NAT Traversing Solutions for SIP Applications

Many research activities have been provided to allow Session Initiation Protocol (SIP) based communication in Peer-to-Peer (P2P). We have contributed to these activities by proposing a scalable proxy topology building and routing in P2P SIP network where SIP location service is integrated in proxies that run over peer entities. Therefore as SIP cannot work efficiently through a NAT (Network Address Translation) device without using a specific NAT traversal mechanism, our proposed architecture needs an efficient NAT traversal technique which can work easily and make end-to-end communication effective in our framework by meeting our previously defining requirements. This paper provides a suitable technique to our P2P SIP framework for SIP signaling and media flow. Our NAT traversal solution proposes an implementation of a smart SIP registrar server which stores the client end device's public contact information (IP address and port) instead of its private address and maintains this public address in the NAT device table. This approach allows the proxy node to always send the SIP signaling message to the correct address by checking the Registrar server before each transmission. To enable media flow to be exchanged between the two SIP clients, we use a media relay located in the public network. The proxy server of the originator of the signaling message is allowed to replace suitably the private addresses in the message body by the public addresses of the media relay. We provide some relevant experimental results to show that the approach is feasible.

Performance evaluation of Recursive Distributed Rendezvous based service discovery for Peer-to-Peer Session Initiation Protocol

Chapter 14 - Securing Multimedia Communications

The convergence of company communications on IP network continues to oscillate between the protocol owners and the standards SIP, MGCP and H.323. We propose in this paper a new approach allowing a transparent traversal of NATs (Network Address Translation) to SIP protocol (Session Initiation Protocol). This ensures thus optimisation in the case of multimedia sessions. Indeed, the fact that SIP belongs to the application layer constitutes a weakness vis-àvis the traversal of NATs. It is due, on the one hand, to the way in which the server responds to requests of clients. On the other hand, it is caused by the dynamic allocation of the UDP ports. The approach proposed, called ''Adequate Solution for each Situation'' (ASS), allows to adapt in a dynamic way one of the following three solutions: connection-oriented media, STUN and TURN, following the situation which occurs during the call initialisation.

The Session Initiation Protocol (SIP) implements methods for generic service discovery and versatile messaging. It is, therefore, expected to be a key component in many telecommunication and Internet services. For example, the 3GPP IP Multimedia Subsystem relies heavily on SIP. Given its critical role, ensuring the security of SIP is clearly a crucial task. In this paper, we analyze the SIP protocol and show that it can easily be exploited to mount effective and large-scale botnets. We do this by scrutinizing the details of the SIP protocol and show how it offers a variety of ways to conceal botnet traffic within legitimate-looking SIP traffic. Using our analysis, we implement a SIP bot and present experimental results from a real testbed network. In addition, we employ traffic statistics collected from a large telecommunication provider and discuss the implications for both botnet design and detection. Finally, we present a software tool (called autosip) to generate synthetic traffic that resembles actual SIP traffic with different controllable characteristics. The proposed tool is quite useful for researchers working in the area who may not have access to traffic dumps from actual telecommunication providers.

The session initiation protocol (SIP) was used on a large scale as a session signalling protocol to provide legacy as well as new services. The 3rd Generation Partnership Project (3GPP) has decided to use the SIP protocol in the IP multimedia subsystem of future Universal Mobile Telecommunications System (UMTS) networks. If the SIP protocol is used in carrier grade networks, quality of service (QoS) observations are necessary to ensure quality service provisioning. This, in particular, is important since signalling will use multiservice IP transport networks and share its resources with other services. This paper proposes the concept of virtual SIP links (VSLs) that connect two SIP nodes. VSLs can be used to enable QoS provisioning in SIP signalling overlay networks. Methodologies are introduced to specify, define and dimension these virtual connections. The VSL specification uses the well-known concept of leaky buckets. Simple methodologies are established that are based on known results, to calculate message loss probabilities (MLPs) in leaky buckets. A simple, but efficient, queueing scheme is introduced that reduces the required network resources. Simulation results are given to validate the used models and to underline performance advantages for connections that use VSLs.

The Session Initiation Protocol (SIP) is an application-layer control protocol used to establish and terminate calls that are deployed globally. A flood of SIP INVITE packets sent by an attacker causes a Telephony Denial of Service (TDoS) incident, during which legitimate users are unable to use telephony services. Legacy TDoS defense is typically implemented as network appliances and not sufficiently deployed to enable early detection. To make TDoS defense more widely deployed and yet affordable, this paper presents TDoSD@DP where TDoS detection and mitigation is programmed at the data plane so that it can be enabled on every switch port and therefore serves as distributed SIP sensors. With this approach, the damage is isolated at a particular switch and bandwidth saved by not sending attack packets further upstream. Experiments have been performed to track the SIP state machine and to limit the number of active SIP session per port. The results show that TDoSD@DP was able to detect and mitigate ongoing INVITE flood attack, protecting the SIP server, and limiting the damage to a local switch. Bringing the TDoS defense function to the data plane provides a novel data plane application that operates at the SIP protocol and a novel approach for TDoS defense implementation.

We propose Peer-to-Peer-based (P2P-based) home monitoring system architecture to exploit a vacuum robot with an IP camera, a movable IP camera, without requiring a number of cameras for the whole monitoring at home. The key implementation issues for the proposed home monitoring system are (1) the easy configuration of a vacuum robot to connect to Wi-Fi networks, (2) the session management between a vacuum robot and a home monitoring server, and (3) the support of the Network Address Translator (NAT) traversal between a vacuum robot and a user terminal. In order to solve these issues, we use and extend the Wi-Fi Protected Setup (WPS), the Session Initiation Protocol (SIP), and the UDP hole punching. For easy configuration of a vacuum robot, we also propose the GENERATE method which is an extension to the SIP that allows for the generation of a SIP URI. In order to verify the feasibility of the proposed system, we have implemented the prototype and conducted the performance test using the authoritative call generator.

Network address translator (NAT) is the well-known, transitional method to mitigate the problem of IPv4 address depletion in today's Internet. However, the assignment, translation, and export of address/port in a NAT at run time affect application functions. Accordingly, application servers behind the NAT cannot accept requests directly from public networks. Sensitive applications cannot hold their end-to-end security mechanisms. Applications lose connections after the NAT reboots or changes the binding address/port. However, current proposals for NAT traversal hardly solve the problems. Against the problems, we propose Smart Tunnel Union for NAT Traversal (STUNT) in the paper. STUNT permits applications behind the NAT to be actively contacted by Internet clients, keeps end-to-end security mechanisms, and avoids the risk of exporting binding information of the NAT to connection endpoints. Meanwhile, it permits applications to traverse the NAT and keeps the NAT intact

With the evolution and penetration of the IP-based core network and the mobile access networks, more and more legacy services are being transferred to the converged and unified IP-based platform. For realizing this transfer, SIP (Session Initiation Protocol) has been adopted by standards bodies for creating, modifying, and terminating multimedia sessions. SIP with application-level mobility support can replace MIP (Mobile IP) to provide a FMC (Fixed Mobile Convergence) solution. Taking the important role of SIP into account, it is critical to fully resolve the SIP security issues including service authentication, confidentiality, and integrity protection on both signaling and data transmission. IPSec (IP Security) and the combination of TLS (Transport Layer Security) and SRTP (Secure Real-time Transport Protocol) are two typical SIP security solutions that can protect signaling and data transmission from various security attacks. However, these security solutions don't consider the issue of mobility support during the handover of mobile nodes among different access networks. This paper, therefore, proposes an effective SIP security solution that realizes SIP security with seamless mobility support across heterogeneous mobile networks. We compare the proposal to existing approaches and show that it better satisfies the SIP security requirements in terms of security, mobility support, and performance.

The session initiation protocol (SIP) is an IETF application-layer control (signalling) protocol for creating, modifying and terminating sessions with one or more participants. SIP is a simple, scalable, text-based protocol that offers a number of benefits, including extensibility, the provision of call/session control, and inherent user mobility. BT's experimental version also offers well-defined APIs, allowing it to be easily integrated into Web and other IP-based applications. SIP can also carry different session description protocols and may also be extended to support PSTN transit via encapsulation of SS7 ISUP (SIP-T). SIP is expected to become widely available in 2001, gradually replacing H.323 as the protocol of choice for multimedia session control in IP networks. This paper describes the operation of SIP, details why it is important to BT and looks at the roles that SIP might play in a future all-IP fixed and mobile converged network. Finally, the paper also describes an experimental SIP-based virtual home environment (VHE) providing personal mobility.

Multi-core platforms are becoming prevailing in telecom infrastructures, and many SIP(Session Initiation Protocol) enabled applications are using Java as the development language and runtime environment. It is important to understand the workload characteristics and performance issues of Java based SIP stack over multi-core platforms. In this paper, two RFC 3261 compliant Java based SIP stacks, the JAIN-SIP and a proprietary SIP stack are studied in depth. Especially we focused on the typical performance issues caused by either Java language features or the workload of SIP protocol, including scalability of SIP stack, resource contention issue and GC impact with SIP memory usage pattern. Some optimization techniques and their drawbacks are also discussed along with the performance evaluation. It turns out that due to the complex combination of SIP protocol semantics and Java language features, the performance of Java based SIP stack tends to be far from competitive on multicore platforms. Extensive optimization and certain improvements of program structure and object management policy may help, however, may, on the other hand, sacrifice some key values of the java language, e.g. easy development.

This document describes several Network Address Translator (NAT) traversal techniques that were considered to be used for establishing the RTP media flows controlled by the Real-Time Streaming Protocol (RTSP). Each technique includes a description of how it would be used, the security implications of using it, and any other deployment considerations it has. There are also discussions on how NAT traversal techniques relate to firewalls and how each technique can be applied in different use cases. These findings were used when selecting the NAT traversal for RTSP 2.0, which is specified in a separate document.

Soft Phone is a VoIP soft phone that uses the Session Initiation Protocol. It is a powerful and unique SIP software telephone that lets users make phone and video calls using single software application using any Voice over IP (VoIP) telephony provider. As a fully featured SIP client, Soft Phone is designed from the ground up to work with current and future IP-based. Soft phone can be used in the place where we need establish the voice and video phone calls in the IP network. This can be installed at any personal computer. It uses the SIP protocol to establish the IP session and using RTP, RTCP and RTSP for media transmission. Using Soft phone they make call to any Soft Phone and Physical hardware SIP phone which can understand the SIP protocol.In computing, a soft phone is a software program for making telephone calls over the Internet using a general purpose computer, rather than using dedicated hardware. A soft phone is usually used with a headset connected to the sound card of the PC. To communicate, both end-points must have the same communication protocol and at least one common audio code. Many service providers use the Session Initiation Protocol (SIP) standardized by the Internet Engineering Task Force (IETF)

Overload occurs in Session Initiation Protocol (SIP) networks when SIP servers have insufficient resources to handle all the SIP messages they receive. Even though the SIP protocol provides a limited overload control mechanism through its 503 (Service Unavailable) response code, SIP servers are still vulnerable to overload. This document defines the behavior of SIP servers involved in overload control and also specifies a loss-based overload scheme for SIP.