RFC3261: SIP:26.1.1 注册劫持

26.1.1 Registration Hijacking
26.1.1 注册劫持

   The SIP registration mechanism allows a user agent to identify itself to a registrar as a device at which a user (designated by an address of record) is located.  A registrar assesses the identity asserted in the From header field of a REGISTER message to determine whether this request can modify the contact addresses associated with the address-of-record in the To header field.  While these two fields are frequently the same, there are many valid deployments in which a third-party may register contacts on a user's behalf.

SIP注册机制允许用户代理向注册器将其自身标识为用户（由记录的地址指定）所在的设备。注册器评估REGISTER消息的From报头字段中断言的身份，以确定该请求是否可以修改与To报头字段中的记录地址相关联的联系人地址。虽然这两个字段通常相同，但在许多有效的部署中，第三方可以代表用户注册联系人。

   The From header field of a SIP request, however, can be modified arbitrarily by the owner of a UA, and this opens the door to malicious registrations.  An attacker that successfully impersonates a party authorized to change contacts associated with an address-of-record could, for example, de-register all existing contacts for a URI and then register their own device as the appropriate contact address, thereby directing all requests for the affected user to the attacker's device.

然而，SIP请求的From报头字段可以由UA的所有者任意修改，这为恶意注册打开了大门。例如，成功模拟有权更改与记录地址相关联的联系人的一方的攻击者可以取消注册URI的所有现有联系人，然后将其自己的设备注册为适当的联系人地址，从而将受影响用户的所有请求定向到攻击者的设备。

   This threat belongs to a family of threats that rely on the absence of cryptographic assurance of a request's originator.  Any SIP UAS that represents a valuable service (a gateway that interworks SIP requests with traditional telephone calls, for example) might want to control access to its resources by authenticating requests that it receives.  Even end-user UAs, for example SIP phones, have an interest in ascertaining the identities of originators of requests.

这种威胁属于依赖于请求发起人缺乏加密保证的威胁家族。任何代表有价值服务的SIP UAS（例如，将SIP请求与传统电话呼叫交互的网关）都可能希望通过验证其接收到的请求来控制对其资源的访问。即使是最终用户UA，例如SIP电话，也有兴趣确定请求发起者的身份。

   This threat demonstrates the need for security services that enable SIP entities to authenticate the originators of requests.

这种威胁表明需要安全服务，使SIP实体能够对请求的发起人进行身份验证。