Secure Multicast Conferencing
Download as PPT, PDF0 likes775 views
The document discusses securing multicast conferencing. It describes how multicast conferencing involves sharing audio, video and whiteboards but securing it is challenging due to the need to share keys between group members. It proposes using session descriptions distributed via secure means like S/MIME email or TLS-protected web servers to distribute security parameters to authorized members to enable secure multicast conferencing. New techniques are still needed to allow for encrypted data to be processed by intermediate nodes like proxies without revealing security keys.
Secure Multicast Conferencing
- 1. Secure multicast conferencing Peter Kirstein, Ian Brown and Edmund Whelan University College London IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL
- 2. Video IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Multicast conferencing involves... Audio Shared whiteboard
- 3. Confidentiality: only authorised conference members can access conference data Integrity: you can be sure data has not been altered in transit Authentication: of conference announcers and participants IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Security provides...
- 4. Each link is secured using a standard communications security protocol: IPSEC, SSL/TLS, SSH Extremely wasteful of bandwidth Multipoint control units are security risks IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Point-to-point conferencing security is easy...
- 5. Multicast doesn’t fit the “point-to-point” model of current security protocols There is no standard method of sharing keys between group members IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL But multicast is more tricky...
- 6. Use Real-time Transport Protocol (RTP) to send data Users announce conferences and invite users by sending a session invitation via e-mail, the Session Announcement or Session Invitation Protocols IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Insecure conferences
- 7. RTP allows data to be encrypted with DES - implemented in UCL’s tools We want to move to IPSEC to remove need for cryptographic code in applications and take advantage of its wide range of ciphersuites and protocol and implementation security IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Secure transport
- 8. Now standardised by IETF (RFC 2411) Provides network-layer protection for all packets sent between compatible machines Not yet finished for multicast IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL IP security extensions
- 9. The Internet Key Exchange (IKE) allows two hosts to negotiate security parameters for an IPSEC connection But multicast IKE is much harder, and being investigated by the IRTF IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Key distribution problem
- 10. We use secure session invitations to distribute security parameters Sent using secure SAP, SIP, or e-mail (S/MIME) or retrieved via the World Wide Web (TLS) IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Conferencing solution
- 11. Session descriptions are stored on a secure Web server Authorised conference members can retrieve descriptions over a TLS link IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Web distribution
- 12. Users don’t like having to remember many long passphrases Mobile users need access to keys from many different systems Software keys are vulnerable to theft Smartcards alleviate all these problems IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Smartcards
- 13. In-network code can reduce bandwidth requirements, convert between coding schemes, provide multicast connectivity, etc. etc. IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Active services
- 14. You can give proxies the session keys needed for them to access and process data We are developing proxies that can work without this security risk IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Processing encrypted data
- 15. Multicast conference data can be secured at the network or application layer Until multicast key distribution is standardised, lightweight methods based on session descriptions can be used New techniques are needed to allow in-network processing of encrypted data IDC’99, Madrid 23 Sept. 1999 Ian Brown, UCL Conclusions
Editor's Notes
- #2: 2