A novel design of a VoIP firewall proxy to mitigate SIP-based flooding attacks. (29th September 2008)

• Record Type: Journal Article
• Authors: Lee, Isaac; Hunt, Ray
• Is Part Of: International journal of internet protocol technology. Volume 3:Number 2(2008)
• Page Start: 128
• Page End: 135
• Publication Date: 2008-09-29
• Subjects: SIP -- VoIP flooding attacks -- Linux iptables -- stateful connections -- stateless connections -- digest authentication -- VoIP firewall proxy -- internet protocol -- session initiation protocol -- voice over IP -- VoIP networks -- security threats; File Transfer Protocol (Computer network protocol) -- Periodicals; Multicasting (Computer networks) -- Periodicals; 004.678
• Languages: English
• ISSNs: 1743-8209

Abstract

This paper proposes a novel method to address the protection necessary to mitigate flooding attacks in VoIP networks which can produce rapid saturation of a firewall and crippling of a VoIP switch. The paper proposes a stateless firewall nonce checking mechanism as an extension to the existing (stateful) SIP digest authentication. This combination aims to form a more secure and flood-resistant authentication scheme for SIP-based VoIP systems. The proposed mechanism has been implemented on a Linux iptables firewall and the experimental results demonstrate proof-of-concept showing that by incorporating this mechanism it is possible to provide substantially improved SIP-based flooding mitigation.