An Improved Lightweight Privacy-Preserving Authentication Scheme for SIP-Based-VoIP Using Smart Card

Abstract

Secure information sharing has become very popular in immigration, military applications, healthcare, education and foreign affairs for the past few years. The security and privacy of such type of information cannot easily be compromised because the secure communication utilizes both wireless and wired communication media for exchanging sensitive information. Voice over IP (VoIP) offers many unique capabilities to its users. An important robust dynamism behind the use of IP telephony is cost savings, especially for businesses with large data networks. By transporting voice traffic over IP-based networks, businesses can decrease or abolish the toll charges related to carrying calls over the Public Switched Telephone Network (PSTN). Session Initiation Protocol (SIP) promises simple and efficient management of multimedia sessions amongst several users. To improve the security, integrity, authenticity and privacy issues while sharing sensitive information, numerous authentication schemes or set-of-rules have been recommended by different researchers in recent times. These authentication schemes are vulnerable to prospective security flaws e.g. replay attack, masquerading, insider attack, impersonation, password guessing, server spoofing, Denning Sacco and denial-of-service (DoS). Further, these schemes also fail to deliver mutual authentication. Almost, no researcher claims with conviction about a foolproof secure authentication scheme. This research mainly focuses on designing VoIP system based on SIP scheme that caters all the weaknesses in these schemes having low computation costs and low communication complexity and low storage overhead and shows a significant balance between performance and security. The proposed protocol also offers mutual authentication and reliable information delivery between user and server. A provable formal security analysis for the scheme will also be established mathematically, using BAN logic of authentication.