Security Challenge and Defense in VoIP Infrastructures

Voice over Internet protocol (VoIP) has become a popular alternative to traditional public-switched telephone network (PSTN) networks that provides advantages of low cost and flexible advanced ldquodigitalrdquo features. The flexibility of the VoIP system and the convergence of voice and data networks brings with it additional security risks. These are in addition to the common security concerns faced by the underlying IP data network facilities that a VoIP system relies on. The result being that the VoIP network further complicates the security assurance mission faced by enterprises employing this technology. It is time to document various security issues that a VoIP infrastructure may face and analyze the challenges and solutions that may guide future research and development efforts. In this paper, we examine and investigate the concerns and requirements of VoIP security. After a thorough review of security issues and defense mechanisms, we focus on attacks and countermeasures unique to VoIP systems that are essential for current and future VoIP implantations. Then, we analyze two popular industry best practices for securing VoIP networks and conclude this paper with further discussion on future research directions. This paper aims to direct future research efforts and to offer helpful guidelines for practitioners.     

Integrated management architecture for IP-based networks

IP telephony will bring about a dramatic change in the way IP services are planned, provisioned, managed, and billed. In order to build and retain a strong customer base for these new services, service providers need to meet, if not exceed, the customer expectations set by today's traditional voice services. Acceptance of IP telephony will depend on the quality and efficiency with which service providers offer, deliver, and manage IP services. Installation, configuration, and activation must be rapid and error-free. Furthermore, customers will want direct control over the reconfiguration of services and real-time visibility into the impact change has on their operating costs. Once the service is activated, customers will want the provider to guarantee service quality as defined by industry standards. Corporate customers in particular will need to be assured that the provider is proactively monitoring performance to avoid problems and providing them visibility into the performance data collected. This article discusses an integrated management support system for IP-based networks illustrating the functions needed to support the unique challenges of managing VoIP services. An example of a service management system is also described     

Blocking attacks on SIP VoIP proxies caused by external processing

As Voice over IP (VoIP) applications become increasingly popular, they are more and more facing security challenges that have not been present in the traditional Public Switched Telephone Network (PSTN). One of the reasons is that VoIP applications rely heavily on external Internet-based infrastructures (e.g., DNS server, web server), so that vulnerabilities of these external infrastructures have an impact on the security of VoIP systems as well. This article presents a Denial of Service (DoS) attack on VoIP systems by exploiting long response times of external infrastructures. This attack can lead the whole VoIP system in a blocked state thus reducing the availability of its provided signalling services. The results of our experiments prove the feasibility of blocking attacks. Finally, we also discuss several defending methods and present an improved protection mechanism against blocking attacks.     

基于RTP协议的IP电话QoS监测及提高策略

介绍了多媒体通信的发展趋势和当前存在的问题,对基于RTP协议的网络电话中音频数据传输技术进行了研究,对影响实时传输质量QoS的典型因素进行了分析。在局域网的环境下进行了语音包分析实验,探讨了基于RTP协议的QoS动态监测方法,并提出可行的改进方案。     

Variable bit rate VOiP in IEEE 802.11e wireless LANs [medium access control protocols for wireless LANs]

WLANs have become a ubiquitous networking technology deployed everywhere. Meanwhile. VoIP is one popular application and a viable alternative to traditional telephony systems due to its cost efficiency. VoIP over WLAN (VoWLAN) has been emerging as an infrastructure to provide low-cost wireless voice services. However, VoWLAN poses significant challenges due to the characteristics of contention-based protocols and wireless networks. In this article we propose two mechanisms to provide quality of service for variable bit rate VoIP in IEEE 802.11e contention-based channel access WLANs: access time-based admission control and access point dynamic access. Simulation results are conducted to study these schemes.     

VoIP — Panacea or PIG's Ear?

Voice over IP (VoIP) hit the headlines during the mid-1990s amid claims concerning its potential impact upon existing switched-circuit telephony services. While VoIP has provided a focus for much debate within the industry, there has been a clear gulf between the marketing hype and the technological reality of what VoIP really is and what it can offer. This paper examines VoIP as a technology, considering some of the drivers for meriting its application within the communications industry, introduces the key aspects that need to be considered and indicates the nature of the scope of opportunities afforded.     

Voice over IP service and performance in satellite networks

Voice over IP services have emerged as a low-cost alternative to PSTN voice service, and an attractive solution for voice/data integration in public and private networks. Satellite systems, as an integral part of the global communications infrastructure, already have an increasing portion of their capacities used to carry data packets, and with their global coverage and reach to remote areas are well positioned to enable growth of VoIP services. For VoIP over satellite, several issues need to be addressed. These include transmission and quality of service issues, as well as service-related issues such as service creation and customization, support of IN and supplementary services, and seamless integration with the PSTN. While the service-related aspects of VoIP are common to both terrestrial and satellite networks, transport-related issues are different. This article reports performance results of laboratory experiments for evaluating VoIP over satellite under different link and traffic conditions     

VoIP mobility in IP/cellular network internetworking

This article explores VoIP mobility in the context of IP and cellular networks interworking. ITU-T Rec. H.323 gateways provide the interconnection between IP networks and switched circuit networks. They allow a call originating from an SCN phone to be transmitted over an IP network to an H.323 terminal, or bridged to another SCN phone. While H.323 provides interoperability with other SCN terminals, the major efforts have been focused on IP/wired SCN (PSTN, ISDN, etc.) interworking. In this article we discuss the challenges associated with the interworking between IP networks and cellular networks through H.323 gateways, and propose an innovative approach using the existing call transfer supplementary service to provide VoIP mobility in the H.323 IP telephony networks. The proposed approach uses existing components in the H.323 standard, thereby allowing VoIP mobility service in hybrid IP/cellular networks to be a value-added feature in the existing H.323-compliant Internet telephony systems     

SIP security issues: the SIP authentication procedure and its processing load

Session Initiation Protocol (SIP) is currently receiving much attention and seems to be the most promising candidate as a signaling protocol for the current and future IP telephony services, also becoming a real competitor to the plain old telephone service. For the realization of such a scenario, there is an obvious need to provide a certain level of quality and security, comparable to that provided by the traditional telephone systems. While the problem of QoS mostly refers to the network layer, the problem of security is strictly related to the signaling mechanisms and the service provisioning model. For this reason, at present, a very hot topic in the SIP and IP telephony standardization track is security support. In this work, the security model used by SIP is described, and the different open issues are highlighted. We focus, in particular, on the problem of authentication providing a short tutorial on the solution under standardization. The architecture of a possible commercial IP telephony service including user authentication is also described. Finally, we focus on performance issues. By means of a real testbed implementation, we provide an experimental performance analysis of the SIP security mechanisms, based on our open source Java implementation of a SIP proxy server. The performance of the server has been compared with and without security support, under various scenarios.     

VoIP信令协议SIP和H.323的比较

VoIP系统凭借其低廉的话费和较好的语音质量,已经成为重要的电信业务,并有取代传统长途业务的趋势.许多组织研究并制定了IP网络上呼叫的协议标准,但有两种IP电话信令和控制标准最具有影响力.一种是ITU推荐的H.323协议,另一种是IETF的SIP.这两种协议代表了解决同一问题的两种不同的方法:H.323是信令基于ISDN Q.931和早期推荐的H系列协议的传统的电路交换的方法,而SIP是一种支持基于HTTP的IP网络的超轻量协议标准.本文,我们主要针对SIP和H.323的体系结构,可靠性,复杂性,可扩展性,可伸缩性以及支持业务类型方面进行比较.     

基于SIP协议的IP电话语音系统设计与实现

本文基于SIP协议的IP电话作为主要研究内容,探讨了IP电话的相关议、相关标准和关键技术,对SIP电话协议进行了研究分析,设计提出一套结构合理的VoIP系统,并对系统组成、系统流程等作了详细的规划,安装配置OpenSER服务器,并能够使用MySql数据库系统来存储用户信息,基于分层设计的思想设计了客户端软件,最后利用该软件进行了系统测试,结果表明系统性能优良。     

Mobile Internet telephony: mobility extension to H.323

This paper studies mobility extensions to ITU-T Rec. H.323 for the support of mobile Internet telephony. Internet telephony, also known as voice-over Internet protocol (IP) (VoIP), requires the transmission of two-way and real-time traffic over IP-based networks. The current version of H.323 allows IP telephony and the interoperability of the Internet with switched circuit networks (SCN). However, VoIP mobility has not been previously widely considered, where VoIP mobility refers to the mobility within the scope of IP telephony. We focus on terminal mobility for VoIP. We investigate the influence of mobility on the H.323 layer and propose an H.323 mobility solution to be implemented over the IP layer. Two approaches to mobility extensions to H.323 are described: using ad hoc multipoint conference expansion and using IP multicasting to emulate mobility. Besides, we have also shown that the proposed ad hoc expansion approach shares many properties with the alternative of using IP multicasting for mobility. Hence, the call signaling procedure for the ad hoc expansion approach is also applicable to the multicasting approach. Since ad hoc multipoint expansion has been defined in H.323, our solution introduces no additional entities to H.323 and requires minimal modifications to the existing H.323 protocol. Such mobility extensions can serve as a value-added feature for the Internet telephony systems compliant to the H.323 standard     

VoIP网络信息安全研究

VoIP是基于分组交换的话音传输技术,与基于电路交换的传统电话架构有很大的不同。导致了VoIP网络特有的安全问题。另外,VoIP网络的实时性要求高,由于IP网络服务自身的特性以及各种安全策略的应用,给VoIP网络的性能和服务质量提出了挑战。对VoIP网络存在的安全威胁及各种安全措施进行分析,并对VoIP系统的部署和VoIP管理政策的制定提出建议。     

VoIP网络电话技术及其应用

介绍了VoIP网络电话出现的背景产生及优势;讨论了VoIP通信网络的体系结构;研究了局域网PBX的体系结构及特征;分析了VoIP网络电话的信令协议;介绍了VoIP网络电话技术的应用及其特点。     

Low‐cost and high‐performance: VoIP monitoring and full‐data retention at multi‐Gb/s rates using commodity hardware

Voice over IP (VoIP) is increasingly replacing the old public switched telephone network (PSTN) technology. In this new scenario, there are several challenges for VoIP providers. First, VoIP requires a detailed monitoring of both users' quality of service (QoS) and experience (QoE) to a greater extent than in traditional PSTNs. Second, such a monitoring process must be able to track VoIP traffic in high‐speed networks, nowadays typically of multi‐Gb/s rates. Third, recent government directives require that providers retain information from their users' calls. Similarly, the convergence of data and voice services allows operators to provide new services such as full‐data retention, in which users' calls can be recorded for either quality assessment (call centers, QoE) or security purposes (lawful interception). This implies a significant investment in infrastructure, especially in large‐scale networks which require multiple points of measurement and redundancy. This paper proposes a novel methodology, architecture and system to fulfill such challenges, called VoIPCallMon, as well as the data structures and necessary hardware‐tuning knowledge for its development. As distinguishing features, VoIPCallMon provides very high performance, being able to process VoIP traffic on‐the‐fly at high bitrates, novel services and significant cost reduction by using commodity hardware with minimal interference with operational VoIP networks. The performance evaluation shows that the system copes with the VoIP load of real‐world operators. We further evaluated the system performance at a fully saturated 10 Gb/s link and no packet loss was reported, therefore demonstrating the potential of commodity hardware solutions. Copyright © 2014 John Wiley & Sons, Ltd.     

Leveraging countermeasures as a service for VoIP security in the cloud

The emergence of cloud computing is contributing to the integration of multiple services, in particular VoIP services. While the cloud has recently been used for performing security attacks targeting IP telephony, it also provides new opportunities for supporting the security of this service. In that context, we propose a risk management strategy for VoIP cloud based on security countermeasures that may be outsourced as services. We present the architecture of our solution and its components in the context of services implementing the SIP protocol. We describe the mathematical modelling supporting our approach and detail different treatment strategies for the application of countermeasures. Finally, we quantify the benefits and limits of these strategies based on extensive simulation results. When a countermeasure fails, these strategies allow us to maintain the risk level low at an additional cost of up to 7%, or to accept an additional risk of up to 12%. They can also be combined to obtain a trade‐off between cost and performance. Copyright © 2013 John Wiley & Sons, Ltd.     

Regulatory challenges for the transition of public telephony to the Internet

Fixed and mobile telephony with other telecommunication services are moving to a fundamentally different infrastructure as the transition proceeds from the public telephone network to the Internet. There are many opportunities to make significant progress on major developments such as separation of operator independent functions, modular design, and the integration of other desirable features of sustainable Internet solutions. This progress also means that the impacts of some shortcomings of currently competitive telephony services will decline??another benefit of the transition. However, because telephony services are essentially being ??emulated?? over the Internet infrastructure, other aspects of these services will be changed in ways that could affect the public good. In particular, trust-related issues such as authentication and validation, along with their business implications, present significant challenges. This paper explores these issues, including the opportunity that industry and the regulators now have to address them, and suggests approaches to sustainable solutions that can benefit all the stakeholders in this transition.     

Packets in peril [voice over IP security issues]

Finally, after a number of false starts and much scepticism from the telecommunications establishment, voice over IP (VoIP) services are finally starting to take off in many countries around the world. However, as the VoIP wave begins to swell, with significant amounts of traffic migrating from traditional public networks onto this new technology, questions about its security and reliability are starting to arise, both from users and governments. This article first examines the various VoIP services available and then outlines the security threats to them along with measures to counteract there threats.     

Middleware 2007 Works in Progress

We propose a Web-service-based P2P architecture for VoIP called service-oriented VoIP. SOVoIP provides interoperability between protocols from both telephony and data networks using the converging behavior of Web services while ensuring security, extendability, and mobility. We also address other critical issues related to VoIP such as network address translation and firewall traversal, Enhanced 911, and the Communication Assistance for Law Enforcement Act. SOVoIP also provides modularity and reusability, making client development easier. Extendability in the Web service architecture is transparent to the client, so frequent client updates aren't required in order to consume new features. This reduces the time and money spent on upgrades.     

VoIP reliability: a service provider's perspective

Voice over IP services offer important revenue-generating opportunities, as well as many technical challenges in providing high-quality services. Users have come to expect highly available telecommunications services with high-quality voice. Service providers need reliable high-performance networks to meet user expectations, and must be able to guarantee performance and reliability to their customers. In converged voice and data networks, the network infrastructure must deliver very high quality and availability for some customer needs, while also providing low-cost high-capacity bandwidth for other needs. The use of quality of service mechanisms to provide prioritization for various traffic types is a key element needed for voice and data network convergence. However, it is not sufficient if the underlying networks are unreliable. The focus of this article is to address the reliability aspects of VoIP services, including the underlying IP networks.