Session Initiation Protocol firewall for the IP Multimedia Subsystem core

Bessis, Thierry; Gurbani, Vijay K.; Rana, Ashwin

doi:10.1002/bltj.20479

Cited by 6 publications

(2 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bessis et al [251] discuss the necessary features of a SIPspecific firewall, juxtaposing them with specific threats to SIP messages at each network layer (data link, network, transport and session). They propose a simple, hardware-accelerated SIP-proxy as a front-end SIP firewall and argue that this approach would block most of the attacks.…”

Section: ) Authentication Protocols (15 Items)mentioning

confidence: 99%

A Comprehensive Survey of Voice over IP Security Research

Keromytis

2012

IEEE Commun. Surv. Tutorials

116

View full text Add to dashboard Cite

Abstract-We present a comprehensive survey of Voice over IP security academic research, using a set of 245 publications forming a closed cross-citation set. We classify these papers according to an extended version of the VoIP Security Alliance (VoIPSA) Threat Taxonomy. Our goal is to provide a roadmap for researchers seeking to understand existing capabilities and to identify gaps in addressing the numerous threats and vulnerabilities present in VoIP systems. We discuss the implications of our findings with respect to vulnerabilities reported in a variety of VoIP products.We identify two specific problem areas (denial of service, and service abuse) as requiring significant more attention from the research community. We also find that the overwhelming majority of the surveyed work takes a black box view of VoIP systems that avoids examining their internal structure and implementation. Such an approach may miss the mark in terms of addressing the main sources of vulnerabilities, i.e., implementation bugs and misconfigurations. Finally, we argue for further work on understanding cross-protocol and cross-mechanism vulnerabilities (emergent properties), which are the byproduct of a highly complex system-of-systems and an indication of the issues in future large-scale systems.

show abstract

Section: ) Authentication Protocols (15 Items)mentioning

confidence: 99%

A Comprehensive Survey of Voice over IP Security Research

Keromytis

2012

IEEE Commun. Surv. Tutorials

116

View full text Add to dashboard Cite

show abstract

“…The Session Initiation Protocol (SIP) is a widely-used VoIP signaling protocol for the signaling and control of multimedia communication sessions. The most common applications of SIP are Internet telephony and video calls over IP networks [2]. SIP defines the messages that govern the installation, termination and other basic elements of calls that take place between endpoints.…”

Section: Introductionmentioning

confidence: 99%

A Novel SIP Based Distributed Reflection Denial-of-Service Attack and an Effective Defense Mechanism

2020

View full text Add to dashboard Cite

We introduce a novel SIP based attack, named as the SR-DRDoS attack, that exploits some less known SIP features by using the IP-spoofing technique, the reflection based attack logic and the DDoS attack logic. Furthermore, we develop a SIP-based DoS/DDoS attack simulator, named Mr. SIP, and use it to implement our SR-DRDoS attack. Our attack is shown to dramatically increase the CPU load of a SIP server from 0% up to 100% in only 4 minutes after the attack is initiated. Since our intelligent attack creates legitimate traffic on the SIP network by using reflection methods, it bypasses blacklists as well as IP, packet-count or session/transaction based rate limiting and automatic message generation detection systems which exist in state-of-the-art security perimeters such as firewalls, intrusion detection/prevention systems and anomaly detection systems. Moreover, we propose a novel defense mechanism that effectively mitigates our proposed DRDoS attack. Our defense mechanism is shown to successfully reduce the CPU load of a SIP server under attack from 71% down to 18% within 3 minutes after it is initiated.

show abstract