1. VoIP SEAL 2.0 Security Suite for SIP enabled networks Thilo Ewald, Nico dHeureuse, Saverio Niccolini, Jan Seedorf NEC Europe Ltd., Heidelberg, Germany [ewald, dheureuse, niccolini, seedorf]@nw.neclab.eu

2. June 23, 2008 VoIP SEAL Vision –Attacks on NGN networks will evolve: (D)DoS, Interception and Modification, Abuse of Service (Fraud), Social attacks (e.g., SPIT) –Security and troubleshooting will be fundamental Key issues –Encryption and authentication will not be enough –No single method of detection and protection –Flexible detection and protection technology is required Solution –Holistic security detection and prevention framework for SIP-based infrastructures (VoIP) SEcure Application Level firewall (SEAL) Modular, extensible and distributed platform Multiple different SIP-enabled detection and protection modules cooperate Easily adaptable to different network scenarios VoIP SEAL

3. June 23, 2008 Envisioned Deployment Scenarios 1.Offline analysis -Analysis of call data records, log files, network traces, … -Manual redirection to Stage-2 test (by operator) VoIP SEAL Operator CSCF CDRs Stage 1 VoIP SEAL Stage 2 User 2.Online monitoring -Real-time traffic monitoring -Automatic redirection to Stage-2 test 3.Inline protection (SEAL 2.0) -Real-time traffic interception -5 stage protection system VoIP SEAL Operator CSCF Stage 1 VoIP SEAL Stage 2 User VoIP SEAL Operator CSCF Stage 1 VoIP SEAL Stage 2 User

4. June 23, 2008 VoIP SEAL 2.0 What changed since IPTComm 2007? 1.Distributed deployment -Collaborative scoring -SBC -Application Server -User Equipment 2.Personalization -Personal Black-/WhiteLists -Personal Stage-2 tests -Multi language -Feedback & Configuration via -Web interface -Minibrowser (COTS SIP phone) 3.Improvements on algorithms - e.g. DTMF-Tests, Greylisting, HoneyVoIP SBC SIP infrastructure Internet / outer network (unprotected) Operator / Customer network (VoIP SEAL protected) HoneyVoIP VoIP SEAL - AS