------------------------| 378 | (10) 200 OK | 379 |---------------------------------------------------->| 380 | (11) INVITE (metadata snapshot 2 + SDP offer) | 381 |---------------------------------------------------->| 382 | (12) 200 OK (SDP answer) | 383 |<----------------------------------------------------| 384 | (13) UPDATE (metadata update 1 based on snapshot 2) | 385 |---------------------------------------------------->| 386 | (14) 200 OK | 387 |<----------------------------------------------------| 389 Figure 3: Delivering metadata via SIP UPDATE 391 5.3. Receiving recording indications and providing recording 392 preferences 394 The SRC is responsible to provide recording indications to the 395 participants in the CS. A recording-aware UA supports receiving 396 recording indications via the SDP attribute a=record, and it can 397 specify a recording preference in the CS by including the SDP 398 attribute a=recordpref. The recording attribute is a declaration by 399 the SRC in the CS to indicate whether recording is taking place. The 400 recording preference attribute is a declaration by the recording- 401 aware UA in the CS to indicate its recording preference. A UA that 402 does not want to be recorded may still be notified recording is 403 occurring for a number of reasons (e.g., it was not capable of 404 indicating its preference, its preference was ignored, etc.) If this 405 occurs, the UA's only mechanism to avoid being recorded is to 406 terminate its participation in the session. 408 To illustrate how the attributes are used, if a UA (A) is initiating 409 a call to UA (B) and UA (A) is also an SRC that is performing the 410 recording, then UA (A) provides the recording indication in the SDP 411 offer with a=record:on. Since UA (A) is the SRC, UA (A) receives the 412 recording indication from the SRC directly. When UA (B) receives the 413 SDP offer, UA (B) will see that recording is happening on the other 414 endpoint of this session. Since UA (B) is not an SRC and does not 415 provide any recording preference, the SDP answer does not contain 416 a=record nor a=recordpref. 418 UA A UA B 419 (SRC) | 420 | | 421 | [SRC recording starts] | 422 |(1) INVITE (SDP offer + a=record:on) | 423 |---------------------------------------------------->| 424 | (2) 200 OK (SDP answer) | 425 |<----------------------------------------------------| 426 |(3) ACK | 427 |---------------------------------------------------->| 428 |(4) RTP | 429 |<===================================================>| 430 | | 431 | [UA B wants to set preference to no recording] | 432 | (5) INVITE (SDP offer + a=recordpref:off) | 433 |<----------------------------------------------------| 434 | [SRC honors the preference and stops recording] | 435 |(6) 200 OK (SDP answer + a=record:off) | 436 |---------------------------------------------------->| 437 | (7) ACK | 438 |<----------------------------------------------------| 440 Figure 4: Recording indication and recording preference 442 After the call is established and recording is in progress, UA (B) 443 later decides to change the recording preference to no recording and 444 sends a reINVITE with the a=recordpref attribute. It is up to the 445 SRC to honor the preference, and in this case SRC decides to stop the 446 recording and updates the recording indication in the SDP answer. 448 Note that UA (B) could have explicitly indicated a recording 449 preference in (2), the 200 OK for the original INVITE. Indicating a 450 preference of no recording in an initial INVITE or an initial 451 response to an INVITE may reduce the chance of a user being recorded 452 in the first place. 454 6. SIP Handling 456 6.1. Procedures at the SRC 458 6.1.1. Initiating a Recording Session 460 A recording session is a SIP session with specific extensions 461 applied, and these extensions are listed in the procedures for SRC 462 and SRS below. When an SRC or an SRS receives a SIP session that is 463 not a recording session, it is up to the SRC or the SRS to determine 464 what to do with the SIP session. 466 The SRC can initiate a recording session by sending a SIP INVITE 467 request to the SRS. The SRC and the SRS are identified in the From 468 and To headers, respectively. 470 The SRC MUST include the '+sip.src' feature tag in the Contact URI, 471 defined in this specification as an extension to [RFC3840], for all 472 recording sessions. An SRS uses the presence of the '+sip.src' 473 feature tag in dialog creating and modifying requests and responses 474 to confirm that the dialog being created is for the purpose of a 475 Recording Session. In addition, when an SRC sends a REGISTER request 476 to a registrar, the SRC MAY include the '+sip.src' feature tag to 477 indicate the that it is an SRC. 479 Since SIP Caller Preferences extensions are optional to implement for 480 routing proxies, there is no guarantee that a recording session will 481 be routed to an SRC or SRS. A new options tag is introduced: 482 "siprec". As per [RFC3261], only an SRC or an SRS can accept this 483 option tag in a recording session. An SRC MUST include the "siprec" 484 option tag in the Require header when initiating a Recording Session 485 so that UA's which do not support the session recording protocol 486 extensions will simply reject the INVITE request with a 420 Bad 487 Extension. 489 When an SRC receives a new INVITE, the SRC MUST only consider the SIP 490 session as a recording session when both the '+sip.srs' feature tag 491 and 'siprec' option tag are included in the INVITE request. 493 6.1.2. SIP extensions for recording indication and preference 495 For the communication session, the SRC MUST provide recording 496 indications to all participants in the CS. A participant UA in a CS 497 can indicate that it is recording-aware by providing the "record- 498 aware" option tag, and the SRC MUST provide recording indications in 499 the new SDP a=record attribute described in the SDP Handling section. 500 In the absence of the "record-aware" option tag, meaning that the 501 participant UA is not recording-aware, an SRC MUST provide recording 502 indications through other means, such as playing a tone in-band, 503 having a signed participant contract in place, etc. 505 An SRC in the CS may also indicate itself as a session recording 506 client by including the '+sip.src' feature tag. A recording-aware 507 participant can learn that an SRC is in the CS, and can set the 508 recording preference for the CS with the new SDP a=recordpref 509 attribute described in the SDP Handling section below. 511 6.2. Procedures at the SRS 513 When an SRS receives a new INVITE, the SRS MUST only consider the SIP 514 session as a recording session when both the '+sip.src' feature tag 515 and 'siprec' option tag are included in the INVITE request. 517 The SRS can initiate a recording session by sending a SIP INVITE 518 request to the SRC. The SRS and the SRC are identified in the From 519 and To headers, respectively. 521 The SRS MUST include the '+sip.srs' feature tag in the Contact URI, 522 as per [RFC3840], for all recording sessions. An SRC uses the 523 presence of this feature tag in dialog creating and modifying 524 requests and responses to confirm that the dialog being created is 525 for the purpose of a Recording Session (REQ-30). In addition, when 526 an SRS sends a REGISTER request to a registrar, the SRS SHOULD 527 include the '+sip.srs' feature tag to indicate that it is an SRS. 529 An SRS MUST include the "siprec" option tag in the Require header as 530 per [RFC3261] when initiating a Recording Session so that UA's which 531 do not support the session recording protocol extensions will simply 532 reject the INVITE request with a 420 Bad Extension. 534 6.3. Procedures for Recording-aware User Agents 536 A recording-aware user agent is a participant in the CS that supports 537 the SIP and SDP extensions for receiving recording indications and 538 for requesting recording preferences for the call. A recording-aware 539 UA MUST indicate that it can accept reporting of recording indication 540 provided by the SRC with a new option tag "record-aware" when 541 initiating or establishing a CS, meaning including the "record-aware" 542 tag in the Supported header in the initial INVITE request or 543 response. 545 A recording-aware UA MUST provide a recording indication to the end 546 user through an appropriate user interface, indicating whether 547 recording is on, off, or paused for each medium. Appropriate user 548 interfaces may include real-time notification or previously 549 established agreements that use of the device is subject to 550 recording. Some user agents that are automatons (e.g., IVR, media 551 server, PSTN gateway) may not have a user interface to render 552 recording indication. When such a user agent indicates recording 553 awareness, the UA SHOULD render recording indication through other 554 means, such as passing an in-band tone on the PSTN gateway, putting 555 the recording indication in a log file, or raising an application 556 event in a VoiceXML dialog. These user agents MAY also choose not to 557 indicate recording awareness, thereby relying on whatever mechanism 558 an SRC chooses to indicate recording, such as playing a tone in-band. 560 7. SDP Handling 562 7.1. Procedures at the SRC 564 The SRC and SRS follows the SDP offer/answer model in [RFC3264]. The 565 procedures for SRC and SRS describe the conventions used in a 566 recording session. 568 7.1.1. SDP handling in RS 570 Since the SRC does not expect to receive media from the SRS, the SRC 571 typically sets each media stream of the SDP offer to only send media, 572 by qualifying them with the a=sendonly attribute, according to the 573 procedures in [RFC3264]. 575 The SRC sends recorded streams of participants to the SRS, and the 576 SRC MUST provide a label attribute (a=label), as per [RFC4574], on 577 each media stream in order to identify the recorded stream with the 578 rest of the metadata. The a=label attribute identifies each recorded 579 media stream, and the label name is mapped to the Media Stream 580 Reference in the metadata as per [I-D.ietf-siprec-metadata]. The 581 scope of the a=label attribute only applies to the SDP and Metadata 582 conveyed in the bodies of the SIP request or response that the label 583 appeared in. Note that a recorded stream is distinct from a CS 584 stream; the metadata provides a list of participants that contribute 585 to each recorded stream. 587 The following is an example SDP offer from an SRC with both audio and 588 video recorded streams. Note that the following example contains 589 unfolded lines longer than 72 characters. These are captured between 590 tags. 592 v=0 593 o=SRC 2890844526 2890844526 IN IP4 198.51.100.1 594 s=- 595 c=IN IP4 198.51.100.1 596 t=0 0 597 m=audio 12240 RTP/AVP 0 4 8 598 a=sendonly 599 a=label:1 600 m=video 22456 RTP/AVP 98 601 a=rtpmap:98 H264/90000 602 603 a=fmtp:98 profile-level-id=42A01E; 604 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 605 606 a=sendonly 607 a=label:2 608 m=audio 12242 RTP/AVP 0 4 8 609 a=sendonly 610 a=label:3 611 m=video 22458 RTP/AVP 98 612 a=rtpmap:98 H264/90000 613 614 a=fmtp:98 profile-level-id=42A01E; 615 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 616 617 a=sendonly 618 a=label:4 620 Figure 5: Sample SDP offer from SRC with audio and video streams 622 7.1.1.1. Handling media stream updates 624 Over the lifetime of a recording session, the SRC can add and remove 625 recorded streams from the recording session for various reasons. For 626 example, when a CS stream is added or removed from the CS, or when a 627 CS is created or terminated if a recording session handles multiple 628 CSes. To remove a recorded stream from the recording session, the 629 SRC sends a new SDP offer where the port of the media stream to be 630 removed is set to zero, according to the procedures in [RFC3264]. To 631 add a recorded stream to the recording session, the SRC sends a new 632 SDP offer by adding a new media stream description or by reusing an 633 old media stream which had been previously disabled, according to the 634 procedures in [RFC3264]. 636 The SRC can temporarily discontinue streaming and collection of 637 recorded media from the SRC to the SRS for reasons such as masking 638 the recording. In this case, the SRC sends a new SDP offer and sets 639 the media stream to inactive (a=inactive) for each recorded stream to 640 be paused, as per the procedures in [RFC3264]. To resume streaming 641 and collection of recorded media, the SRC sends a new SDP offer and 642 sets the media stream to sendonly (a=sendonly). Note that a CS 643 itself may change the media stream direction by updating the SDP, for 644 example, by setting a=inactive for SDP hold. Media stream direction 645 changes in CS are conveyed in the metadata by the SRC. When a CS 646 media stream is changed to/from inactive, the effect on the 647 corresponding RS media stream is governed by SRC policy. The SRC MAY 648 have a local policy to pause an RS media stream when the 649 corresponding CS media stream is inactive, or it MAY leave the RS 650 media stream as sendonly. 652 7.1.2. Recording indication in CS 654 While there are existing mechanisms for providing an indication that 655 a CS is being recorded, these mechanisms are usually delivered on the 656 CS media streams such as playing an in-band tone or an announcement 657 to the participants. A new 'record' SDP attribute is introduced to 658 allow the SRC to indicate recording state to a recording-aware UA in 659 a CS. 661 The 'record' SDP attribute appears at the media-level or session- 662 level in either SDP offer or answer. When the attribute is applied 663 at the session-level, the indication applies to all media streams in 664 the SDP. When the attribute is applied at the media-level, the 665 indication applies to the media stream only, and that overrides the 666 indication if also set at the session-level. Whenever the recording 667 indication needs to change, such as termination of recording, then 668 the SRC MUST initiate a reINVITE or UPDATE to update the SDP a=record 669 attribute. 671 The following is the ABNF of the 'record' attribute: 673 attribute =/ record-attr 674 ; attribute defined in RFC 4566 676 record-attr = "record:" indication 677 indication = "on" / "off" / "paused" 679 on: Recording is in progress. 681 off: No recording is in progress. 683 paused: Recording is in progress but media is paused. 685 7.1.3. Recording preference in CS 687 When the SRC receives the a=recordpref SDP in an SDP offer or answer, 688 the SRC chooses to honor the preference to record based on local 689 policy at the SRC. If the SRC makes a change in recording state, the 690 SRC MUST report the new recording state in the a=record attribute in 691 the SDP answer or in a subsequent SDP offer. 693 7.2. Procedures at the SRS 695 Typically the SRS only receives RTP streams from the SRC; therefore, 696 the SDP offer/answer from the SRS normally sets each media stream to 697 receive media, by setting them with the a=recvonly attribute, 698 according to the procedures of [RFC3264]. When the SRS is not ready 699 to receive a recorded stream, the SRS sets the media stream as 700 inactive in the SDP offer or answer by setting it with an a=inactive 701 attribute, according to the procedures of [RFC3264]. When the SRS is 702 ready to receive recorded streams, the SRS sends a new SDP offer and 703 sets the media streams with an a=recvonly attribute. 705 The following is an example of an SDP answer from the SRS for the SDP 706 offer from the above sample. Note that the following example contain 707 unfolded lines longer than 72 characters. These are captured between 708 tags. 710 v=0 711 o=SRS 0 0 IN IP4 198.51.100.20 712 s=- 713 c=IN IP4 198.51.100.20 714 t=0 0 715 m=audio 10000 RTP/AVP 0 716 a=recvonly 717 a=label:1 718 m=video 10002 RTP/AVP 98 719 a=rtpmap:98 H264/90000 720 721 a=fmtp:98 profile-level-id=42A01E; 722 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 723 724 a=recvonly 725 a=label:2 726 m=audio 10004 RTP/AVP 0 727 a=recvonly 728 a=label:3 729 m=video 10006 RTP/AVP 98 730 a=rtpmap:98 H264/90000 731 732 a=fmtp:98 profile-level-id=42A01E; 733 sprop-parameter-sets=Z0IACpZTBYmI,aMljiA== 734 735 a=recvonly 736 a=label:4 738 Figure 6: Sample SDP answer from SRS with audio and video streams 740 Over the lifetime of a recording session, the SRS can remove recorded 741 streams from the recording session for various reasons. To remove a 742 recorded stream from the recording session, the SRS sends a new SDP 743 offer where the port of the media stream to be removed is set to 744 zero, according to the procedures in [RFC3264]. 746 The SRS MUST NOT add recorded streams in the recording session when 747 the SRS sends a new SDP offer. Similarly, when the SRS starts a 748 recording session, the SRS MUST initiate the INVITE without an SDP 749 offer to let the SRC generate the SDP offer with the streams to be 750 recorded. 752 The following sequence diagram shows an example where the SRS is 753 initially not ready to receive recorded streams, and later updates 754 the recording session when the SRS is ready to record. 756 SRC SRS 757 | | 758 |(1) INVITE (SDP offer) | 759 |---------------------------------------------------->| 760 | [not ready to record] 761 | (2)200 OK with SDP inactive | 762 |<----------------------------------------------------| 763 |(3) ACK | 764 |---------------------------------------------------->| 765 | ... | 766 | [ready to record] 767 | (4) re-INVITE with SDP recvonly | 768 |<----------------------------------------------------| 769 |(5)200 OK with SDP sendonly | 770 |---------------------------------------------------->| 771 | (6) ACK | 772 |<----------------------------------------------------| 773 |(7) RTP | 774 |====================================================>| 775 | ... | 776 |(8) BYE | 777 |---------------------------------------------------->| 778 | (9) OK | 779 |<----------------------------------------------------| 781 Figure 7: SRS responding to offer with a=inactive 783 7.3. Procedures for Recording-aware User Agents 785 7.3.1. Recording indication 787 When a recording-aware UA receives an SDP offer or answer that 788 includes the a=record attribute, the UA provides an indication to the 789 end user whether the recording is on, off, or paused for each medium 790 based on the most recently received a=record SDP attribute for that 791 medium. 793 When a CS is traversed through multiple UAs such as a B2BUA or a 794 conference focus, each UA involved in the CS that is aware that the 795 CS is being recorded MUST provide the recording indication through 796 the a=record attribute to all other parties in the CS. 798 It is possible that more than one SRC is in the call path of the same 799 CS, but the recording indication attribute does not provide any hint 800 as to which SRC or how many SRCs are recording. An endpoint knows 801 only that the call is being recorded. Furthermore, this attribute is 802 not used as a request for a specific SRC to start/stop recording. 804 7.3.2. Recording preference 806 A participant in a CS MAY set the recording preference in the CS to 807 be recorded or not recorded at session establishment or during the 808 session. A new 'recordpref' SDP attribute is introduced, and the 809 participant in CS may set this recording preference attribute in any 810 SDP offer/answer at session establishment time or during the session. 811 The SRC is not required to honor the recording preference from a 812 participant based on local policies at the SRC, and the participant 813 can learn the recording indication through the a=record SDP attribute 814 as described in the above section. 816 The SDP a=recordpref attribute can appear at the media-level or 817 session-level and can appear in an SDP offer or answer. When the 818 attribute is applied at the session-level, the recording preference 819 applies to all media stream in the SDP. When the attribute is 820 applied at the media-level, the recording preference applies to the 821 media stream only, and that overrides the recording preference if 822 also set at the session-level. The user agent can change the 823 recording preference by changing the a=recordpref attribute in 824 subsequent SDP offer or answer. The absence of the a=recordpref 825 attribute in the SDP indicates that the UA has no recording 826 preference. 828 The following is the ABNF of the recordpref attribute: 830 attribute =/ recordpref-attr 831 ; attribute defined in RFC 4566 833 recordpref-attr = "a=recordpref:" pref 834 pref = "on" / "off" / "pause" / "nopreference" 836 on: Sets the preference to record if it has not already been 837 started. If the recording is currently paused, the preference is 838 to resume recording. 840 off: Sets the preference for no recording. If recording has already 841 been started, then the preference is to stop the recording. 843 pause: If the recording is currently in progress, sets the 844 preference to pause the recording. 846 nopreference: To indicate that the UA has no preference on 847 recording. 849 8. RTP Handling 851 This section provides recommendations and guidelines for RTP and RTCP 852 in the context of SIPREC. In order to communicate most effectively, 853 the Session Recording Client (SRC), the Session Recording Server 854 (SRS), and any Recording-aware User Agents (UAs) should utilize the 855 mechanisms provided by RTP in a well-defined and predicable manner. 856 It is the goal of this document to make the reader aware of these 857 mechanisms and provide recommendations and guidelines. 859 8.1. RTP Mechanisms 861 This section briefly describes important RTP/RTCP constructs and 862 mechanisms that are particularly useful within the context of SIPREC. 864 8.1.1. RTCP 866 The RTP data transport is augmented by a control protocol (RTCP) to 867 allow monitoring of the data delivery. RTCP, as defined in 868 [RFC3550], is based on the periodic transmission of control packets 869 to all participants in the RTP session, using the same distribution 870 mechanism as the data packets. Support for RTCP is REQUIRED, per 871 [RFC3550], and it provides, among other things, the following 872 important functionality in relation to SIPREC: 874 1) Feedback on the quality of the data distribution 876 This feedback from the receivers may be used to diagnose faults in 877 the distribution. As such, RTCP is a well-defined and efficient 878 mechanism for the SRS to inform the SRC, and for the SRC to inform 879 Recording-aware UAs, of issues that arise with respect to the 880 reception of media that is to be recorded. 882 2) Carries a persistent transport-level identifier for an RTP source 883 called the canonical name or CNAME 885 The SSRC identifier may change if a conflict is discovered or a 886 program is restarted, in which case receivers can use the CNAME to 887 keep track of each participant. Receivers may also use the CNAME to 888 associate multiple data streams from a given participant in a set of 889 related RTP sessions, for example to synchronize audio and video. 890 Synchronization of media streams is also facilitated by the NTP and 891 RTP timestamps included in RTCP packets by data senders. 893 8.1.2. RTP Profile 895 The RECOMMENDED RTP profiles for the SRC, SRS, and Recording-aware 896 UAs are "Extended Secure RTP Profile for Real-time Transport Control 897 Protocol (RTCP)-Based Feedback (RTP/SAVPF)" [RFC5124], when using 898 encrypted RTP streams, and "Extended RTP Profile for Real-time 899 Transport Control Protocol (RTCP)-Based Feedback (RTP/AVPF)" 900 [RFC4585], when using non-encrypted media streams. However, as these 901 are not requirements, some implementations may use "The Secure Real- 902 time Transport Protocol (SRTP)" [RFC3711], and "RTP Profile for Audio 903 and Video Conferences with Minimal Control" [RFC3551]. Therefore, it 904 is RECOMMENDED that the SRC, SRS, and Recording-aware UAs not rely 905 entirely on RTP/SAVPF or RTP/AVPF for core functionality that may be 906 at least partially achievable using RTP/SAVP and RTP/AVP. 908 AVPF and SAVPF provide an improved RTCP timer model that allows more 909 flexible transmission of RTCP packets in response to events, rather 910 than strictly according to bandwidth. AVPF-based codec control 911 messages provide efficient mechanisms for an SRC, SRS, and Recording- 912 aware UAs to handle events such as scene changes, error recovery, and 913 dynamic bandwidth adjustments. These messages are discussed in more 914 detail later in this document. 916 SAVP and SAVPF provide media encryption, integrity protection, replay 917 protection, and a limited form of source authentication. They do not 918 contain or require a specific keying mechanism. 920 8.1.3. SSRC 922 The synchronization source (SSRC), as defined in [RFC3550], is 923 carried in the RTP header and in various fields of RTCP packets. It 924 is a random 32-bit number that is required to be globally unique 925 within an RTP session. It is crucial that the number be chosen with 926 care in order that participants on the same network or starting at 927 the same time are not likely to choose the same number. Guidelines 928 regarding SSRC value selection and conflict resolution are provided 929 in [RFC3550]. 931 The SSRC may also be used to separate different sources of media 932 within a single RTP session. For this reason as well as for conflict 933 resolution, it is important that the SRC, SRS, and Recording-aware 934 UAs handle changes in SSRC values and properly identify the reason of 935 the change. The CNAME values carried in RTCP facilitate this 936 identification. 938 8.1.4. CSRC 940 The contributing source (CSRC), as defined in [RFC3550], identifies 941 the source of a stream of RTP packets that has contributed to the 942 combined stream produced by an RTP mixer. The mixer inserts a list 943 of the SSRC identifiers of the sources that contributed to the 944 generation of a particular packet into the RTP header of that packet. 945 This list is called the CSRC list. It is RECOMMENDED that an SRC or 946 Recording-aware UA, when acting as a mixer, set the CSRC list 947 accordingly, and that the SRC and SRS interpret the CSRC list per 948 [RFC3550] when received. 950 8.1.5. SDES 952 The Source Description (SDES), as defined in [RFC3550], contains an 953 SSRC/CSRC identifier followed by a list of zero or more items, which 954 carry information about the SSRC/CSRC. End systems send one SDES 955 packet containing their own source identifier (the same as the SSRC 956 in the fixed RTP header). A mixer sends one SDES packet containing a 957 chunk for each contributing source from which it is receiving SDES 958 information, or multiple complete SDES packets if there are more than 959 31 such sources. 961 The ability to identify individual contributing sources is important 962 in the context of SIPREC. Metadata [I-D.ietf-siprec-metadata] 963 provides a mechanism to achieve this at the signaling level. SDES 964 provides a mechanism at the RTP level. 966 8.1.5.1. CNAME 968 The Canonical End-Point Identifier (CNAME), as defined in [RFC3550], 969 provides the binding from the SSRC identifier to an identifier for 970 the source (sender or receiver) that remains constant. It is 971 important the SRC and Recording-aware UAs generate CNAMEs 972 appropriately and that the SRC and SRS interpret and use them for 973 this purpose. Guidelines for generating CNAME values are provided in 974 "Guidelines for Choosing RTP Control Protocol (RTCP) Canonical Names 975 (CNAMEs)" [RFC7022]. 977 8.1.6. Keepalive 979 It is anticipated that media streams in SIPREC may exist in an 980 inactive state for extended periods of times for any of a number of 981 valid reasons. In order for the bindings and any pinholes in NATs/ 982 firewalls to remain active during such intervals, it is RECOMMENDED 983 that the SRC, SRS, and Recording-aware UAs follow the keep-alive 984 procedure recommended in "Application Mechanism for Keeping Alive the 985 NAT Mappings Associated to RTP/RTP Control Protocol (RTCP) Flows" 986 [RFC6263] for all RTP media streams. 988 8.1.7. RTCP Feedback Messages 990 "Codec Control Messages in the RTP Audio-Visual Profile with Feedback 991 (AVPF)" [RFC5104] specifies extensions to the messages defined in 992 AVPF [RFC4585]. Support for and proper usage of these messages is 993 important to SRC, SRS, and Recording-aware UA implementations. Note 994 that these messages are applicable only when using the AVPF or SAVPF 995 RTP profiles 997 8.1.7.1. Full Intra Request 999 A Full Intra Request (FIR) Command, when received by the designated 1000 media sender, requires that the media sender sends a Decoder Refresh 1001 Point at the earliest opportunity. Using a decoder refresh point 1002 implies refraining from using any picture sent prior to that point as 1003 a reference for the encoding process of any subsequent picture sent 1004 in the stream. 1006 Decoder refresh points, especially Intra or IDR pictures for H.264 1007 video codecs, are in general several times larger in size than 1008 predicted pictures. Thus, in scenarios in which the available bit 1009 rate is small, the use of a decoder refresh point implies a delay 1010 that is significantly longer than the typical picture duration. 1012 8.1.7.1.1. SIP INFO for FIR 1014 "XML Schema for Media Control" [RFC5168] defines an Extensible Markup 1015 Language (XML) Schema for video fast update. Implementations are 1016 discouraged from using the method described except for backward 1017 compatibility purposes. Implementations SHOULD use FIR messages 1018 instead. 1020 To make sure a common mechanism exists between the SRC and SRS, the 1021 SRS MUST support both mechanisms (FIR and SIP INFO), using FIR when 1022 negotiated successfully with the SRC, and using SIP INFO otherwise. 1024 8.1.7.2. Picture Loss Indicator 1026 Picture Loss Indication (PLI), as defined in [RFC4585], informs the 1027 encoder of the loss of an undefined amount of coded video data 1028 belonging to one or more pictures. [RFC4585] recommends using PLI 1029 instead of FIR to recover from errors. FIR is appropriate only in 1030 situations where not sending a decoder refresh point would render the 1031 video unusable for the users. Examples where sending FIR is 1032 appropriate include a multipoint conference when a new user joins the 1033 conference and no regular decoder refresh point interval is 1034 established, and a video switching MCU that changes streams. 1036 Appropriate use of PLI and FIR is important to ensure with minimum 1037 overhead that the recorded video is usable (e.g., the necessary 1038 reference frames exist for a player to render the recorded video). 1040 8.1.7.3. Temporary Maximum Media Stream Bit Rate Request 1042 A receiver, translator, or mixer uses the Temporary Maximum Media 1043 Stream Bit Rate Request (TMMBR) to request a sender to limit the 1044 maximum bit rate for a media stream to the provided value. 1045 Appropriate use of TMMBR facilitates rapid adaptation to changes in 1046 available bandwidth. 1048 8.1.7.3.1. Renegotiation of SDP bandwidth attribute 1050 If it is likely that the new value indicated by TMMBR will be valid 1051 for the remainder of the session, the TMMBR sender is expected to 1052 perform a renegotiation of the session upper limit using the session 1053 signaling protocol. Therefore for SIPREC, implementations are 1054 RECOMMENDED to use TMMBR for temporary changes, and renegotiation of 1055 bandwidth via SDP offer/answer for more permanent changes. 1057 8.1.8. Symmetric RTP/RTCP for Sending and Receiving 1059 Within an SDP offer/answer exchange, RTP entities choose the RTP and 1060 RTCP transport addresses (i.e., IP addresses and port numbers) on 1061 which to receive packets. When sending packets, the RTP entities may 1062 use the same source port or a different source port as those signaled 1063 for receiving packets. When the transport address used to send and 1064 receive RTP is the same, it is termed "symmetric RTP" [RFC4961]. 1065 Likewise, when the transport address used to send and receive RTCP is 1066 the same, it is termed "symmetric RTCP" [RFC4961]. 1068 When sending RTP, it is REQUIRED to use symmetric RTP. When sending 1069 RTCP, it is REQUIRED to use symmetric RTCP. Although an SRS will not 1070 normally send RTP, it will send RTCP as well as receive RTP and RTCP. 1071 Likewise, although an SRC will not normally receive RTP from the SRS, 1072 it will receive RTCP as well as send RTP and RTCP. 1074 Note: Symmetric RTP and symmetric RTCP are different from RTP/RTCP 1075 multiplexing [RFC5761]. 1077 8.2. Roles 1079 An SRC has the task of gathering media from the various UAs in one or 1080 more Communication Sessions (CSs) and forwarding the information to 1081 the SRS within the context of a corresponding Recording Session (RS). 1082 There are numerous ways in which an SRC may do this, including but 1083 not limited to appearing as a UA within a CS, or as a B2BUA between 1084 UAs within a CS. 1086 (Recording Session) +---------+ 1087 +------------SIP------->| | 1088 | +------RTP/RTCP----->| SRS | 1089 | | +-- Metadata -->| | 1090 | | | +---------+ 1091 v v | 1092 +---------+ 1093 | SRC | 1094 |---------| (Communication Session) +---------+ 1095 | |<----------SIP---------->| | 1096 | UA-A | | UA-B | 1097 | |<-------RTP/RTCP-------->| | 1098 +---------+ +---------+ 1100 Figure 8: UA as SRC 1102 (Recording Session) +---------+ 1103 +------------SIP------->| | 1104 | +------RTP/RTCP----->| SRS | 1105 | | +-- Metadata -->| | 1106 | | | +---------+ 1107 v v | 1108 +---------+ 1109 | SRC | 1110 +---------+ |---------| +---------+ 1111 | |<----SIP----->| |<----SIP----->| | 1112 | UA-A | | B2BUA | | UA-B | 1113 | |<--RTP/RTCP-->| |<--RTP/RTCP-->| | 1114 +---------+ +---------+ +---------+ 1115 |_______________________________________________| 1116 (Communication Session) 1118 Figure 9: B2BUA as SRC 1120 The following subsections define a set of roles an SRC may choose to 1121 play based on its position with respect to a UA within a CS, and an 1122 SRS within an RS. A CS and a corresponding RS are independent 1123 sessions; therefore, an SRC may play a different role within a CS 1124 than it does within the corresponding RS. 1126 8.2.1. SRC acting as an RTP Translator 1128 The SRC may act as a translator, as defined in [RFC3550]. A defining 1129 characteristic of a translator is that it forwards RTP packets with 1130 their SSRC identifier intact. There are two types of translators, 1131 one that simply forwards, and another that performs transcoding 1132 (e.g., from one codec to another) in addition to forwarding. 1134 8.2.1.1. Forwarding Translator 1136 When acting as a forwarding translator, RTP received as separate 1137 streams from different sources (e.g., from different UAs with 1138 different SSRCs) cannot be mixed by the SRC and MUST be sent 1139 separately to the SRS. All RTCP reports MUST be passed by the SRC 1140 between the UAs and the SRS, such that the UAs and SRS are able to 1141 detect any SSRC collisions. 1143 RTCP Sender Reports generated by a UA sending a stream MUST be 1144 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1145 MUST be forwarded to the relevant UA. 1147 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1148 from other UAs participating in the CS, and one from the SRS 1149 participating in the RS. A UA SHOULD process the RTCP Receiver 1150 Reports from the SRS if it is recording-aware. 1152 If SRTP is used on both the CS and the RS, decryption and/or re- 1153 encryption may occur. For example, if different keys are used, it 1154 will occur. If the same keys are used, it need not occur. 1155 Section 12 provides additional information on SRTP and keying 1156 mechanisms. 1158 If packet loss occurs, either from the UA to the SRC or from the SRC 1159 to the SRS, the SRS SHOULD detect and attempt to recover from the 1160 loss. The SRC does not play a role in this other than forwarding the 1161 associated RTP and RTCP packets. 1163 8.2.1.2. Transcoding Translator 1165 When acting as a transcoding translator, an SRC MAY perform 1166 transcoding (e.g., from one codec to another), and this may result in 1167 a different rate of packets between what the SRC receives on the CS 1168 and what the SRC sends on the RS. As when acting as a forwarding 1169 translator, RTP received as separate streams from different sources 1170 (e.g., from different UAs with different SSRCs) cannot be mixed by 1171 the SRC and MUST be sent separately to the SRS. All RTCP reports 1172 MUST be passed by the SRC between the UAs and the SRS, such that the 1173 UAs and SRS are able to detect any SSRC collisions. 1175 RTCP Sender Reports generated by a UA sending a stream MUST be 1176 forwarded to the SRS. RTCP Receiver Reports generated by the SRS 1177 MUST be forwarded to the relevant UA. The SRC may need to manipulate 1178 the RTCP Receiver Reports to take account of any transcoding that has 1179 taken place. 1181 UAs may receive multiple sets of RTCP Receiver Reports, one or more 1182 from other UAs participating in the CS, and one from the SRS 1183 participating in the RS. A Recording-aware UA SHOULD be prepared to 1184 process the RTCP Receiver Reports from the SRS, whereas a recording 1185 unaware UA may discard such RTCP packets as not of relevance. 1187 If SRTP is used on both the CS and the RS, decryption and/or re- 1188 encryption may occur. For example, if different keys are used, it 1189 will occur. If the same keys are used, it need not occur. 1190 Section 12 provides additional information on SRTP and keying 1191 mechanisms. 1193 If packet loss occurs, either from the UA to the SRC or from the SRC 1194 to the SRS, the SRS SHOULD detect and attempt to recover from the 1195 loss. The SRC does not play a role in this other than forwarding the 1196 associated RTP and RTCP packets. 1198 8.2.2. SRC acting as an RTP Mixer 1200 In the case of the SRC acting as a RTP mixer, as defined in 1201 [RFC3550], the SRC combines RTP streams from different UAs and sends 1202 them towards the SRS using its own SSRC. The SSRCs from the 1203 contributing UA SHOULD be conveyed as CSRCs identifiers within this 1204 stream. The SRC may make timing adjustments among the received 1205 streams and generate its own timing on the stream sent to the SRS. 1206 Optionally an SRC acting as a mixer can perform transcoding, and can 1207 even cope with different codings received from different UAs. RTCP 1208 Sender Reports and Receiver Reports are not forwarded by an SRC 1209 acting as mixer, but there are requirements for forwarding RTCP 1210 Source Description (SDES) packets. The SRC generates its own RTCP 1211 Sender and Receiver reports toward the associated UAs and SRS. 1213 The use of SRTP between the SRC and the SRS for the RS is independent 1214 of the use of SRTP between the UAs and SRC for the CS. Section 12 1215 provides additional information on SRTP and keying mechanisms. 1217 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1218 and attempt to recover from the loss. If packet loss occurs from the 1219 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1220 loss. 1222 8.2.3. SRC acting as an RTP Endpoint 1224 The case of the SRC acting as an RTP endpoint, as defined in 1225 [RFC3550], is similar to the mixer case, except that the RTP session 1226 between the SRC and the SRS is considered completely independent from 1227 the RTP session that is part of the CS. The SRC can, but need not, 1228 mix RTP streams from different participants prior to sending to the 1229 SRS. RTCP between the SRC and the SRS is completely independent of 1230 RTCP on the CS. 1232 The use of SRTP between the SRC and the SRS for the RS is independent 1233 of the use of SRTP between the UAs and SRC for the CS. Section 12 1234 provides additional information on SRTP and keying mechanisms. 1236 If packet loss occurs from the UA to the SRC, the SRC SHOULD detect 1237 and attempt to recover from the loss. If packet loss occurs from the 1238 SRC to the SRS, the SRS SHOULD detect and attempt to recover from the 1239 loss. 1241 8.3. RTP Session Usage by SRC 1243 There are multiple ways that an SRC may choose to deliver recorded 1244 media to an SRS. In some cases, it may use a single RTP session for 1245 all media within the RS, whereas in others it may use multiple RTP 1246 sessions. The following subsections provide examples of basic RTP 1247 session usage by the SRC, including a discussion of how the RTP 1248 constructs and mechanisms covered previously are used. An SRC may 1249 choose to use one or more of the RTP session usages within a single 1250 RS. For the purpose of base interoperability between SRC and SRS, an 1251 SRC MUST support separate m-lines in SDP, one per CS media direction. 1252 The set of RTP session usages described is not meant to be 1253 exhaustive. 1255 8.3.1. SRC Using Multiple m-lines 1257 When using multiple m-lines, an SRC includes each m-line in an SDP 1258 offer to the SRS. The SDP answer from the SRS MUST include all 1259 m-lines, with any rejected m-lines indicated with a zero port, per 1260 [RFC3264]. Having received the answer, the SRC starts sending media 1261 to the SRS as indicated in the answer. Alternatively, if the SRC 1262 deems the level of support indicated in the answer to be 1263 unacceptable, it may initiate another SDP offer/answer exchange in 1264 which an alternative RTP session usage is negotiated. 1266 In order to preserve the mapping of media to participant within the 1267 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1268 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1269 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1270 SSRC within the RS. In doing so, the SRC may act as an RTP 1271 translator or as an RTP endpoint. 1273 The following figure illustrates a case in which each UA represents a 1274 participant contributing two RTP sessions (e.g., one for audio and 1275 one for video), each with a single SSRC. The SRC acts as an RTP 1276 translator and delivers the media to the SRS using four RTP sessions, 1277 each with a single SSRC. The CNAME and SSRC values used by the UAs 1278 within their media streams are preserved in the media streams from 1279 the SRC to the SRS. 1281 +---------+ 1282 +------------SSRC Aa--->| | 1283 | + --------SSRC Av--->| | 1284 | | +------SSRC Ba--->| SRS | 1285 | | | +---SSRC Bv--->| | 1286 | | | | +---------+ 1287 | | | | 1288 | | | | 1289 +---------+ +----------+ +---------+ 1290 | |---SSRC Aa-->| SRC |<--SSRC Ba---| | 1291 | UA-A | |(CNAME-A, | | UA-B | 1292 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1293 +---------+ +----------+ +---------+ 1295 Figure 10: SRC Using Multiple m-lines 1297 8.3.2. SRC Using Mixing 1299 When using mixing, the SRC combines RTP streams from different 1300 participants and sends them towards the SRS using its own SSRC. The 1301 SSRCs from the contributing participants SHOULD be conveyed as CSRCs 1302 identifiers. The SRC includes one m-line for each RTP session in an 1303 SDP offer to the SRS. The SDP answer from the SRS MUST include all 1304 m-lines, with any rejected m-lines indicated with the zero port, per 1305 [RFC3264]. Having received the answer, the SRC starts sending media 1306 to the SRS as indicated in the answer. 1308 In order to preserve the mapping of media to participant within the 1309 CSs in the RS, the SRC SHOULD map each unique CNAME within the CSs to 1310 a unique CNAME within the RS. Additionally, the SRC SHOULD map each 1311 unique combination of CNAME/SSRC within the CSs to a unique CNAME/ 1312 SSRC within the RS. The SRC MUST avoid SSRC collisions, rewriting 1313 SSRCs if necessary when used as CSRCs in the RS. In doing so, the 1314 SRC acts as an RTP mixer. 1316 In the event the SRS does not support this usage of CSRC values, it 1317 relies entirely on the SIPREC metadata to determine the participants 1318 included within each mixed stream. 1320 The following figure illustrates a case in which each UA represents a 1321 participant contributing two RTP sessions (e.g., one for audio and 1322 one for video), each with a single SSRC. The SRC acts as an RTP 1323 mixer and delivers the media to the SRS using two RTP sessions, 1324 mixing media from each participant into a single RTP session 1325 containing a single SSRC and two CSRCs. 1327 SSRC Sa +---------+ 1328 +-------CSRC Aa,Ba--->| | 1329 | | | 1330 | SSRC Sv | SRS | 1331 | +---CSRC Av,Bv--->| | 1332 | | +---------+ 1333 | | 1334 +----------+ 1335 +---------+ | SRC | +---------+ 1336 | |---SSRC Aa-->|(CNAME-S, |<--SSRC Ba---| | 1337 | UA-A | | CNAME-A, | | UA-B | 1338 |(CNAME-A)|---SSRC Av-->| CNAME-B) |<--SSRC Bv---|(CNAME-B)| 1339 +---------+ +----------+ +---------+ 1341 Figure 11: SRC Using Mixing 1343 8.4. RTP Session Usage by SRS 1345 An SRS that supports recording an audio CS MUST support SRC usage of 1346 separate audio m-lines in SDP, one per CS media direction. An SRS 1347 that supports recording a video CS MUST support SRC usage of separate 1348 video m-lines in SDP, one per CS media direction. Therefore, for an 1349 SRS supporting a typical audio call, the SRS has to support receiving 1350 at least two audio m-lines. For an SRS supporting a typical audio 1351 and video call, the SRS has to support receiving at least four total 1352 m-lines in the SDP, two audio m-lines and two video m-lines. 1354 These requirements allow an SRS to be implemented that supports video 1355 only, without requiring support for audio recording. They also allow 1356 an SRS to be implemented that supports recording only one direction 1357 of one stream in a CS; for example, an SRS designed to record 1358 security monitoring cameras that only send (not receive) video 1359 without any audio. These requirements were not written to prevent 1360 other modes being implemented and used, such as using a single m-line 1361 and mixing the separate audio streams together. Rather, the 1362 requirements were written to provide a common base mode to implement 1363 for the sake of interoperability. It is important to note that an 1364 SRS implementation supporting the common base may not record all 1365 media streams in a CS if a participant supports more than one m-line 1366 in a video call, such as one for camera and one for presentation. 1367 SRS implementations may support other modes as well, but have to at 1368 least support the ones above such that they interoperate in the 1369 common base mode for basic interoperability. 1371 9. Metadata 1373 Some metadata attributes are contained in SDP, and others are 1374 contained in a new content type "application/rs-metadata". The 1375 format of the metadata is described as part of the mechanism in 1376 [I-D.ietf-siprec-metadata]. A new "disposition-type" of Content- 1377 Disposition is defined for the purpose of carrying metadata. The 1378 value is "recording-session", which indicates the "application/rs- 1379 metadata" content contains metadata to be handled by the SRS. 1381 9.1. Procedures at the SRC 1383 The SRC MUST send metadata to the SRS in an RS. The SRC SHOULD send 1384 metadata as soon as it becomes available and whenever it changes. 1385 Cases in which an SRC may be justified in waiting temporarily before 1386 sending metadata include: 1388 o waiting for a previous metadata exchange to complete (i.e., the 1389 SRC cannot send another SDP offer until the previous offer/answer 1390 completes, and may prefer not to send an UPDATE during this time 1391 either). 1393 o constraining the signaling rate on the RS. 1395 o sending metadata when key events occur rather than for every event 1396 that has any impact on metadata. 1398 The SRC may also be configured to suppress certain metadata out of 1399 concern for privacy or perceived lack of need for it to be included 1400 in the recording. 1402 Metadata sent by the SRC is categorized as either a full metadata 1403 snapshot or a partial update. A full metadata snapshot describes all 1404 metadata associated with the RS. The SRC MAY send a full metadata 1405 snapshot at any time. The SRC MAY send a partial update only if a 1406 full metadata snapshot has been sent previously. 1408 The SRC MAY send metadata (either a full metadata snapshot or a 1409 partial update) in an INVITE request, an UPDATE request [RFC3311], or 1410 a 200 response to an offerless INVITE from the SRS. If the metadata 1411 contains a reference to any SDP labels, the request containing the 1412 metadata MUST also contain an SDP offer that defines those labels. 1414 When a SIP message contains both an SDP offer and metadata, the 1415 request body MUST have content type "multipart/mixed", with one 1416 subordinate body part containing the SDP offer and another containing 1417 the metadata. When a SIP message contains only an SDP offer or 1418 metadata, the "multipart/mixed" container is optional. 1420 The SRC SHOULD include a full metadata snapshot in the initial INVITE 1421 request establishing the RS. If metadata is not yet available (e.g., 1422 an RS established in absence of a CS), the SRC SHOULD send a full 1423 metadata snapshot as soon as metadata becomes available. 1425 If the SRC receives a snapshot request from the SRS, it MUST 1426 immediately send a full metadata snapshot. 1428 The following is an example of a full metadata snapshot sent by the 1429 SRC in the initial INVITE request: 1431 INVITE sip:recorder@example.com SIP/2.0 1432 Via: SIP/2.0/TCP src.example.com;branch=z9hG4bKdf6b622b648d9 1433 From: ;tag=35e195d2-947d-4585-946f-09839247 1434 To: 1435 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1436 CSeq: 101 INVITE 1437 Max-Forwards: 70 1438 Require: siprec 1439 Accept: application/sdp, application/rs-metadata 1440 Contact: ;+sip.src 1441 Content-Type: multipart/mixed;boundary=foobar 1442 Content-Length: [length] 1444 --foobar 1445 Content-Type: application/sdp 1447 v=0 1448 o=SRS 2890844526 2890844526 IN IP4 198.51.100.1 1449 s=- 1450 c=IN IP4 198.51.100.1 1451 t=0 0 1452 m=audio 12240 RTP/AVP 0 4 8 1453 a=sendonly 1454 a=label:1 1456 --foobar 1457 Content-Type: application/rs-metadata 1458 Content-Disposition: recording-session 1460 [metadata content] 1462 Figure 12: Sample INVITE request for the recording session 1464 9.2. Procedures at the SRS 1466 The SRS receives metadata updates from the SRC in INVITE and UPDATE 1467 requests. Since the SRC can send partial updates based on the 1468 previous update, the SRS needs to keep track of the sequence of 1469 updates from the SRC. 1471 In the case of an internal failure at the SRS, the SRS may fail to 1472 recognize a partial update from the SRC. The SRS may be able to 1473 recover from the internal failure by requesting a full metadata 1474 snapshot from the SRC. Certain errors, such as syntax errors or 1475 semantic errors in the metadata information, are likely caused by an 1476 error on the SRC side, and it is likely the same error will occur 1477 again even when a full metadata snapshot is requested. In order to 1478 avoid repeating the same error, the SRS can simply terminate the 1479 recording session when a syntax error or semantic error is detected 1480 in the metadata. 1482 The SRS MAY explicitly request a full metadata snapshot by sending an 1483 UPDATE request. This request MUST contain a body with content 1484 disposition type "recording-session", and MUST NOT contain an SDP 1485 body. The SRS MUST NOT request a full metadata snapshot in an UPDATE 1486 response or in any other SIP transaction. The format of the content 1487 is "application/rs-metadata", and the body is an XML document, the 1488 format of which is defined in [I-D.ietf-siprec-metadata]. The 1489 following shows an example: 1491 UPDATE sip:2000@src.exmaple.com SIP/2.0 1492 Via: SIP/2.0/UDP srs.example.com;branch=z9hG4bKdf6b622b648d9 1493 To: ;tag=35e195d2-947d-4585-946f-098392474 1494 From: ;tag=1234567890 1495 Call-ID: d253c800-b0d1ea39-4a7dd-3f0e20a 1496 CSeq: 1 UPDATE 1497 Max-Forwards: 70 1498 Require: siprec 1499 Contact: ;+sip.srs 1500 Accept: application/sdp, application/rs-metadata 1501 Content-Disposition: recording-session 1502 Content-Type: application/rs-metadata 1503 Content-Length: [length] 1505 1506 1507 SRS internal error 1508 1510 Figure 13: Metadata Request 1512 Note that UPDATE was chosen for the SRS to request metadata snapshot 1513 because it can be sent regardless of the state of the dialog. This 1514 was seen as better than requiring support for both UPDATE and re- 1515 INVITE for this operation. 1517 When the SRC receives a request for a metadata snapshot, it MUST 1518 immediately provide a full metadata snapshot in a separate INVITE or 1519 UPDATE transaction. Any subsequent partial updates will not be 1520 dependent on any metadata sent prior to this full metadata snapshot. 1522 The metadata received by the SRS can contain ID elements used to 1523 cross reference one element to another. An element containing the 1524 definition of an ID, and an element containing a reference to that ID 1525 will often be received from the same SRC. It is also valid for those 1526 elements to be received from different SRCs, for example, when each 1527 endpoint in the same CS act as an SRC to record the call and a common 1528 ID refers to the same CS. The SRS MUST NOT consider this an error. 1530 10. Persistent Recording 1532 Persistent recording is a specific use case outlined in REQ-005 or 1533 Use Case 4 in [RFC6341], where a recording session can be established 1534 in the absence of a communication session. The SRC continuously 1535 records media in a recording session to the SRS even in the absence 1536 of a CS for all user agents that are part of persistent recording. 1537 By allocating recorded streams and continuously sending recorded 1538 media to the SRS, the SRC does not have to prepare new recorded 1539 streams with a new SDP offer when a new communication session is 1540 created and also does not impact the timing of the CS. The SRC only 1541 needs to update the metadata when new communication sessions are 1542 created. 1544 When there is no communication session running on the devices with 1545 persistent recording, there is no recorded media to stream from the 1546 SRC to the SRS. In certain environments where Network Address 1547 Translator (NAT) is used, typically a minimum of flow activity is 1548 required to maintain the NAT binding for each port opened. Agents 1549 that support Interactive Connectivity Establishment (ICE) solve this 1550 problem. For non-ICE agents, in order not to lose the NAT bindings 1551 for the RTP/RTCP ports opened for the recorded streams, the SRC and 1552 SRS SHOULD follow the recommendations provided in [RFC6263] to 1553 maintain the NAT bindings. 1555 11. IANA Considerations 1557 11.1. Registration of Option Tags 1559 This specification registers two option tags. The required 1560 information for this registration, as specified in [RFC3261], is as 1561 follows. 1563 11.1.1. siprec Option Tag 1565 Name: siprec 1567 Description: This option tag is for identifying that the SIP 1568 session is for the purpose of a recording session. This is 1569 typically not used in a Supported header. When present in a 1570 Require header in a request, it indicates that the UA is either an 1571 SRC or SRS capable of handling a recording session. 1573 11.1.2. record-aware Option Tag 1575 Name: record-aware 1577 Description: This option tag is to indicate the ability for the 1578 user agent to receive recording indicators in media-level or 1579 session-level SDP. When present in a Supported header, it 1580 indicates that the UA can receive recording indicators in media- 1581 level or session-level SDP. 1583 11.2. Registration of media feature tags 1585 This document registers two new media feature tags in the SIP tree 1586 per the process defined in [RFC2506] and [RFC3840] 1588 11.2.1. src feature tag 1590 Media feature tag name: sip.src 1592 ASN.1 Identifier: TBD at registration 1594 Summary of the media feature indicated by this tag: This feature 1595 tag indicates that the user agent is a Session Recording Client 1596 for the purpose of a Recording Session. 1598 Values appropriate for use with this feature tag: boolean 1600 The feature tag is intended primarily for use in the following 1601 applications, protocols, services, or negotiation mechanisms: This 1602 feature tag is only useful for a Recording Session. 1604 Examples of typical use: Routing the request to a Session 1605 Recording Server. 1607 Security Considerations: Security considerations for this media 1608 feature tag are discussed in Section 11.1 of RFC 3840. 1610 11.2.2. srs feature tag 1612 Media feature tag name: sip.srs 1614 ASN.1 Identifier: TBD at registration 1615 Summary of the media feature indicated by this tag: This feature 1616 tag indicates that the user agent is a Session Recording Server 1617 for the purpose of a Recording Session. 1619 Values appropriate for use with this feature tag: boolean 1621 The feature tag is intended primarily for use in the following 1622 applications, protocols, services, or negotiation mechanisms: This 1623 feature tag is only useful for a Recording Session. 1625 Examples of typical use: Routing the request to a Session 1626 Recording Client. 1628 Security Considerations: Security considerations for this media 1629 feature tag are discussed in Section 11.1 of RFC 3840. 1631 11.3. New Content-Disposition Parameter Registrations 1633 This document registers a new "disposition-type" value in Content- 1634 Disposition header: recording-session. 1636 recording-session: The body describes either: 1638 * metadata about the recording session 1640 * reason for metadata snapshot request 1642 as determined by the MIME value indicated in the Content-Type. 1644 11.4. Media Type Registration 1646 11.5. SDP Attributes 1648 This document registers the following new SDP attributes. 1650 11.5.1. 'record' SDP Attribute 1652 Contact names: Leon Portman leon.portman@gmail.com, Henry Lum 1653 henry.lum@genesyslab.com 1655 Attribute name: record 1657 Long form attribute name: Recording Indication 1659 Type of attribute: session or media-level 1661 Subject to charset: no 1662 This attribute provides the recording indication for the session or 1663 media stream. 1665 Allowed attribute values: on, off, paused 1667 11.5.2. 'recordpref' SDP Attribute 1669 Contact names: Leon Portman leon.portman@nice.com, Henry Lum 1670 henry.lum@genesyslab.com 1672 Attribute name: recordpref 1674 Long form attribute name: Recording Preference 1676 Type of attribute: session or media-level 1678 Subject to charset: no 1680 This attribute provides the recording preference for the session or 1681 media stream. 1683 Allowed attribute values: on, off, pause, nopreference 1685 12. Security Considerations 1687 The recording session is fundamentally a standard SIP dialog 1688 [RFC3261]; therefore, the recording session can reuse any of the 1689 existing SIP security mechanisms available for securing the session 1690 signaling, the recorded media, and the metadata. The use cases and 1691 requirements document [RFC6341] outlines the general security 1692 considerations, and this document describes specific security 1693 recommendations. 1695 The SRC and SRS MUST support SIP with TLS version 1.2, SHOULD follow 1696 the best practices when using TLS as per [RFC7525], and MAY use SIPS 1697 with TLS as per [RFC5630]. The Recording Session MUST be at least as 1698 secure as the Communication Session, meaning using at least the same 1699 strength of cipher suite as the CS if the CS is secured. For 1700 example, if the CS uses SIPS for signaling and RTP/SAVP for media, 1701 then the RS may not use SIP or plain RTP unless other equivalent 1702 security measures are in effect, since doing so would mean an 1703 effective security downgrade. Examples of other potentially 1704 equivalent security mechanisms include mutually-authenticated TLS for 1705 the RS signaling channel or an appropriately protected network path 1706 for the RS media component. 1708 12.1. Authentication and Authorization 1710 At the transport level, the recording session uses TLS authentication 1711 to validate the authenticity of the SRC and SRS. The SRC and SRS 1712 MUST implement TLS mutual authentication for establishing the 1713 recording session. Whether the SRC/SRS chooses to use TLS mutual 1714 authentication is a deployment decision. In deployments where a UA 1715 acts as its own SRC, this requires the UA have its own certificate as 1716 needed for TLS mutual authentication. In deployments where the SRC 1717 and the SRS are in the same administrative domain and have some other 1718 means of assuring authenticity, the SRC and SRS may choose not to 1719 authenticate each other, or to have the SRC authenticate the SRS 1720 only. In deployments where the SRS can be hosted on a different 1721 administrative domain, it is important to perform mutual 1722 authentication to ensure the authenticity of both the SRC and the SRS 1723 before transmitting any recorded media. The risk of not 1724 authenticating the SRS is that the recording may be sent to an entity 1725 other than the intended SRS, allowing a sensitive call recording to 1726 be received by an attacker. On the other hand, the risk of not 1727 authenticating the SRC is that an SRS will accept calls from an 1728 unknown SRC and allow potential forgery of call recordings. 1730 There may be scenarios in which the signaling between the SRC and SRS 1731 is not direct, e.g., a SIP proxy exists between the SRC and the SRS. 1732 In such scenarios, each hop is subject to the TLS mutual 1733 authentication constraint and transitive trust at each hop is 1734 utilized. Additionally, an SRC or SRS may use other existing SIP 1735 mechanisms available, including but not limited to, Digest 1736 Authentication [RFC3261], Asserted Identity [RFC3325], and Connected 1737 Identity [RFC4916]. 1739 The SRS may have its own set of recording policies to authorize 1740 recording requests from the SRC. The use of recording policies is 1741 outside the scope of the Session Recording Protocol. 1743 12.2. RTP handling 1745 In many scenarios it will be critical for the media transported 1746 between the SRC and the SRS to be protected. Media encryption is an 1747 important element in the overall SIPREC solution; therefore the SRC 1748 and the SRS MUST support RTP/SAVP [RFC3711] and RTP/SAVPF [RFC5124]. 1749 RTP/SAVP and RTP/SAVPF provide media encryption, integrity 1750 protection, replay protection, and a limited form of source 1751 authentication. They do not contain or require a specific keying 1752 mechanism. At a minimum, the SRC and SRS MUST support the SDP 1753 Security Descriptions (SDES) key negotiation mechanism [RFC4568]. 1754 For cases in which DTLS-SRTP is used to encrypt a CS media stream, an 1755 SRC may use SRTP Encrypted Key Transport (EKT) 1757 [I-D.ietf-avtcore-srtp-ekt] in order to use SRTP-SDES in the RS 1758 without needing to re-encrypt the media. 1760 Note: When using EKT in this manner, it is possible for 1761 participants in the CS to send traffic that appears to be from 1762 other participants and have this forwarded by the SRC to the SRS 1763 within the RS. If this is a concern (e.g. the RS is intended for 1764 audit or compliance purposes), EKT is not an appropriate choice. 1766 When RTP/SAVP or RTP/SAVPF is used, an SRC can choose to use the same 1767 or different keys in the RS than the ones used in the CS. Some SRCs 1768 are designed to simply replicate RTP packets from a CS media stream 1769 to the SRS, in which case the SRC will use the same key in the RS as 1770 used in the CS. In this case, the SRC MUST secure the SDP containing 1771 the keying material in the RS with at least the same level of 1772 security as in the CS. The risk of lowering the level of security in 1773 the RS is that it will effectively become a downgrade attack on the 1774 CS since the same key is used for both CS and RS. 1776 SRCs that decrypt an encrypted CS media stream and re-encrypt it when 1777 sending it to the SRS MUST use a different key than what is used for 1778 the CS media stream, to ensure that it is not possible for someone 1779 who has the key for the CS media stream to access recorded data they 1780 are not authorized to access. In order to maintain a comparable 1781 level of security, the key used in the RS SHOULD of equivalent or 1782 greater strength than that used in the CS. 1784 12.3. Metadata 1786 Metadata contains sensitive information such as the address of record 1787 of the participants and other extension data placed by the SRC. It 1788 is essential to protect the content of the metadata in the RS. Since 1789 metadata is a content type transmitted in SIP signaling, metadata 1790 SHOULD be protected at the transport level by SIPS/TLS. 1792 12.4. Storage and playback 1794 While storage and playback of the call recording is beyond the scope 1795 of this document, it is worthwhile to mention here that it is also 1796 important for the recording storage and playback to provide a level 1797 of security that is comparable to the communication session. It 1798 would defeat the purpose of securing both the communication session 1799 and the recording session mentioned in the previous sections if the 1800 recording can be easily played back with a simple, unsecured HTTP 1801 interface without any form of authentication or authorization. 1803 13. Acknowledgements 1805 We want to thank John Elwell, Paul Kyzivat, Partharsarathi R, Ram 1806 Mohan R, Hadriel Kaplan, Adam Roach, Miguel Garcia, Thomas Stach, 1807 Muthu Perumal, Dan Wing, and Magnus Westerlund for their valuable 1808 comments and inputs to this document. 1810 14. References 1812 14.1. Normative References 1814 [I-D.ietf-siprec-metadata] 1815 R, R., Ravindran, P., and P. Kyzivat, "Session Initiation 1816 Protocol (SIP) Recording Metadata", draft-ietf-siprec- 1817 metadata-18 (work in progress), August 2015. 1819 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1820 Requirement Levels", BCP 14, RFC 2119, 1821 DOI 10.17487/RFC2119, March 1997, 1822 . 1824 [RFC2506] Holtman, K., Mutz, A., and T. Hardie, "Media Feature Tag 1825 Registration Procedure", BCP 31, RFC 2506, 1826 DOI 10.17487/RFC2506, March 1999, 1827 . 1829 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 1830 A., Peterson, J., Sparks, R., Handley, M., and E. 1831 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 1832 DOI 10.17487/RFC3261, June 2002, 1833 . 1835 [RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model 1836 with Session Description Protocol (SDP)", RFC 3264, 1837 DOI 10.17487/RFC3264, June 2002, 1838 . 1840 [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. 1841 Jacobson, "RTP: A Transport Protocol for Real-Time 1842 Applications", STD 64, RFC 3550, DOI 10.17487/RFC3550, 1843 July 2003, . 1845 [RFC3840] Rosenberg, J., Schulzrinne, H., and P. Kyzivat, 1846 "Indicating User Agent Capabilities in the Session 1847 Initiation Protocol (SIP)", RFC 3840, 1848 DOI 10.17487/RFC3840, August 2004, 1849 . 1851 [RFC4574] Levin, O. and G. Camarillo, "The Session Description 1852 Protocol (SDP) Label Attribute", RFC 4574, 1853 DOI 10.17487/RFC4574, August 2006, 1854 . 1856 [RFC7245] Hutton, A., Ed., Portman, L., Ed., Jain, R., and K. Rehor, 1857 "An Architecture for Media Recording Using the Session 1858 Initiation Protocol", RFC 7245, DOI 10.17487/RFC7245, May 1859 2014, . 1861 14.2. Informative References 1863 [I-D.ietf-avtcore-srtp-ekt] 1864 Mattsson, J., McGrew, D., and D. Wing, "Encrypted Key 1865 Transport for Secure RTP", draft-ietf-avtcore-srtp-ekt-03 1866 (work in progress), October 2014. 1868 [RFC2804] IAB and , "IETF Policy on Wiretapping", RFC 2804, 1869 DOI 10.17487/RFC2804, May 2000, 1870 . 1872 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 1873 UPDATE Method", RFC 3311, DOI 10.17487/RFC3311, October 1874 2002, . 1876 [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private 1877 Extensions to the Session Initiation Protocol (SIP) for 1878 Asserted Identity within Trusted Networks", RFC 3325, 1879 DOI 10.17487/RFC3325, November 2002, 1880 . 1882 [RFC3551] Schulzrinne, H. and S. Casner, "RTP Profile for Audio and 1883 Video Conferences with Minimal Control", STD 65, RFC 3551, 1884 DOI 10.17487/RFC3551, July 2003, 1885 . 1887 [RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. 1888 Norrman, "The Secure Real-time Transport Protocol (SRTP)", 1889 RFC 3711, DOI 10.17487/RFC3711, March 2004, 1890 . 1892 [RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session 1893 Description Protocol (SDP) Security Descriptions for Media 1894 Streams", RFC 4568, DOI 10.17487/RFC4568, July 2006, 1895 . 1897 [RFC4585] Ott, J., Wenger, S., Sato, N., Burmeister, C., and J. Rey, 1898 "Extended RTP Profile for Real-time Transport Control 1899 Protocol (RTCP)-Based Feedback (RTP/AVPF)", RFC 4585, 1900 DOI 10.17487/RFC4585, July 2006, 1901 . 1903 [RFC4916] Elwell, J., "Connected Identity in the Session Initiation 1904 Protocol (SIP)", RFC 4916, DOI 10.17487/RFC4916, June 1905 2007, . 1907 [RFC4961] Wing, D., "Symmetric RTP / RTP Control Protocol (RTCP)", 1908 BCP 131, RFC 4961, DOI 10.17487/RFC4961, July 2007, 1909 . 1911 [RFC5104] Wenger, S., Chandra, U., Westerlund, M., and B. Burman, 1912 "Codec Control Messages in the RTP Audio-Visual Profile 1913 with Feedback (AVPF)", RFC 5104, DOI 10.17487/RFC5104, 1914 February 2008, . 1916 [RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for 1917 Real-time Transport Control Protocol (RTCP)-Based Feedback 1918 (RTP/SAVPF)", RFC 5124, DOI 10.17487/RFC5124, February 1919 2008, . 1921 [RFC5168] Levin, O., Even, R., and P. Hagendorf, "XML Schema for 1922 Media Control", RFC 5168, DOI 10.17487/RFC5168, March 1923 2008, . 1925 [RFC5630] Audet, F., "The Use of the SIPS URI Scheme in the Session 1926 Initiation Protocol (SIP)", RFC 5630, 1927 DOI 10.17487/RFC5630, October 2009, 1928 . 1930 [RFC5761] Perkins, C. and M. Westerlund, "Multiplexing RTP Data and 1931 Control Packets on a Single Port", RFC 5761, 1932 DOI 10.17487/RFC5761, April 2010, 1933 . 1935 [RFC6263] Marjou, X. and A. Sollaud, "Application Mechanism for 1936 Keeping Alive the NAT Mappings Associated with RTP / RTP 1937 Control Protocol (RTCP) Flows", RFC 6263, 1938 DOI 10.17487/RFC6263, June 2011, 1939 . 1941 [RFC6341] Rehor, K., Ed., Portman, L., Ed., Hutton, A., and R. Jain, 1942 "Use Cases and Requirements for SIP-Based Media Recording 1943 (SIPREC)", RFC 6341, DOI 10.17487/RFC6341, August 2011, 1944 . 1946 [RFC7022] Begen, A., Perkins, C., Wing, D., and E. Rescorla, 1947 "Guidelines for Choosing RTP Control Protocol (RTCP) 1948 Canonical Names (CNAMEs)", RFC 7022, DOI 10.17487/RFC7022, 1949 September 2013, . 1951 [RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre, 1952 "Recommendations for Secure Use of Transport Layer 1953 Security (TLS) and Datagram Transport Layer Security 1954 (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May 1955 2015, . 1957 Authors' Addresses 1959 Leon Portman 1960 NICE Systems 1961 22 Zarhin Street 1962 P.O. Box 690 1963 Ra'anana 4310602 1964 Israel 1966 Email: leon.portman@gmail.com 1968 Henry Lum (editor) 1969 Genesys 1970 1380 Rodick Road, Suite 201 1971 Markham, Ontario L3R4G5 1972 Canada 1974 Email: henry.lum@genesyslab.com 1976 Charles Eckel 1977 Cisco 1978 170 West Tasman Drive 1979 San Jose, CA 95134 1980 United States 1982 Email: eckelcu@cisco.com 1984 Alan Johnston 1985 Avaya 1986 St. Louis, MO 63124 1988 Email: alan.b.johnston@gmail.com 1989 Andrew Hutton 1990 Unify 1991 Brickhill Street 1992 Milton Keynes MK15 0DJ 1993 United Kingdom 1995 Email: andrew.hutton@unify.com