Session Border Controller (SBC) software performs many different and important roles in communications systems, from fraud prevention to load balancing, across service provider and enterprise networks. Below you can find the most common Session Border Controller use cases, featuring customer case studies that demonstrate their real-world applications. For ProSBC configuration manuals, please visit TB Wiki.
This article is based on the TelcoBridges past webinar.
You can watch recording here.
The goal of peering is to establish connectivity between service providers, typically linking a wholesale VoIP provider with another provider. This could be a regional, small, or midsize service provider, or even a UCaaS provider that offers SBC functionality.
These SBCs manage traffic and call routing, often handling mediation and call detail record (CDR) functionality to track expenses. Generally, they are deployed in the core of a service provider’s network. This approach is quite straightforward, typically implemented with our ProSBC on one end and, frequently, another vendor’s session border controller on the other.
SMB Access is a highly popular use case for ProSBC, often regarded as one of our most sought-after applications. In this scenario, a service provider connects to a soft switch or IP PBX platform, which may include a registrar and billing systems within their cloud infrastructure. This setup allows the provision of telephone services to small and medium-sized businesses (SMBs) and enterprises, but it comes with challenges, particularly concerning NAT traversal. The small IAD/router uses network address translation to assign IP addresses to the IP phones and different devices, and the session border controller must navigate this NAT transition while keeping firewall ports open.
ProSBC is responsible for managing NAT traversal and registration forwarding, ensuring that registrations from IP phones are correctly sent to the registrar. Session capacity is crucial, aiming to support multiple SMBs or enterprises—ideally thousands. High performance is essential for delivering voice and traffic efficiently, and having analytics and management connectors is important for effectively provisioning and managing the setup between the SMBs.
This use case typically involves large businesses or enterprise networks with IP PBX systems that collaborate with various operators, including toll-free, inbound DIDs, and international providers. These customers often adopt a “bring your own trunking” model, sourcing services from multiple operators. To effectively integrate and normalize these services within their Internet Protocol (IP) PBX applications, they require interoperability and application protection.
ProSBC plays a key role in providing interoperability and protecting applications from potential threats, especially with international inbound services. Additionally, ProSBC manages outbound call routing, ensuring the right operator handles each call and balancing the load when routing traffic or handling operator outages. This comprehensive SIP trunking solution is popular among enterprise customers due to its flexibility and robust security.
In this scenario, an operator works with one or more SIP trunk providers and wants to ensure full redundancy between their softswitches, customers, and operators. They achieve this by deploying two active ProSBC servers, both running live full-time.
Through routing rules set in the softswitch, ProSBC, and SIP trunking provider, backup routes are established for all traffic. This setup ensures that if one system fails, traffic is automatically redirected, preserving service continuity and call quality for end users. For example, if a trunk provider begins underperforming and the MOS score rises, ProSBC detects this and reroutes traffic to another provider. The same logic applies if a provider goes offline, a softswitch fails, or one of the SBCs crashes; the traffic is automatically rerouted, ensuring continuous service.
This applies to UCaaS providers, contact centers, or other unified communications platforms like CPaaS or collaboration services. These providers need to secure remote devices, whether telephones or soft clients, using SIP over TLS. Often, the UCaaS application prefers not to handle encryption directly, so ProSBC is responsible for managing this security.
In this setup, communication between the remote device and ProSBC is encrypted, which then decrypts it and sends it in the clear to the UCaaS or CPaaS application. Additionally, the SBC manages NAT traversal at remote offices and benefits from being cloud-native, as it can be deployed in a VMware cloud environment alongside the UCaaS application.
In this scenario, the SBC manages traffic to and from multiple operators for UCaaS applications in the cloud. These operators might provide toll-free numbers, inbound DIDs, or other services, often involving multiple international providers.
The SBC’s role here is to protect the UCaaS application, ensure interoperability, and handle traffic routing between the various operators. Whether the traffic is inbound or outbound, the SBC manages it seamlessly, supporting the UCaaS environment. This functionality is compatible with major CPaaS platforms like Twilio, Telestax, and RingCentral.
STIR/SHAKEN is a mechanism used to attach an encrypted certificate to a call from the originating service provider. This allows the terminating service provider to verify that the call’s origin is legitimate, ensuring that the originating provider knows the customer and can validate that the call is not illegally spoofed.
ProSBC facilitates the two key components: the STIR/SHAKEN authentication service, which creates the encrypted tokens, and the verification service, which validates these tokens when they reach their destination. This system helps terminate providers display information to end-users about whether the call is attested, meaning that the originating provider has confirmed the identity of the customer.
TDoS Protection is needed when bad actors flood a business or service provider with unwanted phone calls, often through SIP or TDM trunks. These attacks can be accidental or deliberate, potentially caused by extortion attempts, malfunctioning dialers, or illegal robocall campaigns. The result is that the end customer, such as a business, becomes overwhelmed with calls, tying up agents or administrative staff.
A key solution involves using cloud-based analytics or a reputation service. When ProSBC receives a call, it forwards the invite to the analytics platform, which determines whether the call is good, bad, or suspicious based on reputation and analytics. The call can then either be blocked, redirected to voicemail, or allowed through to the customer, screening out the worst offenders.
Typically, an SBC is positioned in the cloud or at the core of a service provider’s network, managing traffic alongside a soft switch. In this case, however, the aim is to create an intelligent edge by extending routing logic, traffic management, and other functions to the branch office or subscriber’s premises. This shift enables local handling of traffic and early filtering before it reaches the core network.
This setup is especially useful for customers with high call volumes. For instance, some universal CPE equipment makers and TDoS protection application vendors are adopting this approach, allowing SBC functionality to be virtualized at the customer’s location. This provides all the benefits of an SBC at the core, but with local traffic management tailored for each customer.
Last use case and probably one of the most complicated ones: CPaaS Enablement. In the past, we’ve worked with application developers wanting to build on a CPaaS platform, such as Twilio, Telestax, or RingCentral. They often need to connect with various operators—local, international, or DID operators—to bring in traffic. This requires traffic management, normalization, and SIP trunking interoperability. Developers prefer a cloud-based Session Border Controller (SBC), hosted on platforms like AWS or Azure, to align with their fully cloud-deployed environments.
One key feature they seek is media bypass, where the SBC manages signaling traffic only, while media from operators bypasses the cloud directly to the application. This approach significantly reduces data charges imposed by cloud providers like AWS.
There are literally thousands of central offices around the globe that are still depending on aging and end-of-life TDM (Digital) switches that are becoming increasingly difficult to maintain and expensive to operate. Many of these service providers are looking to IP-delivered services to facilitate consolidation of facilities and reduce operating costs while retaining their existing customers. Not only a technical challenge, but it also requires a new business model.
Facilitating and protecting user access to hosted applications, including gIP-PBX, Contact Center, Conferencing/Collaboration, Unified Communications and more…
Inspection of incoming and outgoing call traffic, measuring the associated risk of each call. Integrating with a Real-Time Fraud Protection service provider. Compatible with validated TelcoBridges Alliance Partners Youmail, TransNexus and JeraSoft
Securing the access points for Software as a Service offerings. With SIP/TLS and SRTP bypass, work-at-home or remote users can securely access hosted voice applications.
Resolving interoperability issues, providing traffic management and routing for SIP Trunking connectivity to major Software as a Service platforms.
