Secure Signaling in Next Generation Networks with NSIS

The IETF working group next steps in signaling (NSIS) develops signaling protocols for quality-of-service (QoS) reservations or dynamic NAT and firewall (NAT/FW) configuration. QoS signaling allows for on-demand resource reservations in order to provide guaranteed quality-of-service for real-time oriented services in IP-based next generation networks whereas NAT/FW signaling allows for establishing pinholes in firewalls or bindings in NAT devices. QoS signaling must be secured to allow for a reliable accounting and NAT/FW configuration is a sensitive operation per se. This paper presents an approach that provides an integrity protection of NSLP signaling messages by extending an NSLP session authorization object. A worked example for secure QoS signaling in a Kerberos-secured domain is given.