陳懷恩博士助理教授兼計算機中心資訊網路組組長國立宜蘭大學資工所 TEL: # 340

Transcription

1 Advanced Issues- Wireless VoIP, IPv6 and Security 陳懷恩博士助理教授兼計算機中心資訊網路組組長國立宜蘭大學資工所 TEL: # 340

2 Outline Wireless VoIP IPv6 Solutions and Transition SIP Security 2

3 Wireless VoIP

4 Introduction to wireless VoIP Voice over Wireless LAN expands the capability of Wireless LANs Wireless VoIP is a natural extension of VolP Wireliess VoIP is the added feature which will enable users to make phone calls using this mobile internet access 4

5 Introduction to wireless VoIP VoIP and Wireless LAN VoIP SIP, RTP, H.323 Wireless LAN WiFi : a/b/g WiMAX :

6 Introduction to wireless VoIP Wireless VoIP Protocol stack 6

7 Why wireless VoIP? Low cost Free Charge of ISM Band ISM band : free ( GHz) 3G band : NTD 10 Billion Inexpensive network deployment Reuse of existing network, and easy to setup Low cost of Access Point VS. High cost of Base Station 7

8 Why wireless VoIP? Low complexity Centralized architecture in cellular network PBX contains most intelligence of the network Hard to maintain the proprietary system Decentralized architecture in VoIP network Intelligence are implemented in User Agent Easy for maintenance 8

9 Why wireless VoIP? Low transmission power Small coverage of the AP, small transmission power needed GSM: 500mW ~ 2W WLAN: < 100mW Easy for providing value-added service Voice and data service is integrated into VoIP Flexibility of SIP protocol 9

10 Why wireless VoIP? Market trend Voice over WLAN market will reach $507 million (end user revenue) by 2007 (In Stat/MDR) Voice over WLAN handset will grow by more than 89 percent annually until 2007 when there will be more than 653,000 (On world) 10

11 Requirements of wireless VoIP Performance Voice quality must be as well as wired network Delay >100 ms is sensible by human Low latency : <50 ms latency is recommended Reliable transmission over wireless channel Low packet lost rate User mobility management Support roaming between wireless network 11

12 Requirements of wireless VoIP Capacity management Heavy traffic load increase packet lost rate and latency Number of Users must be controlled Channel assignment 11 channels in b Manage operating channel among adjacent Access Point 12

13 Requirements of wireless VoIP Security Data ciphering Wireless channel is insecure Data over wireless should be protected AAA Authentication : legal user identification Authorization : different service levels Accounting : billing statistics ti ti Location Tracking 13

14 Challenges of wireless VoIP Due to the requirements of wireless VoIP, several issue should be solved User Mobility Issue Power Consumption Issue Security Issue QoS Issue Capacity Issue Other Related Issue 14

15 Challenges of wireless VoIP User mobility User mobility is an important feature of wireless VoIP Concern on two factors Handoff latency Packet lost rate Seamless handoff Fast handover : reducing handoff latency Smooth handover : reducing packet loss during handoff 15

16 Challenges of wireless VoIP Power consumption issue Limited battery power available at mobile device System CPU, Memory, LCD, DSP/Codec WLAN Physical Layer: Radio Frequency MAC Layer: a/b/g, , and Network Layer: TCP/IP 16

17 Challenges of wireless VoIP Security issue Data ciphering WEP, i AAA (Authentication, Authorization, Accounting) 802.1x, RADIUS, DIAMETER 17

18 Challenges of wireless VoIP QoS issue Voice quality is depend on the delay and loss rate of packets No QoS guarantee in legacy DCF, since each mobile device contends for the channel by using CSMA/CA There are some proprietary QoS schemes proposed, but QoS is still an open issue 18

19 Challenges of wireless VoIP Capacity Issue Voice quality is a key component of voice service (realtime, high throughput) CSMA/CA mechanism limits the max number of subscribers under the AP A VoIP streams typically requires less than 10Kbps Ideally, the number of simultaneously VoWLAN sessions is 11M / (10K * 2) = 550 However, the maximum number of fvoip sessions is about t12 if GSM 6.10 (13.2Kbps) is used 19

20 Challenges of wireless VoIP Other Related Issue Codec Compression The ability to maximize the wireless bandwidth for voice, intelligent use of compression codec is important. Often require hardware assist, the target device is hardware dependent and needs to be specially designed 20

21 Challenges of wireless VoIP Other Related Issue Combine WLAN and Cellular WLAN High bandwidth, Low Cost, Multimedia Service, Video Phone Cellular Large Coverage, High Mobility, Mature Billing System, Popularity 21

22 Challenges of wireless VoIP Other Related Issue Combine WLAN and Cellular 22

23 Summary for Wireless VoIP The existing wireless VoIP solutions may not be robust and reliable enough to support deployment for a large base of users QoS of wireless VoIP is always an open issue Security and Capabilities for fast handoff between APs still needs improvement 23

24 IPv6 Solutions and Transition

25 IP Header [1/2] Version 4 Header Length Type of Service Total Length Identification, Flags, and Fragment Offset TTL A datagram can be split into fragments Identify data fragments Flags a datagram can be fragmented or not Indicate the last fragment A number of hops (not a number of seconds) 25

26 IP Header [2/2] Protocol The higher-layer protocol TCP (6); UDP (17) Source and Destination IP Addresses 26

27 IP Version 6 The explosive growth of the Internet IPv4 address space, 32-bit Real-time and interactive applications Expanded address space, 128 bits Simplified header format Enabling easier processing of IP datagrams Improved support for headers and extensions Enabling greater flexibility for the introduction of new options Flow-labeling capability Btt Better support at tthe IPlevel lfor real-time lti app. Authentication and privacy 27

28 IPv6 Header [1/3] 28

29 IPv6 Header [2/3] Version 6 Traffic Class, 8-bit For the quality of service Flow Label, 20-bit Label sequences of packets that belong to a single flow A flow := source address, destination address, flow label 29

30 IPv6 Header [3/3] Payload Length, 16-bit unsigned integer The length of payload in octets Header extensions are part of the payload Next Header, 8-bit The next higher-layer h protocol Same as the IPv4 The existence of IPv6 header extensions Hop Limit, 8-bit unsigned integer The TTL field of the IPv4 header Source and Destination Addresses, 128-bit 30

31 IPv6 addresses XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XX XX:XXXX X is a hexadecimal character E.g., 1511:1:0:0:0:FA22:45:11 The symbol :: can be used to represent a number of contiguous fields with zero values. = 1511:1::FA22:45: :0:0:0:AA11:50:22:F77 = ::AA11:50:22:F77 :: can appears only once 31

32 IPv6 special addresses The all-zeros address, :: An unspecified address; a node does not yet know its address The loopback address, ::1 On a virtual internal interface IPv6 address with embedded IPv4 address (type 1) 96-bit zeros + 32-bit IPv4 address :: Used by IPv6 hosts and routers that tunnel IPv6 packets through an IPv4 infrastructure IPv6 address with embedded IPv4 address (type 2) 80-bit zeros + FFFF + 32-bit IPv4 address 0:0:0:0:0:FFFF: ::FFFF: Applied to nodes that do not support IPv6 32

33 IPv6 Header Extensions To be placed between the fixed header and the actual data payload Next Header The type of payload carried in the IP datagram The type of header extension Each extension has its own next header field. 33

34 Header extension Use the next header field 34

35 UDP Client/Server Programming g UDP Client UDP Server socket socket sendto recvfrom data data bind recvfrom sendto close/ closesocket close/ closesocket These functions are the same for both IPv4 and IPv6. 35

36 IPv4/IPv6 Socket Parameter Mapping Socket 參數名稱轉換 IPv4 IPv6 AF_INET AF_INET6 PF_INET PF_INET6 IN_ADDR_ANY inaddr6_any 36

37 IPv4/IPv6 Data Structure Mapping 資料結構轉換 IPv4 in_addr IPv6 in6_addr sockaddr sockaddr_in6 sockaddr_in sockaddr_in6 37

38 IPv4/IPv6 Data Structure Mapping 資料結構參數轉換 IPv4 sin_len sin_family sin_port IPv6 sin6_len sin6_family sin6_port sin_addr sin6_addr s_addr s6_addr 38

39 Domain Name and IP Conversion APIs 函式轉換 Name-to-address Functions IPv4 inet_aton() inet_addr() inet_ntoa() IPv6 inet_pton() inet_ntop() Address conversion Functions gethostbyname() gethostbyaddr() getipnodebyname() getipnodebyaddr() getnameinfo() getaddrinfo() 39

40 Results of Using Checkv4.exe 40

41 IPv4 SIP User Agent Provided by CCL/ITRI and NTPO SIP-based VoIP phone running on Windows Support H.263 Video codec Support G.711u/G.711a/G.723/G.729 Audio codecs Support registration Support authentication 41

42 GUI Problem IP Address Control IPv4 specified Do not accept domain name and IPv6 The Variable-length l Input Component (A) (B) 42

43 Get Local Address SIP User Agent should provide the IPv4 and IPv6 address of the local host. The IPHelper functions Microsoft Windows system provides this function from Windows 98 This solution works on both Windows XP and 2003 I It s a Windows-only solution Function name: GetAdaptersAddresses() 43

44 Parsing IPv6 URI in SIP and SDP IPv4 SIP URI IPv6 SIP URI IPv4 parser assumes that semicolon is used to separate the IP address and port number, and the SIP parser in SIP and SDP protocol stacks should be modified to process IPv6 address and port number. IP6 address type and IPv6 address in Session Description Protocol (SDP) c=in IP6 FE80:60::2 44

45 IPv6 Link-local Address Problem Link-local IPv6 address with scope-id E.g. fe80::201:2ff:fe85:37ed%3 Used by link-local local address Identify the same address on different interface Scope-id must be specified when connecting to sites using link-local address An extra parameter should be added in the data structure 45

46 Porting IPv4 SIP UA to IPv6 Results IPv4 SIP UA contains about 100,000-line codes in 150 files. We change about 600-line codes in 39 files. About 300-line codes are not identified by checkv4.exe SIPv6 UA supports IPv4 or IPv6 communication IPv6 address in SIP and SDP IPv6 address in GUI 46

47 Result: A SIPv6 User Agent 4.Video Using IPv6 Addresses 1.Configuration SIPv6 UA 4. RTP 4Vid 4.Video 3.1 INVITE OK 3.7 ACK IPv6 Network (Showroom) 2.Dialing Dual-stack Router Tunneling 3.2 INVITE OK 3.8 ACK 4. RTP 圖例 : Internet (IPv4) SIP Signaling (IPv6) SIP Signaling (Tunnel) Dual-stack Router 3.3 INVITE OK 3.9 ACK IPv6 Network SIPv6 UA 4. RTP (NCTU VoIP Lab) 47

48 Why we need to modify our applications? v4/v6 Protocol-independent IPv4 APP. IPv6 APP. Application WinSock WinSock TCP/UDP TCP/UDPv6 Dual Stack IPv4 IPv6 Host TCP/UDP IPv4 TCP/UDPv6 IPv6 PHY & MAC PHY & MAC AF_INET AF_INET6 Some Socket APIs, parameters and data structures of IPv6 are different from that of IPv4 and should be modified. 48

49 Socket-layer Translator (SLT) IPv4 Applications Function Mapper Address Mapper Name Resolver Users can access IPv6 resources through IPv4 applications and SLT. 49

50 Address Translation Example: Originator Dual Stack Host6 DNS IPv4 app. Extension Name Resolver Address Mapper Translator IPv6 Resolve an IPv4 address for host6 Query A Query A and AAAA for host6 Reply only with AAAA Request one IPv4 address (internal IPv4 address allocation) Reply with the IPv4 address Reply with the A record Send an IPv4 packet to Host6 An IPv4 packet Request IPv6 address Reply with the IPv6 address Translation (v4->v6) Translate IPv4 to IPv6 An IPv6 Packet An IPv6 packet ( Reply) Request IPv4 address Reply with the IPv4 address Translate IPv6 into IPv4 An IPv4 packet Translation (v6->v4) 50

51 Address Translation Example: Recipient Dual Stack Host6 IPv4 app. Extension Name Resolver Address Mapper Translator IPv6 Receive a data from host6 An IPv6 packet Request IPv4 address from table Reply with the IPv4 address Translate IPv6 to IPv4 header An IPv4 packet Translation (v6->v4) Reply an IPv4 data to host6 An IPv4 reply packet Request IPv6 address from table Reply with the IPv6 address Translation (v4->v6) Translate v4 packet to v6 An IPv6 packet 51

52 SIPv6 Translator Through manual modification and Socket-layer Translator, we have IPv6 SIP UAs (SIPv6 UAs). However, only using SIPv6 UAs, which can utilize rich IPv6 addresses, does NOT solve the IP address shortage problem in VoIP deployment, because a SIPv6 UA cannot communicate with a SIPv4 UA (e.g. CISCO7960). To solve this problem, we develop a SIPv6 Translator based on the architecture proposed p in IETF RFC 2766 (Network Address Translation and Protocol Translation, NAT-PT). The SIPv6 Translator is a gateway between IPv6 and IPv4 networks. The SIPv6 Translator can translate not only the IP headers but also the application-layer headers (e.g. SIP and SDP). 52

53 NAT-PT with DNS-ALG DNS1 DNS 3ffe:3600:1::2 IPv6 Network DNS-ALG Translator DNS2 DNS IPv4 Network UA1 The NAT-PT translator configuration UA2 3ffe:3600:1::3 Address Pool: ua1.ipv6.nctu.edu.tw NAT-PT Prefix: 3ffe:3600:2::/96 ua2.ipv4.nctu.edu.tw tw 53

54 NAT-PT operations with DNS-ALG (IPv6 IPv4) IPv4) IPv6 Network IPv4 Network DNS-ALG UA1 DNS1 + DNS2 UA2 NAT-PT DNS Query (AAAA) DNS Query (AAAA) DNS Query (A) 1.4 DNS Response (A) DNS Response (AAAA) DNS Response (AAAA) 1.9 ICMPv6 Message (MAC Address Query) 1.10 ICMPv6 Message (MAC Address Response) 1.11 IPv6 Packet 1.12 ARP Message (MAC Address Query) ARP Message (MAC Address Response) IPv4 Packet 54

55 NAT-PT operations with DNS-ALG (IPv4 IPv6) IPv6) UA1 IPv6 Network DNS1 IPv4 Network DNS-ALG + NAT-PT DNS2 UA2 DNS Query (A) 2.2 DNS Query (A) DNS Query (AAAA) 2.5 DNS Response (AAAA) DNS Response (A) DNS Response (A) ARP Message (MAC Address Query) ARP Message (MAC Address Response) ICMPv6 Message (MAC Address Query) IPv4 Packet ICMPv6 Message (MAC Address Response) 2.14 IPv6 Packet 55

56 System Architecture of SIPv6 Translator IPv6-IPv4 Address Mapping SIIT Component ALG: Application Level Gateway DNS: Domain Name Service SIP: Session Initiation Protocol NIC: Network Interface Controller SIIT: Simple IP and ICMP Translation; see IETF RFC 2765 NAT-PT: Network Address Translation and Protocol Translation; see IETF RFC

57 IPv4/IPv6 Translation for Registration UA3 SIP-ALG SIPv4 Server 3.1 REGISTER sip.ipv4.nctu.edu.tw Via: SIP/2.0/UDP [3ffe:3600:1::4]:5060 To: [3ffe:3600:1::3]:5060> 3.2 REGISTER sip.ipv4.nctu.edu.tw Via: SIP/2.0/UDP :5061 To: :5061> OK Via: SIP/2.0/UDP : OK To: 4 t Via: SIP/2.0/UDP [3ffe:3600:1::4]:5060 From:<sip:3456@ipv4.nctu.edu.tw> To: <sip:1234@ipv4.nctu.edu.tw> Contact:<sip:1234@ :5061> From:<sip:3456@ipv4.nctu.edu.tw> Contact:<sip:1234@ [3ffe:3600:1::3]:5060> IPv6 Network IPv4 Network 57

58 IPv4/IPv6 Translation for INVITE Transaction (IPv4->IPv6) IPv6 Network IPv4 Network SIP-ALG UA1 NAT-PT SIPv4 Server UA2 4.3 INVITE Via: SIP/2.0/UDP [3ffe:3600:2:: ]:5060 Via: SIP/2.0/UDP : INVITE Via: SIP/2.0/UDP :5060 Via: SIP/2.0/UDP :5060 Contact: c=in IP d / Contact: t <sip:5678@sip.ipv4.nctu.edu.tw> i i t m=audio 9000 RTP/AVP c=in IP6 3ffe:3600:2:: m=audio 9000 RTP/AVP INVITE sip:1234@sip.ipv4.nctu.edu.tw Via: SIP/2.0/UDP :5060 Contact: <sip:5678@sip.ipv4.nctu.edu.tw> c=in IP m=audio 9000 RTP/AVP OK Via: SIP/2.0/UDP / [3ffe:3600:2:: ]:5060 Via: SIP/2.0/UDP :5060 Contact: sip:1234@sip.ipv4.nctu.edu.tw c=in IP6 3ffe:3600:1::3 m=audio 9000 RTP/AVP OK Via: SIP/2.0/UDP :5060 Via: SIP/2.0/UDP :5060 Contact: <sip:1234@sip.ipv4.nctu.edu.tw> c=in IP m=audio 9002 RTP/AVP OK Via: SIP/2.0/UDP :5060 Contact: <sip:1234@sip.ipv4.nctu.edu.tw> c=in IP m=audio 9002 RTP/AVP ACK sip:1234@[3ffe:3600:1::3]:5060 Via: SIP/2.0/UDP [3ffe:3600:2:: ]:5060 Via: SIP/2.0/UDP :5060 Contact: <sip:5678@sip.ipv4.nctu.edu.tw> 4.8 ACK sip:1234@ :5061 Via: SIP/2.0/UDP : :5060 Via: SIP/2.0/UDP :5060 Contact: <sip:5678@sip.ipv4.nctu.edu.tw> 4.7 ACK sip:1234@sip.ipv4.nctu.edu.tw Via: SIP/2.0/UDP :5060 Contact: <sip:5678@sip.ipv4.nctu.edu.tw> i i 58

59 SIPv6 Analyzer Control Panel Packet List Protocol Parser (using Ethereal parser) Hex Dump 59

60 SIP Viewer Call-ID From To SIP Flowchart SIP Dialog Collection SIP Viewer automatically collect SIP messages. SIP Flowchart from Headers 60

61 RTP Viewer RTP Viewer can play back Video and Voice! Yueh-Hsin Sung RTP Session List Video Playback Video and Voice Control Panel RTP Viewer automatically collect RTP packets according to the SDP c and m fields. 61

62 The IPv6 SIP-based VoIP Deployment XXX is assign to IPv6 network XXX is assign to IPv4 network. The forwarding rules are set in the SIP proxies. 62

63 The IPv6 and IPv4 SIP Environment PSTN Speaker Phone (PSTN) Snom 200 CISCO 7940 Pingtel Windows Messenger SIPv6 Translator &SIP SIPv6 6Analyzer SIPv6 UA (implemented by NCTU VoIP Lab) 63

64 The PSTN Gateways CISCO 2621XM Gateway Vontel Gateway (implemented by ITRI/CCL Taiwan) 64

65 The Interoperability Test Results SIP Message SDP Message Request URI Contact Via From To c m o IP Soft Phone CCL Skin UA Windows Messenger IP Hard Phone PingTel snom 200 Cisco IP Phone 7940 Series PSTN Gateway Vontel PSTN Gateway Cisco PSTN Gateway The SIPv6 UA developed by NCTU can communicate with all of the commercial IPv4 SIP UAs through the SIPv6 Translator. The IPv4 SIP UAs are deploy in the NTP VoIP platform. 65

66 SIP Security

67 SIP Security SIP communications are susceptible to several types of attacks. The simplest attack in SIP is snooping, which permits an attacker to gain information on users identities, services, media, network topology, and so on. 67

68 SIP Security SIP messages may contain information a user or server wishes to keep private. The headers can reveal information about the communication patterns and content of individuals, or other confidential information. The SIP message body may also contain user information (media type, codec, addresses and ports, etc.) that should not tbe revealed. 68

69 SIP Security Securing SIP header and body information can be motivated by two different reasons: Maintain private user and network information in order to guarantee a certain level of privacy Avoiding SIP sessions being set up or changed by someone faking the identity of someone else 69

70 SIP Security The mechanisms that provide security in SIP can be classified as end-to-end or hop-by-hop protection. Edt End-to-end dmechanisms involve the caller and/or callee SIP user agents and are realized by features of the SIP protocol specifically designed for this purpose (e.g., SIP authentication and SIP message body encryption). Hop-by-hop p mechanisms secure the communication between two successive SIP entities in the path of signaling messages. 70

71 SIP Security SIP does not provide specific features for hop-by- hop protection and relies on network-level (IPsec) or transport-level security y( (TLS). Hop-by-hop mechanisms are needed because intermediate elements may play an active role in SIP processing by reading and/or writing some parts of the SIP messages. 71

72 SIP Security End-to-end security cannot apply to these parts of messages that are read/written by intermediate SIP entities. 72

73 SIP Security Two main security mechanisms are used with SIP: Authentication Data encryption 73

74 SIP Security Data authentication is used to authenticate the sender of the message, and to ensure that some critical message information was unmodified in transit. This is to prevent an attacker from modifying and/or replaying SIP requests and responses. 74

75 SIP Security SIP makes use of Proxy-Authenticate,, Proxy- Authorization, Authorization, and WWW- Authenticate header fields, similar to those of HTTP, for authentication of the end system by means of a digital signature. Instead, hop-by-hop authentication can be performed using transport- or network-layer authentication protocols such as TLS or IPsec. 75

76 SIP Security Data encryption is used to ensure confidentiality of SIP communications, letting only the intended recipient decrypt and read the data. This is usually done using encryption algorithms such as Data Encryption Standard (DES) and Advanced Encryption Standard (AES). 76

77 SIP Security SIP supports two forms of encryption: end-to-end hop-by-hop 77

78 SIP Security End-to-end encryption provides confidentially for all information (some SIP headers and the message body) that does not need to be read by intermediate proxy servers. End-to-end encryption is performed by S/MIME mechanisms. 78

79 SIP Security Hop-by-hop pencryption of whole SIP messages can be used in order to protect the information that should be accessed by intermediate entities, such us From, To, and Via headers. Encryption of such information can prevent malicious users from determining who calls who, or accessing route information. 79

80 SIP Security Hop-by-hop pencryption can be performed by security mechanisms external to SIP (IPsec or TLS). 80

81 SIP Security IPsec is a network layer mechanism that can be used to introduce security directly at the IP layer. Usually IPsec is used to provide security based on network node identity, and this is done independently by the SIP architecture. 81

82 SIP Security For this reason, IPsec can be used in SIP mainly between SIP entities that have a preconfigured and quite static security association (e.g., servers within the same IP telephony provider). 82

83 SIP Security TLS provides transport-layer security over connection-oriented protocols (TCP), and it is suited to architectures in which hop-by-hop psecurity is required between hosts with a more dynamic security association. 83

84 SIP Security Note that if a user agent uses IPsec or TLS to send SIP requests to a proxy server (hop by hop), this does not guarantee that secure transport will be used on the rest of the end-to-end path. 84

85 SIP Security The most recent version of the SIP specification includes a way to specify that a resource (e.g., a server or user) should be reached securely using TLS. In particular, the address of a user is normally defined in SIP using a SIP uniform resource identifier (URI) in the form of sip:hsn@ndhuee.com. 85

86 SIP Security If a user address is expressed using a new type of URI, a SIP Secure (SIPS) URI (sips:hsn@ndhuee.com), it means that the use of TLS is requested. The security mechanisms must be combined properly to obtain a trusted network scenario. 86

87 SIP Security An example of this combination: 87

88 SIP Security The Authentication Procedure in SIP: The SIP authentication procedure is derived from HTTP Digest authentication It is a challenge-based mechanism when a server receives a request, it may challenge the initiator of the request to provide assurance of its identity. 88

89 SIP Security Digest authentication: 89