We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byJessica Kerr
Modified over 3 years ago
© 2006 NEC Corporation - Confidential age 1 November 2008 - 1 SPEERMINT Security Threats and Suggested Countermeasures draft-ietf-speermint-voipthreats-01 Saverio Niccolini, Eric Chen, Jan Seedorf, Hendrik Scholz
© 2006 NEC Corporation - Confidential November 2008 - 2 Goals / Scope Goals of the draft –List of security threats (specific) for SPEERMINT –Mapping of these threats to suggested countermeasures As information for implementers Also helping implementers choose proper means for addressing SPEERMINT security requirements (as defined in draft-ietf-speermint-requirements-07) Target: –Informational document for implementers
© 2006 NEC Corporation - Confidential November 2008 - 3 VoIP-SPECIFIC USE CASES IM/PRESENCE-SPECIFIC USE CASES VOIP-SPECIFIC REQUIREMENTS IM/PRESENCE-SPECIFIC REQUIREMENTS ARCHITECTURE MESSAGE FLOWS DNS SRV & NAPTR USE OTHER IMPLEMENTER DOCUMENTS (BCPs) TERMINOLOGY Contribution of the draft (related to SPEERMINT document flow chart) SPEERMINT Security Threats and Suggested Countermeasures: Informational Document
© 2006 NEC Corporation - Confidential November 2008 - 4 Security Requirements vs. concrete Solutions Security Requirements: draft-ietf-speermint-requirements-07 –This draft lists security requirements without stating concrete protocols or guidance on how to meet these requirements How to fulfill/meet the Security Requirements: draft-ietf-speermint-voipthreats-01 –This draft provides concrete protocols and solutions for meeting the requirements –As guidance for implementers who want to fulfill the security requirements for SPEERMINT –Section on security requirements (section 3) Currently only listing the security requirements Waiting for draft-ietf-speermint-requirements-07 to be finalized (IESG processing) Then addressing the requirements with text on protocols and solutions
© 2006 NEC Corporation - Confidential November 2008 - 5 Comments received for Version -00 at IETF 73 Minimization of SED suggested as countermeasure Included in the new -01 version Text regarding password cracking was misleading Changed Digest authentication onall requests was seen as unrealistic Removed PKI is assumed for TLS Added text
© 2006 NEC Corporation - Confidential November 2008 - 6 Changes since -00 version Addressed comments received (see previous slide) New threats –network discovery –unwanted requests New countermeasures –minimization of session establishment data –topology hiding Renamed / Restructured Countermeasures (see next slide) Editorial changes –Updated/removed references
© 2006 NEC Corporation - Confidential November 2008 - 7 Version -01: Suggested Countermeasures Suggested Countermeasures –Database Security BCPs –DNSSEC –DNS Replication –Cross-Domain Privacy Protection –Use TCP instead of UDP to deliver SIP messages –Ingress Filtering / Reverse-Path Filtering –Strong Identity Assertion –Reliable Border Element Pooling –Rate limit –Topology Hiding –Border Element Hardening –Minimization of Session Establishment Data –Encryption and Integrity Protection of Signalling Messages –Encryption and Integrity Protection of Media Stream
© 2006 NEC Corporation - Confidential November 2008 - 8 Current Issues / Discussion IPSec vs. TLS –IPSec is a lower-layer solution but often deployed and seen as sufficient for hop-to-hop SSP security –Requirements draft says: Even though SSPs may use lower layer security mechanisms to guarantee some of those security properties, candidate protocols for the LUF and LRF must meet the above requirements authentication/integrity/confidentiality]. –Opinions from the WG? Section on deployment (Comment received at IETF 71) –Are there other solutions besides DNSSEC which are not deployed yet?
© 2006 NEC Corporation - Confidential November 2008 - 9 How to proceed... We welcome any comments on this work on the mailing list –Are there additional threats missing / not considered? –Are there countermeasures missing / not considered? –Editorial changes / comments? Or contact authors directly if you have any comments: –Saverio Niccolini: email@example.com –Eric Chen: firstname.lastname@example.org –Jan Seedorf: email@example.com –Hendrik Scholz: firstname.lastname@example.org
© 2006 NEC Corporation - Confidential November 2008 - 10 History of the draft Early versions of the draft –Investigations on the security threats and attack vectors related to SPEERMINT Classification of the threats Description of instances of the threats –Objectives Identify and enumerate the SPEERMINT-specific threat vectors Help in selecting security-related requirements Input now included in draft-ietf-speermint- requirements-07 Since IETF-72, the draft has become WG item
© 2006 NEC Corporation - Confidential Ｐ age 1 July SPEERMINT Security Threats and Suggested Countermeasures draft-niccolini-speermint-voipthreats-04.
Page 1 IETF Speermint Working Group Speermint draft-ietf-speermint-requirements-04 IETF 71 - Wednesday March 12, 2008 Jean-François Mulé -
Page 1 IETF Speermint Working Group Speermint Requirements/Guidelines for SIP session peering draft-ietf-speermint-requirements-02 IETF 69 - Monday July.
SPEERMINT Architecture - Reinaldo Penno Juniper Networks SPEERMINT, IETF 70 Vancouver, Canada 2 December 2007.
DNS SRV and NAPTR Use for SPEERMINT - Tom Creighton, Gaurav Khandpur Comcast SPEERMINT Intermin Meeting Philadelphia Sept
Peering: A Minimalist Approach Rohan Mahy IETF 66 — Speermint WG.
Requirements for SIP-based VoIP Interconnection (BCP) draft-natale-sip-voip-requirements-00.txt Bob Natale For Consideration by the.
Diameter SIP Application 58th IETF meeting draft-ietf-aaa-diameter-sip-app-00.txt.
1 ForCES Applicability Statement Alan Crouch Mark Handley Hormuzd Khosravi 65 th IETF Meeting, Dallas.
Page 1 IETF DRINKS Working Group Data Model and Protocol Requirements for DRINKS IETF 72 - Thursday July Tom Creighton -
WG Document Status 192nd IETF TEAS Working Group.
SIP issues with S/MIME and CMS Rohan Mahy SIP, SIPPING co-chair.
S. Ali, K. Cartwright, D. Guyton, A. Mayrhofer, J-F. Mulé Data for Reachability of Inter/tra-NetworK SIP (drinks) DRINKS WG draft-mule-drinks-proto-02.
SPEERMINT Terminology Draft th IETF - Chicago Editors: Daryl Malas David Meyer.
SIP Interconnect Guidelines draft-hancock-sip-interconnect-guidelines-01 David Hancock, Daryl Malas.
IETF 67 – SPEERMINT WG Presence Use Cases draft-houri-speermint-usecase-presence-00 Avshalom Houri – IBM Edwin Aoki – AOL LLC Sriram Parameswar - Microsoft.
Session Recording (SIPREC) Protocol (draft-ietf-siprec-protocol-09) Leon Portman Henry Lum
SIP Working Group IETF 72 chaired by Keith Drage, Dean Willis.
IETF sec - 1 Security Work in the IETF Scott Bradner Harvard University
IEEE MEDIA INDEPENDENT HANDOVER DCN: Title: IETF Liaison Report Date Submitted: November 15, 2007 Presented.
Softwire Security Requirement Update draft-ietf-softwire-security-requirements-02.txt IETF Meeting, Prague March 19, 2007 Shu Yamamoto Carl Williams Florent.
Draft-ietf-fecframe-config-signaling-02 1 FEC framework Configuration Signaling draft-ietf-fecframe-config-signaling-02.txt IETF 76 Rajiv Asati.
Analysis of SIP security Ashwini Sanap ( ) Deepti Agashe ( )
6lowpan ND Optimization draft Update Samita Chakrabarti Erik Nordmark IETF 69, 2007 draft-chakrabarti-6lowpan-ipv6-nd-03.txt.
IETF 71 SIPPING WG meeting draft-ietf-sipping-pai-update-00.
Security, NATs and Firewalls Ingate Systems. Basics of SIP Security.
SIP Interconnect Guidelines draft-hancock-sip-interconnect-guidelines-02 David Hancock, Daryl Malas.
IEEE MEDIA INDEPENDENT HANDOVER DCN: xx-00-sec Title: Initiate An Exercise for Generating a 21a Document Date Submitted: September 21, 2009.
Slide title In CAPITALS 50 pt Slide subtitle 32 pt RTSP 2.0 TLS handling Magnus Westerlund draft-ietf-mmusic-rfc2326bis-12.
Multiple Interfaces (MIF) WG IETF 79, Beijing, China Margaret Wasserman Hui Deng
Security Threats and Security Requirements for the Access Node Control Protocol (ANCP) IETF 68 - ANCP WG March 18-23, 2007 draft-ietf-ancp-security-threats-00.txt.
Session Peering Use Cases for Federations David Schwartz – Kayote Networks Eli Katz - XConnect Jeremy Barkan - Digitalshtick draft-schwartz-speermint-use-cases-federations-00.txt.
The study and demonstration on SIP security vulnerabilities Mahidhar Penigi Vamsi Krishna Karnati.
August 2, 2005 IETF 63 – Paris, France Media Independent Handover Services and Interoperability Ajay Rajkumar Chair, IEEE WG.
IPFIX Requirements: Document Changes and New Issues Raised Jürgen Quittek, NEC Benoit Claise, Cisco Tanja Zseby, Sebstian Zander, FhG FOKUS.
September 19, 2006speermint interim1 VoIP Threats and Attacks Alan Johnston.
MASS / DKIM BOF IETF – Paris 4 Août 2005 dkim.org mipassoc.org/mass IETF – Paris 4 Août 2005 dkim.org mipassoc.org/mass MIPA.
STIR Problem Statement IETF 88 (Vancouver) Tuesday Session Jon Peterson.
By: Versha Thakur Shravani Aishwarya Sai Kamal. The Session Initiation Protocol (SIP) is a simple text-based protocol that is easy to understand.
MWIF Confidential MWIF-Arch Security Task Force Task 5: Security for Signaling July 11, 2001 Baba, Shinichi Ready for MWIF Kansas.
Dynamic Symmetric Key Provisioning Protocol (DSKPP) Andrea Doherty Mingliang Pei Salah Machani Magnus Nyström IETF 74 San Francisco, USA 24 March 2009.
1 SIPREC Requirements IETF #80 Authors: K. Rehor, A. Hutton, L. Portman, R. Jain, H. Lam.
1 SIP End-to-End Performance Metrics (draft-ietf-pmol-sip-perf-metrics-00.txt)draft-ietf-pmol-sip-perf-metrics-00.txt 71 st IETF Conference PMOL Daryl.
71 th IETF – Philadelphia, USA March 2008 PCECP Requirements and Protocol Extensions in Support of Global Concurrent Optimization Young Lee (Huawei) J-L.
Postech DP&NM Lab Session Initiation Protocol (SIP) Date: Seongcheol Hong DP&NM Lab., Dept. of CSE, POSTECH Date: Seongcheol.
Incident Object Description and Exchange Format TF-CSIRT IODEF Editorial Group Jimmy Arvidsson Andrew Cormack Yuri Demchenko Jan Meijer.
World Class Standards ANFOV - Milano, 14 November 2007 – Paolo DE LUTIIS ANFOV - Milano, 14 November 2007 Autore:Paolo DE LUTIIS Telecom Italia Security.
Design Considerations for the Common MIH Protocol Functions draft-hepworth-mipshop-mih-design-considerations-01 Ele Hepworth (*), Robert Hancock, Srinivas.
RadSec – A better RADIUS protocol Stig Venaas Stefan Winter
21-07-xxxx IEEE MEDIA INDEPENDENT HANDOVER DCN: Title: MIH Protocol Security Date Submitted: December, 2007 Presented.
© 2017 SlidePlayer.com Inc. All rights reserved.