nd resume the music once the call is over via another DO. Extending SIP: The SIP Toolkit Laura Bob's radio Figure 6-18 Bob controls his radio (1) INVITE using SIP. (2) DO (3) 200 OK (4) 200 OK (5) ACK Conversation (6) BYE (7) 200 OK (8) DO set volume to 3/10 (9) 200 OK SIP Security The IETF community considers security a critical aspect of any protocol because the IETF designs protocols for use in the Internet, which is consid- ered a hostile environment. Internet users protect their transmissions in many ways against potential attackers. SIP users are no exception. It is important, however, not to confuse SIP security with the security of a SIP- enabled session. SIP security is concerned with the exchange of SIP sig- nalling. Hence, Bob can send an encrypted INVITE to Laura SO that nobody knows which kind of session they are establishing, but once the session is established, if they transmit unencrypted RTP packets, an eavesdropper will be able to hear the whole conversation. SDP, for instance, can carry cryptographic keys for encrypting media ses- sions. SIP users can exchange keys during session establishment and then use them to exchange media in a secure way. The remainder of this section focuses on SIP security (authentication, message integrity, and confiden- tiality) rather than on media security. How It's Done A major aspect of security is authentication. When Laura receives a SIP request from somebody claiming to be Bob, she wants to be sure that Bob is really the one sending the request. She needs a mechanism to check the identity of any caller. Chapter 6 Because SIP is based on HTTP, it can borrow HTTP authentication mechanisms used in the Web for message authentication based on user IDs and passwords. When somebody tries to view a restricted-access Web page, HTTP has to determine who the user is before it can decide whether to give him or her access. In SIP, these mechanisms are used to accept or reject a session invitation. Let's briefly analyze two different authentication schemes: basic and digest