SIP Proxy Server Research Articles

Design, implementation and performance evaluation of a proactive overload control mechanism for networks of SIP servers

The extent and diversity of systems, provided by IP networks, have made various technologies approach integrating different types of access networks and convert to the next generation network (NGN). The session initiation protocol (SIP) with respect to facilities such as being in text form, end-to-end connection, independence from the type of transmitted data, and support various forms of transmission, is an appropriate choice for signalling protocol in order to make connection between two IP network users. These advantages have made SIP be considered as a signalling protocol in IP multimedia subsystem (IMS), a proposed signalling platform for NGNs. Despite having all these advantages, SIP protocol lacks appropriate mechanism for addressing overload causing serious problems for SIP servers. SIP overload occurs when a SIP server does not have enough resources to process messages. The fact is that the performance of SIP servers is largely degraded during overload periods because of the retransmission mechanism of SIP. In this paper, we propose an advanced mechanism, which is an improved method of the windows based overload control in RFC 6357. In the windows based overload control method, the window is used to limit the amount of message generated by SIP proxy server. A distributed adaptive window-based overload control algorithm, which does not use explicit feedback from the downstream server, is proposed. The number of confirmation messages is used as a measure of the downstream server load. Thus, the proposed algorithm does not impose any additional complexity or processing on the downstream server, which is overloaded, making it a robust approach. Our proposed algorithm is developed and implemented based on an open source proxy. The results of evaluation show that proposed method could maintain the throughput close to the theoretical throughput, practically and fairly. As we know, this is the only SIP overload control mechanism, which is implemented on a real platform without using explicit feedback.

Traffic Prediction for Reliable and Resilient Video Communications Over Multi-Location WMNs

This paper studies reliable and resilient deployment of video over IP across a multi-location organization, where a number of wireless mesh network (WMN) clouds are connected by a virtual private network (VPN). Particularly, we propose a scheme of enhanced SIP proxy server which can support an accountable network. In our proposed solution, the enhanced SIP proxy server consists of three modules, namely traffic load prediction, VPN bandwidth negotiation, and call admission control (CAC) in order to provide trustable service. We identify traffic load prediction as the key component among the three modules, and we further develop a linear predictor of variable sampling rate-normalized least mean square (VSR-NLMS) to estimate the traffic patterns. VSR-NLMS predictor employs adjustable sampling rate to achieve improved efficiency and performance. Numerical results show that our proposed scheme can automatically choose suitable sampling rate to track and predict the traffic load curve with acceptable accuracy and reasonable computational complexity.

A load scheduler for SIP proxy servers: design, implementation and evaluation of a history weighted window approach

SummaryThe widespread use of Session Initiation Protocol as a signalling protocol has created various challenges. An important one is that its throughput can be severely degraded when an overload happens in the proxy server because of several retransmissions from the user agent. One common approach to overcome this problem is ‘load balancing’. A balancer needs to know the status of proxy servers, which are continuously gathered implicitly or explicitly. Implicit methods have averagely less overhead than explicit ones. This paper attempts to prevent throughput reduction by balancing the loads among available proxy servers properly using an implicit mechanism called History Weighted Average Response time. The proposed algorithm is robust because it incurs no extra processing to proxy servers. The novelty of the mechanism is making use of ‘response time history’ to estimate the load being currently processed on servers. By implementing in a real testbed, throughput and scalability are improved compared with an important state‐of‐the‐art similar algorithm. This improvement stems from no need for modification in SIP protocol, easy implementation and application, simple computations for making decision and no need for extra feedback between servers and load balancer. Copyright © 2015 John Wiley & Sons, Ltd.

Efficient ID-based authentication and key agreement protocols for the session initiation protocol

In a widely deployed VoIP system tens of thousands of clients compete for the SIP proxy server's authentication service. SIP protocol implementations have to meet certain QoS and security requirements. In this study new ID-based protocols are proposed for the SIP authentication and key agreement protocols. These protocols minimize the use of expensive pairing functions but still resist notable attacks. The security of the proposed protocols are analyzed and demonstrated with security proofs based on the BJM security model. Finally, the performance overhead of the proposed protocols are compared to ID-based SIP authentication and key agreement protocols given in the literature.

Statistical Analysis of Message Delay in SIP Proxy Server

Single hop delay of SIP message going through SIP proxy server operating in carriers backbone network is being analyzed. Results indicate that message sojourn times inside SIP server in most cases do not exceed order of tens of milliseconds (99% of all SIP-I messages experience less than 21 ms of sojourn delay) but there were observed very large delays which can hardly be attributed to message specific processing procedures. It is observed that delays are very variable. Delay components distribution that is to identified are not exponentially distributed or nearly constant even per message type or size. The authors show that measured waiting time and minimum transit time through SIP server can be approximated by acyclic phase-type distributions but accuracy of approximation at very high values of quantiles depends on the number outliers in the data. This finding suggests that modeling of SIP server with queueing system of G|PH|c type may server as an adequate solution.

SIP Flooding Attack Detection with a Multi-Dimensional Sketch Design

The session initiation protocol (SIP) is widely used for controlling multimedia communication sessions over the Internet Protocol (IP). Effectively detecting a flooding attack to the SIP proxy server is critical to ensure robust multimedia communications over the Internet. The existing flooding detection schemes are inefficient in detecting low-rate flooding from dynamic background traffic, or may even totally fail when flooding is launched in a multi-attribute manner by simultaneously manipulating different types of SIP messages. In this paper, we develop an online detection scheme for SIP flooding attacks, by integrating a novel three-dimensional sketch design with the Hellinger distance (HD) detection technique. In our sketch design, each SIP attribute is associated with a two-dimensional sketch hash table, which summarizes the incoming SIP messages into a probability distribution over the sketch table. The evolution of the probability distribution can then be monitored through HD analysis for flooding attack detection. Our three-dimensional design offers the benefit of high detection accuracy even for low-rate flooding, robust performance under multi-attribute flooding, and the capability of selectively discarding the offending SIP messages to prevent the attacks from bringing damages to the network. Furthermore, we design a scheme to control the distribution of the normal traffic over the sketch. Such a design ensures our detection scheme’s effectiveness even under the severe distributed denial of service (DDoS) scenario, where attackers can flood over all the sketch table entries. In this paper, we not only theoretically analyze the performance of the proposed detection techniques, but also resort to extensive computer simulations to thoroughly examine the performance.

SIP Flow Time Interval between Messages of Statistical Analysis

SIP protocol is most often used for voice information transmitting over IP networks via communication session. Communication session process has been managed by SIP proxy server. In order to determine its operating characteristics, such as message service time, and message blocking probability, it is necessary to know the statistical features of the served traffic including the time interval of incoming message flow, the time interval distribution between arriving messages, mean value and their possible deviation. The statistic characteristics of time intervals of individual SIP messages and the total flow entering into SIP Proxy server have been experimentally determined in the paper. It has been found that the inter-arrival time of the sum total of SIP message flow does not correspond to the Poisson distribution thus General distribution should be used in the tests.DOI: http://dx.doi.org/10.5755/j01.eee.19.5.2908

Performance Analysis and Improvement on SIP-Based VoIP Server

The performance improvement on SIP-based VoIP server is given in this paper. The signaling server “SIP Proxy Server” and media streaming server “Media Relay Server” are applied. Firstly, the performance of VoIP server is analyzed and evaluated in detail. Then the effective method is applied to improve the performance of VoIP server. In the analysis results of SIP Proxy Server, the CPU time for the registration and call-setup sessions need 3.241 ms and 7.985 ms respectively. Moreover, in the Media Relay Server system, when the packet size from 1 to 32 bytes, the maximum throughput of packet is about 82,000 and 16,000 per second for UDP and TCP respectively. The large the packet, the less throughput is tenable. There are three methods applied to improve the performance. The capacity by 31 times is achieved. The capacity with 3,524 calls for each Media Relay Server is achieved. The improved method proposed in this paper is reasonable.

Detection And Countermeasure Scheme For Call-Disruption Attacks On SIP-Based Voip Services

Owing to its simplicity and flexibility, the session initiation protocol (SIP) has been widely adopted as a major session-management protocol for Internet telephony or Voice-over IP (VoIP) services. However, SIP has faced various types of security threats. Call-disruption attacks are some of the most severe threats they face, and can greatly inconvenience consumers. In this paper, we analyze such SIP call-disruption attacks, and propose a method for detecting and counteracting them by extending the SIP INFO method with authentication. Using the proposed method, both the target user and the SIP server can detect the existence of a call-disruption attack on a user and counteract the attack. We demonstrate the effectiveness of the proposed method from the viewpoint of computational complexity by configuring a test-bed with an Asterisk SIP proxy server and an SIP performance (SIPp) emulator.

Side effects of identity management in SIP VoIP environment

In this article, we summarize the security threats targeting SIP proxy servers or other infrastructures in NGN by misusing a specific signaling authentication mechanism, which has been proposed in RFC 4474 (Peterson and Jennings, 2006). This mechanism is designed to authenticate inter-domain SIP requests based on domain certificates to prevent identity theft. Nevertheless, despite its contribution, this protection raises some “side effects”, that actually lead to new vulnerabilities in both the availability and confidentiality of SIP services. We provide an overview of different attack possibilities and explain them in more detail, including attacks utilizing algorithm complexity, certificates storage, and certificates distribution. We also suggest some alternative design to prevent or reduce the attacks. SIP, VoIP, NGN, Authentication, Denial of Service, Timing attack.

A Study on Locating Lossy Links of Signaling Messages in SIP-Based Services

The number of SIP-based services provided by network service providers (NSPs) is increasing. SIP allows NSPs to control services and to collect the information relating to charging for the usage of their customer communications. Monitoring SIP messages (exchanged between SIP proxy servers and user terminals) is vital for providing the stable SIP-based services. Monitoring SIP messages enables NSPs to quickly discover a fault location where SIP messages are lost, and to determine the subsequent recovery solutions. This paper proposes a lightweight method for determining the location of SIP message loss through relationships based on the SIP's retransmission mechanism. Numerical analyses show that the proposed method can locate the lossy links of SIP messages with a low probability of detection failure.

A study of performance and scalability metrics of a SIP proxy server – a practical approach

In recent years, Internet Protocol (IP) telephony has been a real alternative to the traditional Public Switched Telephone Networks (PSTN). IP telephony offers more flexibility in the implementation of new features and services. The Session Initiation Protocol (SIP) is becoming a popular signalling protocol for Voice over IP (VoIP) based applications. The SIP proxy server is a software application that provides call routing services by parsing and forwarding all the incoming SIP packets in an IP telephony network. The efficiency of this process can create large scale, highly reliable packet voice networks for service providers and enterprises. We established that the efficient design and implementation of the SIP proxy server architecture can enhance the performance characteristics of a SIP proxy server significantly. Since SIP proxy server performance can be characterised by its transaction states of each SIP session, we emulated the M / M / 1 performance model of the SIP proxy server and studied some of the key performance benchmarks such as average response time to process the SIP calls, and mean number of SIP calls in the system. We showed its limitations, and then studied an alternative M / M / c based SIP proxy server performance model with enhanced performance model and studied additional key performance characteristics such as server utilisation, queue size and memory utilisation. Provided the comparative results between the predicted results with the experimental results conducted in a lab environment.

PrivaSIP: Ad-hoc identity privacy in SIP

In modern and future networks that belong to different providers, multimedia protocols will have to operate through multiple domains. In such an environment security is considered a crucial parameter; this is true especially for privacy since not all domains can be considered trusted beforehand in terms of personal data protection. Probably the most promising protocol for multimedia session management is SIP. While SIP is popular and a lot of research has been conducted, it still has some security issues, one of which is related to privacy and more particularly the protection of user identities (IDs). In the general case everybody can reveal the communicating parties IDs by simply eavesdropping on the exchanged SIP messages. In this paper we analyze the lack of user ID protection in SIP and propose two solutions; in the first the ID of the caller is protected while in the second both IDs of the caller and the callee are protected. Our work also includes performance results and extensive comparison with similar methods. The most significant advantage of our method is that it can assure user ID protection even when SIP messages are transmitted through untrusted SIP domains before reaching the Home Domain of the user or another trusted domain. Moreover, it does not require from the SIP Proxy server to maintain state information for exchanged SIP requests and respective responses.

SIP 공격 대응을 위한 보안성이 강화된 Stateful SIP 프로토콜

SIP 프로토콜 기반 VoIP 서비스는 편리함과 저렴한 통신비용으로 사용자 수가 급증하고 있다. 하지만 SIP 프로토콜은 텍스트 형태의 SIP 헤더 정보를 UDP 방식으로 전송하기 때문에 손쉽게 위변조 할 수 있으며, 송신자에 대한 인증 기능을 제공하고 있지 않기 때문에 악의적 공격자에 의해 SIP 패킷 폭주 공격등에 매우 취약하다. 따라서 본 논문에서는 이러한 SIP 취약성을 해결하기 위해 SIP 상태코드를 모니터링 하여 SIP 폭주 공격을 탐지하고 SIP 패킷에 대해 인증 및 보안 기능이 강화된 프로토콜을 제시하였다. SIP 공격탐지 시스템을 구축하여 SIP 세션을 능동적으로 관리하였으며 보안 기능을 강화하기 위해 사용자 인증을 적용하여 SIP 프로토콜의 취약점을 해결할 수 있었다. 본 논문에서 제시한 기법은 기존 SIP 프로토콜에서의 보안 취약성을 해결하고 최소한의 트래픽 전송 지연만으로도 안전하게 패킷을 송수신할 수 있도록 하였으며 SIP 프록시 서버에서의 서비스 지연, 서버의 과부하 등의 문제를 최소화할 수 있도록 설계되었다. The user valence of VoIP services with SIP protocol is increasing rapidly because of cheap communication cost and its conveniency. But attacker can easily modify the packet contents of SIP protocol as SIP header is transmitted by using UDP methods in text form. The reason is that SIP protocols does not provide an authentication function on the transmission session. Therefore, existing SIP protocol is very weak on SIP Packet Flooding attack etc. In order to solve like this kinds of SIP vulnerabilities, we used SIP status codes under the monitoring module for detecting SIP Flooding attacks and additionally proposed an advanced protocol where the authentication and security function is strengthened about SIP packet. We managed SIP session spontaneously in order to strengthen security with SIP authentication function and to solve the vulnerability of SIP protocol. The proposed mechanism can securely send SIP packet to solves the security vulnerability with minimum traffic transmission. Also service delay in SIP proxy servers will be minimized to solve the overload problem on SIP proxy server.

An Integrated Personal Mobility Management Framework based on RFID in Heterogeneous Fixed and Mobile Networks

Event Abstract Back to Event An Integrated Personal Mobility Management Framework based on RFID in Heterogeneous Fixed and Mobile Networks Yun-Won Chung1* 1 Soongsil University, South Korea Personal mobility (PM) enables users to receive services through any terminal based on unique user identifier (UID) [1]. Although manual registration was needed in conventional PM [1], automatic registration using RFID technology has been proposed recently [2,3]. In [2,3], if a user with RFID tag moves into home or office, RFID reader in fixed terminal detects the RFID tag and registers the user with the terminal at registrar. Then, services can be delivered to the registered terminal, and handoff between terminals can be provided seamlessly. In [2,3], however, only fixed terminal is considered but both fixed and mobile terminals should be considered together in order to achieve true PM in future network.In this poster, we propose an integrated PM management framework based on RFID technology, as in Figure 1, where mobile networks such as cellular network and WLAN and fixed networks such as home network and office network are interworked based on all-IP core network. SIP proxy, redirect, and registrar servers are used to provide PM. Service to a user is delivered based on a chain of location information at registrar and access network: the relationship between UID and registered terminal IDs (TIDs) is managed by registrar and the location information of registered TIDs is managed by access networks. For example, the location information of mobile terminals (MTs) in cellular network is managed by home location register (HLR) by terminal mobility management. Home and office gateways also manage the location information of users moving within their domains with RFID technology. Service to UID is intelligently delivered based on the quality of service (QoS) requirement of a requested service and user preference in the service profile stored in registrar. If the delay is a more important QoS requirement, parallel forking to all registered terminals can be used. If the cost is a more important user preference in the service profile, the service is firstly delivered to a fixed network and if not found, mobile network is searched. Our future work includes performance analysis of the proposed PM management based on detailed registration and delivery procedures with QoS requirement and user preference in the service profile. Acknowledgement: This research is supported by the Ubiquitous Computing and Network (UCN) Project, Knowledge and Economy Frontier R&D Program of the Ministry of Knowledge Economy(MKE) in Korea and a result of subproject UCN 09C1-C1-20S. fig

An enhanced SIP proxy server for wireless VoIP in wireless mesh networks

The wireless mesh network (WMN) has emerged recently as a promising technology for next-generation wireless networking. In WMNs, it is important to provide high quality multimedia service in a flexible and intelligent manner. To address this issue in this article, we study the Session Initiation Protocol (SIP) for wireless voice over IP (VoIP) applications. Especially, we investigate the technical challenges in WMN VoIP systems and propose a design of an enhanced SIP proxy server to overcome them. An analysis of the signaling process and a study of simulation results have shown the advantages of our proposed approach.

Bandwidth Allocation and Session Scheduling using SIP

Session Initiation Protocol (SIP) is a new signaling protocol designed to establish multimedia sessions in telecommunication networks. In this paper, we suggest the extension of SIP functionalities to coordinate QoS mechanisms deployed in IP networks, and especially in DiffServ domain. Indeed, the interaction between small and big TCP sessions may have dramatic consequences on small TCP sessions. Hence, we use SIP to achieve QoS management on a session basis, in which the over all activity of the user during the session is considered. The suggested mechanisms deal with two issues: first, session scheduling based on session duration and/or volume, and second bandwidth allocation on a per-flow basis using equivalent bandwidth estimation techniques. The proposed mechanisms are implemented in the SIP proxy server as QoS management algorithms, and they are validated by simulations.

Scalable and efficient QoS support for SIP‐signalled voice calls

AbstractThis paper proposes an extension of the functionality of a SIP proxy server for providing QoS to SIP‐signalled voice over IP calls in a scalable and efficient way. The basic concept lies in aggregating SIP calls into bandwidth‐provisioned trunks and on admitting calls on trunks only within the limit of their bandwidth. The SIP proxy server derives bandwidth requirements of SIP calls directly from parsed SIP messages. The bandwidth of the logical trunks can be dynamically changed. With a moderate trunk over‐sizing, the trunk resizing rate can be kept much lower than the call arrival process. The approach scales well in a scenario where a centralized entity (bandwidth broker) is in charge of managing all the trunks of a given domain. We present simulation results that confirm this good scalability. The functionality and scalability of the proposed approach is compared with other ones currently discussed in the IETF or in the literature. Copyright © 2006 John Wiley & Sons, Ltd.

Special Issue on Voice Over IP—Theory and Practice

Special Issue on Voice Over IP—Theory and Practice

Stage based parallel programming model for high concurrency, stateful network services: internals and design principles

Recent research has revealed that the conventional threaded programming model exhibits poor performance under high concurrency workloads. Moreover, with emerging stateful network services, where concurrent states can go to thousands, the traditional 'thread per request' solution is no longer feasible. To meet this challenge, people promote a new parallel programming model, stage-based programming, where the whole service logic is viewed as a set of stages, each driven by a limited number of threads and capable of communicating with others through message passing. In this paper, we show two main streams of stage design, Thread-Over-Stages and Thread-Per-Stage. Due to the advantages in Thread-Per-Stage, we promote this solution and reveal three key design principles for delivering a high performance stage-based design. They are: on a uniprocessor system, the number of stages should not be too large - for most fine grained network services, it should not be over ten; for stages with blocking calls, a good estimation of the number of threads for that stage can be gotten by (call arrival rate × blocking time); and to deliver temporary messages quickly, it is much better to locate this part of the services in a separate nonblocking stage. We implement a sample SIP proxy server to prove our arguments.