SIP PAI Stripping

The Oracle Communications Session Border Controller now has the ability to strip P-Asserted-Identity (PAI) headers so that service providers can ensure an extra measure of security against malicious users pretending to be legitimate users. To pretend to represent another account, the malicious users simply send an INVITE with an imitation PAI. This feature allows real-time detection of such fraudulent use.

This feature uses a combination of:

DoS protection applied on a per-realm basis
SIP PAI header stripping

The combination of these settings can produce different results for the SIP PAI stripping feature.

SIP PAI header stripping enabled for an untrusted realm—If the PAI stripping parameter is set to enabled in a realm that is untrusted, then the Oracle Communications Session Border Controller strips the PAI headers from SIP INVITEs that are received from the external address, regardless of the privacy type. The Oracle Communications Session Border Controller then sends the modified INVITE (without the PAI). If the INVITE comes from a trusted realm, then the Oracle Communications Session Border Controller does not strip the PAI header and the system behaves as it does when you are using previous 1.3.1 releases.

The SIP PAI Header Stripping diagram is described above.

Multiple SIP PAIs in a SIP INVITE—The Oracle Communications Session Border Controller removes all PAIs when there are multiple PAIs set in SIP INVITEs that come from untrusted realms.
Oracle Communications Session Border Controller behavior bridging trusted and untrusted realms—The following graphics shows you how Oracle Communications Session Border Controllers can be positioned and configured to handle PAI stripping between trusted and untrusted realms.

This image shows PAI stripping between trusted and untrusted realms.

Realm Configuration Settings	REALM A	REALM B	REALM C
Realm designation trusted or untrusted (trust-me)	Disabled	Enabled	Enabled
SIP PAI stripping (pai-strip)	Enabled	Enabled or disabled	Disabled
SBC’s behavior	Strip PAI regardless of privacy type	Same as behavior for SIP privacy support in previous 1.3.1 releases	Same as behavior for SIP privacy support in previous 1.3.1 releases

SIP PAI Stripping Configuration

When you configure this feature, please note how the Oracle Communications Session Border Controller behaves when you combine the designation of a realm as trusted/untrusted and SIP PAI stripping is enabled. Enter the choices for the ACLI trust-me and pai-strip parameters accordingly.

Be aware that trust is also established in the session agent configuration, and that the trust level set in a session agent configuration overrides the trust set in a realm configuration. For example, a realm might have several endpoints, some of which are associated with session agents and some of which are not. The endpoints that have configured session agent will take their trust level from the session agent parameters you set; the other endpoints, ones that are not associated with session agents, take their trust level from the realm parameters you set.

Distinguishing SAs and endpoints to identify trust level.

Take this relationship into consideration when you configure SIP PAI header stripping, or this feature will not work as designed.

For the sample configuration cited below, the desired Oracle Communications Session Border Controller behavior is to always strip the PAI regardless of privacy type.

To configure SIP PAI stripping for an existing realm using the ACLI:

In Superuser mode, type configure terminal and press Enter.
```
ORACLE# configure terminal
```
Type media-manager and press Enter to access the media-manager path.
```
ORACLE(configure)# media-manager
```
Type realm-config and press Enter. The system prompt changes to let you know that you can begin configuring individual parameters.
```
ORACLE(media-manager)# realm-config
ORACLE(realm-config)#
```

Select the realm to which you want to apply this feature.

ORACLE(realm-config)# select
identifier:
1: acmePacket <none>           192.168.20.0/24
2: realm1     <none>           0.0.0.0
selection:2
ORACLE(realm-config)#

pai-strip—Enable PAI stripping. The default is disabled. Valid values are:
- enabled | disabled
```
ORACLE(realm-config)# pai-strip enabled
```
Save your work using the ACLI save or done command.