A session border controller (SBC) is a network element deployed to protect SIP based voice over Internet Protocol (VoIP) networks.
Early deployments of SBCs were focused on the borders between two service provider networks in a peering environment. This role has now expanded to include significant deployments between a service provider's access network and a backbone network to provide service to residential and/or enterprise customers.
The term "session" refers to a communication between two or more parties – in the context of telephony, this would be a call. Each call consists of one or more call signaling message exchanges that control the call, and one or more call media streams which carry the call's audio, video, or other data along with information of call statistics and quality. Together, these streams make up a session. It is the job of a session border controller to exert influence over the data flows of sessions.
The term "border" refers to a point of demarcation between one part of a network and another. As a simple example, at the edge of a corporate network, a firewall demarcates the local network (inside the corporation) from the rest of the Internet (outside the corporation). A more complex example is that of a large corporation where different departments have security needs for each location and perhaps for each kind of data. In this case, filtering routers or other network elements are used to control the flow of data streams. It is the job of a session border controller to assist policy administrators in managing the flow of session data across these borders.
The term "controller" refers to the influence that session border controllers have on the data streams that comprise sessions, as they traverse borders between one part of a network and another. Additionally, session border controllers often provide measurement, access control, and data conversion facilities for the calls they control.
Functions
SBCs commonly maintain full session state and offer the following functions: Security – protect the network and other devices from: Malicious attacks such as a denial-of-service attack (DoS) or distributed DoS Toll fraud via rogue media streams Malformed packet protection Encryption of signaling (via TLS and IPSec) and media (SRTP) Connectivity – allow different parts of the network to communicate through the use of a variety of techniques such as: NAT traversal SIP normalization via SIP message and header manipulation IPv4 to IPv6 interworking VPN connectivity Protocol translations between SIP, SIP-I, H.323 Quality of service – the QoS policy of a network and prioritization of flows is usually implemented by the SBC. It can include such functions as: Traffic policing Resource allocation Rate limiting Call admission control ToS/DSCP bit setting Regulatory – many times the SBC is expected to provide support for regulatory requirements such as: emergency calls prioritization and lawful interception Media services – many of the new generation of SBCs also provide built-in digital signal processors (DSPs) to enable them to offer border-based media control and services such as: DTMF relay and interworking Media transcoding Tones and announcements Data and fax interworking Support for voice and video calls Statistics and billing information – since all sessions that pass through the edge of the network pass through the SBC, it is a natural point to gather statistics and usage-based information on these sessions.
With the advent of WebRTC some SBCs have also assumed the role of SIP to WebRTC Gateway and translate SIP. While no one signalling protocol is mandated by the WebRTC specifications, SIP over WebSockets (RFC 7118) is often used partially due to the applicability of SIP to most of the envisaged communication scenarios as well as the availability of open source software such as JsSIP. In such a case the SBC acts as a gateway between the WebRTC applications and SIP end points.
Applications
SBCs are inserted into the signaling and/or media paths between calling and called parties in a VoIP call, predominantly those using the Session Initiation Protocol (SIP), H.323, and MGCP call-signaling protocols.