This post is deals with some less known real world implication of developing and integrating WebRTC with telecom service providers network and bring the solution in action . The regulatory and legal constrains are bought to light after the product is in action and are mostly result of short sightedness . The following is a list of factors that must be kept in mind while webRTC solution is in development stages
- WebRTC services from telecom provider depend on the access technology, which may differ if the user accessing the network through a third party Wi-Fi hotspot.
- User/network type may also dictate if decryption of the media is possible/required.
- For Peer-to-Peer paths, media could be extracted through the use of network probes or other methodology
Then there are Other Considerations such as specific services, for example if WebRTC is used to create softphones software permitting users to receive or originate calls to the PSTN, the current view is to treat this as a fully interconnected VoIP service subject to all the rules that apply to the PSTN – regardless of technologies employed.
CALEA
Communications Assistance for Law Enforcement Act (CALEA) , a United States wiretapping law passed in 1994, during the presidency of Bill Clinton.
- CALEA requirement for an LTE user may be very different than the CALEA requirements for a user accessing the network through a third party Wi-Fi hotspot.
- For media going through the SBC, CALEA may use a design similar to existing CALEA designs.
Read more on WebRTC Security here which discusses SOP (single origin policy ) , CORs ( cross origin requests) , JSONP , ICE , location sharing , scerensharing , Long term access to camera and microphone , SRTP DTLS as well as best practises for secure communication
VoIP and WebRTC platform security largely depend on the underlying protocols such as SIP . SIP is an robuts and time tested VoIP proctol to facilitate VoIP calls . To learn more about SIP security against atacks like
- Registration Hijacking
- Impersonating a Server
- Temparing Message bodies
- mid-session threats like tearing down session
- Denial of Service and Amplification
Also security mechnisms like
- Full encryption vs hop by hop encrption
- Transport and Network Layer Security
- SIP over TLS
- SRTP
Read more about Certificates , compliances and Security in VoIP which summarized
- HIPAA (Health Insurance Portability and Accountability Act) ,
- SOX( Sarbanes Oxley Act of 2002) ,
- Privacy Related Compliance certificates like COPPA (Children’s Online Privacy Protection Act ) of 1998 ,
- CPNI (Customer Proprietary Network Information) 2007 ,
- GDPR (General Data Protection Regulation) in European Union 2018,
- California Consumer Privacy Act (CCPA) 2019 ,
- Personal Data Protection Bill (PDP) – India 2018 and
- also specificatiosn against Robocalls and SPIT ( SPAM over Internet Telephony) among others
Read about General Data Protection Regulation (GDPR) in VoIP
Telecom R & D 