The success of the Internet has brought significant changes to the telecommunication industry. One of the remarkable outcomes of this evolution is Voice over IP (VoIP), which enables realtime voice communications over packet switched networks for a lower cost than traditional public switched telephone networks (PSTN). Nevertheless, security and privacy vulnerabilities pose a significant challenge to hindering VoIP from being widely deployed. The main object of this thesis is to define and elaborate unexplored security and privacy risks on standardized VoIP protocols and their implementations as well as to develop suitable countermeasures. Three research questions are addressed to achieve this objective: Question 1:  What are potential unexplored threats in a SIP VoIP network with regard to availability, confidentiality and privacy by means of unwanted traffic and information disclosure? Question 2:  How far are existing security and privacy mechanisms sufficient to counteract these threats and what are their shortcomings? Question 3:  How can new countermeasures be designed for minimizing or preventing the consequences caused by these threats efficiently in practice? Part I of the thesis concentrates on the threats caused by "unwanted traffic", which includes Denial of Service (DoS) attacks and voice spam. They generate unwanted traffic to consume the resources and annoy users. Part II of this thesis explores unauthorized information disclosure in VoIP traffic. Confidential user data such as calling records, identity information, PIN code and data revealing a user's social networks might be disclosed or partially disclosed from VoIP traffic. We studied both threats and countermeasures by conducting experiments or using theoretical assessment. Part II also presents a survey research related to threats and countermeasures for anonymous VoIP communication.

The purpose of this project is to update the tool of Network Traffic Recognition System (NTRS) which is proprietary software of Ericsson AB and Tsinghua University, and to implement the updated tool to finish SIP/VoIP traffic recognition. Basing on the original NTRS, I analyze the traffic recognition principal of NTRS, and redesign the structure and module of the tool according to characteristics of SIP/VoIP traffic, and then finally I program to achieve the upgrade. After the final test with our SIP data trace files in the updated system, a satisfactory result is derived. The result presents that our updated system holds a rate of recognition on a confident level in the SIP session recognition as well as the VoIP call recognition. In the comparison with the software of Wireshark, our updated system has a result which is extremely close to Wireshark’s output, and the working time is much less than Wireshark. In the aspect of practicability, the memory overflow problem is avoided, and the updated system can output the specific information of SIP/VoIP traffic recognition, such as SIP type, SIP state, VoIP state, etc. The upgrade fulfills the demand of this project.

Die vorliegende Arbeit beschreibt SIP Clients für Linux und Windows. Die Programme funktionieren in einem leistungsstarken Netzwerk, wie z.B. dem Intranet der Technischen Universität Chemnitz, problemlos. Alle Funktionen wurden in einer VoIP-Umgebung getestet. Die Sprachübertragungqualität über das Internet mittels dieser Clients ist jedoch nicht Gegenstand der Arbeit und somit auch nicht erprobt worden. In vielen Unternehmensbereichen fällt häufig der Begriff Echtzeitkommunikation in Verbindung mit einer geeigneten Infrastruktur, ausgelöst durch den Zuwachs der verfügbaren Netzwerkbandbreite und somit immer realistischer werdender Sprach- und Videoübertragungen. Ein Ansatz für die Anwendungen ist das Protokoll SIP (Session Initiation Protocol), welches für die Signalisierung der Video- und Sprachübertragung verwendet wird.

Η μεγάλη εξάπλωση των δικτύων που βασίζονται στο Internet Protocol (IP) , έδωσε την ευκαιρία για χρήση του Διαδικτύου για μετάδοση φωνής , μέσω της τεχνολογίας Voice over IP(VoIP) , έναντι των παραδοσιακών δημοσίων τηλεφωνικών δικτύων (PSTN) . Το Session Initiation Protocol είναι το πρωτόκολλο σηματοδοσίας , που χρησιμοποιείται για τον έλεγχο συνόδων πολυμέσων , όπως κλήσεις φωνής ή βιντεοκλήσεις στα δίκτυα IP . Η χρησιμοποίηση του πρωτοκόλλου σε φορητές συσκευές , όπου η διαχείριση πόρων παίζει σπουδαίο ρόλο , δίνει το ερέθισμα για τη δημιουργία ειδικού υλικού που θα αποφορτίζει τον επεξεργαστή της συσκευής από τους απαιτητικούς ελέγχους που χρειάζονται για την δημιουργία μιας συνόδου . Στα πλαίσια της παρούσας διπλωματικής εργασίας παρουσιάζεται ένα σύστημα , υλοποιημένο σε FPGA , που προσομοιώνει έναν χρήστη SIP , κι έχει τη δυνατότητα να λαμβάνει , να επεξεργάζεται και να απαντά σε μηνύματα για την δημιουργία μια συνόδου . Στα κεφάλαια που ακολουθούν παρουσιάζεται η δομή του πρωτοκόλλου και τα χαρακτηριστικά του συστήματος που υλοποιήθηκε . Αρχικά παρουσιάζονται οι βασικές αρχές του πρωτοκόλλου και τα δομικά στοιχεία του . Έπειτα αναλύεται η δομή ενός SIP μηνύματος κι εξηγούνται οι λόγοι που κάνουν την αποθήκευσή του απαιτητική εργασία για την CPU . Έπειτα αναλύεται η βασική διαδικασία δημιουργίας συνόδου χρησιμοποιώντας ένα παράδειγμα . Το επόμενο μέρος αφιερώνεται στην αναλυτική περιγραφή του συστήματος που υλοποιήθηκε και την διαδικασία ελέγχου της ορθής λειτουργίας του . Τέλος παρουσιάζονται τα αποτελέσματα και συμπεράσματα της εργασίας . / The wide spread of networks based on Internet Protocol (IP), gave the opportunity for using the Internet for voice transmission , through Voice over IP (VoIP) technology, over traditional public telephone networks (PSTN). The Session Initiation Protocol is a signaling protocol , used to control multimedia sessions such as voice calls or video calls in IP networks. The use of this protocol in mobile devices , where resources management is very important ,is giving the stimulus for the creation of special hardware that offloads the CPU of demanding controls needed to create a session . As part of this thesis ,a system implemented on FPGA, which simulates a SIP user, and has the ability to receive, process and respond to messages to create a session , is presented. The following chapters present the structure of the protocol and the characteristics of the implemented system . Originally presented the basic principles of the Protocol and its structural elements . Thereafter the structure of a SIP message is analyzed , and the reasons that make storing a demanding work for the CPU , are explained. Then the basic process of creating a session is analyzed , using an example . The next part is devoted to a detailed description of the implemented system and the process of verifying the proper operation. Finally are presented the results and conclusions of the work .

Magistrinio darbo tikslas yra ištirti SIP protokolo panaudojimo galimybes mobiliems prietaisams skirtuose internetinės telefonijos sprendimuose ir parengti tokio bendravimo modelį. Atlikto darbo pagrindinis rezultatas yra reikalingos literatūros apžvalga ir analizė bei eksperimentinio IP telefonijos modelio realizacija mobiliose operacinėse sistemose. Pirmame skyriuje trumpai pateikiamas įvadas apie tradicinės telefonijos evoliuciją į balso perdavimą per interneto tinklus. Taip pat, kad palaipsniui IP telefonija vis labiau realizuojama į mobilius prietaisus. Tolimesniame skyriuje, norint argumentuoti IP telefonijos augimą, aprašomas atliktas rinkos tyrimas ir jo išvados apie esamą padėtį IP telefonijos srityje. Trečiame skyriuje pateikiama informacija apie apžvelgtą literatūrą: SIP protokolo struktūrą ir savybes, įkraunamas aplikacijas į mobiliuosius terminalus bei jų palyginimas. Sekančiame skyriuje pateikiama atlikto eksperimentinio modelio realizacija: reikalavimų specifikacija, reikalavimai įrangai, pasirinktų priemonių veikimo demonstravimas mobiliose aplinkose. Penktame skyriuje parašyti pagrindiniai rezultatai ir gautos išvados, o paskutiniame – nurodomi darbe naudoti literatūros šaltiniai. / The goal of this Master Thesis is to research practice possibilities of SIP protocol in voice over IP solutions for mobile devices and to formulate such communication model. The main result of accomplished work is review and analysis of needful literature and implementation of experimental IP telephony model in mobile operating systems. In the first section is introduced the preface about traditional telephony development to a voice transfer over internet networks. Also, that IP telephony is more and more actualized to mobile devices. To prove the growth of IP telephony was done a market research and was made the conclusions about existing position in VoIP sphere. That information can be found in the next chapter. The third chapter is about reviewed literature: the structure and features of SIP protocol, applications which can be installed into mobile terminals and their comparison. In the next section of the Master Thesis is given realization of experimental model: specifications, request for hardware, demonstration of chosen software tools in mobile systems. The main results and obtained conclusions are written in the fifth chapter, literature list – in the last one.

Η παρούσα εργασία διαπραγματεύεται το Σύστημα Παρουσίας και Στιγμιαίου Μηνύματος (Presence and Instant Messaging System) πάνω σε αρχιτεκτονικά πλαίσια που στηρίζονται στο πρωτόκολλο SIP, π.χ. το IMS. Σκοπός μας είναι μέσω της εφαρμογής που υλοποιούμε, να μπορεί ένας χρήστης να απολαμβάνει την υπηρεσία παρουσίας με τη βοήθεια γραπτού κειμένου (text). Στο Κεφάλαιο 1, δίνεται μια εισαγωγή σχετικά με τις έννοιες αλλά και τις οντότητες που πλαισιώνουν το μηχανισμό αυτό. Εν συνεχεία, παραθέτουμε την αρχιτεκτονική του συστήματος, δηλαδή τη γραφική διεπαφή, με την οποία ο χρήστης αλληλεπιδρά. Στο Κεφάλαιο 3, ακολουθεί λεπτομερής περιγραφή της υλοποίησης και δίνονται επεξηγήσεις για συγκεκριμένα σημεία του κώδικα. Στο κεφάλαιο 4, δύο χρήστες τρέχουν παράλληλα την εφαρμογή και παρουσιάζεται το σύστημα μας τόσο από τη μεριά των χρηστών όσο και από τη μεριά του εξυπηρετητή. Στο Κεφάλαιο 5, γίνεται αναφορά σε πολύπλοκα σενάρια και δίνονται περιγραφικές λύσεις που μπορούν να αποτελέσουν βάση για τον αναγνώστη εκείνο που επιθυμεί να διευρύνει περισσότερο τους ορίζοντές του στο συγκεκριμένο αντικείμενο. Τέλος, στο παράρτημα βρίσκεται ο πηγαίος κώδικας καθώς επίσης και τα αρχεία που χρειάστηκε να τροποποιήσουμε προκειμένου ο εξυπηρετητής να μας προσφέρει την αντίστοιχη υπηρεσία. / This thesis discusses the "Presence and Instant Messaging System" on an architectural framework based on the protocol SIP, eg IMS. Our goal is to implement an application that a typical user can interract with. This application provides this service using written text (text). Chapter 1 is an introduction to the concepts and entities in the specific area. Subsequently, we present the architecture of the system, ie the graphical interface of our application. In Chapter 3, we give a detailed description of the implementation plus explanations on specific parts of the code. In Chapter 4, two users run simultaneously our implementation.In Chapter 5, we refer to complex scenarios and we give solutions for them.Finally, in the Annex we attach the source code as well as the files that we had to modify for the server in order to offer us this service.

[pt] Impulsionada pelo grande crescimento da Internet, a telefonia IP conquistou a atenção do mercado e dos grandes fabricantes com promessas de redução de custo na operacão, gerência, provisionamento, manutenção e tarifação. Diversos protocolos foram desenvolvidos de modo a prover VoIP como o H.323, MGCP, Megaco e SIP. O SIP tem se destacado por ser um protocolo baseado em texto, estensível, independente do protocolo de transporte, e portanto mais flexível e simples que seu concorrente direto, o H.323. O SIP (Session Initiation Protocol) é um protocolo de sinalização utilizado para iniciar, modificar e terminar sessões, podendo ser usado para chamadas de voz sobre IP (VoIP) ou para troca de mensagens instantâneas, entre outras aplicações. Ele foi desenvolvido originalmente em 1996 e foi padronizado pela IETF em 1999. Neste trabalho, o desempenho do protocolo SIP para estabelecimento de chamadas VoIP será avaliado, já que há uma grande quantidade de trabalhos focando a qualidade da voz e poucos têm avaliado a sinalização [3]. Serão montados ambientes experimentais a fim de variar parâmetros como retardo, perda de pacotes, jitter, largura de banda e protocolo de transporte, permitindo verificar como esses parâmetros afetam isoladamente os tempos de post-dial delay, post-pickup delay e call release delay. / [en] Pushed by the growth of the Internet, the IP Telephony conquered a great attention of the market and big suppliers, with promises of cost reductions on operation, management, provisioning, maintenance and billing. Different protocols were developed for providing VoIP such as H.323, MGCP, Megaco and SIP. SIP has been highlighted for being a text based protocol, extensible, independent of the transport protocol, therefore more flexible and simpler than your competitor, the H.323. SIP (Session Initiation Protocol) is a signaling protocol used for establish, modify and terminate sessions. It can be used for voice calls over IP (VoIP) or to exchange instant messaging, among other applications. It has been developed originally in 1996 and has been standardized by IETF in 1999. In this work, the performance of SIP protocol for establishing VoIP calls will be estimated, since there are a lot of papers focalizing in the voice quality and few treated the signaling [3]. Experimental environments will be used for varying parameters like delay, packet loss, jitter, bandwidth and transport protocol, allowing to verify how there parameters affect separately the post-dial delay, post-pickup delay and call release delay.

L’IMS (IP Multimedia Subsystem) constitue l’architecture clé de contrôle pour les réseaux de nouvelle génération (NGN : Next Generation Network). IMS offre aux opérateurs réseaux la possibilité d'étendre leurs services, en intégrant la voix et des communications multimédia et de les livrer dans de nouveaux environnements avec de nouveaux objectifs. Sa sécurité totale mais à moindre coût est donc primordiale, principalement l’authentification. En IMS l’authentification est divisée en deux phases, une au niveau du domaine PS (Packet-Switch) avec le protocole 3GPP-AKA, et l’autre au niveau IMS en utilisant le protocole IMS-AKA. Dans notre première contribution, nous proposons un nouveau protocole d’authentification plus sécurisé que celui utilisé en IMS (IMS-AKA) et plus performant en termes d’utilisation de la bande passante et de temps de traitement. Notre méthode d’analyse repose sur la quantification de la signalisation induite par l’authentification IMS. La quantification est effectuée à l’aide d’expérimentations réelles. Sur la base des résultats obtenues, nous pouvons confirmer que notre protocole (1) peut économiser au moins 21,5% du trafic SIP/Cx par rapport à l’IMS-AKA, (2) permet de réduire la consommation de la bande passante de 27% par rapport à l’IMS-AKA, (3) résiste aux attaques atteignant la confidentialité et l’intégrité des données lors d’un enregistrement IMS (validé par AVISPA). Dans notre seconde contribution, nous avons présenté un nouveau modèle, nommé virtual walled-garden, de fourniture de services centré sur l'utilisateur en IMS. Ce modèle de fourniture de service permet d'offrir plus de liberté d'utiliser les services de tout fournisseur de contenu en fonction des besoins et préférences des utilisateurs. De cette manière les trois parties (utilisateur, fournisseurs de services et opérateur IMS) sont satisfaites. Les utilisateurs auront accès à un plus large éventail de services soutenus par l'IMS, les fournisseurs de services peuvent mettre en œuvre un large éventail de services IMS/SIP sans aucun investissement sur la mise en œuvre d'un réseau de cœur IMS ou de sa maintenance. Quant aux opérateurs cette façon de faire constitue une nouvelle forme de partenariat d'affaires avec les fournisseurs de services. Le modèle virtual walled-garden se base sur une fédération d'identité multi niveaux pour prendre en considération plusieurs niveaux de sécurité selon la criticité des applications sollicitées. / The IMS (IP Multimedia Subsystem) architecture is the key control for next generation networks (NGN). IMS gives network operators the opportunity to extend their services, including voice and multimedia communications and deliver them in new environments with new goals. Its security is paramount, especially authentication. In IMS, authentication is divided into two phases a PS (Packet-Switch) domain-level with the 3GPP-AKA protocol, and a second at IMS level using the IMS-AKA protocol. In our first contribution, we propose a new IMS authentication mechanism that improves the IMS-AKA in terms of security and more efficient in the use of bandwidth and processing time. Based on the results obtained, we can confirm that our protocol can save at least 21.5% of SIP/Cx traffic compared to the IMS-AKA and resists to attack reaching the confidentiality and integrity of data in an IMS registration (validated by AVISPA). In our second contribution, we propose a new Service provisioning model: Virtual Walled-Garden. This new model allows the user accessing all the applications, even the external ones transparently, simulating a walled-garden environment. This model will create a trust link between IMS domain and external services, and will reduce the burden of both end users and SPs through a Single Sign-On (SSO) feature, using identity federation. We also introduce the notion of security level to classify the SPs in a Multi-level model.

Recentemente, as tecnologias de telecomunicações esão convergindo para a concepção da Next Generation Network, onde propõe-se que todas as informações trocadas sejam classificadas por prioridade e segurança. Porém, como as redes atuais ainda não promovem tais práticas, protocolos VoIP, em conjunto a outras soluçõoes, buscam a melhoria da qualidade das ligações. Como o protocolo VoIP IAX vem ganhando credibilidade na comunidade open source nos úlltimos anos, torna-se relevante compará-lo ao protocolo SIP, o qual é bastante investigado pela literatura. Desta forma, o objetivo deste trabalho é o estudo e avaliação dos protocolos SIP e IAX, através de verificações de qualidade do áudio em ligações VoIP. Para a realização dos experimentos foi desenvolvida uma estrutura que representasse chamadas VoIP no simulador Network Simulator e, para tais ligações, empregou-se método de avaliação de qualidade PESQ. Assim, foi possível a verficação das semelhanças compreendidas entre os protocolos SIP e IAX diante dos problemas de perda de pacotes, atraso, limitação da taxa de dados e jitter / Telecommunications technologies are recently converging to the Next Generation Network conception, where it is proposed that all exchanged information should be classied by security and priority. As the currently available networks do not provide such practices, VoIP protocols, among other solutions, aim for the improvement of the calls quality. As the IAX VoIP protocol had been receiving credibility in the open source community in the last years, it is relevant to compare it to the SIP protocol, which is widely investigated in the literature. In this way, the objective of this work is the study and evaluation of the SIP and IAX protocols through verications of audio quality in VoIP calls. To implement the experiments, a structure that represents VoIP calls was developed in the \"Network Simulator\" software. For these calls, the PESQ method was used to evaluate the calls quality. Using this approach, it was possible to verify similarities between the SIP and IAX protocols regarding the problems of packet loss, delay, limitation in the data rate and jitter

In today's world, more and more phone calls are made over IP. This results in an increasing demand for scalable IP telephony equipment. Ingate Systems AB produces firewalls specialized in handling IP telephony. They have an inherent limit in the number of concurrent phone calls that they can handle. This can be a bottleneck at high loads. There is a load balancing solution available in the platform, but it has a number of drawbacks, such as media latency and client capability requirements, limiting its usage. Many companies provide load balancing solutions for SIP. However, it appears few handle all the problematic scenarios that the Ingate firewall does. This master's thesis aims to add load balancing functionality to the Ingate firewall, so that it can handle all types of clients. By splitting the firewall into two completely separate layers - a SIP layer and a firewall layer - the concept of a virtual machine emerges. A machine is no longer restricted to its physical SIP and firewall layers. Instead, virtual machines are used to process calls. They still have SIP and firewall layers, but the layers can reside on different physical machines. This thesis demonstrates the operation of an innovative load balancing implementation. The implementation was evaluated, and using four machines the test setup performed 50% better than the original Ingate platform, while still retaining all functionality -- something that was not possible with the original platform. This surpassed both the company's and my own expectations.