We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byJessica Kerr
Modified over 4 years ago
© 2006 NEC Corporation - Confidential age 1 November 2008 - 1 SPEERMINT Security Threats and Suggested Countermeasures draft-ietf-speermint-voipthreats-01 Saverio Niccolini, Eric Chen, Jan Seedorf, Hendrik Scholz
© 2006 NEC Corporation - Confidential November 2008 - 2 Goals / Scope Goals of the draft –List of security threats (specific) for SPEERMINT –Mapping of these threats to suggested countermeasures As information for implementers Also helping implementers choose proper means for addressing SPEERMINT security requirements (as defined in draft-ietf-speermint-requirements-07) Target: –Informational document for implementers
© 2006 NEC Corporation - Confidential November 2008 - 3 VoIP-SPECIFIC USE CASES IM/PRESENCE-SPECIFIC USE CASES VOIP-SPECIFIC REQUIREMENTS IM/PRESENCE-SPECIFIC REQUIREMENTS ARCHITECTURE MESSAGE FLOWS DNS SRV & NAPTR USE OTHER IMPLEMENTER DOCUMENTS (BCPs) TERMINOLOGY Contribution of the draft (related to SPEERMINT document flow chart) SPEERMINT Security Threats and Suggested Countermeasures: Informational Document
© 2006 NEC Corporation - Confidential November 2008 - 4 Security Requirements vs. concrete Solutions Security Requirements: draft-ietf-speermint-requirements-07 –This draft lists security requirements without stating concrete protocols or guidance on how to meet these requirements How to fulfill/meet the Security Requirements: draft-ietf-speermint-voipthreats-01 –This draft provides concrete protocols and solutions for meeting the requirements –As guidance for implementers who want to fulfill the security requirements for SPEERMINT –Section on security requirements (section 3) Currently only listing the security requirements Waiting for draft-ietf-speermint-requirements-07 to be finalized (IESG processing) Then addressing the requirements with text on protocols and solutions
© 2006 NEC Corporation - Confidential November 2008 - 5 Comments received for Version -00 at IETF 73 Minimization of SED suggested as countermeasure Included in the new -01 version Text regarding password cracking was misleading Changed Digest authentication onall requests was seen as unrealistic Removed PKI is assumed for TLS Added text
© 2006 NEC Corporation - Confidential November 2008 - 6 Changes since -00 version Addressed comments received (see previous slide) New threats –network discovery –unwanted requests New countermeasures –minimization of session establishment data –topology hiding Renamed / Restructured Countermeasures (see next slide) Editorial changes –Updated/removed references
© 2006 NEC Corporation - Confidential November 2008 - 7 Version -01: Suggested Countermeasures Suggested Countermeasures –Database Security BCPs –DNSSEC –DNS Replication –Cross-Domain Privacy Protection –Use TCP instead of UDP to deliver SIP messages –Ingress Filtering / Reverse-Path Filtering –Strong Identity Assertion –Reliable Border Element Pooling –Rate limit –Topology Hiding –Border Element Hardening –Minimization of Session Establishment Data –Encryption and Integrity Protection of Signalling Messages –Encryption and Integrity Protection of Media Stream
© 2006 NEC Corporation - Confidential November 2008 - 8 Current Issues / Discussion IPSec vs. TLS –IPSec is a lower-layer solution but often deployed and seen as sufficient for hop-to-hop SSP security –Requirements draft says: Even though SSPs may use lower layer security mechanisms to guarantee some of those security properties, candidate protocols for the LUF and LRF must meet the above requirements authentication/integrity/confidentiality]. –Opinions from the WG? Section on deployment (Comment received at IETF 71) –Are there other solutions besides DNSSEC which are not deployed yet?
© 2006 NEC Corporation - Confidential November 2008 - 9 How to proceed... We welcome any comments on this work on the mailing list –Are there additional threats missing / not considered? –Are there countermeasures missing / not considered? –Editorial changes / comments? Or contact authors directly if you have any comments: –Saverio Niccolini: email@example.com –Eric Chen: firstname.lastname@example.org –Jan Seedorf: email@example.com –Hendrik Scholz: firstname.lastname@example.org
© 2006 NEC Corporation - Confidential November 2008 - 10 History of the draft Early versions of the draft –Investigations on the security threats and attack vectors related to SPEERMINT Classification of the threats Description of instances of the threats –Objectives Identify and enumerate the SPEERMINT-specific threat vectors Help in selecting security-related requirements Input now included in draft-ietf-speermint- requirements-07 Since IETF-72, the draft has become WG item
RadSec – A better RADIUS protocol
IEEE MEDIA INDEPENDENT HANDOVER DCN: xx-00-sec Title: Initiate An Exercise for Generating a 21a Document Date Submitted: September 21, 2009.
SIP Interconnect Guidelines draft-hancock-sip-interconnect-guidelines-02 David Hancock, Daryl Malas.
IETF 71 SIPPING WG meeting draft-ietf-sipping-pai-update-00.
Dynamic Symmetric Key Provisioning Protocol (DSKPP)
71 th IETF – Philadelphia, USA March 2008 PCECP Requirements and Protocol Extensions in Support of Global Concurrent Optimization Young Lee (Huawei) J-L.
1 SIP End-to-End Performance Metrics (draft-ietf-pmol-sip-perf-metrics-00.txt)draft-ietf-pmol-sip-perf-metrics-00.txt 71 st IETF Conference PMOL Daryl.
SIP issues with S/MIME and CMS Rohan Mahy SIP, SIPPING co-chair.
The study and demonstration on SIP security vulnerabilities Mahidhar Penigi Vamsi Krishna Karnati.
World Class Standards ANFOV - Milano, 14 November 2007 – Paolo DE LUTIIS ANFOV - Milano, 14 November 2007 Autore:Paolo DE LUTIIS Telecom Italia Security.
September 19, 2006speermint interim1 VoIP Threats and Attacks Alan Johnston.
SIPPING IETF51 3GPP Security and Authentication Peter Howard 3GPP SA3 (Security) delegate
SIP Security Matt Hsu.
1 SIPREC Requirements IETF #80 Authors: K. Rehor, A. Hutton, L. Portman, R. Jain, H. Lam.
Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net 1 ANCP protocol draft updates draft-ietf-ancp-protocol-00.txt ANCP.
21-07-xxxx IEEE MEDIA INDEPENDENT HANDOVER DCN: Title: MIH Protocol Security Date Submitted: December, 2007 Presented.
SIPREC Conference Recording (draft-kyzivat-siprec-conference-use-cases-01) IETF 89, March 7, 2014 Authors: Michael Yan, Paul Kyzivat, Simon Romano.
MASS / DKIM BOF IETF – Paris 4 Août 2005 dkim.org mipassoc.org/mass IETF – Paris 4 Août 2005 dkim.org mipassoc.org/mass MIPA.
Draft-khan-ip-serv-peer-arch-03.txt SPEERMINT Peering Architecture IETF-66, Montreal, Canada Sohel Khan, Ph.D. Technology Strategist.
Incident Object Description and Exchange Format
© 2018 SlidePlayer.com Inc. All rights reserved.