SIP security

SIP security is a vast and somewhat challenging field.

• Authentication: Can users steal other users identity?
• Integrity: Is the SIP message received the same as the one sent?
• Confidentiality: Is someone else listening on your SIP call setup?
• Privacy
• Non-repudiation: Making sure we can trace callers

In addition, the RTP media stream, the actual conversation audio, may need to be confidential.

Client security

• Replay

Server security

• Denial of service attacks

IETF RFCs

• RFC 3329 Security Mechanism Agreement for the Session Initiation Protocol (SIP)
• RFC Draft SIP digest authentication relay attack

Additional Reading

Multimedia services using SIP face a range of challenges including traversing Firewalls which were never designed to be VoIP aware, exposing a publicly accessible address for a client which invited hacking and so on. Some of the basic issues surrounding SIP and security are examined.

PATTON Electronics whitepaper…

Ever wonder who eavesdrops on your VoIP conversations? Unencrypted VoIP compromises information security for companies that handle sensitive information and the carriers that serve them. This Patton white paper explains how you can make your Internet Telephony solution completely secure. Find out why VoIP-over-VPN technology is more expedient than emerging CODEC-based approaches such as SRTP and SIP TLS. You’ll also learn how Internet Key Exchange (IKE) simplifies VoIP installation at the same time it strengthens information security

See also

• Asterisk security
• Asterisk security through geographic IP address restriction
• Hacking Tools – How to install some hacking tools
• VOIP Consultants – VoIP Consultants who may provide security services or referrals outside their main line of business
• VOIP Security – VoIP Security Information
• VoIP Security Consultants – Consultants who offer various security services
• VoIP Security Training – Security Training Providers
• VoIP Security Vulnerabilities – Security Vulnerabilities that have been publicly disclosed in VoIP products
• VoIP Security Forum – Forum dedicated to VoIP security issues
• SIP Security discussion by OnSIP

• Back to SIP