Study On Lightweight Security Mechanism For SIP Based On Capabilities

SIP was brought up and develops along with the Internet development, it has become a critical application protocol for the NGN(Next Generation Network)due to its advantage of simple structure with better extensibility and openness, and its convenience to be carried out. However, SIP has no corresponding effective security mechanism on its own. The existing security mechanisms for SIP have some certain limitations and security vulnerabilities universally. Moreover, these security measures will also bring some negative impacts, such as much heavier burdens for SIP servers during the connections and business process, reducing the efficiency and quality of services through SIP, affecting the security and stability of the SIP Session Network. Meanwhile, the loadbearing circumstance for SIP to run is a highly open and distributed application environment with great uncertainty and unreliability, resulting in serious latent security risks for the corresponding function safely and reliably achieving of SIP. So, an efficient and convenient security mechanism is very important for the further development and application for SIP.The security mechanism for SIP should be comprehensively considered combining the intrinsic characteristics of protocol itself and the particularity of NGN, maintaining its consistency, integrity and other special features. In this paper, we firstly discuss the important concepts and attributes of SIP, focusing on the specification of SIP message, including the request message and response message of SIP. Secondly,we make classified research about the existing security threats and mechanisms of SIP in detail, such as registration hijacks, server disguising, message tampering, DoS(Denial of Service) and so on, and give detailed study and analysis on existing SIP security authentication and encryption, including HTTP digest authentication, identity-based security authentication, S/MIME encryption, TLS encryption, IPSec encryption. Thirdly, we study an advanced lightweight security authentication and key negotiation mechanism based on ECDH algorithm, in which one-time password authentication, and a new authentication and key negotiation method based on ECODH are introduced. Subsequently , we demonstrate its properties of security according to the Key Negotiation Security Properties Standard. It shows the highly lightweight characteristics of the new protocol by comparison the amount of its calculation with existing RSA encryption, DH key agreement. As we know, the DoS/DDoS defense for IP networks benefits from the capabilities signing during the data selection in routers. In this paper, we combine the instinct characteristics of SIP and the achievement of credibility research for NGN, configuring boundary proxy servers in every SIP network domain to perform capabilities analysis and process to SIP messages, monitoring and prewarning them simultaneously during the whole procedure to well defending DoS/DDoS. Besides, we also improve the topology of SIP network to improve the overall implementation in a lightweight pattern. The capabilities are used for boundary proxy servers to choose the coming SIP messages as the standard reference, including security attributes and identification strategies associated with the SIP message behavioral characteristics.Based on the above research work, we proposed a more appropriate capabilities-based and lightweight security scheme for SIP, which is more suitable for its further applications in NGN. Comparing to the existing SIP security mechanisms, it is more secure, efficient and portable. The proposed solution is able to avoid the risks of user password being easily stolen for the authentication and key agreement process based on ECDH, and it is characterized of more concise consultation key, easy-to-realization, and conforming to the security assessment specifications perfectly. Also, for our solution monitoring and prewarning SIP messages through capabilities analysis procedure during the whole process, it transforms passive defense into active defense, filtering illegitimate SIP messages more intelligently, and thus defensing DoS/DDoS effectively. Additionally, the lightweight optimization for SIP network topology will make implementation of SIP functions easier and more efficient.