SIP协议及其安全性分析

发布时间：2018-03-25 21:07

本文选题：SIP　切入点：AVISPA　出处：《国防科学技术大学》2014年硕士论文

【摘要】：随着Internet技术的飞速发展,基于Internet的多媒体应用业务得以快速推广和普及。作为多媒体应用管理的有效的基础协议,会话初始化协议SIP成为下一代网络中信令控制标准协议,其安全性受到高度关注。SIP协议在设计上追求简单、灵活、高可扩展等特性,缺乏有效的安全机制,同时协议中的消息采用文本类型的编码方式,因此,运行在开放Internet环境下的SIP协议遭受多种安全威胁。常见的SIP协议攻击有注册劫持攻击、服务器伪装攻击、消息篡改攻击、会话更改攻击和拒绝服务攻击等。IETF建议使用现有的网络协议安全机制来保证SIP的安全运行,如HTTP摘要认证机制、S/MIME机制、TLS机制、IPsec机制等。但是,这些安全机制仅适用于特定应用场景,局限性大,不能有效保证SIP的安全运行。如何有效的改进和扩展SIP的安全机制,确保基于SIP的多媒体应用业务的安全运行,是当前急需解决的热点研究课题。本文从SIP协议入手,首先是分析了SIP协议的结构、功能、消息格式等,接下来分析了SIP协议的安全问题,并利用形式化的方法对SIP协议的安全性进行分析,在此基础上提出了一种SIP安全性增强方法,并进行了编码实现与分析验证,取得了较好的效果。本文的主要内容如下:1.从SIP协议的设计机制和运行机制上对SIP协议的安全性进行分析,进而分析了针对SIP协议的几种安全威胁以及其原理,归纳总结了IETF提出的几种现有的安全机制的适用范围;2.分别使用基于BAN逻辑的人工分析和基于AVISPA的自动化分析两种形式化分析方法分析了SIP协议的安全性,得出了协议中存在安全缺陷及其可行的攻击路径;3.针对SIP协议的安全分析结果提出了一种安全增强方法,详细阐述了改进后的SIP方案,并对其安全性及其可攻击利用性进行了形式化分析。安全增强方法通过利用椭圆曲线双线性对以及基于身份的加密方法对SIP协议进行改进,使其不仅同时满足客户端对服务器的认证以及服务器对客户端的认证,也解决了HTTP摘要认证机制下的密钥托管问题;同时提出了白名单策略,对消息的某些头域进行进一步的认证,为客户端和服务器端都同时增加了另一层保护。通过对改进后方案的编码实现,验证了本文提出方法的有效性,改进了原有SIP协议的安全性,消除了可攻击路径。
[Abstract]:With the rapid development of Internet technology, multimedia application services based on Internet have been popularized and popularized rapidly. As an effective basic protocol for multimedia application management, session initialization protocol (SIP) has become the signaling control standard protocol in the next generation network. The security of SIP protocol is paid close attention to, which is simple, flexible and extensible in design, and lacks of effective security mechanism. At the same time, the message in the protocol adopts the encoding method of text type, so, The SIP protocol running in the open Internet environment is subject to various security threats. Common SIP protocol attacks include registry hijacking attacks, server camouflage attacks, message tampering attacks, etc. IETF suggests to use existing network protocol security mechanisms to ensure the secure operation of SIP, such as HTTP digest authentication mechanism, HTTP summary authentication mechanism, TLS mechanism and IPsec mechanism, etc. These security mechanisms are only suitable for specific application scenarios, which are limited and can not effectively guarantee the safe operation of SIP. How to effectively improve and extend the security mechanism of SIP to ensure the secure operation of multimedia applications based on SIP, This paper begins with the SIP protocol, first of all, analyzes the structure, function, message format of the SIP protocol, and then analyzes the security problems of the SIP protocol. On the basis of analyzing the security of SIP protocol by formal method, a security enhancement method of SIP is proposed, and the coding implementation and analysis verification are carried out. The main contents of this paper are as follows: 1. From the design mechanism and operation mechanism of SIP protocol, the security of SIP protocol is analyzed, and several kinds of security threats to SIP protocol and its principle are analyzed. The application scope of several existing security mechanisms proposed by IETF is summarized. Two formal analysis methods, manual analysis based on BAN logic and automated analysis based on AVISPA, are used to analyze the security of SIP protocol. The security defects in the protocol and its feasible attack path are obtained. According to the security analysis results of SIP protocol, a security enhancement method is proposed, and the improved SIP scheme is described in detail. The security and its exploitability are analyzed formally. The security enhancement method improves the SIP protocol by using elliptic curve bilinear pair and identity-based encryption. It not only satisfies the authentication of the server and the client, but also solves the key escrow problem under the HTTP summary authentication mechanism, and puts forward the whitelist strategy. Some header domains of the message are further authenticated, and another layer of protection is added to both the client and the server. The effectiveness of the proposed method is verified by the coding implementation of the improved scheme. The security of the original SIP protocol is improved and the attack path is eliminated.
【学位授予单位】：国防科学技术大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN915.04

【参考文献】