Elin Sundby Boysen Lars Strand Norwegian Defence Research Establishment (FFI) Norwegian Computing Center (NR) University Graduate Center (UNIK) November 24, 2009 SIP Handover Extension -security issues and possible solutions

2 This presentation will introduce the SIP Handover Extension and discuss some security issues Introduction to SIP Session handover using the SIP Handover Extension Security issues

3 People are connected through voice and data, everywhere, all the time

INVITE SIP/2.0 Via: SIP/2.0/UDP pc33.atlanta.com;branch=z9hG4bK776asd hds Max-Forwards: 70 To: Bob From: Alice ;tag= Call-ID: CSeq: INVITE Contact: Content-Type: application/sdp Content-Length: 142 SIP is an application-layer protocol used to set up, modify and terminate sessions INVITE 100 Trying 180 Ringing 200 OK ACK RTP / RTCP BYE 200 OK

The handover time is too long, resulting in poor user experience

7 The suggested SIP extension—the Handover Extension–will eliminate packet loss during handover

8 The SIP Handover Extension with various degrees of help from an intermediary node in the MN’s home network

9

10 The SIP Handover Extension with various degrees of help from an intermediary node in the MN’s home network

INVITE SIP/2.0 Via: SIP/2.0/UDP pc33.atlanta.com;branch=z9hG4bK776asdhds Max-Forwards: 70 To: Bob From: Alice ;tag= Call-ID: Handover: To-tag=5f7b910a; From-tag=as14ff55c1 CSeq: INVITE Contact: Content-Type: application/sdp Content-Length: 142 The main security issue introduced by the Handover Extension is forged Handover INVITE-messages

SIP already supports different types of security mechanisms. SIPS, TLS and IPSec Hop-by Hop security between proxies Authentication using Digest Access Authentication (DAA) Requires re-sending messages. Authentication and intergrity using S/MIME Hides vital headers. Shows headers needed in proxies.

15 In summary, we propose the SIP Handover Extension to support seamless handover in heterogeneous networks Among the current security solutions supported by SIP, S/MIME is currently the only method that provides integrity and authentication Questions? We have looked at security issues particular to the extension