Transaction-based authentication and key agreement protocol for inter-domain VoIP

We present an authentication and key agreement protocol to secure Voice over IP call establishment between interconnection proxies of different domains. The protocol operates on a transaction basis. Each transaction is defined as the set of operations and data required to send an Authenticated Message from a sender to a responder. A transaction allows a sender to either transmit a cryptographically protected stand-alone message; or a key-agreement message required to establish a secure session. The protocol handles transaction synchronisation loss and guarantees the use of a single transaction window in the general (inter-domain) context with multiple originating servers.

[1]  Randall J. Atkinson,et al.  Security Architecture for the Internet Protocol , 1995, RFC.

[2]  Mark Handley,et al.  RFC 4566: SDP: Session Description Protocol , 2006 .

[3]  Scott O. Bradner,et al.  The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) , 2011, RFC.

[4]  Colin Boyd,et al.  Protocols for Authentication and Key Establishment , 2003, Information Security and Cryptography.

[5]  John T. Kohl,et al.  The Kerberos Network Authentication Service (V5 , 2004 .

[6]  Alfred Menezes,et al.  Handbook of Applied Cryptography , 2018 .

[7]  Viktor K. Prasanna,et al.  An adaptive cryptographic engine for internet protocol security architectures , 2004, TODE.

[8]  Angelos D. Keromytis,et al.  A Survey of Voice over IP Security Research , 2009, ICISS.

[9]  Dan Boneh,et al.  Cryptanalysis of RSA with private key d less than N0.292 , 1999, IEEE Trans. Inf. Theory.

[10]  Dan Wing,et al.  Session Description Protocol (SDP) Security Descriptions for Media Streams , 2006, RFC.

[11]  Shoichi Hirose,et al.  Enhancing the Resistence of a Provably Secure Key Agreement Protocol to a Denial-of-Service Attack , 1999, ICICS.

[12]  Simone Fischer Hübner,et al.  SIP Proxies: New Reflectors? Attacks and Defenses , 2010 .

[13]  Cullen Jennings,et al.  The Session Initiation Protocol (SIP) and Spam , 2008, RFC.

[14]  Hao Zhou,et al.  Transport Layer Security (TLS) Session Resumption without Server-Side State , 2008, RFC.

[15]  Ge Zhang,et al.  SIP Proxies: New Reflectors in the Internet , 2010, Communications and Multimedia Security.

[16]  Quynh H. Dang,et al.  Secure Hash Standard | NIST , 2015 .

[17]  Mark Handley,et al.  SIP: Session Initiation Protocol , 1999, RFC.

[18]  Gene Tsudik,et al.  Improving secure server performance by re-balancing SSL/TLS handshakes , 2006, ASIACCS '06.

[19]  Radia Perlman,et al.  Network Security , 2002 .

[20]  Henning Schulzrinne,et al.  Have I met you before?: using cross-media relations to reduce SPIT , 2009, IPTComm.

[21]  Danilo Bruschi,et al.  Voice over IPsec: analysis and solutions , 2002, 18th Annual Computer Security Applications Conference, 2002. Proceedings..

[22]  Luca Salgarelli,et al.  Securing the signaling plane in beyond 3G networks: analysis of performance overheads , 2010, Secur. Commun. Networks.

[23]  Angelos D. Keromytis,et al.  Efficient, DoS-resistant, secure key exchange for internet protocols , 2001, CCS '02.

[24]  Eric Rescorla,et al.  Datagram Transport Layer Security , 2006, RFC.

[25]  Jason Hill.  The storm ahead: how CALEA will turn VoIP on its head , 2006, InfoSecCD '06.

[26]  SchulzrinneHenning,et al.  The impact of TLS on SIP server performance , 2012 .

[27]  Dan S. Wallach,et al.  Performance analysis of TLS Web servers , 2006, TOCS.

[28]  Christopher Leckie,et al.  CPU-based DoS attacks against SIP servers , 2008, NOMS 2008 - 2008 IEEE Network Operations and Management Symposium.

[29]  Elaine B. Barker,et al.  The Keyed-Hash Message Authentication Code (HMAC) | NIST , 2002 .

[30]  Radu State,et al.  Assessing the security of VoIP Services , 2007, 2007 10th IFIP/IEEE International Symposium on Integrated Network Management.

[31]  Ping Lin,et al.  MIKEY-RSA-R: An Additional Mode of Key Distribution in Multimedia Internet KEYing (MIKEY) , 2006, RFC.

[32]  Hugo Krawczyk,et al.  A Security Architecture for the Internet Protocol , 1999, IBM Syst. J..

[33]  Sean Turner,et al.  Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification , 2019, RFC.

[34]  Saverio Niccolini,et al.  SPEERMINT Security Threats and Suggested Countermeasures , 2008 .

[35]  Klara Nahrstedt,et al.  Protecting SIP Proxy Servers from Ringing-Based Denial-of-Service Attacks , 2008, 2008 Tenth IEEE International Symposium on Multimedia.

[36]  Henning Schulzrinne,et al.  The Impact of TLS on SIP Server Performance: Measurement and Modeling , 2010, IEEE/ACM Transactions on Networking.

[37]  Clemens Heinrich,et al.  Transport Layer Security (TLS) , 2011, Encyclopedia of Cryptography and Security.

[38]  Dorgham Sisalem,et al.  A comparative analysis of the security aspects of the multimedia key exchange protocols , 2009, IPTComm.

[39]  Luca Veltri,et al.  SIP security issues: the SIP authentication procedure and its processing load , 2002, IEEE Netw..

[40]  D. Boneh.  Cryptanalysis of RSA with Private Key d Less Than N 0 , 1999 .

[41]  Mats Näslund,et al.  The Secure Real-time Transport Protocol (SRTP) , 2004, RFC.

[42]  J. David Irwin,et al.  Using Identity-Based Privacy-Protected Access Control Filter (IPACF) to against denial of service attacks and protect user privacy , 2007, SpringSim '07.

[43]  Patrick Battistello.  Inter-domain and DoS-resistant call establishment protocol (IDDR-CEP): work in progress , 2010, IPTComm.

[44]  Jon Peterson,et al.  Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP) , 2006, RFC.

[45]  Muhammad Ali Akbar,et al.  Evaluating DoS Attacks against Sip-Based VoIP Systems , 2009, GLOBECOM 2009 - 2009 IEEE Global Telecommunications Conference.

[46]  Hovav Shacham,et al.  Client-side caching for TLS , 2004, TSEC.

[47]  Cullen Jennings,et al.  Verification Involving PSTN Reachability: Requirements and Architecture Overview , 2010 .

[48]  Errol A. Blake.  Network and database security: regulatory compliance, network, and database security--a unified process and goal , 2007, InfoSecCD '07.

[49]  Radu State,et al.  Intrusion detection mechanisms for VoIP applications , 2006, ArXiv.

[50]  Patrik Fältström,et al.  The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) , 2004, RFC.

[51]  Hugo Krawczyk,et al.  A Security Architecture for the Internet Protocol , 1999, IBM Syst. J..

[52]  Simon Heron,et al.  Encryption: Advanced Encryption Standard (AES) , 2009 .

[53]  Jari Arkko,et al.  MIKEY: Multimedia Internet KEYing , 2004, RFC.

[54]  Robert H. Deng,et al.  DoS-resistant access control protocol with identity confidentiality for wireless networks , 2005, IEEE Wireless Communications and Networking Conference, 2005.

[55]  Errol A. Blake.  Network security: VoIP security on data network--a guide , 2007, InfoSecCD '07.

[56]  Jon Callas,et al.  ZRTP: Media Path Key Agreement for Unicast Secure RTP , 2011, RFC.

[57]  Mark Handley,et al.  SDP: Session Description Protocol , 1998, RFC.

[58]  Eric Rescorla,et al.  Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP) , 2010, RFC.

[59]  Anand Raghunathan,et al.  Efficient Software Architecture for IPSec Acceleration Using a Programmable Security Processor , 2008, 2008 Design, Automation and Test in Europe.

[60]  Jason Smith,et al.  Denial-of-service resistance in key establishment , 2007, Int. J. Wirel. Mob. Comput..

[61]  Eric Rescorla,et al.  The Transport Layer Security (TLS) Protocol Version 1.2 , 2008, RFC.

[62]  Cullen Jennings,et al.  Certificate Management Service for the Session Initiation Protocol (SIP) , 2011, RFC.

[63]  Dan Boneh,et al.  Cryptanalysis of RSA with private key d less than N0.292 , 2000, IEEE Trans. Inf. Theory.