Realtime communication security - SIP, XMPP and others
6 likes2,035 views
The document discusses the security challenges of real-time communication, highlighting issues such as identity, confidentiality, integrity, and authorization. It addresses the lack of implementation and awareness regarding security in telecom systems, emphasizing the need for secure sessions. The author questions the general apathy towards real-time security and encourages a discussion on what constitutes a secure session.
Realtime communication security - SIP, XMPP and others
- 1. REALTIME COMMUNICATION SECURITY Olle E. Johansson * oej@edvina.net * Twitter oej Copyright Edvina AB, Sollentuna, Sweden 2011. All rights reserved.
- 2. From this...
- 3. to this
- 4. Talk Video Chat Application sharing 3D holographic 7.1 conferences
- 5. COMMUNICATION BETWEEN TWO OR MORE PEOPLE
- 6. OUT OF SCOPE TODAY. Tommy the system intruder Christina the network sniffer Adrian the BOT network manager
- 7. IN SCOPE You Me
- 8. WHAT IS THE PROBLEM? The usual security issues...
- 9. WHO’S TALKING? You Me Identity
- 10. WHO IS LISTENING? You Me 3rd party Confidentiality
- 11. DID YOU REALLY WRITE THAT? You Me Integrity
- 12. YOU CAN’T DO THAT. You Me Authorization
- 13. WHO AM I? IP Phone Pad Softphone Set-top-box Chat client Laptop Me Car Cell phone
- 14. THE SIP WORLD DATACOM TELECOM
- 15. NETWORK SECURITY You Me Our problem
- 16. TELECOM SECURITY MODEL You Me In the telco we trust.
- 17. END2END OR THROUGH PROXY SERVER? Do you want someone else to handle your keys? You Me Do you want to set up a secure session between you and me? If so, how?
- 18. THIS APPLIES TO MANY PROTOCOLS SIP RTCWEB XMPP ?
- 19. SIP SECURITY TLS DTLS/SRTP SIGNALLING MEDIA S/MIME SIP IDENTITY INTEGRITY HTTP DIGEST MSRP/TLS AUTH CHAT
- 20. ASTERISK 1.8 TLS ACLs SRTP SDES TLS very, very experimental
- 21. KAMAILIO SIP SERVER 3.1 TLS ACLs DOS prevention TLS very, very good!
- 22. WHAT’S THE ISSUE WITH REAL TIME SECURITY? No one asks for it. Therefore no one implements it. Which means lack of experience.
- 23. WHAT I DO NOT UNDERSTAND. Why does nobody care, really?
- 24. FINAL QUESTION: What’s a secure session for you?
- 25. H E L P. THANK YOU.