Understanding Voice over IP Security (Artech House Telecommunications Library)

Understanding Voice over IP Security......Page 2
Contents......Page 6
Foreword......Page 14
Acknowledgments......Page 18
1 Introduction 1......Page 20
1.1 VoIP: A Green Field for Attackers 2......Page 21
1.2 Why VoIP Security Is Important 3......Page 22
1.4 Organization 4......Page 23
2.2 Cryptography Fundamentals 7......Page 26
2.2.1 Secret Key (Symmetric) Cryptography 10......Page 29
2.2.2 Asymmetric (Public Key) Cryptography 12......Page 31
2.2.3 Integrity Protection 13......Page 32
2.2.4 Authenticated and Secure Key Exchange 17......Page 36
2.3 Digital Certificates and Public Key Infrastructures 20......Page 39
2.3.1 Certificate Assertions 22......Page 41
2.3.2 Certificate Authorities 24......Page 43
References 27......Page 46
3.1.2 VoIP Architectures 29......Page 48
3.2 Components 31......Page 50
3.3.1 Session Initiation Protocol 32......Page 51
3.3.2 Session Description Protocol 40......Page 59
3.3.3 H.323 42......Page 61
3.3.4 Media Gateway Control Protocols 45......Page 64
3.3.5 Real Time Transport Protocol 46......Page 65
3.3.6 Proprietary Protocols 47......Page 66
3.4 Security Analysis of SIP 48......Page 67
References 49......Page 68
4.2.1 Denial of Service (DoS) 51......Page 70
4.2.2 Man-in-the-Middle 56......Page 75
4.2.3 Replay and Cut-and-Paste Attacks 57......Page 76
4.2.4 Theft of Service 58......Page 77
4.2.5 Eavesdropping 59......Page 78
4.2.7 Poisoning Attacks (DNS and ARP) 60......Page 79
4.2.8 Credential and Identity Theft 61......Page 80
4.2.9 Redirection/Hijacking 62......Page 81
4.2.10 Session Disruption 63......Page 82
4.3.1 Port Scans 64......Page 83
4.3.2 Malicious Code 65......Page 84
4.3.3 Buffer Overflow 67......Page 86
4.3.7 Bid Down 69......Page 88
References 70......Page 89
5.1.1 Origins of Internet Security Terminology 73......Page 92
5.1.2 Castle Building in the Virtual World 74......Page 93
5.2 Security Policy 75......Page 94
5.3 Risk, Threat, and Vulnerability Assessment 77......Page 96
5.4 Implementing Security 79......Page 98
5.5 Authentication 80......Page 99
5.7 Auditing 82......Page 101
5.8 Monitoring and Logging 84......Page 103
5.9 Policy Enforcement: Perimeter Security 85......Page 104
5.9.1 Firewalls 86......Page 105
5.9.2 Session Border Controller 90......Page 109
5.9.3 Firewalls and VoIP 82......Page 111
5.10 Network Address Translation 93......Page 112
5.11 Intrusion Detection and Prevention 95......Page 114
5.13 Conclusions 97......Page 116
References 98......Page 117
6.1 Introduction 101......Page 120
6.2 IP Security (IPSec) 103......Page 122
6.2.1 Internet Key Exchange 105......Page 124
6.3 Transport Layer Security (TLS) 107......Page 126
6.4 Datagram Transport Layer Security (DTLS) 111......Page 130
6.5 Secure Shell (SecSH, SSH) 112......Page 131
6.6 Pretty Good Privacy (PGP) 115......Page 134
6.7 DNS Security (DNSSEC) 116......Page 135
References 119......Page 138
7.1 Introduction 121......Page 140
7.3.1 Server Security 122......Page 141
7.3.2 Client OS Security 124......Page 143
7.4 LAN Security 126......Page 145
7.4.1 Policy-Based Network Admission 127......Page 146
7.4.2 Endpoint Control 128......Page 147
7.4.3 LAN Segmentation Strategies 129......Page 148
7.4.4 LAN Segmentation and Defense in Depth 130......Page 149
7.5 Secure Administration 131......Page 150
7.8 Summary 132......Page 151
References 133......Page 152
8.1 Introduction 135......Page 154
8.2 Port-Based Network Access Control (IEEE 802.1x) 137......Page 156
8.3 Remote Authentication Dial-In User Service 140......Page 159
References 143......Page 162
9.1 Introduction 145......Page 164
9.2.1 Basic Authentication 146......Page 165
9.2.2 Digest Authentication 147......Page 166
9.2.3 Pretty Good Privacy 152......Page 171
9.2.4 S/MIME 153......Page 172
9.2.5 Transport Layer Security 155......Page 174
9.2.6 Secure SIP 159......Page 178
9.3 H.323 Signaling Security with H.235 160......Page 179
References 161......Page 180
10.1 Introduction 163......Page 182
10.2 Secure RTP 164......Page 183
10.3.1 Preshared Keys 168......Page 187
10.3.2 Public Key Encryption 169......Page 188
10.3.3 Authenticated Key Management and Exchange 170......Page 189
10.4 Security Descriptions in SDP 172......Page 191
10.5 Multimedia Internet Keying (MIKEY) 173......Page 192
10.5.1 Generation of MIKEY Message by Initiator 177......Page 196
10.5.2 Responder Processing of a MIKEY Message 183......Page 202
10.6 Failure and Fallback Scenarios 186......Page 205
10.7 Alternative Key Management Protocol—ZRTP 188......Page 207
References 190......Page 209
11.2 Names, Addresses, Numbers, and Communication 193......Page 212
11.2.1 E.164 Telephone Numbers 194......Page 213
11.2.2 Internet Names 195......Page 214
11.3.1 URI Authentication 196......Page 215
11.4 Trust Domains for Asserted Identity 199......Page 218
11.5 Interdomain SIP Identity 202......Page 221
11.5.1 SIP Authenticated Identity Body (AIB) 203......Page 222
11.5.2 Enhanced SIP Identity 204......Page 223
11.6 SIP Certificates Service 209......Page 228
11.7.1 Secure Assertion Markup Language 217......Page 236
11.7.4 Third Party Identity and Referred-By 219......Page 238
11.8 Privacy 220......Page 239
References 223......Page 242
12.2 PSTN Security Model 225......Page 244
12.3 Gateway Security 227......Page 246
12.3.1 Gateway Security Architecture 228......Page 247
12.3.2 Gateway Types 229......Page 248
12.3.3 Gateways and Caller ID 230......Page 249
12.3.5 Gateway Decomposition 231......Page 250
12.3.6 SIP/ISUP Interworking 232......Page 251
12.4 Telephone Number Mapping in the DNS 233......Page 252
References 236......Page 255
13.1 Introduction 237......Page 256
13.2 Is VoIP Spam Inevitable? 238......Page 257
13.3.1 Filtering Spam Using Identity Information 240......Page 259
13.3.2 Grey Listing 241......Page 260
13.3.4 Distributed Checksum Filtering (DCF) 242......Page 261
13.4 VoIP and Spit 243......Page 262
13.5 Summary 245......Page 264
References 246......Page 265
14.1 Summary 247......Page 266
14.3 VoIP Endpoints Are New 248......Page 267
14.5 Base VoIP Security on Best Current Security Practices for Data 249......Page 268
14.7 Merging Public and Private VoIP Services Will Be Problematic 250......Page 269
14.8 Concluding Remarks 251......Page 270
Index 253......Page 272
Recent Titles in the Artech House Telecommunications Library......Page 282