Tài liệu Practical voip security

  • Số trang: 592 |
  • Loại file: PDF |
  • Lượt xem: 262 |
  • Lượt tải: 0
hoanggiang80

Đã đăng 20010 tài liệu

Mô tả:

Practical VoIP Security
Register for Free Membership to solutions@syngress.com Over the last few years, Syngress has published many best-selling and critically acclaimed books, including Tom Shinder’s Configuring ISA Server 2004, Brian Caswell and Jay Beale’s Snort 2.1 Intrusion Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal Packet Sniffing. One of the reasons for the success of these books has been our unique solutions@syngress.com program. Through this site, we’ve been able to provide readers a real time extension to the printed book. As a registered owner of this book, you will qualify for free access to our members-only solutions@syngress.com program. Once you have registered, you will enjoy several benefits, including: ■ Four downloadable e-booklets on topics related to the book. Each booklet is approximately 20-30 pages in Adobe PDF format. They have been selected by our editors from other best-selling Syngress books as providing topic coverage that is directly related to the coverage in this book. ■ A comprehensive FAQ page that consolidates all of the key points of this book into an easy-to-search web page, providing you with the concise, easy-to-access data you need to perform your job. ■ A “From the Author” Forum that allows the authors of this book to post timely updates and links to related sites, or additional topic coverage that may have been requested by readers. Just visit us at www.syngress.com/solutions and follow the simple registration process. You will need to have this book with you when you register. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there is anything else we can do to make your job easier. Practical VoIP Security Thomas Porter Jan Kanclirz Andy Zmolek Antonio Rosela Michael Cross Larry Chaffin Brian Baskin Choon Shim Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Syngress Publishing, Inc. “Syngress:The Definition of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 002 003 004 005 006 007 008 009 010 HJIRTCV764 PO9873D5FG 829KM8NJH2 BNNERHJC7B CVPLQ6WQ23 VBP965T5T5 HJJJ863WD3E 2987GVTWMK 629MP5SDJT IMWQ295T6T PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Practical VoIP Security Copyright © 2006 by Syngress Publishing, Inc. All rights reserved. Printed in Canada. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in Canada 1 2 3 4 5 6 7 8 9 0 ISBN: 1597490601 Publisher: Andrew Williams Acquisitions Editor: Gary Byrne Cover Designer: Michael Kavish Technical Editors: Andy Zmolek,Thomas Porter, and Stephen Watkins Page Layout and Art: Patricia Lupien Copy Editor: Adrienne Rebello and Mike McGee Indexer: Julie Kawabata Distributed by O’Reilly Media, Inc. in the United States and Canada. or information on rights, translations, and bulk sales, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email matt@syngress.com or fax to 781-681-3585. Acknowledgments Syngress would like to acknowledge the following people for their kindness and support in making this book possible. Syngress books are now distributed in the United States and Canada by O’Reilly Media, Inc.The enthusiasm and work ethic at O’Reilly are incredible, and we would like to thank everyone there for their time and efforts to bring Syngress books to market:Tim O’Reilly, Laura Baldwin, Mark Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol Matsutaro, Mark Wilson, Rick Brown,Tim Hinton, Kyle Hart, Sara Winge, Peter Pardo, Leslie Crandell, Regina Aggio Wilkinson, Pascal Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen, Betsy Waliszewski, Kathryn Barrett, John Chodacki, Rob Bullington, Kerry Beck, Karen Montgomery, and Patrick Dirden. The incredibly hardworking team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran, Emma Wyatt, Krista Leppiko, Marcel Koppes, Judy Chappell, Radek Janousek, Rosie Moss, David Lockley, Nicola Haden, Bill Kennedy, Martina Morris, Kai Wuerfl-Davidek, Christiane Leipersberger,Yvonne Grueneklee, Nadia Balavoine, and Chris Reinders for making certain that our vision remains worldwide in scope. David Buckland, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, Joseph Chan, June Lim, and Siti Zuraidah Ahmad of Pansing Distributors for the enthusiasm with which they receive our books. David Scott, Tricia Wilden, Marilla Burgess, Annette Scott, Andrew Swaffer, Stephen O’Donoghue, Bec Lowe, Mark Langley, and Anyo Geddes of Woodslane for distributing our books throughout Australia, New Zealand, Papua New Guinea, Fiji,Tonga, Solomon Islands, and the Cook Islands. v Lead Author and Technical Editor Thomas Porter, Ph.D. (CISSP, IAM, CCNP, CCDA, CCNA, ACE, CCSA, CCSE, and MCSE) is the Lead Security Architect in Avaya’s Consulting & Systems Integration Practice. He also serves as Director of Network Security for the FIFA World Cup 2006. Porter has spent over 10 years in the networking and security industry as a consultant, speaker, and developer of security tools. Porter’s current technical interests include VoIP security, development of embedded microcontroller and FPGA Ethernet tools, and H.323/SIP vulnerability test environments. He is a member of the IEEE and OASIS (Organization for the Advancement of Structured Information Standards). Porter recently published Foundation articles for SecurityFocus titled “H.323 Mediated Voice over IP: Protocols, Vulnerabilities, and Remediation”; and “Perils of Deep Packet Inspection.” Tom lives in Chapel Hill, North Carolina, with his wife, Kinga, an Asst. Professor of Internal Medicine at the University of North Carolina, and two Chesapeake Bay retrievers. vii Contributing Authors Brian Baskin (MCP, CTT+) is a researcher and developer for Computer Sciences Corporation, on contract to the Defense Cyber Crime Center’s (DC3) Computer Investigations Training Program (DCITP). Here, he researches, develops, and instructs computer forensic courses for members of the military and law enforcement. Brian currently specializes in Linux/Solaris intrusion investigations, as well as investigations of various network applications. He has designed and implemented networks to be used in scenarios, and has also exercised penetration testing procedures. Brian has been instructing courses for six years, including presentations at the annual DoD Cyber Crime Conference. He is an avid amateur programmer in many languages, beginning when his father purchased QuickC for him when he was 11, and has geared much of his life around the implementations of technology. He has also been an avid Linux user since 1994 and enjoys a relaxing terminal screen whenever he can. He has worked in networking environments for over 10 years from small Novell networks to large, mission-critical, Windows-based networks. Brian lives in the Baltimore, MD, area with his lovely wife and son. He is also the founder and president of the Lightning Owners of Maryland car club. Brian is a motor sports enthusiast and spends much of his time building and racing his vehicles. He attributes a great deal of his success to his parents, who relinquished their household 80286 PC to him at a young age and allowed him the freedom to explore technology. Brian cowrote Chapter 8. Joshua Brashars is a security researcher for the External Threat Assessment Team at Secure Science Corporation. Before that, Joshua spent many years in the telecommunications industry as an imple- viii mentation consultant for traditional and VoIP PBX systems. Joshua would like to extend heartfelt thanks to his family, friends, Lance James and SSC, Johnny Long and all of johnny.ihackstuff.com, and a special nod to Natas, Strom Carlson, and lucky225 for fueling the fire in his passion for telephone systems. Joshua contributed to Chapter 3. Larry Chaffin (CISSP, PMP, JNCIE, MBCP, CWNP, NNCSE, NNCDE, CCNP, CCDP, CCNP-WAN, CCDP-WAN) is the CEO/Chairman of Pluto Networks and the Vice President of Advanced Network Technologies for Plannet Group. He is an accomplished author; he cowrote Managing Cisco Network Security (ISBN: 1-931836-56-6) and has also been a coauthor/ghost writer for 11 other technology books for VoIP, WLAN, security, and optical technologies. Larry has more than 29 vendor certifications such as the ones already listed, plus Cisco VoIP, Optical, Security, VPN, IDS, Unity, and WLAN. He is also certified by Nortel in DMS Carrier Class Switches along with CS100’S, MCS5100, Call Pilot, and WLAN. Many other certifications come from vendors such as Avaya, HP, IBM, Microsoft, PeopleSoft, and VMware. Larry has been a Principal Architect around the world in 22 countries for many Fortune 100 companies designing VoIP, Security, WLAN, and optical networks. His next project is to write a book on Nortel VoIP and a new security architecture book he has designed for VoIP and WLAN networks. Larry cowrote Chapter 7. Michael Cross (MCSE, MCP+I, CNA, Network+) is an Internet Specialist/Computer Forensic Analyst with the Niagara Regional Police Service (NRPS). He performs computer forensic examinations on computers involved in criminal investigation. He also has consulted and assisted in cases dealing with computerrelated/Internet crimes. In addition to designing and maintaining the NRPS Web site at www.nrps.com and the NRPS intranet, he ix has provided support in the areas of programming, hardware, and network administration. As part of an information technology team that provides support to a user base of more than 800 civilian and uniform users, he has a theory that when the users carry guns, you tend to be more motivated in solving their problems. Michael also owns KnightWare (www.knightware.ca), which provides computer-related services such as Web page design, and Bookworms (www.bookworms.ca), where you can purchase collectibles and other interesting items online. He has been a freelance writer for several years, and he has been published more than three dozen times in numerous books and anthologies. He currently resides in St. Catharines, Ontario, Canada, with his lovely wife, Jennifer, his darling daughter, Sara, and charming son, Jason. Michael wrote Chapter 6. Bradley Dunsmore (CCNP, CCDP, CCSP, INFOSEC, MCSE+I, MCDBA) is a Software/QA engineer for the Voice Technology Group at Cisco Systems Inc. He is part of the Golden Bridge solution test team for IPT based in RTP, NC. His responsibilities include the design, deployment, testing, and troubleshooting of Cisco’s enterprise voice portfolio. His focus area is the integration of Cisco’s network security product line in an enterprise voice environment. Bradley has been working with Cisco’s network security product line for four years and he is currently working on his CCIE lab for Security. Prior to his six years at Cisco, Bradley worked for Adtran, Bell Atlantic, and as a network integrator in Virginia Beach, Va. Bradley has authored, co-authored, or edited several books for Syngress Publishing and Cisco Press for network security, telecommunication, and general networking. He would like to thank his fiancée, Amanda, for her unwavering support in everything that he does. Her support makes all of this possible. Bradley contributed to Chapter 8. x Jan Kanclirz Jr. (CCIE #12136-Security, CCSP, CCNP, CCIP, CCNA, CCDA, INFOSEC Professional, Cisco WLAN Support/Design Specialist) is currently a Senior Network Information Security Architect at IBM Global Services. Jan specializes in multivendor designs and post-sale implementations for several technologies such as VPNs, IPS/IDS, LAN/WAN, firewalls, content networking, wireless and VoIP. Beyond network designs and engineering Jan’s background includes extensive experience with open source applications and Linux. Jan has contributed to Managing and Securing Cisco SWAN (ISBN: 1-932266-91-7), a Syngress publication. In addition to Jan’s full-time position at IBM G.S., Jan runs a security portal, www.MakeSecure.com, where he dedicates his time to security awareness and consulting. Jan lives with his girl friend, Amy, and her daughter, Abby, in Colorado, where they enjoy outdoor adventures. Jan wrote Chapter 2. Tony Rosela (PMP, CTT+) is a Senior Member Technical Staff with Computer Sciences Corporation working in the development and delivery of technical instructional material. He provides leadership through knowledge and experience with the operational fundamentals of PSTN architecture and how the PSTN has evolved to deliver high-quality services, including VoIP. His other specialties include IP enabling voice networks, WAN voice and data network design, implementation and troubleshooting, as well as spending a great deal of time in the field of computer forensics and data analysis. Tony cowrote Chapter 4. Mark Spencer founded Linux Support Services in 1999 while still a Computer Engineering student at Auburn University. When faced with the high cost of buying a PBX, Mark simply used his Linux PC and knowledge of C code to write his own.This was the beginning of the worldwide phenomenon known as Asterisk, the open xi source PBX, and caused Mark to shift his business focus from Linux support to supporting Asterisk and opening up the telecom market. Linux Support Services is now known as Digium, and is bringing open source to the telecom market while gaining a foothold in the telecom industry. Mark strongly believes that every technology he creates should be given back to the community.This is why Asterisk is fully open source.Today, that model has allowed Asterisk to remain available free of charge, while it has become as robust as the leading and most expensive PBXs. The Asterisk community has ambassadors and contributors from every corner of the globe. Recently Mark was named by Network World as one of the 50 Most Powerful People in Networking, next to Cisco’s John Chambers, Microsoft’s Bill Gates, and Oracle’s Larry Ellison. A renowned speaker, Mark has presented and delivered keynotes at a number of industry conferences, including Internet Telephony, SuperComm, and the VON shows. Mark holds a degree in Computer Engineering from Auburn University, and is now president of Digium, Inc. He has also led the creation of several Linux-based open source applications, most notably Asterisk, the Open Source PBX, and Gaim Instant Messenger. Mark wrote the IAX section of Chapter 7. Choon Shim is responsible for the Qovia’s technology direction and development of the Qovia product line. Choon was previously President at Widearea Data Systems, where he designed and developed collaboration platform software. Prior to joining Widearea Data Systems, he was the Senior Development Manager and Principal Engineer for Merant. Choon is a successful technology leader with 20+ years’ experience architecting, building, and delivering large-scale infrastructure software products. He has extensive hands-on technical development skills and has successfully managed software teams for well-known xii enterprise software companies, including BMC Software and EMC Corporation. Choon is the author of Community Works and Express/OS shareware used widely throughout the world. He is a frequent speaker at VoIP and networking conferences for academic and industry. He recently gave a keynote speech to SNPD conference and chaired VoIP Security Panel at Supercomm05. Choon holds a B.S. in Computer Science from Kyoungpook National University and an M.S in Electrical Engineering from the University of Wisconsin. Choon wrote Chapters 14 and 16. Stephen Watkins (CISSP) is an Information Security Professional with more than 10 years of relevant technology experience, devoting eight of these years to the security field. He currently serves as Information Assurance Analyst at Regent University in southeastern Virginia. Before coming to Regent, he led a team of security professionals providing in-depth analysis for a global-scale government network. Over the last eight years, he has cultivated his expertise with regard to perimeter security and multilevel security architecture. His Check Point experience dates back to 1998 with FireWall-1 version 3.0b. He has earned his B.S. in Computer Science from Old Dominion University and M.S. in Computer Science, with Concentration in Infosec, from James Madison University. He is nearly a life-long resident of Virginia Beach, where he and his family remain active in their church and the local Little League. Stephen was the technical editor for Chapter 15. Andy Zmolek is Senior Manager, Security Planning and Strategy at Avaya. In that role, Andy drives product security architecture and strategy across Avaya’s voice and data communications products. Previously at Avaya, he helped launch the Avaya Enterprise Security Practice, led several Sarbanes-Oxley-related security projects within Avaya IT, and represented Avaya in standards bodies (IETF, W3C) as xiii part of the Avaya CTO Standards Group. Avaya Inc. designs, builds and manages communications networks for more than one million businesses worldwide, including over 90 percent of the FORTUNE 500®. Andy has been involved with network security for over a decade, and is an expert on Session Initiation Protocol (SIP) and related VoIP standards, Presence systems, and firewall traversal for VoIP. He holds a degree in Mathematics from Brigham Young University and is NSA IAM certified. Prior to joining Avaya, he directed network architecture and operations at New Era of Networks, a pioneer of enterprise application integration (EAI) technology, now a division of Sybase. Andy got his start in the industry as a systems architect responsible for the design and operation of secure real-time simulation networks for missile and satellite programs at Raytheon, primarily with the Tomahawk program. Andy wrote Chapter 15, cowrote Chapters 3 and 4, and was a technical editor for several chapters. xiv Contents Chapter 1 Introduction to VoIP Security . . . . . . . . . . . . . 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 The Switch Leaves the Basement . . . . . . . . . . . . . . . . . . . . .4 What Is VoIP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 VoIP Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 VoIP Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 VoIP Isn’t Just Another Data Protocol . . . . . . . . . . . . . . . . .10 Security Issues in Converged Networks . . . . . . . . . . . . . . . .13 VoIP Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 A New Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .21 Chapter 2 Asterisk Configuration and Features . . . . . . 23 Introduction: What Are We Trying to Accomplish? . . . . . . . .24 What Functions Does a Typical PBX Perform? . . . . . . . . . . .24 PBX Administration . . . . . . . . . . . . . . . . . . . . . . . . . . .27 Asterisk Gateway Interface (AGI) . . . . . . . . . . . . . . .27 Asterisk Manager API . . . . . . . . . . . . . . . . . . . . . . . .27 Dial Plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28 Numbering Plans . . . . . . . . . . . . . . . . . . . . . . . . . . .29 Choosing a Numbering Scale for Your Private Numbering Plan . . . . . . . . . . .31 Extensions Based on DID . . . . . . . . . . . . . . . . . . . . .33 Dialing Plan and Asterisk PBX . . . . . . . . . . . . . . . . .34 Billing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Billing Accounting with Asterisk PBX System . . . . . .35 Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38 xv xvi Contents Time-of-Day Routing . . . . . . . . . . . . . . . . . . . . . . .39 Day-of-Week Routing . . . . . . . . . . . . . . . . . . . . . . .39 Source Number Routing . . . . . . . . . . . . . . . . . . . . .39 Cost-Savings Routing . . . . . . . . . . . . . . . . . . . . . . . .39 Disaster Routing . . . . . . . . . . . . . . . . . . . . . . . . . . .39 Skill-Based Routing . . . . . . . . . . . . . . . . . . . . . . . . .40 DUNDi Routing Protocol . . . . . . . . . . . . . . . . . . . .40 Other Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40 Music on Hold . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41 Call Parking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41 Call Pickup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42 Call Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43 Conferencing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43 Direct Inward System Access . . . . . . . . . . . . . . . . . . .45 Unattended Transfer (or Blind Transfer) . . . . . . . . . . .46 Attended Transfer (or Consultative Transfer) . . . . . . .46 Consultation Hold . . . . . . . . . . . . . . . . . . . . . . . . . .46 No Answer Call Forwarding . . . . . . . . . . . . . . . . . . .46 Busy Call Forwarding . . . . . . . . . . . . . . . . . . . . . . . .46 Do Not Disturb (DND) . . . . . . . . . . . . . . . . . . . . . .47 Three-Way Calling . . . . . . . . . . . . . . . . . . . . . . . . . .48 Find-Me . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48 Call-Waiting Indication . . . . . . . . . . . . . . . . . . . . . .49 Voice Mail and Asterisk PBX . . . . . . . . . . . . . . . . . . . . . . .49 How Is VoIP Different from Private Telephone Networks? . .51 Circuit-Switched and Packet-Routed Networks Compared . . . . . . . . . . . . . . .51 What Functionality Is Gained, Degraded, or Enhanced on VoIP Networks? . . . . . . . . . . . .52 Gained Functionality . . . . . . . . . . . . . . . . . . . . . . . .52 Degraded Functionality . . . . . . . . . . . . . . . . . . . . . .54 Enhanced Functionality . . . . . . . . . . . . . . . . . . . . . .55 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .58 Contents Chapter 3 The Hardware Infrastructure . . . . . . . . . . . . 59 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 Traditional PBX Systems . . . . . . . . . . . . . . . . . . . . . . . . . . .61 PBX Lines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 PBX Trunks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 PBX Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 PBX Adjunct Servers . . . . . . . . . . . . . . . . . . . . . . . . . . .68 Voice Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . .69 Interactive Voice Response Servers . . . . . . . . . . . . . .70 Wireless PBX Solutions . . . . . . . . . . . . . . . . . . . . . . . . .71 Other PBX Solutions . . . . . . . . . . . . . . . . . . . . . . . . . .71 PBX Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71 VoIP Telephony and Infrastructure . . . . . . . . . . . . . . . . . . . .72 Media Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72 Interactive Media Service: Media Servers . . . . . . . . . .73 Call or Resource Control: Media Servers . . . . . . . . . .73 Media Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . .75 Firewalls and Application-Layer Gateways . . . . . . . . .75 Application Proxies . . . . . . . . . . . . . . . . . . . . . . . . . .76 Endpoints (User Agents) . . . . . . . . . . . . . . . . . . . . . .76 IP Switches and Routers . . . . . . . . . . . . . . . . . . . . . . . .80 Wireless Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . .80 Wireless Encryption: WEP . . . . . . . . . . . . . . . . . . . .80 Wireless Encryption: WPA2 . . . . . . . . . . . . . . . . . . .81 Authentication: 802.1x . . . . . . . . . . . . . . . . . . . . . . .82 Power-Supply Infrastructure . . . . . . . . . . . . . . . . . . . . .83 Power-over-Ethernet (IEEE 802.3af ) . . . . . . . . . . . .84 UPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84 Energy and Heat Budget Considerations . . . . . . . . . .85 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .88 Chapter 4 PSTN Architecture . . . . . . . . . . . . . . . . . . . . . 91 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92 PSTN: What Is It, and How Does It Work? . . . . . . . . . . . . .92 PSTN: Outside Plant . . . . . . . . . . . . . . . . . . . . . . . . . .93 xvii xviii Contents PSTN: Signal Transmission . . . . . . . . . . . . . . . . . . . . . .95 T1 Transmission: Digital Time Division Multiplexing 96 PSTN: Switching and Signaling . . . . . . . . . . . . . . . . . .102 The Intelligent Network (IN), Private Integrated Services, ISDN, and QSIG . . . . . .105 ITU-T Signaling System Number 7 (SS7) . . . . . . . .106 PSTN: Operational and Regulatory Issues . . . . . . . . . .110 PSTN Call Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111 PSTN Protocol Security . . . . . . . . . . . . . . . . . . . . . . . . .114 SS7 and Other ITU-T Signaling Security . . . . . . . . . . .114 ISUP and QSIG Security . . . . . . . . . . . . . . . . . . . .117 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .120 Chapter 5 H.323 Architecture . . . . . . . . . . . . . . . . . . . 123 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124 The H.323 Protocol Specification . . . . . . . . . . . . . . . . . .124 The Primary H.323 VoIP-Related Protocols . . . . . . . . . . .126 H.225/Q.931 Call Signaling . . . . . . . . . . . . . . . . . . . .129 H.245 Call Control Messages . . . . . . . . . . . . . . . . . . . .134 Real-Time Transport Protocol . . . . . . . . . . . . . . . . . . .136 H.235 Security Mechanisms . . . . . . . . . . . . . . . . . . . . . . .137 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .143 Chapter 6 SIP Architecture. . . . . . . . . . . . . . . . . . . . . . 145 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .146 Understanding SIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .146 Overview of SIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147 RFC 2543 / RFC 3261 . . . . . . . . . . . . . . . . . . . . .148 SIP and Mbone . . . . . . . . . . . . . . . . . . . . . . . . . . .149 OSI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .149 SIP Functions and Features . . . . . . . . . . . . . . . . . . . . . . . .152 User Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152 User Availability . . . . . . . . . . . . . . . . . . . . . . . . . . .153 Contents User Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . .153 Session Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153 Session Management . . . . . . . . . . . . . . . . . . . . . . . .153 SIP URIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154 SIP Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154 SIP Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155 User Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155 SIP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155 Stateful versus Stateless . . . . . . . . . . . . . . . . . . . . . .157 Location Service . . . . . . . . . . . . . . . . . . . . . . . . . . .157 Client/Server versus Peer-to-Peer Architecture . . . . . . .158 Client/Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158 Peer to Peer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159 SIP Requests and Responses . . . . . . . . . . . . . . . . . . . .159 Protocols Used with SIP . . . . . . . . . . . . . . . . . . . . . . .162 UDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 Transport Layer Security . . . . . . . . . . . . . . . . . . . . .164 Other Protocols Used by SIP . . . . . . . . . . . . . . . . .165 Understanding SIP’s Architecture . . . . . . . . . . . . . . . . .168 SIP Registration . . . . . . . . . . . . . . . . . . . . . . . . . . .169 Requests through Proxy Servers . . . . . . . . . . . . . . .169 Requests through Redirect Servers . . . . . . . . . . . . .170 Peer to Peer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171 Instant Messaging and SIMPLE . . . . . . . . . . . . . . . . . . . . .172 Instant Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . .172 SIMPLE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .180 Chapter 7 Other VoIP Communication Architectures . 183 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184 Skype . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185 Skype Protocol Design . . . . . . . . . . . . . . . . . . . . . . . .186 Skype Messaging Sequence . . . . . . . . . . . . . . . . . . . . . . . .186 Skype Protocol Security . . . . . . . . . . . . . . . . . . . . . . .189 xix xx Contents H.248 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190 H.248 Protocol Design . . . . . . . . . . . . . . . . . . . . . . . .191 H.248 Messaging Sequence . . . . . . . . . . . . . . . . . . . . . . . .193 H.248 Protocol Security . . . . . . . . . . . . . . . . . . . . . . .194 IAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195 IAX Protocol Design . . . . . . . . . . . . . . . . . . . . . . . . . .195 IAX Messaging Sequence . . . . . . . . . . . . . . . . . . . . . . . . .195 IAX Protocol Security . . . . . . . . . . . . . . . . . . . . . . . . .197 Microsoft Live Communication Server 2005 . . . . . . . . . . .197 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 MLCS Protocol Design . . . . . . . . . . . . . . . . . . . . . . . .199 MLCS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .203 Chapter 8 Support Protocols . . . . . . . . . . . . . . . . . . . . 205 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206 DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206 DNS Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . .207 Fully Qualified Domain Name (FQDN) . . . . . . . . .208 DNS Client Operation . . . . . . . . . . . . . . . . . . . . . .209 DNS Server Operation . . . . . . . . . . . . . . . . . . . . . .211 Security Implications for DNS . . . . . . . . . . . . . . . . . . .212 TFTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212 TFTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213 TFTP File Transfer Operation . . . . . . . . . . . . . . . . .214 Security Implications for TFTP . . . . . . . . . . . . . . . . . .215 HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216 HTTP Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216 HTTP Client Request . . . . . . . . . . . . . . . . . . . . . .217 HTTP Server Response . . . . . . . . . . . . . . . . . . . . .217 Security Implications for HTTP . . . . . . . . . . . . . . . . .218 SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219 SNMP Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . .219 SNMP Operation . . . . . . . . . . . . . . . . . . . . . . . . . .220
- Xem thêm -