1 a review of the architecture and the underlying protocols in the telephone network dipak ghosal...

123
1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California at Davis

Upload: bennett-pierson

Post on 29-Mar-2015

213 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

1

A Review of the Architecture and the Underlying Protocols in

the Telephone Network

Dipak GhosalDepartment of Computer ScienceUniversity of California at Davis

Page 2: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 2

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 3: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 3

History Pre-1984

AT&T 1980’s saw rapid deployment of digital

technology in the core network 1984

Breakup of AT&T into 7 RBOCs (Regional Bell Operating Companies), AT&T, and others

Local area carriers (LECs) serving LATA were regulated

Long distance carrier (IXC) service was opened

Page 4: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 4

History (2) Post 1984

New Telecom Act in 1996 Further deregulation of LECs (ILECs and CLECS) Local area and long distance markets opened Local Number Portability

Break-up of AT&T AT&T Lucent (Bell-Labs)

Mergers of RBOCs and CLECs

Page 5: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 5

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 6: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 6

A Typical Regional POTS Network

Page 7: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 7

Network Architecture

Page 8: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 8

Circuit Network Central Offices (End Offices)

Local aggregation points for phone lines

Wire-pair (local loop) to each telephone

Tandems Hubs interconnecting Central Offices Connecting to IXCs

Page 9: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 9

Circuit Network (2) Hierarchical organization

End office Toll Center Primary Center Sectional Center Regional Center

Page 10: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 10

End Office

Page 11: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 11

Signaling Network Signaling network is the brain Circuit network forms the the muscles All nodes in the signaling network are

called signaling points SSP -> Service Switching Points STP -> Signaling Transfer Point SCP -> Service Control Point

Page 12: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 12

Service Switching Point This is the local exchange in the

telephone network Interfaces both the circuit network and

signaling network Generate SS7 messages from signals from

the voice network Generate SS7 query messages for non-

circuit related messages LNP has significantly altered the traffic

mix

Page 13: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 13

Signaling Transfer Point Routers in the SS7 network

Route messages between SSPs Support Global Title Translation for

non-circuit related messages These can be separate stand alone

nodes or adjuncts to a voice switch Many tandems used to act as STPs

Deployed as a mated pair

Page 14: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 14

Signaling Transfer Point (2) Hierarchy of STPs

Local and Regional STPs International STPs Gateway STPs

Interconnect different networks including cellular networks

Very important node in the SS7 network Many other functions including

measurements and data mining

Page 15: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 15

Service Control Point Interfaces to databases

800/900 databases HLR/VLR databases LIDB (Line Information Databases) for

calling cards Local Number Portability Database New Advanced Intelligent Network

(AIN) services.

Page 16: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 16

Types of Signaling Links

                                                                                                                                                                                  

               

Page 17: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 17

Types of Signaling Links (2) A-Links are access links between SSP and STP or

SCP and STP B-Links are bridge links that connect mated STP

pairs in the same hierarchy C-Links are cross links between an STP and its

mat D-Links are diagonal links between STPs at

different levels of the hierarchy E-Links a extended links to connect to remote STP

pairs F-links are fully associated links

Page 18: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 18

Types of Signaling Links (3) Link sets are group of links with the

same adjacent nodes Route is a collection of link sets required

to reach a destination Route set is a collection of routes Routing is hop-by-hop

A signaling point needs to know which linkset to use towards the destination

Page 19: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 19

Addressing Each signaling point has a address and

it is referred to as the Point Code It is a 24-bit address

8 bits network identifier 8 bits cluster identifier 8 bits node identifier

Full point code routing Partial point code routing

Cluster routing or network routing

Page 20: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 20

Requirements Availability objective: an unavailability

of no more than 10 minutes downtime between two SPs

Lost message probability: 1 in 10**7 Message Out-of-sequence probability: 1

in 10**10 Performance objectives:

Maximum link utilization must be less than 40% Various other requirements on various processing

delay Maximum message processing delay at an SP is 200ms

Page 21: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 21

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 22: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 22

Protocol Stack

Page 23: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 23

ISDN User Part (ISUP)

                                                                                                                                                                                       

Page 24: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 24

ISDN User Part (ISUP) IAM – Initial Address Message

Message type, Called party number, calling party category, forward call indicators, nature of connection identifier, user service information

ACM – Acknowledge Message ANM –Answer Message REL – Release Message RLC – Release Clear Message All these message have a associated circuit

identification code (CIC)

Page 25: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 25

Database Query (TCAP)

                                                                                   

       

Page 26: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 26

Signaling Connection Control Part (SCCP) Additional functions over MTP (network)

layer to support connectionless and connection oriented services Very similar to transport layer

Address Translations Dialed digits to destination point codes Particularly important for non-routable numbers

such as 800/900. GTT functionality is supported in the STP to

determine which database will provide the translation.

Page 27: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 27

Message Transfer Part (MTP) Layer 3 Network Management

Link management Traffic management Route Management

Message discrimination Message distribution Message routing

Page 28: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 28

MTP Layer 3 (2) Message discrimination

Determine if the message is destined to the receiving node

If yes apply message distribution to distributed it to the appropriate application

Else, route it to the destination using the most direct route (I.e., fewest number of hops)

Page 29: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 29

MTP Layer 3 (3) Traffic management

Link failures Route failures Congestion

Page 30: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 30

Transient A-Link Failure

Level3

L2

Level3

STP1

STP2

LinkFailure

SP1 SP2

L2

SPn

L2

L2

Page 31: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 31

Link Failure Level-2 processor sends a link failure

message to the Level-3 processor Level-3 processor updates its own

routing table Level-3 processor sends out routing

table update message to other Level-3 processors within the STP

Page 32: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 32

Link Failure (2) Send out Traffic Restricted (TFR) messages to

all the SPs Send out Traffic Prohibited (TFP) message to

the mate-STP via the C-link Send change-over message to the

corresponding SP Sends changeover signal to the Level-2

processor to re-routes messages via the C-link

Page 33: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 33

Congestion

Level3

L2

Level3

STP1

STP2

SP1 SP2

L2

SPn

L2

L2

SP3

TFCMessages

Page 34: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 34

STP Architecture

Page 35: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 35

Key Design Issue What is the best cluster size?

Centralized architecture have few Level-3 processors Fewer number of routing tables hence quicker

update of failue information within the STP Potential Level-3 processor overload

Distributed architectures have large number of Level-3 processors

Multiple failures can be processed in parallel Large number of routing tables and hence delays

in updating all copies What is the priority structure for different

message types in the Level-3 processor?

Page 36: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 36

Model of Level-3 Processor

Page 37: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 37

Network Model 1, 8, 16, 24 A-link

failures All failures to a

single STP Simultaneous

recovery after 11 seconds

Page 38: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 38

Call Throughput

Page 39: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 39

Key Results A clustered architecture with 8/16

Level-2 processors per Level-3 processor performed the best

Priority of tasks was a very important factor

Dynamic priority inversion

Page 40: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 40

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 41: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 41

Routing in Circuit Network Dynamic Routing

Some part of the routing changes over time

Adaptive Routing Some part of the routing is a function

of the network state at the time the decision is made

Page 42: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 42

Alternate Routing An ordered set of routes from which the

choice is made Fixed alternate routing

A small subset of fixed route is used The set of alternate route is scanned in

some predetermined order and the call is connected on the first free path that is found

There are different methods on how the routing control is propagated

Page 43: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 43

Alternate Routing (2) There are different methods on

how the routing control is propagated Originating-office control Spill-forward control Crankback

Page 44: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 44

Fixed Hierarchical Routing Hierarchical organization of switches

End office Toll Center Primary Center Sectional Center Regional Center

There are specific hierarchical fan rules of how switches are connected

Page 45: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 45

Dynamic Nonhierarchical Routing Deployed in mid 1980s A day is divided in to 10 traffic periods All switches are same – no hierarchy Routing is alternate type with the

provision that alternate paths are limited to atmost two links

Long paths can result in “knock-on” effect and make the system highly sensitive to overloads

Uses crankback

Page 46: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 46

Adpative Routing Residual capacity adaptive routing

(RCAR) Uses occupancy information of all

trunk groups periodically updated by measurements

DCR – sends calls to paths with the largest expected number of free trunks

Trunk Status Map Routing Adaptive DNHR

Page 47: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 47

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 48: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 48

The Problem

Media events may stimulate a large number of calls to a single number in a very short time interval

Mass Call-Ins cause focused overloads, denying service to customers trying to reach other numbers

Outages may persist for long period Existing automated network controls

protect the network, but deny service unnecessarily

Page 49: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 49

Example of Mass Callin

Page 50: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 50

Choke Network Special exchange which serves

many clients (e.g., radio stations) that regularly generate call-ins

Small number of trunk to this exchange

Not suitable for clients that would like to have large number of calls completed (ticket sales)

Page 51: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 51

SSP

STP

Call

Attempt

SSP

XXX-XXX-XXXX 60XXX-XXX-XXXX 60XXX-XXX-XXXX 120XXX-XXX-XXXX 30XXX-XXX-XXXX 10XXX-XXX-XXXX 100XXX-XXX-XXXX 30XXX-XXX-XXXX 3XXX-XXX-XXXX 60XXX-XXX-XXXX 60XXX-XXX-XXXX 120XXX-XXX-XXXX 30XXX-XXX-XXXX 10XXX-XXX-XXXX 100XXX-XXX-XXXX 30XXX-XXX-XXXX 3XXX-XXX-XXXX 60

Call Gap Table

Manual Call Gaps

Page 52: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 52

SSP

STP

Call

Attempt

SSP

Block all calls

to target DPC

TFC

CongestionDetected

TFC Congestion Control

Page 53: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 53

Other Methods Automatic Congestion Control (ACC)

Method by which a switch can protect itself if overloaded

Curtails a percentage of call request on a per trunk-group basis

Code Blocks Blocks a percentage of calls to specific

numbers

Page 54: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 54

Caller

Caller

Callee

Callee

Normal Call

Call to a Busy Number

IAM

IAM

ACMANM REL RLC

REL RLC

Release-Busy

IAM carries called number

Conversation

Call Processing and Signaling

Page 55: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 55

• When a Mass Call-In occurs, a very large number of Release-Busies messages from the same target number are quickly generated

• Call gaps are an effective method for stopping traffic to a particular number

• Call gaps have almost no effect on traffic to other numbers, while squelching traffic to the target

Key Ideas

Page 56: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 56

Example of Mass Callin

Page 57: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 57

• Maintain information on called numbers during initial call processing

• Cache recent Release-Busies using hashing

• Detect multiple Release-Busies to the same target number over a short (2-3 second) interval

• Insert Call-Gaps into switches generating traffic to the busy number

• Remove Call-Gaps after a period of inactivity (5-10 minutes)

Algorithm

Page 58: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 58

• Current switch technology does not allow Call Gaps to be set quickly

• Fast Call Gaps assume switches engineering to allow Call Gaps to be set within one second

• Slow Call Gaps assume Call Gaps can be set with an 8 second delay plus 700 milliseconds per switch (achievable with current switches)

Implementation Issues

Page 59: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 59

Simulation Results

Page 60: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 60

Simulation Results (Detail)

Page 61: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 61

Operator Utilization (10 Operators)

Page 62: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 62

Operator Utilization (100 Operators)

Page 63: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 63

• Unanticipated Mass Call-In events can be effectively and efficiently controlled by a simple detection method

• Fast Call Gaps would reduce the effect of Call-In overloads to almost unnoticeable levels

• Slow Call Gaps would provide an effective method for controlling Call-In events without the necessity of modification of existing switches

Summary

Page 64: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 64

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 65: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 65

Research Summary Security

B. Reynolds and Dipak Ghosal. STEM: Secure Telephony Enabled Middlebox. IEEE Communications Magazine Special Issue on Security in Telecommunication Networks. October 2002.

B. Reynolds and Dipak Ghosal, “Secure IP Telephony Using Multi-Layer Protection,” to appear in Network and Distributed Systems Security (NDSS03), San Diego, February 2003.

Resource Management M. C. Caesar, D. Ghosal, and R. Katz, ``Resource Management for IP

Telephony Networks,'' International Workshop of Quality of Service

(IWQoS), Miami, May 2002. Node Architectures

Dipak Ghosal, “A Comparative Analysis of STP Architectures Under Transient Failure and Overload Conditions,” IEEE International Conference on Perfromance and Dependable Systems, June 1999.

Page 66: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 66

Research Summary (2) Pricing

Matthew Caesar, Sujatha Balaraman and Dipak Ghosal, "A Comparative Study of Pricing Strategies for IP Telephony", IEEE Globecom 2000, Global Internet Symposium, San Francisco, USA, -- I presented my work on Nov. 29, 2000.

Traffic Issues J. Burns and D. Ghosal, ``Automatic Detection and Control of

Media Stimulated Focused Overloads,'' Proceedings of the International Teletraffic Congress, Washington D.C., June 1997, pp.889-900. To appear in Telecommunication Systems

A. Mukherjee and D. Ghosal, ``The Impact of Background Traffic on the Effectiveness of FEC for Audio over Internet,'' InternationalTeletraffic Congress, Edinburgh, UK 1999.

Page 67: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 67

Research Summary (3) Enhanced Signaling

Network Architecture Abramson, Xiao-yan Fang, and D. Ghosal. Analysis of an

Enhanced Signaling Network for Scalable Mobility Management in Next Generation Wireless Networks. IEEE Globecom. Taiwan, ROC, November 2002. 

T. Sinclair and D. Ghosal, An Enhanced Signaling Network Architecture for Replicated HLR – Prototype Implementation and Performance Analysis, ICC 1999, Vancouver

•J

Page 68: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 68

Outline History Network Architecture SS7 Protocol Routing Media Stimulated Focused Overload Overview of Telephony Research Current Efforts

Page 69: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 69

Overview

Security Security architecture for IP Telephony Sensors to detect DoS attacks Detection algorithm Recovery algorithms Preliminary results from simulation analysis Future work

Resource Management in IP Telephony Routing

Page 70: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 70

Enterprise Network

PSTN

Enterprise DMZ

SIPRedirect

Proxy

SIPRegistrar /LocationServer

WebServer

DNSServer

EdgeRoute

rExternal

Firewall

Internal

Firewall

Softphone IP Phone

EnterpriseLAN

Authentication Server

Media /Signal

Gateway

Internet

Page 71: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 71

SIP IP Phone

SIP IP Phone

Location Service

SIP Proxy

SIP Proxy/LS

DNS Server

Media Transport

1

2

3

4

5

6

A request is sent (SIP INVITE) to

ESTABLISH a session

DNS Query for the IP Address

of the SIP Proxy of the

Destination Domain

The INVITE is forwarded

The Location Service is queried to check that the

destination IP address represents a valid

registered device, and for its IP Address

The request is forwarded to the End-Device

Destination device returns its IP Address to the

originating device and a media connection is

opened

Call Setup – Net-to-Net

Page 72: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 72

Call Setup – PSTN-to-Net

Page 73: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 73

Comparison of Solutions

Method Advantage Disadvantage

All Access Every application will work

No perimeter security at all

Traffic Redirection No issues with firewall or NAT

Removes advantages of using IP telephony

Application Proxy Firewall does not need to be modified

Firewall can’t provide protection for proxy

Protocol Tunneling Limited additional filter rules required

Large overhead and requires modifying IP telephony clients

Secure Telephony Enabled Middleboxes (STEM)

Provides high level of network security and allows dynamic apps

Requires new firewall installed

Page 74: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 74

Vulnerability Analysis Property oriented approach

Access control to use IP telephony service

Integrity and authenticity of IP telephony signaling messages

Resource availability and fairness in providing IP telephony service

Confidentiality and accountability

Page 75: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 75

Access Control Deny unauthorized users access to

IP telephony service Central authentication servers

E.g.: RADIUS server Enable various network elements to

query authentication server

Page 76: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 76

Integrity and Authenticity of Signaling Messages

Call Based Denial of Service CANCEL messages, BYE message,

Unavailable responses Call Redirection

Re-registering with bogus terminal address, user moved to new address, redirect to additional proxy

User Impersonation

Page 77: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 77

Payload Encryption

Capture and decoding of voice stream Can be done in real-time very easily

Capture of DTMF information Voice mail access code, credit card

number, bank account Call profiling based on information in

message headers

Page 78: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 78

Resource Fairness and Availability Flood based attacks

Network bandwidth between enterprise and external network

Server resources at control points SIP Proxy Server

Voice ports in Media/Signaling Gateway Signaling link between Media/Signaling

Gateway and PSTN End user

Page 79: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 79

Internet Originated Attack

Enterprise network connection can be flooded using SYN flooding

Resources in the SIP proxy server can be exhausted by a large flood of incoming call request

End user can be targeted with a large number of SIP INVITE requests in a brief period of time

Page 80: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 80

PSTN Originated Attack

Voice ports on the M/S gateway are completely allocated

Signaling link between M/S gateway and PSTN STP becomes saturated with messages

Large number of PSTN endpoints attempt to contact a single individual resulting in a high volume of INVITE messages

Page 81: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 81

Security Architecture

Internet

Enterprise DMZ

SIPRedirect

Proxy

SIPRegistrar /LocationServer

WebServer

DNSServer

External

Firewall

EdgeRoute

rInterna

lFirewal

l

Transport LayerAttackSensor

ApplicationLayerAttackSensor

PSTN

Media /Signal

Gateway

ApplicationLayerAttackSensor

Softphone IP Phone

EnterpriseLAN

Authentication Server

Page 82: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 82

Application Layer Attack Sensor (ALAS)

Monitors the number of SIP INVITE requests and the SIP OK (call acceptance) responses URI level monitor Aggregate level monitor

Detection Algorithm Response Algorithm

Proxy or M/S gateway returns temporally busy messages

Page 83: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 83

Transport Layer Attack Sensor (TLAS)

Monitors the number of TCP SYN and ACK packets

Traffic is monitored at an aggregate level

Upon detection of an attack, throttling is applied by perimeter devices (e.g. firewall) If attack persists, traceback technologies

can be used to drop malicious traffic at an upstream point

Page 84: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 84

RTP Stream Attack Sensor (RSAS) To detect malicious RTP and RTCP streams Parameters of the RTP streams are known

at connection setup time Police individual streams Statistical techniques to determine large flows

Packets corresponding to the malicious streams are dropped at the firewall

Need cooperation of upstream routers to mitigate link saturation

Page 85: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 85

Detection Algorithm for TLAS

Monitoring the volume of connection attempts vs. volume of complete connection handshakes can be used to detect an attack

Based on the sequential change point detection method proposed by Wang, Zhang and Shin (Infocom 2002) to detect TCP SYN attacks

Page 86: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 86

Algorithm All connection setup attempts and complete

handshakes are counted during the observation period

During each sampling period the difference is computed and normalized

Under normal operation, the resulting value should be very close to 0

In the presence of an attack, the result is a large positive number

Apply a cumulative sum method to detect short high volume attacks as well as longer low volume attacks

Page 87: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 87

Recovery Algorithm Linear Recovery

This is the default behavior of the detection algorithm

Exponential Recovery The cumulative sum decreases

multiplicatively once the attack has ceased Reset after Timeout

The cumulative sum decays linearly decays until a timer expires at which point it is reset to 0

Page 88: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 88

Preliminary Results Types of attack

Limited DoS attack Single user targeted by one or more attackers

Stealth DoS attack Multiple users targeted by one or more attackers

each with a low volume of call requests Aggressive DoS attack

Multiple users targeted with moderate call requests Ability to detect both aggregate level

attacks as well as attack to individual URIs

Page 89: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 89

Preliminary Results

Page 90: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 90

Preliminary Results

Page 91: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 91

Preliminary Results

Page 92: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 92

Results

Page 93: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 93

Future Work Detailed analysis

Tradeoff between detection time and false alarm rate

Formal vulnerability analysis Additional vulnerabilities with ENUM

Routing layer issues Vulnerabilities of multihomed

networks

Page 94: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

94

Resource Management in IP Telephony Networks

Matthew Caesar, Dipak Ghosal, Randy H. Katz

{mccaesar, randy}@[email protected]

Page 95: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 95

Motivation What is IP Telephony?

Packetized voice over IP PSTN access through Internet Telephony Gateway (ITG)

Benefits: Improved network utilization Next generation services (POTS PANS)

Growth: Revenues $1.7 billion in 2001, 6% of international traffic

was over IP, growing [Frost 2002] [Telegeography 2002] Standardized, deployed protocols (TRIP, SIP, H.323)

Requires scalable architecture to limit congestion.

Page 96: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 96

Goals High quality, economically efficient

telephony over the Internet. Low blocking probability Provide preferential treatment, high QoS

Questions: How to perform call admission control? How best to route calls through converged

network?

Page 97: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 97

Approach Mechanisms

ITG selection Congestion

sensitive call admission control

Techniques Awareness of ITG

congestion Path quality

between important points in network

Dis

tance

Utilization

**

**

*

* *

Page 98: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 98

Overview IP Telephony Networks Pricing-based Admission Control Redirection Techniques Experimental Design Results Future Work

Page 99: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 99

System Architecture

ITG

LS

Example Call SetupExample AdvertisementGateway (ITG)

IP TerminalLocation Server (LS)

InternetAdmin. Domain (AD)

Example Call Session

ITGITG

ITG

ITG

ITG

ITG

LS

LS

LS

LS

LS

LS

1 2

3

4

5

6

Page 100: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 100

Scope of Study 1. All calls are net-to-phone2. ADs cooperate to provide service.3. Use IETF’s TRIP architecture to

support interoperability.4. Disregard degradation in access

network.5. Prices determined at start of call.6. ITGs offer equal PSTN reachability.

Page 101: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 101

Pricing PSTN

distance pricing time of day pricing

IP Telephony richer user interface allows for more dynamic pricing

schemes Baseline: Flat-rate Admission

Control (FAC)

Page 102: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 102

Congestion Sensitive Call Admission Control (CAC) Goal: prevent system overload and

generate revenue Price of call

function of number of voice ports in use

rises when highly utilized More dynamic than PSTN

Page 103: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 103

Price-Congestion Function Used M/M/m/m (m-

server loss system) responsive server loss system discouraged arrivals

Found price-congestion function that maximized revenue with respect to

0

1

2

m-1

m

...

m-1

m

Page 104: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 104

Congestion Pricing Analysis Exponential function generates most

revenue Stepwise linear function almost as good

Maximum system price charged early Approximation to function minimizes price

fluctuationsPrice-congestion Function Used in this Study

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 10 20 30 40 50 60Utilization [voice ports]

No

rmal

ized

Pri

ce C

har

ged

Revenue-maximizing Price-congestion Function

00.10.20.30.40.50.60.70.80.9

1

0 10 20 30 40 50 60Utilization [voice ports]

No

rma

lize

d P

ric

e C

ha

rge

d

Page 105: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 105

Redirection Problem: finding the “best” ITG Approach: tradeoffs between quality and load Method: LS maintains

Average measured path quality Number voice ports in use

Algorithms: Random Redirection (RR) (baseline) QoS Sensitive Redirection (QR) Congestion Sensitive Redirection (CR) Hybrid Scheme (CQR)

Page 106: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 106

Redirection Schemes QoS Sensitive Redirection (QR)

Different paths provide different service Technique:

Use RTCP RRs to monitor path congestion Route over best paths

Congestion Sensitive Redirection (CR) Unbalanced load causes call blocks Technique:

Use TRIP advertisements to estimate ITG utilization

Route to least utilized ITG

Page 107: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 107

Hybrid Redirection (CQR) Choosing nearby ITG improves call quality, but

can unbalance load. Algorithm:

Compute Rdm = *Mi+(1-)*Qi Mi is utilization, Qi is loss rate

Select randomly from k ITGs with lowest Rdm Tradeoffs:

Use to trade off call quality and load balance Use k to vary flash crowd protection

Price Sensitive CQR (PCQR) Decrease for higher bids

Page 108: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 108

Overview IP Telephony Networks Pricing-based Admission Control Redirection Techniques Experimental Design Results Future Work

Page 109: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 109

Experimental Method Modified ns-2 Ran for 1.5 simulated hours

Eliminated first half-hour User Model

Bid uniformly distributed Voice traffic on-off Markov process

Pareto cross-traffic Data points stable across several time

scales

Page 110: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 110

Evaluation: Metrics Blocking Probability Average call QoS

Used Mean Opinion Score (MOS) based on RTP loss rate

Economic efficiency Ratio of service tier to QoS achieved

Stability: Variance in ITG utilization Over time Over the set of ITGs

Page 111: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 111

Admission Control: Blocking Probability

Flat pricing unnecessarily blocks many callers

Congestion pricing changes system price dynamically with load

Call Blocking Probability

0

0.1

0.2

0.3

0.4

0.5

0.6

0 0.2 0.4 0.6 0.8 1Offered Load

Blo

ckin

g P

rob

ab

ilit

y

QR+FAC

QR+CAC

Page 112: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 112

Call Blocking Probability

0

0.02

0.04

0.06

0.08

0.1

0.12

0.14

0.16

0.18

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1Beta

Blo

ckin

g P

ro

bab

ilit

y

CQR+NAC k=1CQR+NAC k=3CQR+NAC k=6RR+NAC

Redirection: Blocking Probability

Congestion sensitivity decreases blocking probability Small k few blocked calls Congestion Sensitive Redirection (CR) improves balance over

Random Redirection (RR)

Page 113: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 113

System Stability

0

50

100

150

200

250

300

0 0.2 0.4 0.6 0.8 1Beta

Va

ria

nc

e in

Uti

liza

tio

n [

po

rts

/se

c]

CQR+NAC k=1

CQR+NAC k=3

CQR+NAC k=6

RR+NAC

Redirection: Load Balance

More congestion sensitivity improves balance

Load imbalance blocks calls

Page 114: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 114

Redirection: Background Traffic Effects

Effects of Background Traffic

0

1

2

3

4

5

6

0 1 2 3 4 5Background Traffic Multiplier

Qo

S [

MO

S]

CQR+NAC Beta=0

CQR+NAC Beta=0.9

CQR+NAC Beta=1

RR+NAC

QoS sensitivity minimizes effects of cross traffic Small amount of sensitivity vastly improves

call quality

Page 115: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 115

Summary Admission Control Schemes:

Congestion sensitive pricing decreases unnecessary call blocking, increases revenue, and improves economic efficiency

Derived exponential price-congestion function that maximizes revenue

Redirection Schemes: Hybrid scheme achieves “best of both worlds” Price sensitivity improves economic efficiency

Page 116: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 116

Future Work Realistic workload Improve user model

Develop price-congestion function for real users

Study flash-crowd effects ITG Placement Competitive Network

Page 117: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

117

Routing in IP Telephony Networks

Brian Liao, Matthew Caesar, Dipak Ghosal

Page 118: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 118

Problem: Finding suitable Gateway to

balance resource, enhance QoS. Select best path to lower blocking

probability, decrease delay.

Page 119: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 119

Finding The Appropriate Gateway Performing matrix =

βMi+(1-β)Qi

Mi: voice port in use in gateway iQi: Audio Quality in gateway I

Page 120: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 120

Finding Suitable Path (I) Blocking Probability & Delay are

two keys selection criteria Multi-constraints shortest path

problem is NP

Page 121: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 121

Finding Suitable Path (II) Finding K-shortest paths for

primary constraint. From the K-shortest paths, select

the best path with respect to secondary constraint.

Feasible in Polynomial Time.

Page 122: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 122

Proposed solution Base on location, select the best

gateway nearby. Using K shortest path to select

path and fulfill multi-constraint.

Page 123: 1 A Review of the Architecture and the Underlying Protocols in the Telephone Network Dipak Ghosal Department of Computer Science University of California

April 10, 2023 123

Reference Canhui (Sam) Ou, Keyao Zhu, Hui Zang, Laxman H.

Sahasrabuddhe, and Biswanath Mukherjee, Traffic Grooming for Survivable WDM Networks -- Shared Protection

David Eppstein, Finding the K shortest paths.