1. Towards a Scalable and Secure VoIP Infrastructure Towards a Scalable and Secure VoIP Infrastructure Lab for Advanced Networking Systems Director: David K. Y. Yau DNS server Proxy / redirect server VoIP phone POTS Media gateway IP network Legacy phone Mobile VoIP phone SIP signaling / TLS / TCP User registration Media: RTP/RTCP/UDP SIP flood and spoofing / theft-of- service / authentication attack Media eavesdropping, UDP / RTP flood, encryption attack, faked ToS (theft-of-service) Device Threats Virus, misconfiguration, compromise (phone) TLS flood, authentication / encryption (proxy) RTP port starvation (media gateway) Wireless attack, jamming, RTS / CTS attack 2. VoIP Network Architecture INVITE sip:john.lui@cuhk.edu.hk 180 Ringing BYE 200 OK INVITE sip:john.lui@cuhk.edu.hk 180 Ringing ACK Media Stream 200 OK 3. SIP: Security Issues SIP requires: Proxy server, Redirection Server, Firewall …etc These servers can be subjected to (1) DDoS attack (2) Low-Rate TCP attack (3) Jamming attack If not handled carefully, VoIP won’t fly. Server To S Aggressive flow Throttle for S’ To S’ Throttle for S Securely installed by S Deployment router Server 18.23 6.65 14.1 0.01 1.40 0.22 17.73 0.61 0.95 6.25 20.53 24.88 15.51 17.73 0.22 0.61 0.95 59.9  Sufficiently large attack burst  Packet loss at congested router  TCP time out & retransmit after RTO  Attack period = RTO of TCP flow,  TCP continually incurs loss & achieves zero or very low throughput.  Sufficiently large attack burst  Packet loss at congested router  TCP time out & retransmit after RTO  Attack period = RTO of TCP flow,  TCP continually incurs loss & achieves zero or very low throughput. Avg BW= lR/T Case 3. Wi-Fi Jamming Wireless VoIP using 802.11 Wi-Fi Security problems :  Common Jamming  Low-rate attack on the control plane  Exploiting the protocol :RTS-CTS AP AB time RTS(A) CTS(A) defer RTS(A) CTS(A) 4. Conclusion  Security solutions  Initial focus will be on denial-of-service, considering security protocols like SRTP, TLS, S/MIME, SSL, etc  Protocol design and analysis (solutions must be scalable despite encryption, authentication, etc)  Seek experimental evaluation  Realistic testbed network  Hope to evolve into international scope: Bell Labs (NJ), Purdue (IN), Chinese University (Hong Kong), … Protocol Stack Session Initiation Protocol (SIP) Case 1. Flooding Attack Solution: Router Throttle Example Max-min Rates (L=18, H=22) Case 2. Low-rate DoS Attack on TCP Flow RTS-CTS Jamming  Attack flows V.S. legitimate flows  Expect a separation between them.  Attack flows V.S. legitimate flows  Expect a separation between them.  Probability distribution of DTW values threshold Robustness of Detection  Sample recent instantaneous throughput at a constant rate  Each time of detection consists of a sequence of instantaneous throughput  Normalization is necessary  The background noise of samples need to be filtered  Background noise (UDP flows and other TCP flows that less sensitive to attack)  For simplicity, a threshold filter can be used.  Autocorrelation is adopted to extract the periodic signature of input signal. periodic input => special pattern of its autocorrelation. (Autocorrelation can also mask the difference of time shift S)  Unbiased normalization M: length of input sequence m: index of autocorrelation  Similarity between the template and input should be calculated.  We use the Dynamic Time Warping (DTW). (The detail algorithm of DTW is provided in our research work)  The smaller the DTW value, the more similar they are.  DTW values will be clustered; threshold can be set to distinguish them. Pattern match Extract the signature Filter the noise Sample the traffic Algorithm of Detection 1. Security Challenges:  Traditional telephone network  Highly reliable, voice specific, closed and physically secure system  VoIP network  Unpredictable/open transport, data/voice convergent, publicly connected (intelligent but untrusted/malicious systems)  Security should not be an afterthought  Media, signaling, infrastructure attacks