Last ned (Gratis)

Abstrakt

With the increased demand for mobility support in VoIP, a SIP
Handover Extension has been proposed. This paper discusses and
analyses the security threats to this extension. Dierent usage scenarios
for the Handover Extension are identied. For each scenario we
identify known threats, and discuss how to counter them using known
security mechanisms. The Handover Extension is particularly vulnerable
to wiretapping call-hijacking. Further we argue that all identied
threats can be countered using known security mechanisms, and propose
S/MIME as the best countermeasure, but with an added price of
increased complexity.

Referanser

[1] N. Banerjee, S. K. Das, and A. Acharya. SIP-based Mobility Architecture
for Next Generation Wireless Networks. In Pervasive Computing and
Communications, 2005. PerCom 2005. Third IEEE International Conference
on, pages 181{190. IEEE Computer Society, March 2005.
[2] P. Bellavista, A. Corradi, and L. Foschini. SIP-Based Proactive Hando
Management for Session Continuity in the Wireless Internet. In 26th IEEE
94 The Norwegian Information Security Conference (NISK) 2009
International Conference on Distributed Computing Systems Workshops 2006,
(ICDCSW06), pages 69{69. IEEE Computer Society, July 2006.
[3] E. S. Boysen and T. Maseng. Seamless handover in heterogeneous networks
using SIP: A proactive handover scheme with the Handover Extension.
International Journal on Advances in Internet Technologies, 2, 2009.
[4] T. Dierks and E. Rescorla. The Transport Layer Security (TLS) Protocol
Version 1.2. RFC 5246 (Proposed Standard), Aug. 2008.
[5] ETSI. TS 101 329 -2 v2.1.3 (2002-01) Telecommunications and Internet
Protocol Harmonization Over Networks (TIPHON) Release 3; End-to-end
Quality of Service in TIPHON systems; Part 2: Denition of speech Quality of
Service (QoS) classes. www.etsi.org, 2002.
[6] H. Fathi, S. S. Chakraborty, and R. Prasad. On SIP session setup delay for
VoIP services over correlated fading channels. IEEE Transactions on Vehicular
Technology, 55(1):286{295, January 2006.
[7] J. Franks, P. Hallam-Baker, J. Hostetler, S. Lawrence, P. Leach, A. Luotonen,
and L. Stewart. HTTP Authentication: Basic and Digest Access Authentica-
tion. RFC 2617 (Draft Standard), June 1999.
[8] A. M. Hagalisletto and L. Strand. Formal Modeling of Authentication in
SIP Registration. In Second International Conference on Emerging Security
Information, Systems and Technologies, 2008. (SECURWARE \'08), pages 16{
21. IEEE, August 2008.
[9] M. Handley, V. Jacobson, and C. Perkins. SDP: Session Description Protocol.
RFC 4566 (Proposed Standard), July 2006.
[10] A. D. Keromytis. Voice over IP: Risks, Threats and Vulnerabilities. In Cyber
Infrastructure Protection Conference 2009. CIP 2009, June 2009.
[11] R. Mahy, B. Biggs, and R. Dean. The Session Initiation Protocol (SIP)
\\Replaces\" Header. RFC 3891 (Proposed Standard), Sept. 2004.
[12] R. Mahy and D. Petrie. The Session Initiation Protocol (SIP) \\Join\" Header.
RFC 3911 (Proposed Standard), Oct. 2004.
[13] P. Park. Voice over IP Security. Cisco Press, 1 edition, Sept. 2008.
[14] B. Ramsdell. Secure/Multipurpose Internet Mail Extensions (S/MIME) Version
3.1 Certicate Handling. RFC 3850 (Proposed Standard), July 2004.
[15] B. Ramsdell. Secure/Multipurpose Internet Mail Extensions (S/MIME) Version
3.1 Message Specication. RFC 3851 (Proposed Standard), July 2004.
[16] J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson,
R. Sparks, M. Handley, and E. Schooler. SIP: Session Initiation Protocol. RFC
3261 (Proposed Standard), June 2002.
[17] H. Schulzrinne, S. Casner, R. Frederick, and V. Jacobson. RTP: A Transport
Protocol for Real-Time Applications. RFC 3550 (Standard), July 2003.
The Norwegian Information Security Conference (NISK) 2009 95
[18] D. Sisalem, J. Floroiu, J. Kuthan, U. Abend, and H. Schulzrinne. SIP Security.
WileyBlackwell, Mar. 2009.
[19] E. Tews and M. Beck. Practical attacks against WEP and WPA. In Proceedings
of the second ACM conference on Wireless network security, pages 79{86. ACM,
2009.
[20] S. Tsiakkouris and I. Wassell. PROFITIS: Architecture for Location-based
Vertical Handovers Supporting Real-Time Applications. In 25th IEEE
International Performance, Computing, and Communications Conference, 2006
(IPCCC 2006), pages 629{634. IEEE, April 2006.
[21] Voice over IP Security Alliance (VOIPSA). VoIP Security and Privacy Threat
Taxonomy, Release 1.0. Web: http://voipsa.org/Activities/taxonomy.php,
October 2005. Accessed: 21 Aug 2009.
[22] W. Wu, N. Banerjee, K. Basu, and S. K. Das. SIP-based vertical hando
between WWANs and WLANs. IEEE Wireless Communications, 12(3):66{72,
June 2005.
[23] C.-H. Yeh, Q. Wu, and Y.-B. Lin. SIP Terminal Mobility for both IPv4
and IPv6. In 26th IEEE International Conference on Distributed Computing
Systems Workshops (ICDCS), pages 53{53. IEEE, July 2006.



Forrige artikkel      Neste artikkel