“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 “ Securing IP Multimedia Subsystem (IMS) infrastructures: protection against attacks ” M. Tsagkaropoulos Dept. Of Electrical and Computer Engineering Wireless Telecommunications Laboratory University of Patras Patras Greece

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Agenda  NGN Networks  IMS Architecture  IMS Security Framework  Vulnerabilities in IMS  Security Mechanisms & enhancements  Conclusions

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 NGN Vision (1) Transition to an “All-IP” network infrastructure. Convergence among network and services. Support of heterogeneous access technologies ( e.g. WLANs, WiMAX, xDSL, etc ). Unified control architecture to manage application and services.

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 NGN Vision (2) Seamless handovers across both homogeneous and heterogeneous wireless technologies. Mobility, nomadicity and QoS support on or above IP layer. Provisioning of triple-play services creating a service bundle of unifying video,voice and Internet.

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Converged Network Concept IP Network Management Control Signalling AP WiMAX UMTS/ WCDMA, HSDPA, LTE AP WLAN AAA Application Policing Server Farm Internet

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Convergence Realization Common service delivery platform on fixed, mobile/wireless, broadcast and IP- based networks IP Multimedia Subsystem (IMS) –Originally standardized by 3GPP and 3GPP2 in the mobile world –Extended for fixed domain ETSI (TISPAN, NGN), ITU-T

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IP Multimedia Subsystem (IMS) Goal –Access, Security, Mobility, QoS, Charging, Service Platform Integration Extended Functionalities –IMS is the central point of control multiple applications and services –Handling of different user profiles –Service Discovery

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IMS Architecture Signaling Plane –Proxy Call/Session Control Function –Interrogating (I-CSCF) –Serving CSCF (S-CSCF) –Media Gateway Function Application Plane –Application Servers Presence, Instant Messaging –Home Subscriber Subsystems Media Server

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IMS Security Architecture

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IMS Vulnerabilities Denial of Service SQL Injection Eavesdropping Tearing down sessions Registration hijacking Session hijacking Impersonating a server Man in the middle

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IMS Existing Security Plane Authentication & Key Agreement between IM subscriber and home network Security Mechanism Agreement between IM client and visited network Integrity Protection and Confidentiality Network Domain Security between different Domains (?) Existing GPRS/UMTS Access Security

IDS “Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Security Mechanisms BYE&CANCEL attacks Eavesdropping Registration& Session Hijacking Man-In-the-Middle attacks SIP Message flooding SQL Injection IPSec & TLS Authentication &Authorization None

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Proposed Security Architecture P-CSCF S-CSCF ISC Mw HSS Cx Gm IMS Client (Alice) Application Servers Farm IMS Core I-CSCF IDS Internet (IP connectivity) User List Blacklist Attack Detection SER SIP Server Detection Rules IDS

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IMS Security Target Handling Protocol Vulnerabilities Protection against Attacks SPAM Handling

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IDS Use Cases Detection Register Flooding Detection Invite flooding Detection SQL injection Detection Malformed Msg IDS P-CSCF Detection Attacks Detection

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Testing Tools Traffic Generator –SIPp: SIP Traffic generator –Seagull: IMS Traffic Generator IMS Client –Ericsson Service Development Studio (SDS) –UCT IMS Client Attacker –Developed C++ Tool for specific attacks IMS Core –FOKUS’s Open Source IP Multimedia Subsystem (IMS) Core

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 IDS Process Delay Number of SIP messages Processing Delay (ms) 100,2 503,8 1004,2

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Future Work Extended Functionalities of IDS System Optimize processing load Interaction with deployed services Stand alone implementation at Application Servers Definition of relationships/dependencies among partners...

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Conclusions IMS Deployment towards NGN vision Identification of IMS vulnerabilities Enhanced IMS security framework Integration of Intrusion Detection System Experimental Testbed Future steps

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Questions

“Securing IP Multimedia Subsystem (IMS) infrastructures …,” M. Tsagkaropoulos UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunications Laboratory M. Tsagkaropoulos 47 th FITCE Congress London 2008 Thank you for your attention UNIVERSITY OF PATRAS Department of Electrical & Computer Engineering Wireless Telecommunication Laboratory Michail Tsagkaropoulos mailto: