1. SIP Security Issues: The SIP Authentication Procedure and its Processing Load Stefano Salsano, DIE — Universit à di Roma “ Tor Vergata ” Luca Veltri, and Donald Papalilo, CoRiTeL — Research Consortium in Telecommunications IEEE Network November/December 2002 通訊所 研一 黃清富

2. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load2 Outline  Security Mechanisms in SIP  The Authentication Procedure in SIP  An Example Scenario of a SIP-Based IP Telephony Service  Methodology for the Evaluation of Processing Cost and Experimental Results  Conclusions  References

3. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load3 SIP Basic Call Flow INVITE F1 INVITE F2 INVITE F4 100 Trying F3 100 Trying F5 180 Ringing F6 180 Ringing F7 180 Ringing F8200 OK F9 200 OK F10 200 OK F11 ACK F12 Media Session BYE F13 200 OK F14

4. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load4 Security Mechanisms in SIP  Two reasons for securing SIP header and body  Security in SIP End-to-end versus hop-by-hop  Caller and/or callee versus two SIP entities  SIP protocol versus TLS or IPsec  Tow main security mechanisms Authentication  To prevent attackers from modifying and/or replaying SIP requests and responses Encryption  To ensure confidentiality

5. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load5 Security Mechanisms in SIP (cont.)

6. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load6 Security Mechanisms in SIP (cont.)  Types of attacks Snooping Modification attacks  DoS (denial of service) Spoofing SIP prone to DoS attacks  e.g., flooding

7. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load7 The Authentication Procedure is SIP SERVER REQUEST nonce, realm username, response REQUEST CHALLENGE nonce, realm CLIENT Generate the nonce value Compute response= = F( nonce, username, password, realm) Authentication: compute F( nonce, username, password, realm) And compare with response

8. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load8 The Authentication Procedure is SIP (cont.) User agent Client (UAC) Proxy server Proxy server User agent server (UAS) INVITE 407 proxy authentication Required ( nonce, … ) ACK INVITE ( nonce, …, response) INVITE 180 ringing 200 OK 180 ringing 200 OK ACK Authentication

9. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load9 An Example Scenario of a SIP-Based IP Telephony Service ITSP (Internet telephony service provider) provides gateway and delivers calls to the PSTN. Proxy authentication Proxy-to-proxy authentication

10. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load10 Methodology for the Evaluation of Processing Cost and Experimental Results

11. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load11 Methodology for the Evaluation of Processing Cost and Experimental Results (cont.)

12. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load12 Methodology for the Evaluation of Processing Cost and Experimental Results (cont.)

13. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load13 Methodology for the Evaluation of Processing Cost and Experimental Results (cont.)

14. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load14 Conclusions  The authentication procedure, based on HTTP Digest authentication, is described.  The performance aspects of SIP authentication are considered with a pure experimental approach.  The processing costs of different security procedures/scenarios are compared.

15. 2003/12/08SIP Security Issues: The SIP Authentication Procedure and its Processing Load15 References  “ SIP Security Issues: The SIP Authentication Procedure and Processing Load, ” IEEE Network, Nov/Dec 2002.  “ SIP: Session Initiation Protocol, ” IETF RFC 3261,June 2002.  “ HTTP Authentication: Basic and Digest Access Authentication, ” IETF RFC 2617, June 1999.