재전송 메커니즘에 의한 SIP 등록 취소 및 통화 방해 공격 대응 방안
Detection of SIP De-Registration and Call-Disruption Attacks using a Retransmission Mechanism and a Countermeasure Scheme
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
SIP는 상호 간의 멀티미디어 통신 세션을 관리하는 응용 계층 시그널링 프로토콜이다. 현재 SIP는 프로토콜의 간편성, 유연성, 다양성 등의 장점을 가지고 인터넷 메신저, 게임, VoIP(Voice over IP)등에 널리 이용되고 있다. 그러나 SIP는 여러 보안상의 문제점들을 가지고 있고, 특히 통화 방해 공격은 사용자들에게 큰 불편을 줄 수 있는 공격으로 이에 대한 대응 방법이 요구된다. 따라서 본 논문에서는 SIP 등록 취소 공격 및 통화 방해 공격에 대해서 분석해 보고 이를 탐지 하는 기법을 제안한다. 공격 탐지는 재전송 메커니즘을 기반으로 공격으로 의심되는 메시지와 사용자가 마지막으로 전송한 메시지의 비교를 통해서 이루어진다. 만약 메시지가 공격으로 판단될 경우 사용자에게 이를 알리고 재인증 과정을 거친다.
Abstract
SIP is an application-level signaling protocol that manages a mutual multimedia communication session. Presently, SIP is widely used with internet messaging, games and with VoIP (Voice over IP) due to advantages such as its simplicity, flexibility and variety of protocols. However, SIP is associated with many types of security issues and requires a countermeasure device against call-disturbance attacks that can cause a great amount of inconvenience to users. Therefore, this study analyses SIP De-registration and call-disruption attacks and proposes a means of detecting these attacks. Attack detection is accomplished through a comparison of the messages last sent by the user and those that are considered to be an attack based on a Retransmission mechanism. When a message is detected as an attack, the user is informed and a Re-authentication process is performed.
참고문헌 (14)
- Rosenberg J., "SIP: Session Initiation Protocol. RFC 3261" (2002), IETF Network Working Group
- Pawel Lawecki, "VoIP Security in Public Networks" (2007), Alcatel Lucent
- Pauli Vesterinen, "User Authentication in SIP" (2006), Seminar on Network Security
- Thermos Peter, "Two Attacks against VoIP" (2006), SecurityFocus
- Srinivasan R., "Authentication of Signaling in VoIP Applications", Communications, Asia- Pacific Conference, pp.530~533 (2005)
- Chia-Hui Wang, "A Distributed Key Changing Mechanism for Secure Voice- Over-IP Service", 2007 IEEE International Conference on Multimedia and Expo (2007)
- Anat Bremler-Barr, "Unregister Attacks in SIP", 2nd IEEE Workshop on Secure Network Protocols, pp.32~37 (2006)
- Yanlan Ding, "Intrusion Detection System for Signal-based SIP Attacks Through Timed HCPN", The Second International Conference on Availability (2007), Reliability and Security
- Yu-Sung Wu, "SCIDIVE: A Stateful and Cross Protocol Intrusion Detection Architecture for Voice- Over-IP Environments" (2004), Dependable Systems and Networks
- Feng Cao, "Providing Response Identity and Authentication in IP Telephony" (2006), ARES
- Schmidt, H, "Proxy-based Security for the Session Initiation Protocol(SIP)" (2007), Systems and Networks Communications
- Sher, M, "Protecting IP Multimedia Subsystem (IMS) Service Delivery Platform from Time Independent Attacks" (2007), Information Assurance and Security
- J. Rey, "RTP Retransmission Payload Format. RFC 4588" (2006), IETF Network Working Group
- H. Schulzrinne, "RTP: A Transport Protocol for Real-Time Applications. RFC 3550" (2003), IETF Network Working Group