3G网络信令系统安全关键技术研究

发布时间：2018-06-27 04:03

本文选题：3G + SIP协议　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：随着现代移动技术的蓬勃发展,第三代移动通信即3G技术已经在全球范围内商业化并且快速的取代了原有的移动通信技术。3G技术具有很多优点,例如通信速度快、网络性能强、业务量承载能力强大等。所以3G技术的应用给人们的生活带来了前所未有的改变以及发挥了难以想象的作用。IP多媒体子系统即IMS是3G网中的最核心的一部分,通信网络中包括接入层、传输层、控制层和应用层等都需要通过IMS来控制和交互。而在IMS中,会话初始协议即SIP是一个重要的信令控制协议。该协议控制IMS子系统创建、修改和终止一个或多个会话。同时,由于该协议的重要作用以及其灵活简单、开放性强、兼容性好等特点,使得该协议成为了会话控制协议的标准协议。利用SIP协议,能够让用户体验即时消息、在线状态等新的服务。虽然目前SIP协议已经被广泛应用,但是其还存在着诸多安全问题。基于此,HTTP摘要认证、S/MIME机制、TLS机制、IPsec等机制都已经被开发并且使用。而HTTP摘要认证对SIP协议的兼容性最好的,所以该机制是SIP协议的缺省安全认证机制,所取得的主要研究成果为:1.简要介绍了3G的发展历史,详细介绍了IMS系统的结构。然后对SIP协议进行了重点分析和研究。研究了其目前的研究状态、研究成果,详细分析了其可能面临的主要攻击等。2.对SIP安全问题进行全面分析之后,本文针对与其在安全方面配合良好的HTTP摘要认证进行研究和分析,并且与其他的安全机制进行比较,例如S/MIME机制、TLS机制等。分析结果表明该机制非常容易受到例如服务器攻击、密码离线猜测攻击、重放攻击等非法攻击。3.针对传统HTTP摘要认证的缺陷,国内有人提出了双向的HTTP摘要认证,本文对该双向的认证方式进行分析研究,并在此基础上提出了一种改进的双向的HTTP摘要认证——sHTTP摘要认证。同时,本文结合服务器伪装攻击、重放攻击、注册劫持攻击以及离线猜测这四种攻击的攻击方式和攻击强度,来分析三种摘要认证的优缺点并且进行相互之间的对比。分析结果表明本文所提出的sHTTP摘要认证能够很好地防御这四种攻击。4.本文基于sHTTP摘要认证,对SIP呼叫过程进行了改进,并且对该改进的SIP呼叫过程进行安全性分析,其中分别分析了会话密匙Key、Hash算法和AES加密算法。最后,本文在实验室利用FETCH消息构造了通信函数并且在服务器、交换机等设备上模拟实现了该SIP会话通信。
[Abstract]:With the rapid development of modern mobile technology, the 3G technology has been commercialized in the global scope and replaced the original mobile communication technology. 3G technology has many advantages, such as fast communication speed, strong network performance. Business load bearing capacity is strong, and so on. Therefore, the application of 3G technology has brought unprecedented changes to people's lives and played an unimaginable role. IMS is the core part of 3G network, and the communication network includes access layer and transmission layer. Both the control layer and the application layer need to be controlled and interacted through IMS. In IMS, session initiation protocol (SIP) is an important signaling control protocol. This protocol controls the IMS subsystem to create, modify, and terminate one or more sessions. At the same time, due to the important role of the protocol and its flexible, simple, open, good compatibility and other characteristics, the protocol has become the standard protocol of session control protocol. Using SIP protocol, users can experience new services such as instant messaging, online state and so on. Although SIP protocol has been widely used, there are still many security problems. Based on this, HTTP digest authentication / S / mime mechanism, TLS mechanism and IPsec mechanism have been developed and used. However, HTTP digest authentication has the best compatibility with SIP protocol, so this mechanism is the default security authentication mechanism of SIP protocol. The main research results are: 1: 1. The development history of 3G is briefly introduced, and the structure of IMS system is introduced in detail. Then the SIP protocol is analyzed and researched. This paper studies its current research status, research results, and analyzes in detail the main attacks it may face. 2. 2. After a comprehensive analysis of SIP security issues, this paper studies and analyzes HTTP digest authentication which works well with SIP security, and compares with other security mechanisms, such as Sr mime mechanism and TLS mechanism. The analysis results show that the mechanism is vulnerable to such illegal attacks as server attack, password offline guessing attack, replay attack and so on. In view of the defects of traditional HTTP digest authentication, some people in our country have proposed a bidirectional HTTP digest authentication. This paper analyzes and researches the bidirectional authentication method, and proposes an improved bi-directional HTTP digest authentication, sHTTP digest authentication. At the same time, combined with server camouflage attack, replay attack, register hijack attack and off-line guess attack, this paper analyzes the advantages and disadvantages of the three kinds of digest authentication and compares them with each other. The analysis results show that the sHTTP digest authentication proposed in this paper can protect against these four attacks. 4. 4. In this paper, the SIP call process is improved based on sHTTP digest authentication, and the security of the improved SIP call process is analyzed, in which the session key Hash algorithm and AES encryption algorithm are analyzed respectively. Finally, this paper constructs a communication function using fetch messages in the laboratory and simulates the SIP session communication on servers, switches and other devices.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN929.53

【相似文献】