ANSI SCTE 173-3-2017 pdf free download – Specification for Authentication in Preferential Telecommunications over IPCablecom2 Networks.
6Authentication in IPCablecom2
Authentication in IPCablecom2 networks is impacted by two dimensions:
.location of originating and terminating devices or VolP user agent (UA) functionality; and
form of identity presented by the preferential telecommunication service requester andmanner by which the asserted identity is verified.
Authentication entails receiving identification and identity verification/validation informationnecessary, prior to authorizing completion of a preferential priority call or session. This capabilityshould exist on the access network and it must also be propagated throughout all relevant networkentities to provide, as much as possible,end-to-end preferential treatment. The manner in which end-to-end preferential treatment is provided is outside the scope of this standard.
The following four possibilities are to be considered for calls that require preferential treatment:l) Originate from a UA at a location authorized for preferential treatment services and
terminate at a UA at any general location.
2) Originate from a UA at a location authorized for preferential treatment services andterminate at a UA at a location that is authorized for preferential treatment services.
3) Originate from a UA at a general location and terminate at a UA at a location authorized forpreferential treatment services.
4) Originate from a UA at a general location and terminate at a UA at any general location.Authentication itself can be subdivided into two (or sometimes three) components: The first isreceipt of identification information, which identifies the preferential service requester. The secondis receipt of identification verification information that allows the network to verify the accuracy ofthe requester’s claimed identity when placing a preferential service call, so that the information canbe propagated to all relevant entities in the network，should the call be authorized. The thirdcomponent，necessary in some situations，may require validating the identity against a database ofauthenticated identities.
Another factor that can impact authentication is whether preferential treatment for access will beauthorized on a:
·per call basis, or a subscription basis.
Currently, identification and authentication are combined through the use of a personal identificationnumber (PIN) presented by the caller after dialling an access number for enabling preferentialtreatment. This PIN may be validated against a PIN database to determine authorized services.PINbased authentication actually authenticates the requester, not the device being used when making therequest, and thus allows preferential treatment requests to be initiated from any device. Also, thisapproach allows calls that require preferential treatment to be originated from circuit switchedtelephone devices attached to private PBX systems.The PlN based authentication approach wasdesigned specifically for per call requests. IPCablecom2-enabledinfrastructures shouldaccommodate this legacy approach along with providing other forms of identification andauthentication for VolP-based calls using the session initiation protocol (SIP).
Appendix lll of [ITU-T J.360] and [b-ITU-T J.366.8] include the three SIP authenticationmechanisms specified in [b-IETF RFC 3261]:
usage of HTTP authentication (section 22), also referred to as Digest Authentication;usage of transport layer security (section 26.2.1), based on TLS; and usage of network layer security (section 26.2.1), based on lPsec.
Identification of the calling and called party in IPCablecom2 networks is supported by SIP registration. Authentication of the called party is supported for services requiring preferential treatment by including a PIN with SIP digest or SIP over TLS or SIP over IPSec mechanisms.ANSI SCTE 173-3 pdf download.