HMU Support for RTP to SRTP Interworking

The Oracle® Enterprise Session Border Controller (E-SBC) supports RTP to SRTP Interworking by monitoring and correcting unexpected changes to session continuity information. You enable the hide-egress-media-update parameter on the applicable inbound media-sec-policy to enable this support on traffic that comes into this realm as RTP and egresses the outbound realm as SRTP, referred to as single-ended SRTP terminations.

RFC 3350 does not require RTP to maintain sequential packet sequence numbering. In contrast, STRP does not allow significant packet sequence number changes or resets to zero. To compensate for this, the E-SBC can watch for these changes and, if necessary, calculate and transmit the correct values to the SRTP end station.

When configured to support RTP to SRTP interworking, the HMU function latches previous sequence numbers, SSRCs, and timestamps from RTP packets and watches for changes to ensuing sequence numbers on an ongoing basis. Sequence number changes the HMU feature acts on include resets to zero and jumps downward. HMU hides these changes from the SRTP end station. The HMU logic performs calculations on the latched sequence number, and populates the egress packet with a new sequence number, which the SRTP end station can recognize as valid.

SRTP considers downward sequence number changes greater than 127 as indicating the packet is a replay packet that should be discarded. This HMU function monitors for sequence number decreases greater than 127 and resets to zero. If the E-SBC detects one of these changes, it invokes the HMU logic, which sets the prescribed values in the SRTP traffic before egress.

To configure this function, you enable the hide-egress-media-update parameter on the inbound traffic for the RTP realm's media-sec-policy. The configuration applies the HMU logic only to inbound RTP traffic.

media-sec-policy
        name                                    hmu-rtp-side
        pass-through                            disabled
        options                                 
        inbound
                profile                                 
                mode                                    rtp
                protocol                                none
                hide-egress-media-update                enabled
        outbound
                profile                                 
                mode                                    rtp
                protocol                                none

Apply the name of this policy to the RTP realm's media-sec-policy parameter to complete the configuration.

Note:

Configuration on the ingress realm differs from standard HMU configuration, which you configure on the egress realm. Similarly, bi-directional HMU is not relevant within the context of RTP to SRTP interworking.

For example, consider configuring for single-ended SRTP sessions between a core (unencrypted) realm and a peer (encrypted) realm. To do this, you configure the core realm media security policy (inbound and outbound) to RTP mode. In addition, you configure the peer realm media security policy (inbound and outbound) to SRTP mode. After the E-SBC establishes the session flows through signaling, it applies the media security policy to ingress RTP packets from the inbound realm and transmits them via the outbound realm as SRTP. It is significant to note that enabling the hide-egress-media-update is the only reason to apply a media security policy to RTP traffic.

This call flow depicts the E-SBC using HMU to support this RTP to SRTP interworking. The call sets up normally with RTP and SRTP interworking properly. The RE-INVITE from UE #1 triggers the HMU logic, which manages the RTP packet sequence numbers and prevents the SRTP leg from dropping media packets, or eventually, the call.

This feature extends upon the HMU feature, which operates when you apply the hide-egress-media-update parameter to all media traffic on a realm. This use of the hide-egress-media-update allows you to limit HMU processing to the targeted RTP and SRTP interworking traffic.

Note:

HMU is not supported for RTCP or SRTCP packets. Regardless of HMU configuration, the E-SBC supports only up to 7 SSRC changes per SRTP session. Also, if HMU is disabled, the E-SBC supports only up to 7 SSRC changes per SRTP session for RTP and RTCP packets.

Refer to the section on Hiding Problematic Media Updates for general information on HMU, including the HMU state machine, RTC and HA support.