Session Initiation Protocol Server Research Articles

Performance analysis: Securing SIP on multi-threaded/multi-core proxy server using public keys on Diffie-Hellman (DH) in single and multi-server queuing scenarios.

The rapid replacement of PSTN with VOIP networks indicates the definitive phase-out of the PBX/PABX with smartphone-based VOIP technology that uses WLAN connectivity for local communication; however, security remains a key issue, regardless of the communication coverage area. Session initiation protocol (SIP) is one of the most widely adopted VOIP connection establishment protocols but requires added security. On the Internet, different security protocols, such as HTTPS (SSL/TLS), IPSec, and S/MIME, are used to protect SIP communication. These protocols require sophisticated infrastructure and some pose a significant overhead that may deteriorate SIP performance. In this article, we propose the following: i) avoid using Internet bandwidth and complex Internet protocols for local communication within an organization, but harness WLAN connectivity, ii) use multi-threaded or multicore computer systems to handle concurrent calls instead of installing hardware-based SIP servers, and iii) run each thread in a separate core. Cryptography is a key tool for securely transmitting confidential data for long- and short-range communication, and the Diffie-Hellman (DH) protocol has consistently been a popular choice for secret key exchanges. Primarily, used for symmetric key sharing, it has been proven effective in generating public/private key pairs, sharing public keys securely over public channels, and subsequently deriving shared secret keys from private/public keys. This key exchange scheme was proposed to safeguard VOIP communication within WLANs, which rely on the SIP for messaging and multimedia communication. For ensuring an efficient implementation of SIP, the system was rigorously analyzed using the M/M/1 and M/M/c queuing models. We analyze the behavior of SIP servers with queuing models with and without end-to-end security and increase users' trust in SIP security by providing a transparent sense of end-to-end security as they create and manage their private and public keys instead of relying on the underlying SIP technology. This research implements instant messaging, voice conversation, and secret key generation over DH while implementing and observing the role of multi-threading in multiqueue systems that serve incoming calls. By increasing the number of threads from one to two, the SIP response time improved from 20.23809 to 0.08070 min at an arrival rate of 4250 calls/day and a service rate of three calls/min. Similarly, by adding one to seven threads, the queue length was reduced by four calls/min. Implementing secure media streaming and reliable AES-based signaling for session confidentiality and integrity introduces a minor 8-ms tradeoff in SIP service performance. However, the advantages of implementing added security outweigh this limitation.

Desktop aplikacija za razmenu kriptozaštićenog govora

Introduction/purpose: All data exchanged over the Internet as well as other computer networks should be considered exposed to various types of security threats. In light of this, the transmission of voice over applications that do not use any type of crypto-protection allows anyone to discern the content of communication. Since voice transmission requires as little delay as possible, various protocols are used to enable crypto protected real-time communication. This paper presents one solution in a desktop application variant. Methods: The essence in voice exchange systems as well as in other systems where real-time communication is necessary is the establishment of a crypto-protected session which is a virtual secure channel for communication to which only the communicating parties have access. Voice sessions in the application are established with the SIP (Session Initiation Protocol) protocol. The sessions are further protected using the ZRTP (Zimmerman Real-time Transport Protocol) protocol. FusionPBX was used as the SIP server (registrar) for testing purpouses. The application is developed in C++ language using the Qt framework. Results: The final version of the application demostrates that ZRTP and SIP protocols are well suited for establishing crypto protected voice communications with low delay. Conclusion: This solution provides cryptographic functions for data secrecy and the management of cryptographic keys. Improving the solution with digital signatures and certificates will result in additional cryptographic functions: data integrity and personal identification. With this improvement, this solution will be able to withstand modern security threats with low delay.

A Novel Approach for Efficient Mitigation against the SIP-Based DRDoS Attack

Voice over Internet Protocol (VoIP) and its underlying Session Initiation Protocol (SIP) are widely deployed technologies since they provide an efficient and fast means of both voice and data communication over a single network. However, in spite of their advantages, they also have their security threats due to the inherent vulnerabilities in the underlying Internet Protocol (IP) that can potentially be exploited by hackers. This study introduces a novel defense mechanism to effectively combat advanced attacks that exploit vulnerabilities identified in some less-known features of SIP. The SIP-DRDoS (SIP-based distributed reflection denial of service) attack, which can survive the existing security systems, is an advanced attack that can be performed on an SIP network through the multiplication of legitimate traffic. In this study, we propose a novel defense mechanism that consists of statistics, inspection, and action modules to mitigate the SIP-DRDoS attack. We implement the SIP-DRDoS attack by utilizing our SIP-based audit and attack software in our VoIP/SIP security lab environment that simulates an enterprise-grade SIP network. We then utilize our SIP-based defense tool to realize our novel defense mechanism against the SIP-DRDoS attack. Our experimental results prove that our defense approach can do a deep packet analysis for SIP traffic, detect SIP flood attacks, and mitigate them by dropping attack packets. While the SIP-DRDoS attack with around 1 Gbps of traffic dramatically escalates the CPU (central processing unit) usage of the SIP server by up to 74%, our defense mechanism effectively reduces it down to 17% within 6 min after the attack is initiated. Our approach represents a significant advancement over the existing defense mechanisms and demonstrates the potential to effectively protect VoIP systems against SIP-based DRDoS attacks.

A Performance Evaluation of In-Memory Databases Operations in Session Initiation Protocol

Real-time communication has witnessed a dramatic increase in recent years in user daily usage. In this domain, Session Initiation Protocol (SIP) is a well-known protocol found to provide trusted services (voice or video) to end users along with efficiency, scalability, and interoperability. Just like other Internet technology, SIP stores its related data in databases with a predefined data structure. In recent, SIP technologies have adopted the real advantages of in-memory databases as cache systems to ensure fast database operations during real-time communication. Meanwhile, in industry, there are several names of in-memory databases that have been implemented with different structures (e.g., query types, data structure, persistency, and key/value size). However, there are limited resources and poor recommendations on how to select a proper in-memory database in SIP communications. This paper provides recommended and efficient in-memory databases which are most fitted to SIP servers by evaluating three types of databases including Memcache, Redis, and Local (OpenSIPS built-in). The evaluation has been conducted based on the experimental performance of the impact of in-memory operations (store and fetch) against the SIP server by applying heavy load traffic through different scenarios. To sum up, evaluation results show that the Local database consumed less memory compared to Memcached and Redis for read and write operations. While persistency was considered, Memcache is the preferable database selection due to its 25.20 KB/s for throughput and 0.763 s of call–response time.

Load balancing with SIP protocol using distributed web-server system

Web server system describes an innovative algorithm for balancing load by allocating the task to the clusters (Pai et al., 1998) of SIP server (Aron and Druschel, 1999; Bernardos et al., 2016). The requisition to a cluster of SIP servers is developed by using session initiation protocol (SIP). This algorithm supports three main techniques for the locally distributed WS system such as CJSQ, TJSQ and TLWL for the allocation of works to least values in the servers. This technique is incorporated with the knowledge of the SIP server (Aron and Druschel, 1999; Bernardos et al., 2016; Foundry Networks, 2007) to recognise the variability in call length and for creating a dynamic estimate of back-end server load for peculiar SIP transactions. The load balancer helps to boost both the throughput and response time. The SIP is a protocol developed by knowing the growing importance with uses for VOIP (Pai et al., 1998), audio conferencing and online messaging. We present a detailed analysis of occupancy to show how the SIP algorithm significantly diminishes reduced response time.

Optimizing VoIP server resources using linear programming model and autoscaling technique: An SDN approach

SummaryNowadays, the Voice Over IP (VoIP) technology is an important component of the communications industry as well as a low‐cost alternative to Public Switched Telephone Networks. Communication in VoIP networks consists of two main phases, for example, signaling and media exchange. VoIP servers are responsible for signaling exchange using the Session Initiation Protocol (SIP) as the signaling protocol. The saturation of SIP server resources is one of the issues with the VoIP network, which causes problems such as overload or loss of energy. Resource saturation occurs mainly due to a lack of integrated server resource management. In the traditional VoIP networks, management and routing are distributed among all equipment, including servers. These servers are overloaded during peak times and face energy loss during idle times. Given the importance of this issue, this paper introduces a framework based on Software‐Defined Networking technology for SIP server resource management. The advantage of this framework is to have a global view of all the server resources. In this framework, the resource allocation optimization problem and resource autoscaling are presented to deal with the problems posed. The goal is to maximize total throughput and minimize energy consumption. In this regard, we seek to strike a balance between efficiency and energy. The proposed framework is implemented in the actual testbed. The results show that the proposed framework has succeeded in achieving these goals.

A Machine Learning Approach for Prediction of Signaling SIP Dialogs

In this paper, we propose a machine learning methodology for prediction of signaling sessions established with the Session Initiation Protocol (SIP). Given the increasing importance of predicting and detecting abnormal sequences of SIP messages to avoid SIP signaling-based attacks, we first propose a Bayesian inference method capable of representing the statistical relation between a SIP message, observed by a SIP user agent or a SIP server, and prior trustworthy SIP dialogs. The Bayesian inference method, a Hidden Markov Model (HMM) enriched with n-gram Markov observations, is updated over time, so the inference can be used in real-time. The HMM is then used for predicting and detecting SIP dialogs through a lightweight implementation of Viterbi algorithm for sparse state spaces. Experimental results are also reported, where a SIP dataset representing prior information collected by a SIP user agent and/or a SIP server is used to predict or detect if a received sequence of SIP messages is legitimate according to similar SIP dialogs already observed. Finally, we discuss the results obtained for a dataset of abnormal SIP sequences, not observed during the inference stage, showing the effective utility of the proposed methodology to detect abnormal SIP sequences in a short period of time.

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

Voice over IP (VoIP) services hold promise because of their offered features and low cost. Most VoIP networks depend on the Session Initiation Protocol (SIP) to handle signaling functions. The SIP is a text-based protocol that is vulnerable to many attacks. Denial of Service (DoS) and distributed denial of service (DDoS) attacks are the most harmful types of attacks, because they drain VoIP resources and render SIP service unavailable to legitimate users. In this paper, we present recently introduced approaches to detect DoS and DDoS attacks, and classify them based on various factors. We then analyze these approaches according to various characteristics; furthermore, we investigate the main strengths and weaknesses of these approaches. Finally, we provide some remarks for enhancing the surveyed approaches and highlight directions for future research to build effective detection solutions.

Studying the Impact of SIP Message Differentiation on the Quality of VoIP Session Control Procedures

Voice over Internet Protocol (VoIP) is characterized by the growth of session control signalling, which is based on the Session Initiation Protocol (SIP). The growing amount of SIP signalling may cause an overload of VoIP session control infrastructure and quality of service degradation. To reduce the effect of overload conditions, we studied the impact of SIP message differentiation on the quality of VoIP session control procedures. We proposed an algorithm for SIP message prioritization and tested it with Kamailio SIP server under different conditions. Summarizing our research findings, the proposed algorithm improves the performance metrics related to VoIP session control procedures.

Design and Implementation of Hardware-Based Remote Attestation for a Secure Internet of Things

In general, Internet of Things (IoT) devices collect status information or operate according to control commands from other devices. If the safety and reliability of externally accessed devices are compromised, the risk of exposure of internally collected privacy information or abnormal operation of internal devices increases. This paper proposes a method of building a safe smart home environment by pre-blocking devices that may cause a risk by performing mutual safety verification between devices prior to data transmission and reception through the Session Initiation Protocol (SIP) of the home network. Using a Samsung’s commercial smartphone, not a development board to implement the device’s own verification function, and using an open source application and a SIP server providing free service, we established a test environment that is practically applicable and proved the feasibility of the attestation operation of the device. As a result of an operation test involving the capturing of packet data on a communication channel between two devices, it was confirmed that the transmission of parameter data for the actual attestation in SIP/Session Description Protocol packets succeeded without any problems. It was also confirmed that the final verification result of the target device was correctly derived. With the proposed method, it is possible to establish a safe trust relationship between smart home devices and external smart devices or between various IoT devices while also securing the smart home environment by blocking communications with devices that intentionally seek to do harm.

SIP Issues and Challenges – A Scalable Three Factor Authentication Scheme

The SIP (Session Initiation Protocol) is an application and presentation layer signaling protocol used for initiating, continuing and terminating multimedia session for the end user. It gains much attention of the researchers because it is exposed to several threats and noticed challenging vulnerabilities from time to time. Consequently, the security of SIP is a crucial task and many efforts have been made by different researchers and tried to divert the attention towards its solution. But still, no one claims with conviction about a foolproof secure mechanism for SIP. As users extensively use SIP services, the mutual authentication and key agreement among the participants is an important issue. So, robust authentication and key agreement scheme are mandatory for enhancing security, legitimacy and better complexities. Therefore, we present an improved three-factor authentication scheme that caters all the weaknesses and known attacks in Mishra et al. scheme. The proposed scheme not only guarantees for security but performance can also be made lightweight. As performance and security contradict each other, the change in one inversely affects the other. The proposed scheme has been analyzed both formally using BAN (Burrows-Abadi-Needham) logic and ProVerif1.93 software verification toolkit, and informally using assumptions which show a delicate balance of security with performance.

SIP Issues and Challenges – A Scalable Three Factor Authentication Scheme

The SIP (Session Initiation Protocol) is an application and presentation layer signaling protocol used for initiating, continuing and terminating multimedia session for the end user. It gains much attention of the researchers because it is exposed to several threats and noticed challenging vulnerabilities from time to time. Consequently, the security of SIP is a crucial task and many efforts have been made by different researchers and tried to divert the attention towards its solution. But still, no one claims with conviction about a foolproof secure mechanism for SIP. As users extensively use SIP services, the mutual authentication and key agreement among the participants is an important issue. So, robust authentication and key agreement scheme are mandatory for enhancing security, legitimacy and better complexities. Therefore, we present an improved three-factor authentication scheme that caters all the weakness and known attacks in Mishra et al. scheme. The proposed scheme not only guarantees for security but performance can also be made lightweight. As performance and security contradict each other, the change in one inversely affects the other. The proposed scheme has been analyzed both formally using BAN (Burrows-Abadi-Needham) logic and ProVerif1.93 software verification toolkit, and informally using assumptions which show a delicate balance of security with performance.

Overload control in SIP signalling networks with redirect servers

Session Initiation Protocol (SIP) is the most popular IP-based application level signalling protocol used for managing multimedia sessions and chat sessions between two or more users. Expeditious growth in usage of smart phones spurred the usage of IP-based multimedia communications. Rapid growth in the usage of Internet Telephony is increasing the load on servers resulting in server overload. Overload control techniques for SIP servers were proposed and standardised; however, existing SIP signalling networks with redirect servers are not well equipped to handle overload conditions. This research work discusses the limitations of existing SIP overload control techniques when employing redirect servers and proposes a solution for controlling overload in downstream SIP servers when employing redirect servers. We propose an algorithm for controlling overload state and formulate the conditions for analysing the overload control parameters, based on queue lengths. Simulation studies revealed that retransmissions in the proposed system are reduced by 63.64% and that of throughput is increased by 27.39%. Call failure rate is reduced by 0.5%.

Effectiveness of SIP Server Under SIP Flooding Attack During VoIP Calls

Voice over Internet Protocol (VoIP) service is increasingly one of the most widespread applications since few decades. Data traffic of VoIP service faces various challenges and threats. The Session Initiation Protocol (SIP) flooding attack is one of the popular threats to this service. Flooding attack is the most severe attack as it is easy to generate and capture the networks and nodes that further lead to Denial of Service attack. Therefore, the performance analysis of SIP servers requires more focus. In this paper, effectiveness of SIP server under SIP flooding attack is evaluated using various message scenarios by setting up an experimental test bed. The stress testing of SIP server is carried out with CPU and memory utilization check. The quality of VoIP calls is measured in term of three quality metrics jitter, delay and packet loss. It is observed that with the increase of simultaneous calls, quality of VoIP calls degraded.

On modeling of priority-based SIP request scheduling

Summary As the retransmission mechanism of the Session Initiation Protocol (SIP) significantly increases the amount of incoming traffic and makes an overloaded SIP server unstable, the models created for a stable SIP system cannot be effectively used to evaluate the performance of the overloaded server. To overcome this difficulty, in this paper, we present a fluid-flow model to analyze the priority-based request scheduling mechanism (PRSM) behavior in the overloaded SIP server equipped with an infinite buffer. The PRSM has been proposed in our earlier studies to prevent the overloading of SIP servers, where the original SIP request messages have strict priority over the retransmissions. The performance evaluation of the proposed model for the PRSM and the reference model of the conventional SIP has been reported under various test scenarios. The experiment results of the proposed model verify the effectiveness of the PRSM fluid-flow model as we already demonstrated in our previous studies using our simulation tool. Without loss of generality, the numerical results closely match with the simulation results, indicating that the proposed models can accurately capture the dynamic behavior of a SIP server with the PRSM.

On fluid‐flow modeling of priority based request scheduling for finite buffer SIP server

SummaryWith the widespread deployments of voice‐over‐internet protocol services, the existing session initiation protocol (SIP) design cannot scale up for large network sizes. Events triggering a demand burst or a server slowdown can cause SIP server overload, overload propagation, and crash, thus bringing down the whole SIP network. Since the SIP retransmission mechanism exacerbates the overload condition, existing models created for a stable SIP system cannot be effectively used to analyze an overloaded server. In this paper, we propose a fluid‐flow model to characterize the behavior of the finite buffer SIP server equipped with priority‐based request scheduling mechanism (PRSM). The model for the PRSM uses primary and secondary queues for the original request messages and the retransmitted requests, respectively. The performance metrics, namely, the failed call attempts and the response delay from sending INVITE request until receiving a 100‐Trying response, are derived using the arrival time‐slot tracking and the removal processes of the proposed fluid‐flow model. We conducted test cases under the heavy traffic conditions, where the overload is caused by bulk and bursty arrivals or server slowdown. The numerical results closely match with the simulation results for all experiments, indicating that the proposed model can accurately capture the dynamic behavior of an SIP server with the PRSM. The experiments demonstrate that the number of failed call attempts is close to 0 and the mean response delay is kept constant around 175 ms for the PRSM when the buffer size is higher than 1K while both metrics are significantly higher for the conventional SIP.

A robust mutual authentication scheme for session initiation protocol with key establishment

The Session Initiation Protocol (SIP) is a communication protocol that controls multimedia communication sessions. As the Internet users widely use SIP services, mutual authentication between the user and SIP server becomes an important issue. Several authentication protocols for SIP have been proposed for enhancing security and better complexities. Very recently, Lu et al. proposes an authenticated key agreement protocol for SIP and claims that it withstands various attacks and efficient. This paper points out that their protocol does not provide one of the most important features user anonymity. In addition, the same protocol is not able to resist user impersonation attack, server impersonation attack and fails to provide mutual authentication. The paper also presents an improved mutual authentication and key establishment protocol that conquers the security weaknesses in Lu et al.’s protocol. Informal security analysis is also carried out for several security properties. The formal proof for the correctness of mutual authentication and session key agreement is provided using BAN logic. It is shown that the proposed protocol is provably secure against identity and password guessing attacks in the random oracle model. The performance of the proposed scheme is compared with that of the existing related Elliptic Curve Cryptography (ECC) based schemes for SIP and shown that our scheme outperforms the others.

Design, implementation and performance evaluation of a proactive overload control mechanism for networks of SIP servers

The extent and diversity of systems, provided by IP networks, have made various technologies approach integrating different types of access networks and convert to the next generation network (NGN). The session initiation protocol (SIP) with respect to facilities such as being in text form, end-to-end connection, independence from the type of transmitted data, and support various forms of transmission, is an appropriate choice for signalling protocol in order to make connection between two IP network users. These advantages have made SIP be considered as a signalling protocol in IP multimedia subsystem (IMS), a proposed signalling platform for NGNs. Despite having all these advantages, SIP protocol lacks appropriate mechanism for addressing overload causing serious problems for SIP servers. SIP overload occurs when a SIP server does not have enough resources to process messages. The fact is that the performance of SIP servers is largely degraded during overload periods because of the retransmission mechanism of SIP. In this paper, we propose an advanced mechanism, which is an improved method of the windows based overload control in RFC 6357. In the windows based overload control method, the window is used to limit the amount of message generated by SIP proxy server. A distributed adaptive window-based overload control algorithm, which does not use explicit feedback from the downstream server, is proposed. The number of confirmation messages is used as a measure of the downstream server load. Thus, the proposed algorithm does not impose any additional complexity or processing on the downstream server, which is overloaded, making it a robust approach. Our proposed algorithm is developed and implemented based on an open source proxy. The results of evaluation show that proposed method could maintain the throughput close to the theoretical throughput, practically and fairly. As we know, this is the only SIP overload control mechanism, which is implemented on a real platform without using explicit feedback.

Detecting Anomalous Behavior in VoIP Systems: A Discrete Event System Modeling

Session initiation protocol (SIP) is an application layer protocol used for signaling purposes to manage voice over IP connections. SIP being a text-based protocol is vulnerable to a range of denial of service (DoS) attacks. These DoS attacks can render the SIP servers/SIP proxy servers unusable by depleting memory and CPU time. In this paper, we consider two types of DoS attacks, namely, flooding attacks and coordinated attacks for detection. Flooding attacks affect both stateless and stateful SIP servers while coordinated attacks affect stateful SIP servers. We model the SIP operation as discrete event system (DES) and design a new state transition machine, which we name as probabilistic counting deterministic timed automata (PCDTA) to describe the behavior of SIP operations. We also identify different types of anomalies that can occur in a DES model, which appear in the form of illegal transitions, violating timing constraints, and appear in number which is otherwise not seen. Subsequently, we map various DoS attacks in SIP to a type of anomaly in DES. PCDTA can learn probabilities of various transitions and timings delay from a set of nonmalicious training sequences. A trained PCDTA can detect anomalies, and hence various DoS attacks in SIP. We perform a thorough experiment with computer simulated SIP traffic and report the detection performance of PCDTA on various attacks generated through custom scripts.

A Secured Load Mitigation and Distribution Scheme for Securing SIP Server

Managing the performance of the Session Initiation Protocol (SIP) server under heavy load conditions is a critical task in a Voice over Internet Protocol (VoIP) network. In this paper, a two-tier model is proposed for the security, load mitigation, and distribution issues of the SIP server. In the first tier, the proposed handler segregates and drops the malicious traffic. The second tier provides a uniform load of distribution, using the least session termination time (LSTT) algorithm. Besides, the mean session termination time is minimized by reducing the waiting time of the SIP messages. Efficiency of the LSTT algorithm is evaluated through the experimental test bed by considering with and without a handler. The experimental results establish that the proposed two-tier model improves the throughput and the CPU utilization. It also reduces the response time and error rate while preserving the quality of multimedia session delivery. This two-tier model provides robust security, dynamic load distribution, appropriate server selection, and session synchronization.