SIP网络安全性研究

Research on the security of session initation protocol(SIP)networks

针对 SIP 网络所面临的典型安全威胁,提出了 SIP 攻击方法的有限状态机描述模型。利用该模型深入研究了注册劫持攻击、INVITE 攻击、re-INVITE 攻击、会话终止攻击和拒绝服务攻击的原理和方式,并在实际环境下重现了这5种攻击方法。同时提出并实现了针对注册劫持的禁止第三方注册或注册权限级别划分的解决方案,以及针对 INVITE 攻击、re-INVITE 攻击和会话终止攻击提出了改进的 HTTP Digest 认证协议和 Proxy 间逐条加密的解决方案,提高了 SIP 网络的安全性和可用性。

In consideration of the security threats in session initiation protocol （SIP） based networks, this paper put forward the deterministic finite automation （DFA） model for SIP attack methods. The attack theories and methods of five attacks of registration hijacking, INVITE, re-INVITE, tearing down sessions, and DoS were deeply analys based on the model, and all the attacks were recurred in real circumstances. At the same time the method to forbid the third part registration or registration rank carving in dealing with registration hijacking attacks, and the improved HTTP digest authentication protocol and the hop-by-hop encryption within proxy to deal with the attacks of INVITE, re-INVITE and BYE were put forward and implemented, which improved the security and usability of SIP networks.