 is based on the concept of a 'confirmed area'. The idea is that when a user authenticates its clean identity with a proxy, the proxy can share this authenticated identity (the confirmed identity) with all the other proxies in the confirmed area. A confirmed area is a totality of proxies that have a mutual configuration of security association. Such association of security represents a confidence between proxies. When a proxy in a confirmed area authenticates the identity of the author of a message, it adds a new letterhead to the message containing the confirmed identity of the user. Such an identity can be employed by all other proxies belonging to the confirmed area. Using this mechanism the client UAC, is capable of identifying himself to a proxy UAS, to an intermediate proxy or to a registration proxy. Therefore, the SIP authentication is applied only to the end-to-end or end-to-proxy com- munication; the authentication proxy-by-proxy would have to count on other mechanisms such as IPsec or TLS. The procedure of authentication is executed when the UAS, the proxy inter- mediate, or the necessary recording proxy for the call of the UAC is authen- ticated before accepting the call or the recording. At the start of the message the UAS sends a request of SIP message (e.g., INVITE). On receipt of this message, the UAS, proxy, or proxy of recording decides that authentication is necessary and sends the client a specific SIP error message for the request of authentication. This message of error represents a challenge. When the message error 401 (Unauthorized) is sent by UAS and recording, the mes- sage error 407 (Proxy Authentication Required) is sent by proxy sever. The UAC receives the error message, calculates the reply, and includes it in a new C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security Client Server Server INVITE 407 Authentification INVITE INVITE Ringing Ringing FIGURE 21.9 Authentication SIP. message of SIP request. Figure 21.9 shows the sequence of message for th