Session Initiation Protocol | SIP

General Description of SIP 
SIP (Session Initiation Protocol) is a standardized and standardized protocol IETF (described by RFC 3261, which obsoletes RFC 2543, and completed by the RFC 3265) which was designed to establish, modify and terminate multimedia sessions. It is responsible for Authentication and location of the multiple participants. It is also responsible for trading on the types of media used by different participants by encapsulating Posts SDP (Session Description Protocol).

SIP does not carry the exchanged data during the session such as voice or video. SIP is independent of the transmission of data, any type of data and protocols can be used for this exchange. However, the RTP (Real-time Transport Protocol) provides mostly audio and video sessions. SIP is gradually replacing H323. SIP is an open standard VoIP, interoperable, the largest and aims to become the multimedia telecommunications standard (sound, image, etc.).

Skype for example, using a proprietary format does not allow interoperability with other VoIP network and provides only pay gateways to standard telephones. SIP is not only meant for VoIP but for many other applications such as video telephony, instant messaging, virtual reality or even video games.

Operating Principle of SIP
Since SIP is chosen to do our work, we will deepen in explain different aspects, features that make SIP a good choice for the establishment of the session, the main features of SIP protocol are:

Attaching a SIP account
It is important to ensure that the called party is always available. For this, a SIP account is associated with a unique name. For example, if a user of a voice service IP has a SIP account and every time he restarts his computer, IP address changes, however it must always be reachable. SIP account must be associated with a SIP server (SIP proxy) whose IP address is fixed. This server will allocate an account for him and he will make or receive a few calls of location. This account will be identifiable through its name (or nickname).

Changing characteristics during a session 
A user should be able to change the characteristics of an active call. For example, a call initially configured (voice only) can be changed (voice + video).

Different modes of communication 
With SIP, users who log on can communicate point mode point in diffusive mode or a manual combination thereof.  Point-to-point mode: we speak in this case of 'unicast' which corresponds to the communication between two machines.  diffusive mode: we speak in this case of 'multicast' (multiple users via a control unit MCU - Multipoint Control Unit).  Combinatorics: combines the previous two modes. Multiple users interconnected multicast via a full mesh network connection.

Participant management 
During a call session, new participants can join participants an already open session by directly participating, being transferred or being set hold (this feature joins the features of a PBX for example, where the caller can be transferred to a given number or be put on hold).

Negotiation of supported media 
This allows a group during a call to negotiate on the types of supported media. For example, the video may or may not be supported in a session.

Addressing
Users with a number (account) SIP have an address like an email address (sip: numéro serveursip.com). The SIP number is unique for user.

Exchange Model 
SIP is based on a request / response model. The exchanges between a terminal calling and a called terminal are through queries. The list of requests exchanged is:

• Prompt: this request indicates that the application (or user) corresponding to the url SIP specified is invited to attend a session. The message body described this session (for eg media supported by the caller). In case of positive response, the guest must specify the media it supports.
• Ack: this request confirms that the calling terminal has received a response ultimately to a request Prompt. 
• Options: a proxy server able to contact the UAS (terminal) called, must meet Options to a request specifying its ability to contact the same terminal. 
• Bye: This query is used by the terminal of the called end indicate that it would to end the session. 
• Cancel: this request is sent by a terminal or a proxy server to annul a request not validated by a final answer, for example, if a machine was invited to participate in a session, and having accepted the invitation does not receive a request Ack, then it sends a request Cancel. 
• Register: This method is used by the client to save the address listed in URL TO by the server to which it is connected. 

Error Codes 
An answer to a query is characterized by a code and a pattern called respectively status code and reason sentence. A status code is an integer coded on 3 digits indicating a result after receiving a query. This result is explained by a sentence, textbased (UTF-8), explaining the reason for refusal or acceptance of the application. The status code is for the controller managing workplace SIP sessions and the reasons for programmers. There are six classes of responses and thus status codes, represented by the first digit:

• 1xx = Information - The application was received and continues to be treated. 
• 2xx = Success - The action was successfully received, understood and accepted. 
• 3xx = Redirection - Another action is needed to validate the request. 
•  4xx =Client Error - The request contains incorrect syntax or can not be handled by this server.
• 5xx = Server Error - The server failed to process a request apparently correct.
• 6xx = General failure - The application may be processed by any server.

Role of components
In a SIP system there are two types of components, user agents (UAS, UAC) and a network of servers (Registrar, Proxy) The UAS (User Agent Server) is the agent of the called party. It is a type application server that contacts the user when a SIP request is received. And returns a response name of the user. The UAC (User Agent Client) is the agent of the appellant.

This is an application of customer type that initiates requests. The Registrar is a server that manages the REGISTER requests sent by Users Agents to signal their current location. These requests therefore contain an IP address, associated to a URI, which will be stored in a database. SIP URIs are very similar in form to email addresses: sip: utilisateur domaine.com. Typically, authentication mechanisms allow to avoid that anyone can register with any URI. A SIP Proxy serves as the intermediary between User Agents that do not know their respective locations (IP address). Indeed, the URI-IP address association was stored beforehand in a database by a Registrar. The proxy can therefore question this database to direct messages to the recipient. The Proxy merely only relaying SIP messages to establish, monitor and terminate the session. Once the session data, such as a stream RTP for VoIP, do not pass through the proxy server. They are exchanged directly between the User Agents.

Advantages and disadvantages 
Open, standard, simple and flexible are the main advantages of SIP, here in detail these advantages:

• Open: the official protocols and documents are detailed and accessible to all in download. 
• Standard: IETF has standardized the protocol and its evolution continues with the creation or the evolution of other protocols that work with SIP. 
• Simple: SIP is simple and very similar to http.
• Flexible: SIP is also used for any type of multimedia sessions (voice, video, but also music, virtual reality, etc.). 
• Voice over public networks: there are many gateways (charges apply) to the public telephone network (PSTN, GSM, etc.) capable of transmitting or receiving voice calls. 
• Similarities with H323: using RTP and some codecs and sound video are shared. 

As against poor implementation or incomplete implementation of the protocol SIP User Agents in messing around or generate unnecessary traffic network. Another disadvantage is the low number of users: SIP is still little known and used by the general public, who have not reached a critical mass, it does not have the effect network.

Advantages and disadvantages of the H323 technology

The H.323 technology has advantages and disadvantages.

The advantages:

1. Managing Bandwidth: H.323 allows good management bandwidth setting limits in audio / video stream to ensure the proper functioning of critical applications on the LAN. Each H.323 terminal may proceed with the adjustment bandwidth and changing the flow based on network behavior real time (latency, packet loss and jitter). 
2. Support Multipoint: H.323 allows for multipoint conferencing via a structure centralized MCU (Multipoint Control Unit) or ad-hoc mode. 
3. Multicast support: H.323 also allows to make multicast transmissions.  Interoperability: H.323 allows users to not worry about how which is communication, the parameters (codecs, flow ...) are traded transparently. 
4. Flexibility: an H.323 conference can include heterogeneous terminals (Studio videoconferencing, PCs, phones ...) who can share as appropriate, to the voice of video and even data with T.120 specifications. 

The disadvantages of H.323 technology are:

1. The implementation complexity of the architecture and problems as regards the convergence of telephony and Internet services and a lack of modularity and flexibility. 
2. Includes many options that can be implemented in different ways by the manufacturers and therefore pose interoperability problems.

Role of the components in H.323

The infrastructure H.323 is based on four main components: terminals, Gateways, gatekeepers, and MCU (Multipoint Control Units).

H.323 terminals 
The terminal can be a computer, a telephone handset, a dedicated terminal for videoconferencing or fax over the Internet. The minimum imposed by H.323 is that implement the compression standard G.711 speech, it uses the H.245 protocol negotiating the opening of a channel and setting the communication parameters, and the Q.931 signaling protocol for establishing and stop communications. The terminal also has optional features, including, for group work and sharing of documents. There are two types of H.323 terminals, one of high quality (for use a LAN) and the other optimized for small bandwidths (28.8 / 33.6 kbit / s - G.723.1 and H.263).

Gateway or gateways to traditional networks (PSTN, ISDN, etc.) 
H.323 gateways provide interconnection with other networks, eg (H.320 / ISDN), H.324 modems, conventional telephones, etc. They ensure correspondence Q.931 signaling correspondence control signals and cohesion between the media (multiplexing, flow matching, audio transcoding).

Gatekeeper or gatekeepers 
In the H323 standard, The Gatekeeper is the entry point to the network for H.323 client. It defines an area on the network, called H.323 zone, grouping several terminals, Gateways and MCU it handles traffic, LAN routing, and the allocation of bandwidth. Customers or Gateway register with the Gatekeeper upon activation thereof, allowing them to find any other user through his fixed identifier obtained from its home Gatekeeper.

The Gatekeeper is to:

1. The translation H.323 aliases to IP addresses as specified RAS (Registration/Admission/Status);
2. Access control, banning users and non sessions authorized;
3. And managing bandwidth, allowing the administrator of the network limit the number of simultaneous video conferences. Specifically a fraction Bandwidth is allocated to videoconferencing to not disturb critical applications on the LAN, and support for multipoint conferences ad hoc.

MCU 
The MCs called MCU (Multipoint Control Unit) offer users to make video conferencing terminals and three more 'presence continuous 'or' voice activation '. An MCU consists of a Multipoint Controller (MC) to which is added one or more Multipoint Processors (MP). MC supports H.245 negotiations between all terminals to harmonize the audio and video settings each. It also controls the resources used. But the MC does not deal directly with streaming audio, video or data, the MP who will retrieve the flows and their make undergoing the required treatment. MC can control multiple MPs distributed on the network and part other MCU.

Protocole H.323

General description of H.323 
The H.323 standard provides, since its approval in 1996, a framework for communications audio, video and data over IP networks. It was developed by the ITU (International Telecommunications Union) for networks that do not guarantee quality service (QoS), such as IP IPX over Ethernet, Fast Ethernet and Token Ring. It is present in more than 30 products and it concerns call control, multimedia management, management bandwidth for point-to-point and multipoint conferences. H.323 also addresses interfacing between LAN and other networks. H.323 is part of the series deals H.32x videoconferencing through different networks. It includes H.320 and H.324 networks related to ISDN (Integrated Service Data Network) and PSTN (Public Switched Telephone Network).

More than one protocol, H.323 creates a combination of several different protocols and can be grouped into three categories: signaling, codec negotiation, and transporting information.

The signaling messages are those sent to request matchmaking two customers, which indicates that the line is busy or the phone rings, etc. In H.323 signaling is based on the RAS protocol for registration and authentication, and Q.931 protocol for initialization and call control.

Negotiation is used to agree on how to encode information to exchange. It is important that the phones (or systems) use language common if they want to understand. This is the least greedy band codec bandwidth or one that offers the best quality. It would also be preferable to have several alternative languages. The protocol used for codec negotiation is the H.245

The transport information is based on the RTP protocol that carries voice, video or scanned data by codecs. RTCP messages may be used for quality control, or renegotiation of codecs if, For example, the band bandwidth decreases.

H.323 communication takes place in five phases: the establishment of call, the exchange capacity and possible reservation of bandwidth through RSVP (Resource booking Protocol), the establishment of the audio-visual communication, the possible invocation of call phase services (eg, call transfer, change bandwidth, etc.) and finally the release of the call.

Introduction to Business VoIP Solution

In recent years, VoIP begins to attract businesses, especially those services such as call centers. The migration of companies to such technology is not for nothing. The purpose is primarily is: minimize the cost of communications; use the same network to deliver data, voice, and images; costs and simplify configuration and support. Many providers offer some solutions that enable companies to migrate to the IP world. PBX manufacturers such as Nortel, Siemens, and Alcatel prefer the gradual integration of VoIP solution by adding IP extension cards.

This approach facilitates the adoption of IP phone especially in large companies with a classic platform and wanting to take advantage of VoIP. But it does not enjoy all the services and the successful integration into the world of data. The development of PABXs software is the solution offered by vendors such Cisco and Asterisk. This approach allows to benefit from a flexible, very good integration in the world of data and voice, and especially a price much interesting.

 This solution, which is completely based on IP technology, is thus affected by the vulnerabilities that threaten the security of this protocol and network infrastructure on which it is deployed. The latter is the major problem for companies and a great challenge for developers. Some attacks on VoIP networks, such as denial of service attacks, identity theft can cause catastrophic losses and enormous for businesses. For this VoIP network security is not only a necessity but a obligation, which can be reduced with up, the risk of attacks on VoIP networks.

The security of a VoIP solution should cover the entire network infrastructure, including tools and communication management equipment and users, the system operating upon which these tools are installed, and the signaling protocols and data transport. It must even protect against attackers. Better one secures, there is less risk. This work aims to: the study of VoIP protocols and available architectures; the study of security vulnerabilities and sisters attacks the various components of a VoIP infrastructure in LANs; and setting up a secure VoIP solution based on open source tools, specifically the Asterisk and client X-Lite server. Companies benefiting from our solution, will be able to set up a VoIP platform quite flexible, inexpensive, and protected against security attacks within the network and outside too.

This report consists of four chapters.

1. The first chapter introduces VoIP and these elements, describes and explains the architecture and protocols, and lists the major points strengths of this technology and its weaknesses. 
2. The second chapter focuses on the security of VoIP infrastructure. It details the different types of security vulnerabilities divided into three classes: vulnerabilities in protocols, infrastructure-related vulnerabilities and vulnerabilities systems. Good practices and security solutions to places to remedy these vulnerabilities are also defined. 
3. The third chapter is interested in setting up a VoIP solution for businesses based on the Asterisk server and client X-Lite. The different prerequisites and necessary libraries are installed, and the essential parameters are defined and configured. 
4. The final chapter of the report focuses on testing and achievement of some attacks VoIP infrastructure deployed in the third chapter. 

An implementation of the various solutions and measures needed to protect against these attacks, is realized.

What VoIP and its Technology

VoIP is currently the most important developments in the field Telecommunications. Before 1970, the voice was done analogically on dedicated to the telephony networks. The technology used was the electromechanical technology (Crossbar). In the 80s, the first major change was the shift to digital transmission (CT). The transmission of voice over computer networks IP packet is now a new comparable major evolution previous. The aim of this chapter is the study of this technology and its various aspects. We speak in detail of the architecture of VoIP, its elements and its operating principle. We also detail VoIP signaling protocols and transport and their principles operation and their main advantages and disadvantages.

Introduction to VoIP 

Definition 
VoIP stands for Voice over Internet Protocol or VoIP. As the name suggests, VoIP can transmit sounds (particularly voice) in IP packets on Internet. VoIP can use accelerating hardware to achieve this purpose and can also be used in the PC environment.

Architecture
VoIP is a new communication technology, it has not yet single standard. Indeed, each manufacturer provides its standards and features to its solutions. The three main protocols H.323, SIP and MGCP / MEGACO. There is therefore several approaches to provide telephony and video telephony over IP networks.

Some put the intelligence in the network, while others prefer an equal approach equal with distributed intelligence at the edge. Each with its advantages and disadvantages. It always comprises terminals, a communication server and a gateway to the other networks. Then each standard has its own characteristics to ensure a more or lower quality of service. The intelligence of the network is to be deported on terminals or gateways on / switch controller, called Gatekeeper.

Common elements: 

1. The router: You can switch the data and routing of packets between two networks. Some routers allow to simulate a Gatekeeper by adding cards specialized supports VoIP protocols. 
2. The gateway: to interface the switched network and the IP network. 
3. The PABX: Switch is the traditional telephone network. It allows to link between the gateway or router, and the switched telephone network (PSTN). However, if all IP network becomes, the equipment becomes obsolete. 
4. Terminals: are usually software-based (software phone) or hardware (Hardphone), the softphone is installed in the PC of the user. The audio interface can be a microphone and speakers connected to the sound card, even if headphones are recommended. For better clarity, USB or Bluetooth phone can be used. 

The hardphone is an IP phone that uses Voice over IP technology to allow phone calls over an IP network such as the Internet instead of the ordinary PSTN system. Calls can browse the Internet network as a private network. A device uses protocols such as SIP (Session Initiation Protocol) or any of the proprietary protocols such as that used by Skype.

Operating principle 
Since many years, it is possible to transmit a signal to a destination far as digital data. Before transmission, it is necessary to digitize the signal to using a CAN (ADC). The signal is then transmitted to be used, it must be converted back into an analog signal, with the aid of a DAC (Digital to analog converter). VoIP operates by digitizing the voice, and then by conversion of packets Digital voice on arrival. The digital format is easier to control, it can be compressed, routed, and converted into a new better format. The digital signal is more noise tolerant than analogue. TCP / IP networks are IP packet traffic carriers containing a header (To control communication) and a payload to transport data. There are several protocols that can support VoIP such as H.323, SIP and MGCP. The two most currently used protocols in VoIP solutions on the market are H.323 and SIP.