Architecture for IMS Security to Mobile: Focusing on Artificial Immune System and Mobile Agents Integration
Total Page:16
File Type:pdf, Size:1020Kb
Master Thesis Computer Science Thesis no: MCS-2009:24 May 22nd 2009 Architecture for IMS Security to Mobile: Focusing on Artificial Immune System and Mobile Agents Integration . Author: Kalyani Chalamalsetty School of Computing Blekinge Institute of Technology Soft Center SE-37225 RONNEBY SWEDEN This thesis is submitted to the Department of Software Engineering and Computer Science, School of Engineering at Blekinge Institute of Technology in partial fulfillment of the requirements for the degree of Master of Science in Computer Science. The thesis is equivalent to 20 weeks of full time studies. Contact Information: Author(s): Kalyani Chalamalasetty E-mail: [email protected] Department of Software Engineering and Computer Science University advisor(s): Dr. Bengt CarlssonAssociate professor Email: [email protected] Department of Software Engineering and Computer Science Dr. Guohua Bai Assistant professor Email: [email protected] Department of Interaction and System Design School of Computing Blekinge Institute of Technology Soft Center SE-37225 RONNEBY SWEDEN ii ABSTRACT The IP Multimedia Subsystem (IMS) is an open IP based service infrastructure that enables an easy deployment of new rich multimedia services mixing voice and data. The IMS is an overlay network on top of IP that uses SIP as the primary signaling mechanism. As an emerging technology, the SIP standard will certainly be the target of Denial of Service (DoS) attacks and consequently IMS will also inherit this problem. The objective of proposed architecture for IMS is to cram the potential attacks and security threats to IP Multimedia Subsystem (IMS) and explore the security solutions developed by 3GPP. This research work incorporates the ideas of immune system and multiagent architecture that is capable of detecting, identifying and recovering from an attack. The proposed architecture protects IMS core components i.e. P-CSCF (Proxy- Call Session Control Function), I-CSCF (Interrogating-Call Session Control Function), S-CSCF (Serving Call Session Control Function) and HSS (Home Subscriber Server) from external and internal threats like eavesdropping, SQL injection and denial-of- service (DoS) attacks. In the first level i.e. CPU under normal load all incoming and out going messages were investigated to detect and prevent SQL injection. Second level considers Denial of Service (DOS) attacks when CPU load exceeds threshold limit. Proposed architecture is designed and evaluated by using an approach called Architecture Tradeoff Analysis Method (ATAM). The results obtained confirm consistency of the architecture. Keywords: IP Multimedia Subsystem (IMS), security threats, Denial of Service (DoS), SQL injection, immune system, Multiagent architecture. 1 CONTENTS ABSTRACT.............................................................................................................................................1 CONTENTS.............................................................................................................................................2 FIGURES.................................................................................................................................................4 TABLES...................................................................................................................................................5 ABBREVIATIONS…………………………………………………………………………………….6 ACKNOWLEDGEMENTS……………………………………………………………………………7 1. INTRODUCTION…………………………………………….……………………. ………………8 1.1Background……………………………………………………………………………………….8 1.2 Aims and objectives……………………………………………………………………...............9 1.3 Research questions………………………………………………………………………………..............9 1.4 Importance of study ………………………………………………………..................................9 1.5 Method/approach…..……………..…………………………………….....................................10 1.6 Audience………………………………………………………………......................................10 1.7 Limitation……………………………………………………………………….........................11 1.8 Motivation…………………………………………………………………................................11 1.9 My contribution …………………………………………………................................................11 1.10 Structure of thesis………………………………………………………………………………11 2. BACKGROUND…………………………………………………………………...........................13 2.1 3GPP standardization…………………………………………………………………………...13 2.2 An overview of IP multimedia subsystem ………………………..............................................14 2.2.1 Key protocols used in IMS network……………………………………………………...15 2.2.2 IMS interfaces/ reference points..………………………………………….…….............16 2.2.3 IMS functionality…………………………………………………………………............17 2.3 IMS security issues………………………………………………………….............................19 2.3.1 IMS attacks and threats………………………………………………………...………...20 2.3.2 Existing security solutions…………………………………………………….................22 2.4 What is not satisfied………………………………………………………………….………...23 2.5 Need of proposed architecture……………………….………………………………...............23 2.6 Biological model introduction……………………………………………………...….............24 2.6.1 Biological model discussion …………………….…………………………….................25 2.6.2 Overview of proposed architecture……………...………………………………………..26 3. PROPOSEDARCHITECTURE………………………..………………………………………...27 3.1 Introduction…………………………………………………………………………….............27 3.2 Security and vulnerability analysis………………………….....................................................27 3.2.1. Redirection attack……………………………………………………………..………...27 3.2.2 Active attacks in attacked networks………………………………………………..….............28 3.2.3 De-synchronization attack…………………………………………………..…………...28 3.3 Design requirements of proposed architecture………………...................................................28 3.4 Location of proposed architecture ………………………………..............................................29 3.5 Proposed architecture…………………………………………………......................................30 3.6 SQL injection- detection methodology……………………………………………..….............31 3.7 Register-flooding detection methodology……………………………………………………...32 3.8 Invite –flooding detection methodology……………………………………………….............33 3.9 Design scenarios of the proposed architecture…………………………………………. ……..33 3.9.1register flooding attack design scenario………………………………………....... …….33 3.9.2 Invite flooding attack design scenario…………...............................................................34 4 ARCHITECTURE EVALUTION...…………………….…………………………………............36 4.1 Benefits of evaluating with ATAM…………...…………….……………...…………………..36 4.2 About ATAM………………………………………………………………………….….…….36 4.3 Architectural evolution using ATAM……………………………………………………….….37 4.4 Results………………………………………………………………………………..................43 5 DISCUSSION……………………………………………………...……………………………......44 6 CONCLUSION AND FUTURE WORK……………………….…………………………............46 6.1 Addressing research questions and objectives………….………................................................46 2 6.2 Future work…………………………………………………………………………………….48 REFERENCES……...………………………………………………………………………...............49 3 FIGURES Figure 1: Research Methodology……….........................................................................................10 Figure 2: Evolution of 3GPP technologies [26]………….……………………………………..13 Figure 3: Open core IMS [21]...........................................................................................................14 Figure 4: IMS Registration [24] ……………….………………….……………………………..18 Figure 5: IMS session management [24]…………………………...……………………………19 Figure 6: INVITE flooding [32]…………………….......................................................................21 Figure 7: Register flooding attack [32]………………………………….………………………21 Figure 8: Session Tear down attack [30]……………………………….…………………….…22 Figure 9: CANCEL attack [30]…………………………………………………………………...22 Figure 10: Existing IMS Security Architecture [33]…………………..……………………….23 Figure 11: Dataflow architectural view of proposed architecture……...……….…………...26 Figure 12: Location of Proposed Architecture………………………………….........................29 Figure 13: Architecture for IMS Security to Mobile: Focusing on Artificial Immune system and Mobile Agents Integration……………………………………………….………….30 Figure 14: REGISTER flooding detection state chart…............................................................33 Figure 15: REGISTER flooding attack design scenario………………………………............34 Figure 16: INVITE flooding attack design scenario……………………………………..........35 4 TABLES Table 1: IMS Interfaces ……..…………………………………………………………………….17 Table2: Analogies between Immune system and proposed architecture…………….……..26 Table 3: Message format of attack alert ……………………………………………………..….33 Table 4: Presenting business drivers for the proposed architecture…………….……….….38 Table 5: Description of architectural approaches in proposed architecture………….…...39 Table 6: Tabular form of utility tree for proposed architecture ATAM evaluation……...41 Table 7: Brainstormed scenarios presented by evaluation team…….……………………....42 5 ABBREVIATIONS 3GPP- 3rd Generation Partnership Project AAA- Authentication, Authorization, and Accounting AIS- Artificial Immune Systems AKA- Authentication and Key Agreement protocol AMPS- Advanced Mobile Phone System ARIB- Association with Radio Industries and Business AS- Application Sever BGCF- Border Gateway Control Function CCSA- China Communications Standards Association CSCF- Call Session Control Function DDoS-Distributed Denial of Service DOS- Denial of Service ETSI- European Telecommunications Standard Institute GPRS- General Packet Radio