DUNDi!"# $. %!%&" ' &" 2008

Transcription

1 DUNDi!"# $ %!%&" '&" 2008

2 , : 10/06/2008!"# $"# " ""# %&'('!"# $"# " ""# %&'('!"# $"# " ""# %&'(' ) 2008

3 ' *& '%!" +&, %&(,' -+& ' ' &$(/ " 0'"'' '% '"% Distributed Universal Number Discovery (DUNDi) #' '' ' &++ &' '!+ Voice over Internet Protocol (VoIP) "1#/ " &' &"( '" %!&*' & + ' " '-* '!&'# '% VoIP ' '' % "%1, %&(,' ' &"(!"'&'"( '/ '$/ Asterisk, / &"/ '/ 0''/ " '/ ' +' +"'(&'& " '& '/ &/, &' 0 '' +($' &" "'(+ %!& '$ Asterisk " '/ ' +' ' &%!, %&(,' &"/ '/ '%+/ '% '"% DUNDi %'"', +($' +" ' +',' &/ &!0 " &/ " &"/ &%+/ % "'*' &' '" ' &%!, '*&&' 10 '/ / '' ' '" '& #&'!% '%! " '-* 0* " % ' ',% ' '', +($'!'"'" '% 0"'*% '!& 1" + ' "'& ' '"# ' & + ' &/, " " / ""/,!% &'"/ $/ + ' 0& '% '"% DUNDi 2'&, %&(,' ' '"( 00 ' "'+(3 " 10+ (%& / '%/ &/,!' &'" " '" (%& ' &''&'"# '&(' "1#/ "' &"( &%(&' ' '%' '' '*&&%,' ' &$(/ " -&'/ & &!& ' + '" -'(,' 00,' ' &'%'"''/, "''/ " &'&/ '%'''/ &' '" DUNDi / &%,'*' 0* ' &"( ' -&'/ %!% "'+$! & &' '" DUNDi!"# $"# " ""# %&'('

4 ABSTRACT In this dissertation is presented the evaluation of security parameters and the efficiency of the protocol Distributed Universal Number Discovery (DUNDi) The first section is an introduction in the Voice over Internet Protocol (VoIP) technology and to the basic VoIP protocols that are being used for the communication of VoIP entities In the following section, are presented the main attributes of the Asterisk PBX and the way that it is installed and configured Furthermore, we outline the basic directories that are being used after the Asterisk activation In the next section, we focus on the protocol DUNDi There is an analytical examination on the way that the DUNDi protocol, dynamically discover how to reach users throughout the VoIP network Moreover, there is an extended description on the configuration of DUNDi files and the process that is used for the communication of two DUNDi `s entities In the following section, we set out the architecture of the network that was used for the research The network was relatively small but we got very important results for the efficiency of the DUNDi protocol In this section are presented the results of the research and the methodology that was used for analyzing them Furthermore, is given a quantitative and a qualitative analysis of the statistical results and finally the main conclusions The final section is focused on security and reliability issues of the DUNDi protocol There is an examination about the issues deal with the confidentiality, the integrity and the authentication services of the DUNDi protocol Finally are presented some reliability problems that are committed to date, about the DUNDi protocol PETROS G PISSAS Information and Communication Systems Engineering UNIVERSITY OF THE AEGEAN

5 - " & '/ 0'" / % +&/ &'0' " ' '/ ' '%!"# % &%0# %' &'+, ' ( "'( + %!&' & ( %/ '%/ +/ %, " #+, + ' &' - & %/ '%/ '/ % %! %'( '! 4 &/ %!&' & ' 0$ % ', % "10 +& &'/ 0*&"/ &'+/ ' '%!"# % &%0# " 1& %&&'"( &' "#& %' ' &'! # $ & - %' ' &0 %/ '%/ $%/ % " &' ( " 1& +'"( &' #& %'( '! %,& &' & 5/ '%/ $1/ 0 1! $'(&! 0# 6'('/ / &' "*$& ' '%!"# % &%0#, #1 ' (+" %!&' & ' " %(" + ' "10 +& % %! &' 0*&" + '/ 0'" / ++/ ' ' " '!(&'" ' &/ ", '& &'" "' + ' " & %' / '/ +&/ 1 " * &!& '%, & &'"( ' 0 '/ 0'" / " ' %!&'# 1( + %' #'/, %' ' 0*&" 0 % '(, + ' &'(0 ' &%0# %, 1 1 %!&' & ' 00"'" &" '% ' '/ '!"# $"# " ""# %&'(' + ' +#& % % '0& (&/ %! ( "(% #1 &!% &' '+&'" ( %,* %' 0* +(, %'( ' 0*&" ( "0'"(! %,&, &/ 0'" +& $#' &' 0$ % ', +' & ' "(& ' '0 ' %' & " 0 1 & 0 % &'/ $/ ( " &'/ 0*&"/ / % 1 "%1 &%

6 1VoIP 1 11 &++ &' VoIP 1 12 '" VoIP SIP IAX2 8 2 Asterisk Asterisk Installation ' &/ %&' '/ "'(&'& ' '' "' "'(&'& Asterisk "'(&'& & Ubuntu 6x "'(&'& & Fedora Core '(+ %!&*' ' Asterisk ""& '% Asterisk 23 3 DUNDi &++ ' DUNDi '%+ % '"% %+/ % '"% DUNDi "/ $!"& "(%3!0 &/ ' ' EID (Entity IDentifier) ' # %+# "' $& % '"% DUNDi ! dundiconf ! iaxconf $& '%!% extensionsconf " ' 44 4!" # $" $& "'*% "'& ' & */ ' & ' &/ (%& '&(' * % ' 67 5 %$ &!"! '!! (" ' ' &$(/ General Peer Agreement (GPA) %1'"& " "'' RSA Advanced Encryption Standard (AES) DUNDi, AES " RSA Peer-to-Peer vs Clients Server (DNS) ' ' -&'/ ("'& " &/ '(%& " 89 6 )& 92

7 1 VoIP (Voice over Internet Protocol) VoIP 11 VoIP VoIP [REF1] () Internet Protocol (IP)! " #, IP! # $ ",, VoIP " % VoIP 1 VoIP VoIP 1

8 1 VoIP VoIP : & ' %, ' VoIP : " IP, VoIP % VoIP 2

9 ( # " ( VoIP " ( 100, 166 ) ) VoIP spamming 12 VoIP H323 [REF2] ITU " IP % H323 realtime audio, video,!, video H323 4 H323, " H323, gateways, gatekeepers multipoint control units (MCUs) 2 : 3

10 2 H323 % (, voice mail, video cameras ) MS Netmeeting!323 % / video gateways ", ISDN, PSTN H323 * gateways ) gateway SIP H323 % gatekeepers "!323 gatekeepers 4

11 +, ) " gatekeeper Petros % gatekeepers, gatekeeper!323, MCUs " # H323 ", ad-hoc % back-end server (BES) "!323 * BES,,, gatekeepers gateways 122 SIP % SIP [REF3] IP UDP ( 5060) SIP SIP SIP video & " SIP video, " SIP, IP " 5

12 PSTN SIP -, Proxy Servers User Agents $ " - VoIP ", SIP " IP (') SIP " IETF,!323 " ITU "! SIP RFC 2543 RFC 3261 SIP HTTP " human readable " /, - % SIP,,!323 - SIP!323 3 " SIP: 6

13 3 SIP * SIP, SIP $ % DUNDi ENUM SIP & SIP & SIP - SIP SIP " Peer-to-Peer (P2P) SIP 7

14 123 IAX2 IAX2 [REF4], Inter Asterisk exchange, +$( - Asterisk, +$(, " +$(, Asterisk (interfaces) IAX Asterisk IAX2, - UDP ( 4569)! in-band (, ), (firewall) 8

15 3 IAX % IAX2 " * (firewalls)! # IAX2 UDP &, 9

16 2 Asterisk Asterisk [REF5], (hardware), (middleware) (software) - Asterisk,,, Asterisk *, Unix/Linux DOS,, /, Asterisk, -, 0 " /, Asterisk PBX - PBX 1 VoIP $ Linux $ OpenBSD, FreeBSD, MacOSX, Sun Solaris MS-Windows -, Linux " Asterisk VoIP $ SIP!323, Inter- Asterisk Exchange (IAX) Asterisk, 10

17 21 Asterisk Installation " Asterisk Asterisk Linux Asterisk, Ubuntu 610 Fedora FC6 $ Linux, Asterisk $ Asterisk & " Asterisk : - Asterisk; : $ 211! Asterisk 1213 " Asterisk, Zaptel PRI (libpri) " VoIP " Asterisk % Zaptel " # VoIP! libpri 11

18 * asterisksounds -` Asterisk, " ", Asterisk gcc ( 3x ) / bison ncurses CLI! Asterisk OpenSSL " Zaptel " / " libpri Asterisk Zaptel linnewt zttool usb-uhci ztdummy / PRI Zaptel " libpri 22 Asterisk, Asterisk Ubuntu 6x Fedora Core 221 Ubuntu 6x Asterisk [REF6] 12

19 : asterisk-1213targz, asterisk-addons-125targz asterisk-sounds-121targz /usr/src/ 2 root # : # cd /usr/src/ # tar zxvf asterisk-1213targz # tar zxvf asterisk-sounds-121targz # tar zxvf asterisk-addons-125targz & : /usr/src/asterisk-1213/ /usr/src/asterisk-sounds-121/ /usr/src/asterisk-addons-125/ Asterisk 2 : # sudo apt-get install gcc build-essential # sudo apt-get install libncurses-dev # sudo apt-get install openssl linssl-dev # sudo apt-get install zlib1g-dev 13

20 $, Asterisk % : # cd /usr/src/asterisk-1213/ # make clean # make # make install # make samples # make progdocs! make clean «"» (binaries) $ / make samples! Asterisk Asterisk $ /etc/asterisk/, make samples old ) extensionsconf extensionsconfold -,, make samples # samples configs/ Asterisk! make progdocs doxygen / doxygen 14

21 $ 3, asterisk-sounds-121 -, / : #cd /usr/asterisk-sounds-121 #make install asterisk-addons-121, CDRs (Call Detail Records) MySQL MP3 / Perl " Asterisk 222 Fedora Core ) Asterisk Linux fedora core Ubuntu 4 libpri Zaptel Asterisk Meetme mp3 music hold on $ (kernel)! : # uname a : Linux luser _EL #1 Wen Aug 15 11:32:12 ED 2007 i686 i686 i368 GNU/Linux 15

22 $ kernel (kernel sources) ) # rpm -q kernel-devel / kernel sources yum ) : # yum install kernel-devel / yum install kernel sources " $ : # rpm -q bison # rpm -q bison-devel # rpm -q ncurses # rpm -q ncurses-devel # rpm -q zlib # rpm -q zlib-devel # rpm -q openssl # rpm -q openssl-devel # rpm -q gnutls-devel # rpm -q gcc # rpm -q gcc-c++ 16

23 $ yum : # yum install bison # yum install bison-devel # yum install ncurses # yum install ncurses-devel # yum install zlib # yum install zlib-devel # yum install openssl # yum install openssl-devel # yum install gnutls-devel # yum install gcc # yum install gcc-c++ yum " PBone ( $, : # rpm -i PACKAGErpm # rpm -Uvh PACKAGErpm Fedora kernel sources /usr/src/linuc Makefile Zaptel Asterisk ) ` /usr/src link " 'linux' kernel sources (% default /usr/src/kernels) " " " : # tar -vxzf PACKAGEtargz 17

24 $, : Libpri: # cd /path/to/source/libpri # make # make install Zaptel: # cd /usr/src/asterisk/zaptel # make ( 24 ) # make linux26 ( 26 ) # make install Asterisk: # cd /usr/src/asterisk/asterisk # make mpg123! mp3 music on hold ) Asterisk : # make # make install # make samples! 1213 Asterisk " Fedora " chan_phone ) Makefile /asterisk/channels/ chan_phone chan_phonec #include compilerh 18

25 23 Asterisk Asterisk [REF7] % asteriskconf! " voice mail recordings, (voice promts) /etc/asterisk/ Asterisk /usr/lib/asterisk/modules/ % (modules) Asterisk /,, Asterisk / Asterisk / modulesconf, " Asterisk Asterisk /var/lib/asterisk/ $ astdb astdb Asterisk, Microsoft Windows! Asterisk v1 Berkeley % /var/lib/asterisk/ : 19

26 agi-bin/ $, Asterisk Asterisk Getway Interface (AGI) firmware/ $ - (firmware) Asterisk / iax/ images/ / ", ", 5, " keys/ Asterisk / RSA # $ keys/, " ( IAX2 ) $, pub key keys/ 20

27 sounds/ 4 Asterisk, Asterisk, soundstxt sounds-extratxt, ( asterisk-sounds-121) var/spool/asterisk/ %, outgoing/, qcall/, tmp/ voic / Asterisk outgoing qcall % tmp/ " # # $ " # 4 (voic ) voic / var/run/ % process id (pid), Asterisk ( " asteriskconf) $ var/run/ ` 21

28 var/log/asterisk/ % Asterisk & " loggerconf /etc/asterisk " $ loggerconf: ; Logging Configuration ; [general] ; ' ;! ISO 8601 yyyy-mm-dd HH:MM:SS ;dateformat=%f %T ; host ;appendhostname = yes ; " ;(! yes) ;queue_log = no ; " ;(! yes) ;event_log = no ;) " ;) ; Asterisk v ( ) ;-d ( ) [logfiles] ;! 22

29 ; : ; debug ; notice ; warning ; error ; verbose ; dtmf ; "console" ;debug => debug console => notice,warning,error messages => notice,warning,error ;full => notice,warning,error,debug,verbose 24 Asterisk! Asterisk /usr/sbin/ & asterisk (daemon) ) asterisk h : #cd /usr/sbin/ #asterisk h : -c : (console) / Asterisk CLI -v: (verbosity) $ CLI -g: (core dump) $ asterisk (crash), core gdb 23

30 -r: (remote) $ Asterisk -x : (execute) ( r CLI, CLI $ ) Asterisk CLI (verbosity) 3, : #asterisk cvvv $ Asterisk, : #asterisk vvvr petros-deskop:~ # asterisk -cvvv Asterisk already running on /var/run/asteriskctl Use 'asterisk -r' to connect petros-desktop:~ # asterisk -vvvr Asterisk 1213, Copyright (C) Digium Written by Mark Spencer <markster@digiumcom> ======================================================== Connected to Asterisk 1213 currently running on Petros-desktop (pid = 7450) -- Remote UNIX connection Verbosity is at least 3 Petros-desktop*CLI> ) CLI ( script), x r : #asterisk rx restart now 24

31 , : #asterisk vvvvvvvvvc tee/tmp/debuglog 25

32 3! DUNDi DUNDi [REF8] DUNDi 31 DUNDi & DUNDi VoIP Public Switched Network (PSTN) % DUNDi (wwwdundicom) : DUNDi Peer-to-Peer (P2P) $ ( ENUM), DUNDi DUNDi " " DUNDi " (SIP, IAX, H323) DUNDi " 6 bytes $ Ethernet MAC Address DUNDi " (dialplans) - ) # 26

33 " (context) private % /164[REF9] ) DUNDi E164 General Peering Agreement (GPA) [REF10] ) DUNDi " " $ -, 4 DUNDi, ) Advanced Encryption Standard (AES) [REF11] RSA[REF12], " / General Peering Agreement (GPA) [REF10] 27

34 32 "! $ DUNDi,, [REF8], ( " ) - DUNDi : 4 # 4 $ B ' 6 $ ) $, 6, ) ' " $ $ 1234 $ " " 6 ' " 28

35 $ 6 ' " ( ) $ " ) ) $ 1234 $" $ ( ) $ ' ) 33! DUNDi & [REF8] DUNDi & " 16 bit, % "! 0 1 bit F (Final) 1 (incoming sequence number) (outgoing sequence number) 8 bit 0 1 (ACK) " 29

36 331 DUNDi 10 $ DUNDi REGREQ REGRESPONSE % REGREQ ( ) REGRESPONSE / EXPIRATION REGRESPONSE & 333 $ % % DPDISCOVER DPRESPONSE #! DPDISCOVER $ ( ) (ACK) DPRESPONSE " 4 DPDISCOVER DPRESPONSE milliseconds TTL

37 2000 & DPDISCOVER CANCEL milliseconds DPDISCOVER DPRESPONSE DPDISCOVER / DPDISCOVER DPDISCOVER : 1 2 TTL 1 DPDISCOVER TTL " DPREQUEST / DPDISCOVER DPRESPONSE: 1 DPRESPONSE / 31

38 2 / TTL 1 flag TTLEXPIRED 3! UNAFFECTED 1 DPDISCOVER ( EID_DIRECT) 4! DONTASK 1 " " 334 EID (Entity IDentifier) % EIDQUERY EIDRESPONSE * EIDQUERY / EIDRESPONSE " bit F 1 % EID DPDISCOVER DPRESPONSE 335 % & ' ' DUNDi 1 Si, So, Ts, Td F bit 32

39 % 1: request/response # # REGREQ (So=0, Si=0, Ts=1234, Td=0, F=0) > < REGRESPONSE (So=0, Si=1, Ts=5678, Td=1234, F=1) ACK (So=1, Si=1, Ts=1234, Td=5678, F=1) > % 2: $ % # # DPDISCOVER (So=0, Si=0, Ts=2345, Td=0, F=0) > < ACK (So=0, Si=1, Ts=6789, Td=2345, F=0) < DPRESPONSE (So=0, Si=1, Ts=6789, Td=2345, F=1) ACK (So=1, Si=1, Ts=2345, Td=6789, F=1) > % 3: EID # # EIDQUERY (So=0, Si=0, Ts=3456, Td=0, F=0) > < ACK (So=0, Si=1, Ts=6789, Td=3456, F=0) < EIDRESPONSE (So=0, Si=1, Ts=6789, Td=2346, F=1) ACK (So=1, Si=1, Ts=3456, Td=6789, F=1) > 33

40 34 (! [REF8] DUNDi UDP 4520 % 6 bytes & MAC address! DUNDi : Source Transaction Destination Transaction ISeqno OSeqno F R CmdResp CmdFlags Information Elements Source Transaction: % Destination Transaction: % ISeqno: % 34

41 OSeqno: % F: bit / 1 R: bit / 0 1 CmdResp:! CmdFlags: / Information Elements: 35 (! DUNDi ) DUNDi $ dundiconf, extensionsconf iaxconf * iaxconf, DUNDi * sipconf, h323conf mgcpconf 351 dundiconf dundiconf " $ " " 35

42 /, " - dundiconf Asterisk: ; DUNDi configuration file ; ; [general] ; ; "general" ; client server ; ; ;, ; ; ;department=your Department ;organization=your Company, Inc ;locality=your City ;stateprov=st ;country=us ; =your@ com ;phone= ; ; ; IP, ; 4520 ; ;bindaddr=0000 ;port=4520 ; 36

43 ;! ( MAC ; " eth, ; MAC ;!) ; ;entityid=00:07:e9:3b:76:60 ; ; # DUNDi ( ; ) ; ttl=32 ; ; $ ACK DPREQUEST 2000ms, autokill ; yes, ( ; ) ;% & ; ; host $ «yes» ;«no» ; autokill=yes ; ;' pbx_dundi «secret», ; ; «secretpath» " ;dundi ( ; dundi/secret); ;secretpath=dundi [mappings] ; ;' «mappings» DUNDi 37

44 ; ;Asterisk ; DUNDi ; DUNDi General Peering Agreement (GPA) ; ; dundi_context => local_context,weight,tech,dest[,options]] ; ;' dundi_context ;' local_context ; ;' tech (IAX, SIP, H323) ;' dest ( ; ${NUMBER} ; ;! (options) : ;nounsolicited: # ; ;nocomunsolicit: # ;residential: % ;commercial: % ;mobile: % ;nopartial: ) (partial) ; DUNDi ;, ; ;e164 => dundi-e164-38

45 comunsolicit,nopartial ;e164 => dundi-e164- ;e164 => munsolicit,nopartial ;digexten => ;asdf => ; ; ; ' ; ' name ; ; ; ;inkey: * ;outkey: ;host: host ;order: (order) * ;(primary), (secondary), (tertiary) (quartiary) ;include: ; ( «all» host) 39

46 ;noinclude: ) ; ( «all» host) ;permit: $ &( DUNDi ; ( «all» host ) ;deny: % &( DUNDi ; ( «all» host ) ;model: $ (inbound), ( (outbound), (symmetric) ;, ;! * ; ; Sample Primary e164 DUNDi peer ; [00:50:8B:F3:75:BB] model = symmetric host = inkey = digium outkey = misery include = e164 permit = e164 qualify = yes ; ; Sample Secondary e164 DUNDi peer ; ;[00:A0:C9:96:92:84] ;model = symmetric 40

47 ;host = miserydigiumcom ;inkey = misery ;outkey = ourkey ;include = e164 ;permit = e164 ;qualify = yes ;order = secondary ;[*] ; 52 iaxconf " Asterisk " [priv] type=user dbsecret=dundi/secret context=dundi-priv-incoming disallow=all allow=ulaw allow=g ( extensionsconf extensionsconf " ; Macro Block [macro-stdexten] ; standard extension macro exten => s,1,answer 41

48 exten => s,2,dial(sip/${arg1},25,t) exten => s,3,goto(s-${dialstatus},1) exten => s-noanswer,1,voic (u${arg1}) exten => s-noanswer,2,hangup exten => s-busy,1,voic (b${arg1}) exten => s-busy,2,hangup exten => _s,1,goto(s-noanswer,1) exten => a,1,voic main(${arg1}) [macro-dundi-lookup] exten => s,1,goto(${arg1},1) include => dundi-priv-lookup ;Directory Service Contexts [dundi-test-canonical] exten => ,1,Goto(pstn-in,s,1) exten => ,1,Goto(pstn2-in,s,1) exten => ,1,Goto(pstn2-in,s,1) ;$ DUNDi 0 ;% [dundi-test-local] include => dundi-test-canonical include => dundi-pstn-local ;E ;dundi-test, ( [dundi-test-lookup] switch => DUNDi/dundi-test ;$ (, ; " switch &( 42

49 ; [dundi-pstn-local] exten => _1416NXXXXXX,1,SetGroup(PSTN-OUTBOUND) ; increase PSTN- OUTBOUND +1 exten => _1416NXXXXXX,2,CheckGroup(2) ; check if <=1, else n+101 exten => _1416NXXXXXX,3,Dial(${LOCALTRUNK}/${EXTEN:1}) exten => _1416NXXXXXX,103,Wait(1) ; too many callers, drop exten => _1416NXXXXXX,104,Playback(goodbye) exten => _1905NXXXXXX,1,SetGroup(PSTN-OUTBOUND) exten => _1905NXXXXXX,2,CheckGroup(2) exten => _1905NXXXXXX,3,Dial(${LOCALTRUNK}/${EXTEN:1}) exten => _1905NXXXXXX,103,Wait(1) exten => _1905NXXXXXX,104,Playback(goodbye) ;$ , ; 2 [dundi-priv-local] exten => _1XXX,1,Macro(stdexten,${EXTEN}) ; > 1999 [dundi-priv-lookup] switch => DUNDi/priv ;+(,( ;'priv' dundi [dundi-priv-incoming] include => dundi-priv-local 43

50 ;-, ; ;Outgoing Calls Contexts [local] exten => _[1-2]XXX,1,Macro(dundi-lookup,${EXTEN}) ; > 2999 ; dundi-lookup 36 ) # DUNDi! Asterisk DUNDi ` 2 " (((( * 7, DUNDi [REF12] +$( (" DUNDi VoIP) 2 iaxconf DUNDi " 44

51 iaxconf : [priv] type=user dbsecret=dundi/secret context=dundi-priv-local & " priv Asterisk % priv dundi-priv-local / " dbsecret dundiconf dundi-priv-local $ " [mappings] - priv=>dundi-priv-canonical,0,iax2,priv:${secret}@{ipaddr} /${NUMBER},nopartial priv => dundi-priv-via-pstn,100,iax2,priv:${secret}@{ipaddr} /${NUMBER},nopartial priv => dundi-priv- customers,400,iax2,priv:${secret}@{ipaddr} /${NUMBER},nopartial 6 0, & ", 45

52 0 " & {IPADDR} )` extensionsconf " Asterisk /, " - extensionsconf DUNDi $" ) " ;private DUNDi network [dundi-priv-canonical] ;Direct numbers [dundi-priv-customers] ; ; ITSP [dundi-priv-via-pstn] ; ; 46

53 [dundi-priv-local] include => dundi-priv-canonical include => dundi-priv-customers include => dundi-priv-via-pstn [dundi-priv-switch] ; # switch => DUNDi/priv [dundi-priv-lookup] include => dundi-priv-local include => dundi-priv-switch [macro-dundi-priv] exten => s,1,goto(${arg1},1) include => dundi-priv-lookup [trydundi] exten => _,1,Macro(dundi-priv,${EXTEN}) exten => _,2,Congestion " script /asterisk- 1213/var/lib/asterisk/keys & astgenkey " hostname Asterisk ) hostname ), server " box1 domain domaincom hostname box1domaincom, box1 /, n 47

54 " Asterisk - " hostname petros1 # cd /var/lib/asterisk/keys # astgenkey n petros1 This script generates an RSA private and public key pair in PEM format for use by Asterisk You will be asked to enter a passcode for your key multiple times Please enter the same code each time The resulting files will need to be moved to /var/lib/asterisk/keys if you want to use them, and any private keys (key files) will need to be initialized at runtime either by running Asterisk with the '-i' option, or with the 'init keys' command once Asterisk is running Press ENTER to continue or ^C to cancel Generating SSL key 'petros1': Generating RSA private key, 1024 bit long modulus e is (0x10001) writing RSA key Key creation successful Public key: petros1pub Private key: petros1key petros1:/var/lib/asterisk/keys # 4 script " petros1pub 48

55 petro1key $ /var/lib/asterisk/keys web server " & text! - " : petros1pub: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADiQKBgQC45BoYojLegRQOLOunRlX WOiGu O5iMbVhyuDipF/fY+qY9vQDacAT6xBTuIJteJewQ8BclLiRtmJLx+2/ZAXv37pW8 mtqpho2l69ppruckei52dvylz11hfsyql3fppahxgug//oe59rubccqi3+nuacb F qidzpq3e1bo7q6yxlqidaqab -----END PUBLIC KEY----- petros1key: -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBgQC45BoYojLegRQOLOunRlXWOiGuO5iMbVhyuDipF/fY+qY9vQDa cat6xbtuijtejewq8bcllirtmjlx+2/zaxv37pw8mtqpho2l69ppruckei52dvyl Z11HfsyQl3fPpAhXGUG//oe59RUbCCqI3+NuaCbFqIdzPQ3E1BO7q6YXlQIDAQAB AoGBAJcJd6wB7G5JobmGxqcqVPqhGFx9wLuOo79rcJXpx4VQFLfAi07mTZsQzUxO BL3fWr3nc/Dihc2l4vycex0aEkruR9McTAu2yXjuqTFcEC1MpnDPMhDh6xvrUkEM btdupl/gfq8yd+9cl9wc+cneuzkwfjstv8dmx1pzhdqy9yehakea59b6wulct4j+ FA/dnFVsB3UVryJ7qr1aAgPvAwiSpVjnZZGL1FQvm6108cLArY6wywrrnSzILC/V pcprlzwl2qjbamwuwzkyozujlbj0zqc2xf8letrnl4v0yj06kzyes+bykxuyxur7 49

56 +5IYxA90yr4xYLMOOdImohNTj6m+WeAt/h0CQQCSzzx+ENY45AK27+lYldzJyEQI W11Yn3y+ZAFduXMuFmTNtWSJ/xr7i9nRNpbSE9kxbeQT8YWAPncd8cWCZBDZAkEA syqo7mmfdhr3mapvnenweqfqjq+2ptu0ke3m+rezgwc91wgrv9tfudmlmztmo2zo 2DZPfpzv882LbwPdkd5J8QJBAMSQeBIh3IlxoAURsLmISBxC1R9cjCxdcMWpN46l cte3/+fv6p6kr3stwik3z6whncd879fvjsayrmzsn7ymrje= -----END RSA PRIVATE KEY----- $ CLI Asterisk show keys : *CLI> show keys Key Name Type Status Sum switch-1n2netnet PUBLIC [Loaded] 58197ca5bae eef petros1 PUBLIC [Loaded] 34bae63322c802fcd90fae d9 petros1 PRIVATE [Loaded] 4cc788941a ebeb b17d freeworlddialup PUBLIC [Loaded] 5efd552d73309f a75f3c701e samos PUBLIC [Loaded] f9c6003c32d8969a80a2e234b6374b3c iaxtel PUBLIC [Loaded] d919b3ef03eb4dc54c8fee86bfeeada1 6 known RSA keys / res_cryptoso pbx_dundiso Asterisk dundiconf *CLI> reload res_cryptoso -- Reloading module 'res_cryptoso' (Cryptographic Digital Signatures) -- Loaded PRIVATE key 'petros1' -- Loaded PUBLIC key ' petros1' 50

57 *CLI> reload pbx_dundiso -- Reloading module 'pbx_dundiso' (Distributed Universal Number Discovery (DUNDi)) == Parsing '/etc/asterisk/dundiconf': Found $ ", 4 DUNDi MAC (Media Access Control) " ) MAC Linux: # ifconfig eth0 eth0 Link encap:ethernet HWaddr 00:02:AA:12:A2:32 inet addr: Bcast: Mask: UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (00 b) TX bytes:0 (00 b) Interrupt:9 Base address:0x5000! MAC ) CLI Asterisk : pbx*cli> dundi show entityid Global EID for this system is 00:02:AA:12:A2:32 51

58 & MAC, dundiconf # ) hostname petros1domaincom petros-desktopdomaincom ", # : petros1domaincomkey / petros1domaincompub petros-desktopdomaincompub / petros-desktopdomaincomkey MAC : petros1domaincom petros-desktopdomaincom 00:02:AA:12:A2:32 00:01:A2:6/:92:$6 $ dundiconf : petros1domaincom ; Primary e164 DUNDi peer ; [00:02:AA:12:A2:32] model = symmetric host = inkey = petros-desktopdomaincompub outkey = petros1domaincompub include = e164 52

59 permit = e164 qualify = yes petros-desktopdomaincom ; Primary e164 DUNDi peer ; [00:01:A2:6/:92:$6] model = symmetric host = inkey = petros1domaincompub outkey = petros-desktopdomaincompub include = e164 permit = e164 qualify = yes $ dundiconf Asterisk # $ CLI Asterisk dundi show peers : *CLI> dundi show peers EID Host Model AvgTime Status 00:01:A2:6/:92:$ (S) Symmetric Unavail OK (273 ms) 1 dundi peers [1 online, 0 offline, 0 unmonitored] $ & dundi show peer CLI Asterisk 53

60 *CLI> dundi show peer 00:01:A2:6/:92:$6 Peer: 00:01:A2:6/:92:$6 Model: Symmetric Host: Dynamic: no KeyPend: no Reg: No In Key: petros1domaincompub Out Key: petros-desktopdomaincompub Include logic: -- include dundi-priv Query logic: -- permit dundi-priv $ extensionconf " * DUNDi ", DUNDi ) "! extensionsconf ) " # [dundi-priv-customers] $ " # 2 : exten => _2XXX,1,Goto(ext-local,${EXTEN},1) 54

61 & DUNDi 2100 $ dundi lookup CL+ Asterisk *CLI> dundi lookup IAX2/dundi: 34bae63322c802fcd90fae d9@ petros1domaincom /2100 (EXISTS NOUNSLCTD NOCOMUNSLTS) from 00:01:A2:6/:92:$6, expires in 787 s DUNDi lookup completed in 331 ms " : *CLI> dundi lookup 7100 DUNDi lookup returned no results DUNDi lookup completed in 1006 ms 55

62 4 * % DUNDi $ DUNDi 41 ( ( ) % RAM 512 &6, Intel Pentium 2,8 MHz 80 GB Linux Ubuntu 610 Fedora FC6 % 512 &6 RAM, 1,6 &!z Intel Celeron 60 GB % RAM 1GB, Intel Pentium 2,4 &!z 200 GB Linux Ubuntu 610 Asterisk 1213 (/3) $ Asterisk - " hostname MAC, +, ( ) " 56

63 PC1 hostname: petros-desktop MAC: 00:01:02:DE:27:2E IP: NUMBER: PC2 hostname: petros1 MAC: 00:0D:9D:D1:5E:92 IP: NUMBER: PC3 hostname: gkamb1 MAC: 00:16:17:C4:62:44 IP: NUMBER: PC4 hostname: petros2 MAC: 00:50:04:44:53:96 IP: NUMBER: PC5 hostname: petros23 MAC: 00:01:02:DE:27:A3 IP : NUMBER: ) $ 57

64 , NFS SMB shared-keys : # sudo mkdir /home/petros/desktop/shared-keys $ $ shared $ IP, mount $ : # sudo mount :/home/petros/Desktop/shared-keys /home/gkamb1/desktop/shared-keys $ DUNDi petrosdesktoppub, petros1pub, petros2pub, gkamb1pub petros23pub 58

65 5 DUNDi: 5 % # 59

66 5 " (PC1, PC2, PC3, PC4, PC5) & " DUNDi % 4 DUNDi $, " ( 1000) '" VoIP $ DUNDi ) 1000: *CLI> dundi lookup IAX2/dundi: 34bae63322c802fcd90fae d9@karlovasigr/1000 (EXISTS NOUNSLCTD NOCOMUNSLTS) from 00:0F:FE:0A:7E:97, expires in 787 s DUNDi lookup completed in 731 ms 60

67 42 * - [REF13] )` script, script ( 1 : result1txt), test $ Linux : $ /test % script : clear for ( ( i=100; i<=599 ; i++ ) ) do asterisk rx dundi lookup 1$i@priv >> resultx done script «"» for " $i " # 500 script asterisk rx CLI asterisk! " 1XXX DUNDi priv % 1((( " ' " 1100, " 61

68 " resultx ( # & 500 " % $ 43! * # hops " % " " hop 6 hop 6 «1» 62

69 hop 7 hop 7 «2» hop 8 hop 8 «3» 63

70 hop 9 hop 9 «4» hops, "! " 10 * & & '& 64

71 10 «5» hop result1 $ ', result2, result3, result4 result5 " DUNDi! 65

72 44 * &: / script, " ': script " '#: % $, (# ) /, cache!/ &: % 11 % 2007! () $ : (txt) Excel 66

73 441 Excel,, [REF13] $ " max( x),min( x) * hop & $, Excel, AVERAGE x x x x x i i1 4, # ) - & /(() ( ) VAR Excel 67

74 s x i ( x i ) i1 i1 2 % STDEV (standard deviation) Excel s 2 s " 11: ( ' #1 68

75 12: ( ' #2 13: ( ' #3 69

76 14: ( ' #4 15: ( ' #5 70

77 #1 #2 #3 #4 #5 / (ms) & (ms) & 41, , , , ,16291 ' 6, , , , , $ 2, , , , , * #1: 1 HOP #2: 2 HOPs #3: 3 HOPs #4: 4 HOPs #5: 4 HOPs 1: 71

78 $ 2 2,6 milliseconds $ 2 2,6 (milliseconds) 41, ,22807 * 2,07747 ms &" 5,17% 43, ,26316 * 2,03509 ms $ 4,7% ) 45, ,15894 * 1,9 ms &" 4,2% - & & $ - $ - $ - #1 #2 #2 #3 #3 #4 5,17% 4,7% 4,7% 2: # ) #5 " DUNDi 72

79 #4 $ DUNDi * #4, #5 & " : 16: *# * #5 & [REF14] " y(x) = 1707x y " x hops DUNDi 73

80 ! DUNDi hop DUNDi 2 millisecond %, 74

81 5 +, " DUNDi -" ", " * VoIP,,2, [REF12] DNS server [REF13] DUNDi , DUNDi " VoIP,,2, &, " DNS DUNDi ", ' ( #, # ) &, & DUNDi 75

82 !, " DUNDi, " E164 [REF9] " e164 ) " e164 # General Peer Agreement (GPA) [REF10], GPA 2, ", GPA, ", 511 General Peer Agreement (GPA) GPA, " E164 e164 & " %, " GPA " $" DUNDi, GPA, " E164, #, E164 76

83 GPA DUNDi VoIP ) e164, " e164,, " *, " " P2P e " (DUNDi, E164, Peering System, Propagate, Participant, Weight ) ",, ", " / &, - # &! GPA forum, 77

84 , " 2, % /,2,, %, % GPA % " ) DUNDi 1,!, % % " # 78

85 , " " / " & GPA " - # % site DUNDi ( $ # DUNDi, AES RES RSA 5121 RSA % RSA [REF17] 1978 (Rivest, Shamir, Adleman) $ RSA RSA " ( - ) " % 79

86 ) " RSA " * f(n)=(p-1)(q-1), p q n $ Euler n e, f(n), e f(n) 1, " d, e modulo f(n), d=e -1 mod f(n) O e d " 1 $ 6 $ $ 6 $ C=M e mod n C $ B, &=C d mod n, % RSA! ", ", # 80

87 % " n! ",, " " -, 2048 bit 5122 Advanced Encryption Standard (AES) % AES [REF18] &, 2002 AES AES 128 bit, 192 bit 256 bit 128 bit, 192 bit 256 bit ",, # $ «Rijndael key schedule» - % : ByteSub, ShiftRow, MixColumn, AddRoundKey - AES 81

88 % ByteSub bytes [ 17] 17: ByteSub ShiftRow byte, [ 18] 18: ShiftRow 82

89 MixColumn " c(x) [ 19] 19: MixColumn AddRoundKey byte " byte XOR () [ 20] 20: AddRoundKey 83

90 % (side channel attacks) AES 128 bit, " AES 5123 DUNDi, AES RSA 4 DUNDi RSA AES RSA 1024 bit AES 128 bit RSA 6 AES $ # DUNDi, " ( 36) " RSA! " RSA # DUNDi PKI!, web site DUNDi " web site dundiconf /, 84

91 RSA " $ DUNDi DUNDi : Information Element Notes EID KEYCRC32 CRC AES, RSA SHAREDKEY AES, ENCDATA AES 6, $ CRC-32 [REF19] AES & " % SHAREDKEY KEYCRC32 $ ", 85

92 SHAREDKEY AES REGREQ " $ ENCDATA % REGRESPONSE #, AES! DUNDi,, " 513 Peer-to-Peer vs Client Server (DNS) VoIP ENUM [REF23] DUNDi [REF8], " ENUM, DUNDi, (client - server) [REF20], Domain Name System (DNS) [REF16], " E164 ENUM DNS # E164 DNS ), Nameserver (NS) Naming Authority Pointer (NAPTR), DNS & ENUM 86

93 DNS 4 DNS &,, $, DNS % Denial of Service (DoS) [REF22] Pharming [REF21] % DoS DNS, (Distributed DoS [REF22]), DNS,, DNS, % Pharming % DNS, & # % Pharming 4, DUNDi ENUM " P2P DUNDi "!, GPA DUNDi *, " 87

94 DNS, DUNDi $" DUNDi 52 +, DUNDi [REF25] 521, DUNDi, ) " -, DUNDi " () DUNDi,, " " $ DUNDi, % DUNDi ",! " 21 88

95 21: ( DUNDi # 521 $ $ D!, ( ), lookup " ( ) " 522 # "! ", DUNDi, /, 89

96 , $ ) $ 4 5, 7 8, , 4, 1, 2, 5, 8, 9, 17, 13, 16 $, " 1 2 ', ( 4) * 7 16 " 90

97 22: % # # DUNDi / 91

98 6, DUNDi $, Asterisk, DUNDi! Asterisk, VoIP DUNDi Asterisk DUNDi,!, DUNDi Asterisk,, / DUNDi # $" " DUNDi " $,, % DUNDi, ',, /, $ ( 4), hop 2 ms - DUNDi ( ) " 92

99 /, " " DUNDi *, ENUM % DNS, P2P DUNDi & AES RSA, DUNDi DUNDi, DUNDi GPA, " & DUNDi, GPA ", DUNDi ", " " " ENUM $ # DUNDi, " 93

100 $ [REF] H323 Protocol Overview: Paul E Jones (October 2007) 3 SIP Protocol Overview: RADVISION Team 4 IAX: Inter-Asterisk exchange Version 2: M Spencer 5 Asterisk: A Non-Technical Overview: Nasser K Manesh Asterisk: The Future of Telephony: Leif Madsen, Jared Smith 8 Distributed Universal Number Discovery (DUNDi)draft-mspencer-dundi-01: M Spencer Internet-Draft Digium, Inc October 13, RFC 2916 E164 number and DNS September DIGIUM GENERAL PEERING AGREEMENT (TM)Version 100: Sept $ ' 1: )",, ' )" 12 Practical VoIP Security: Thomas Porter, Jan Kanclirz, Andy Zmolek, Antonio Rosela, Michael Cross, Larry Chaffin, Brian Baskin, Choon Shim 13 & : ) ', 6 ( ( 14 : ) ' 15 An Overview of Peer-to-Peer: Sami Rollins 16 RFC 883 DOMAIN NAMES - IMPLEMENTATION and SPECIFICATION ADVANCED ENCRYPTION STANDARD (AES) Federal Information Processing Standards Publication The Future of Asterisk: Kevin P Fleming 21 Routing Security: Steven M Bellovin 94

101 22 Spoof Detection for Preventing DoS Attacks against DNS Servers: Fanglu Guo Jiawu Chen Tzi-cker Chiueh 23 "Security and Privacy issues towards ENUM", Proceedings of the ISSPIT 05 5th IEEE International Symposium on Signal Processing and Information Technology, pp , December 2005, Athens, Greece, IEEE Press 24 G Kambourakis, D Geneiatakis, S Gritzalis, T Dagiuklas, C Lambrinoudakis Call Route Discovery with Asterisk / DUNDi: Andre Wangler, September