A short presentation on issues we face with realtime security - too many solutions and too few customer requirements and a lack of demand on the market.

1. REALTIME
COMMUNICATION
SECURITY
Olle E. Johansson * oej@edvina.net * Twitter oej
Copyright Edvina AB, Sollentuna, Sweden 2011. All rights reserved.

2. From this...

3. to this

4. Talk
Video
Chat
Application sharing
3D holographic 7.1 conferences

5. COMMUNICATION BETWEEN
TWO OR MORE PEOPLE

6. OUT OF SCOPE TODAY.
Tommy the system intruder
Christina the network sniffer
Adrian the BOT network manager

7. IN SCOPE
You Me

8. WHAT IS THE PROBLEM?
The usual security issues...

9. WHO’S TALKING?
You Me
Identity

10. WHO IS LISTENING?
You Me
3rd party
Confidentiality

11. DID YOU REALLY WRITE THAT?
You Me
Integrity

12. YOU CAN’T DO THAT.
You Me
Authorization

13. WHO AM I?
IP Phone Pad
Softphone Set-top-box
Chat client Laptop
Me
Car Cell phone

14. THE SIP WORLD
DATACOM TELECOM

15. NETWORK SECURITY
You Me
Our problem

16. TELECOM SECURITY MODEL
You Me
In the telco we trust.

17. END2END OR THROUGH
PROXY SERVER?
Do you want
someone else to handle your keys?
You Me
Do you want to set up
a secure session between you
and me? If so, how?

18. THIS APPLIES TO MANY
PROTOCOLS
SIP
RTCWEB
XMPP
?

19. SIP SECURITY
TLS DTLS/SRTP
SIGNALLING MEDIA
S/MIME
SIP IDENTITY
INTEGRITY
HTTP DIGEST MSRP/TLS
AUTH CHAT

20. ASTERISK 1.8
TLS ACLs
SRTP SDES TLS very, very
experimental

21. KAMAILIO SIP SERVER 3.1
TLS ACLs
DOS
prevention TLS very, very
good!

22. WHAT’S THE ISSUE
WITH REAL TIME SECURITY?
No one asks for it.
Therefore no one
implements it.
Which means lack of
experience.

23. WHAT I DO NOT
UNDERSTAND.
Why does nobody
care, really?

24. FINAL QUESTION:
What’s a secure
session for you?

25. H E L P.
THANK YOU.