Η τηλεπικοινωνιακή πλατφόρμα IP Multimedia Subsystem (IMS) φιλοδοξεί να γεφυρώσει το χάσμα μεταξύ των δικτύων κινητής επικοινωνίας και διαδικτύου, προσφέροντας τη βάση για ανάπτυξη καινοτόμων εφαρμογών και υπηρεσιών. Μια από αυτές τις υπηρεσίες φαίνεται πως θα είναι εκείνη της αποστολής μεγάλων αρχείων πολυμέσων σε συνδρομητές. Το περιεχόμενο αυτών των αρχείων δεν θα είναι όμοιο για όλους αλλά θα αποτελείται από αρκετά ξεχωριστά τμήματα το καθένα προσαρμοσμένο στις ατομικές ανάγκες και ενδιαφέροντα του χρήστη στον οποίο και αποστέλλεται. Η διπλωματική αυτή εργασία περιγράφει μια πρόταση για την αποστολή εξατομικευμένου διαφημιστικού υλικού, η επιλογή του οποίου γίνεται με βάση τις προσωπικές πληροφορίες που υπάρχουν διαθέσιμες για το χρήστη στο διαδίκτυο και δεδομένα που παρέχει ο φορέας της υπηρεσίας. Παρουσιάζεται με λεπτομέρεια η πλατφόρμα πάνω στην οποία βασίστηκε η ανάπτυξη, η σχεδίαση του αλγορίθμου επιλογής καθώς επίσης και η μέθοδος αξιολόγησης των αποτελεσμάτων που ελήφθησαν από την εκτέλεση της εφαρμογής που υλοποιήθηκε. / Implementation and evaluation of an online environment for personalized content delivery.

The aim of this work is to give information about the structure and elements of the IP Multimedia Subsystem, using signaling protocol and transferring messages between the terminal and elements of IMS. Create model, which implements messages transfer between terminal and IMS elements, by environment tools OPNET Modeler. This work describes system function IMS, its architecture, basic elements, architecture of using signaling protocol SIP and its elements, SIP and SDP messages format and the way of ensuring Quality of Services. There is a project of model terminal registration and reservation data flow by terminal in the IMS. These models were realized in a simulation environment called OPNET Modeler by using tools: project editor, node editor and process editor. In the last part of this work, the method of verification correct function of realized models was created by simulation tools called Debbuger. This tool is one of the environment tools OPNET Modeler.

This thesis describes architecture of IMS and shows possibilities of IMS platform testing. Theoretical part describes layer model of the IMS as a whole and then describes it’s individual layers. Next chapters analyse key entities of the IMS, interconnection between reference points and features of protocols used in the IMS. Practical part deals with the introduction of Open IMS Core, which was chosen for the IMS technology testing. Settings necessary to carry out testing and interconnection between PBX Asterisk are shown in next chapters. After introduction of IMS desktop clients is carried out an instant messaging communication within the IMS network. The communication is captured and analysed by Wireshark application. Afterwards there is described how SIP protocol sends messages within the IMS. After a brief introduction to the PBX Asterisk, there are discussed assumptions for the interconnection between Asterisk and IMS. There are also described necessary settings needed for implementation and communication testing itself. The first test is an audio session carried out between the desktop IMS client and IP phone registered to the PBX Asterisk. Communication is captured for the analysis of preparation, conduction and termination of the session. After the successful realization of the audio call, video session has been made. The session was analysed in detail, including statistics of control signals and transmitted packets. There are two laboratory excercises in attachement of this thesis, which will help students to understand the IMS technology and communication options within the IMS network

Το αντικείμενο αυτής της διπλωματικής εργασίας είναι η μελέτη της δομής υπηρεσιών πάνω στα 0ίκτυα Επόμενης Γενιάς (Next Generation Networks, NGN). Συγκεκριμένα, περιγράφεται η αρχιτεκτονική IMS (IP Multimedia Subsystem) πάνω στην οποία βασίζεται η δομή των 0ικτύων Επόμενης Γενιάς. Στα πλαίσια της παρούσας διπλωματικής εργασίας γίνεται αρχικά μια σύντομη αναφορά στο ιστορικό δημιουργίας του IMS, ενώ στην συνέχεια γίνεται μια εκτεταμένη περιγραφή του μοντέλου και του τρόπου λειτουργίας του IMS. Συγκεκριμένα, αναλύονται οι οντότητες και τα σημεία αναφοράς από τα οποία αποτελείται το IMS καθώς και τα πρωτόκολλα που χρησιμοποιεί. Στη συνέχεια γίνεται μία αναφορά στην ασφάλεια του IMS, όπου αναφέρονται πιθανοί κίνδυνοι και απειλές για το IMS καθώς και τρόποι αντιμετώπισής τους. Έπειτα, παρουσιάζονται και περιγράφονται αναλυτικά οι υπηρεσίες που μπορεί να προσφέρει το IMS στα πλαίσια των 0ικτύων Επόμενης Γενιάς. Τέλος, γίνεται παρουσίαση ενός παραδείγματος εφαρμογής της υπηρεσίας VoIP πάνω από την IMS αρχιτεκτονική. Για την υλοποίηση αυτού του παραδείγματος χρησιμοποιήθηκε το πρόγραμμα προσομοίωσης OPNET 10.0, ενώ συλλέχθηκαν αποτελέσματα σχετικά με τη συμπεριφορά του πρωτοκόλλου SIP και της υπηρεσίας VoIP σε IMS περιβάλλον. / The objective of this diploma thesis is the study of the service structure of Next Generation Networks (NGN). Especially, the IMS architecture (IP Multimedia Subsystem) is being described, which the NGN structure is based on. Initially, there is a quick reference to the history of the development of IMS, and continually an extensive description is being made about the model and the functional mode of IMS. Next, security aspects of IMS are being described, and continually there is a presentation about the services that IMS offers. Finally, an example is being presented regarding the application of VoIP service using the IMS architecture. For the configuration of this example, the simulation program OPNET 10.0 was used, while results were collected regarding the behavior of SIP protocol and VoIP service in the IMS environment.

Η παρούσα διπλωματική εργασία είναι η υλοποίηση σε λογισμικό του Home Subscriber Server (HSS). Ο HSS είναι ένας εξυπηρετητής ζωτικής σημασίας για το IP Multimedia Subsystem (IMS). Αποτελεί την κύρια βάση του δικτύου που περιέχει σημαντικές πληροφορίες για τους χρήστες και επιτελεί, μαζί με κάποιες άλλες οντότητες,την πιστοποίηση και την εξουσιοδότηση των χρηστών, που επιθυμούν να χρησιμοποιήσουν το IMS δίκτυο. / This thesis is the software implementetion of a Home Subscriber Server (HSS). The HSS is a server vital for IP Multimedia Subsystem (IMS). It is the main basis of the network which contains important information for users and it performs, along with some other entities, certification and authorization of users who wish to use the IMS network.

The IP Multimedia Subsystem (IMS) is an open IP based service infrastructure that enables an easy deployment of new rich multimedia services mixing voice and data. The IMS is an overlay network on top of IP that uses SIP as the primary signaling mechanism. As an emerging technology, the SIP standard will certainly be the target of Denial of Service (DoS) attacks and consequently IMS will also inherit this problem. The objective of proposed architecture for IMS is to cram the potential attacks and security threats to IP Multimedia Subsystem (IMS) and explore the security solutions developed by 3GPP. This research work incorporates the ideas of immune system and multiagent architecture that is capable of detecting, identifying and recovering from an attack. The proposed architecture protects IMS core components i.e. P-CSCF (Proxy- Call Session Control Function), I-CSCF (Interrogating-Call Session Control Function), S-CSCF (Serving Call Session Control Function) and HSS (Home Subscriber Server) from external and internal threats like eavesdropping, SQL injection and denial-ofservice (DoS) attacks. In the first level i.e. CPU under normal load all incoming and out going messages were investigated to detect and prevent SQL injection. Second level considers Denial of Service (DOS) attacks when CPU load exceeds threshold limit. Proposed architecture is designed and evaluated by using an approach called Architecture Tradeoff Analysis Method (ATAM). The results obtained confirm consistency of the architecture. / kalyani-0046737527800

Dans cette thèse, nous concevons trois nouveaux mécanismes d'authentification basés sur l'identité des utilisateurs. Par conséquent, nous apportons des améliorations sur le contrôle d'accès à différents types de réseaux tels que les réseaux domestiques, les réseaux gouvernementaux et les réseaux cellulaires. L'identité se base sur des gabarits biométriques publics, des chaînes de caractères simples comme l’adresses e-mail ou l’identifiant (login). La première solution concerne l'utilisation de données biométriques dans les mécanismes d'authentification des réseaux domestiques (Home Network HN). Nous voulons personnaliser l'accès de chaque utilisateur dans le HN et prévenir les utilisateurs illégitimes (en passant par la passerelle domestique « Home Gateway (HG) ») d'avoir accès aux services. Nous proposons une nouvelle méthode d'authentification biométrique qui respecte la contrainte de ne pas sauvegarder les données biométriques (Biometric Template (BT)) des utilisateurs dans le HG. Pour satisfaire cette contrainte, nous proposons d'utiliser la méthode de « Fuzzy Vault » pour cacher un secret utilisé pour l'authentification. Un logiciel génère une identité biométrique révocable (BioID) en utilisant une transformation fonctionnelle. Ce BioID est utilisé par le mécanisme du fuzzy vault pour cacher une clé de session secrète. La deuxième solution propose des mécanismes d'authentification pour les passeports biométriques (e-Passeports). Les paramètres de chiffrement sont générés en utilisant les données biométriques et, ainsi, ils seront personnalisés pour l'utilisateur. Notre proposition introduit un nouveau mécanisme d'authentification pour le passeport biométrique utilisant le protocole Diffie-Hellman de partage de clé basé sur les courbes elliptiques (ECDH). Ce protocole est nécessaire pour générer une clé de session utilisée pour authentifier le voyageur et le système d'inspection (IS) et ainsi sécuriser l'échange des données entre eux. Notre protocole peut utiliser les points "minuties" d'une empreinte digitale et le code de l'iris du détenteur du passeport électronique. Dans la troisième solution, nous avons travaillé sur le réseau cellulaire et nous avons utilisé une chaîne de caractères simple (l’adresse e-mail de l’utilisateur) comme identifiant pour accéder aux services. Nous avons choisi l'IP Multimedia Subsystem (IMS) qui est une architecture de recouvrement pour la fourniture de services multimédia, comme support. Nous avons conçu un nouveau mécanisme d'authentification aux services en utilisant la cryptographie basée sur l'identité (IBC). L'objectif était d'authentifier les utilisateurs en utilisant leurs identifiants public et privé pour surmonter les faiblesses connues du protocole «Authentication and Key Agreement (AKA) ». Nous nous sommes concentrés sur les tentatives d'écoute et d’usurpation d'identité qui peuvent avoir lieu dans le scénario classique de l’IMS et nous avons montré comment la solution proposée peut prévenir ces attaques. Nous avons ensuite proposé d'ajouter une vérification par lot au niveau du Bootstrapping Server Function (BSF) pour diminuer le délai de vérification des signatures et le temps de réponse de l’authentification. / In this thesis, we design three new authentication mechanisms based on user identity. Therefore, we bring improvements in access control for different classes of networks such as Home Network, Governmental Network and Cellular Network. The identity can be biometric public features, simple strings (email addresses, login...), etc. The first solution concerns the use of biometric in Home Network' authentication mechanisms. In the Home Network (HN) case study, we aim at personalizing the access of each user in the HN and preventing illegitimate users (passing by the Home Gateway (HG)) to have any access. We propose a new biometric authentication method which respects the constraint of the non storage of the users' Biometric Template (BT) in the HG. To satisfy this constraint, we propose using the fuzzy vault method to hide a secret that should be used for authentication. A software generates a revocable biometric identity (BioID) using a functional transformation. This BioID is used in the fuzzy vault mechanisms to hide a secret session key. The second solution proposes e-Passport authentication mechanisms. The cryptographic parameters are generated using the biometric templates and hence, personalized for the user. In travel document case study, we present our proposal which introduces a new e-Passport authentication mechanisms based on the Elliptic Curve Diffie-Hellman (ECDH) Key Agreement protocol. This protocol is needed to generate a session key used to authenticate the traveler and the Inspection System (IS) to exchange secure data. Our protocol is defined using minutiae data (fingerprint) and iris code of the e-Passport holder. In the third solution, we worked on the Cellular Network and we used a simple string, like email addresses, as identifier to access to services. We choose the IP Multimedia Subsystem (IMS) which is an overlay architecture for the provision of multimedia services. We design a new service authentication mechanism relying on Identity Based Cryptography (IBC) for the IMS architecture. The goal was to authenticate the users using their public and private identifiers to overcome known weaknesses in the Authentication and Key Agreement (AKA) protocol. We focused on the eavesdropping and impersonation attacks that can take place in classical IMS scenario and we showed how our proposed solution can prevent against these attacks. We, then, proposed to add a Batch Verification on the Bootstrapping Server Function (BSF) to decrease signature verification delay and the authentication response time.

Next generation heterogeneous wireless networks are expected to interwork with Internet Protocol (IP)-based infrastructures. Conventional network services operate like silos in that a specific set of services are offered over a specific type of access network. As access networks evolve to provide IP-based packet access, it becomes attractive to break these “service silos” by offering a converged set of IP-based services to users who may access these services using a number of alternative access networks. This trend has started with third generation cellular mobile networks, which have standardized on the use of the IP Multimedia Subsystem (IMS) to manage user access to a wide variety of multimedia services over the mobile Internet, while facilitating interworking of heterogeneous wireless and landline access networks. The future users of communication systems will subscribe to both IP-based and Circuit Switched (CS) based services and in the foreseeable future a single database that handles user profiles across all domains will be required. Home Subscriber Server (HSS) as an evolved version of Home Location Register (HLR) is one of the key components of IMS. In deploying HSS as a central repository database, in a fully overlapped heterogeneous network setting, changes of access mode are very frequent and conveying this information to HSS imposes excessive signaling load and delay. In our proposed scheme we introduce an Interface Agent (IA) for each location area that caches the location and information about the access mode through which a user can be reached. This method results in significant amount of savings in signaling cost and better delay performance. The existing call delivery approaches in cellular networks may not be well suited for future communication systems because they suffer from unnecessary usage of network resources for call attempts that may fail which adds to excessive signaling delays and queuing costs. Reducing the number of queries and retrievals from the database will have a significant impact on the network performance. We present a new scheme based on Reverse Virtual Call setup (RVC) as a solution to the call delivery problem in heterogeneous wireless networks and evaluate the performance of this framework.

Next generation heterogeneous wireless networks are expected to interwork with Internet Protocol (IP)-based infrastructures. Conventional network services operate like silos in that a specific set of services are offered over a specific type of access network. As access networks evolve to provide IP-based packet access, it becomes attractive to break these “service silos” by offering a converged set of IP-based services to users who may access these services using a number of alternative access networks. This trend has started with third generation cellular mobile networks, which have standardized on the use of the IP Multimedia Subsystem (IMS) to manage user access to a wide variety of multimedia services over the mobile Internet, while facilitating interworking of heterogeneous wireless and landline access networks. The future users of communication systems will subscribe to both IP-based and Circuit Switched (CS) based services and in the foreseeable future a single database that handles user profiles across all domains will be required. Home Subscriber Server (HSS) as an evolved version of Home Location Register (HLR) is one of the key components of IMS. In deploying HSS as a central repository database, in a fully overlapped heterogeneous network setting, changes of access mode are very frequent and conveying this information to HSS imposes excessive signaling load and delay. In our proposed scheme we introduce an Interface Agent (IA) for each location area that caches the location and information about the access mode through which a user can be reached. This method results in significant amount of savings in signaling cost and better delay performance. The existing call delivery approaches in cellular networks may not be well suited for future communication systems because they suffer from unnecessary usage of network resources for call attempts that may fail which adds to excessive signaling delays and queuing costs. Reducing the number of queries and retrievals from the database will have a significant impact on the network performance. We present a new scheme based on Reverse Virtual Call setup (RVC) as a solution to the call delivery problem in heterogeneous wireless networks and evaluate the performance of this framework.

Next generation heterogeneous wireless networks are expected to interwork with Internet Protocol (IP)-based infrastructures. Conventional network services operate like silos in that a specific set of services are offered over a specific type of access network. As access networks evolve to provide IP-based packet access, it becomes attractive to break these “service silos” by offering a converged set of IP-based services to users who may access these services using a number of alternative access networks. This trend has started with third generation cellular mobile networks, which have standardized on the use of the IP Multimedia Subsystem (IMS) to manage user access to a wide variety of multimedia services over the mobile Internet, while facilitating interworking of heterogeneous wireless and landline access networks. The future users of communication systems will subscribe to both IP-based and Circuit Switched (CS) based services and in the foreseeable future a single database that handles user profiles across all domains will be required. Home Subscriber Server (HSS) as an evolved version of Home Location Register (HLR) is one of the key components of IMS. In deploying HSS as a central repository database, in a fully overlapped heterogeneous network setting, changes of access mode are very frequent and conveying this information to HSS imposes excessive signaling load and delay. In our proposed scheme we introduce an Interface Agent (IA) for each location area that caches the location and information about the access mode through which a user can be reached. This method results in significant amount of savings in signaling cost and better delay performance. The existing call delivery approaches in cellular networks may not be well suited for future communication systems because they suffer from unnecessary usage of network resources for call attempts that may fail which adds to excessive signaling delays and queuing costs. Reducing the number of queries and retrievals from the database will have a significant impact on the network performance. We present a new scheme based on Reverse Virtual Call setup (RVC) as a solution to the call delivery problem in heterogeneous wireless networks and evaluate the performance of this framework. / Applied Science, Faculty of / Electrical and Computer Engineering, Department of / Graduate