Lecture Notes in Computer Science 5185

More documents

Recommendations

Info

60 D. Geneiatakis, G. Kambourakis, and C. Lambrinoudakis Several researchers [2]-[4] have already identified various types of attacks that could be launched against VoIP services. Such attacks can severely affect not only the end-users but also the VoIP providers and the underlying infrastructure. Putting aside Quality of Service (QoS) issues, when end-users acquire VoIP services they are mostly worried about the accuracy and validity of their billing accounts. For example, the service provider could act maliciously and modify in an illegal way the Call Detail Records (CDRs) in order to overcharge the billing account of a given end-user. In the same way, an end-user could repudiate the calls included in his billing account in order to avoid the charges. It should be stressed that in such cases neither the end-user nor the TSP can prove the validity of the CDRs due to the lack of the appropriate nonrepudiation mechanisms in IP Telephony services. This paper proposes a simple, practical and effective mechanism for protecting, both end-users and TSPs, from billing frauds. While our mechanism focuses on VoIP services that are based on Session Initiation Protocol (SIP) [5], it can be easily amended to cover other VoIP signaling protocols as well. This is because our scheme takes advantage of the underlying AAA network infrastructure to deliver robust time stamping services to SIP network entities. The rest of the paper is organized as follows. Section 2 provides background information regarding billing services in VoIP. Section 3 presents various security incidents that affect the validity and accuracy of the billing service, while Section 4 introduces and thoroughly analyzes the proposed scheme. Finally, Section 5 concludes the paper giving directions for future work. 2 Billing Services in IP Telephony VoIP attracts gradually more and more subscribers [1] and as already mentioned it is anticipated to gain a significant market share in the next few years. This growth is actually driven by two key factors: the low cost of VoIP service acquisition and the similar levels of QoS when compared to those of PSTN. TSPs do promote VoIP services through various offers, like free usage time, lower costs for prepaid cards and many more. In fact, all these offers are based on different billing methods that the TSPs must support. According to [6],[7] the billing methods that are available for services provided through the Internet architecture can be classified into the following categories: • Fixed Charge: The subscriber pays a fixed subscription fee for a specific period of time (e.g. monthly) irrespectively of the service usage. • Usage Charge: The subscriber pays a fee based on service usage (e.g. the volume of the data being transferred). For Internet oriented services two basic usage models are employed: (a) Service Time usage and (b) Transferred Media. Note that the latter model is not suitable for voice services. • Service Quality Charge: According to this model whenever the subscriber access the service, he pays a fee based on the provided QoS offered by the TSP as the case may be.
A Mechanism for Ensuring the Validity and Accuracy of the Billing Services 61 Nowadays most TSPs employ mixed billing schemes, combining Fixed and Usage charging schemes, which rely either on prepaid or post billing services. However, in every case the employed billing scheme does not influence the general accounting method in use. To be more precise, by the term accounting method we refer to the process of collecting information about chargeable events, which will be later used as input to the billing service. Consequently, the billing process for IP telephony requires, among others, accurate tracing of “start” and “end” events for all the services acquired by a given subscriber in order to charge him appropriately. These events are known as Call Detail Records (CDRs). An example of such an event logging process sequence in a SIP based VoIP service, is presented in Table 1. Normally, CDRs are captured either by the Authentication, Authorization and Accounting (AAA) Server in charge, or the corresponding SIP proxy, depending on the service configuration parameters. Table 1. An Example of Call Detail Records Call-Id Caller Callee Type Msg Time-Date 123@sip.gr dgen@sip.gr gkar@sip.gr INVITE 1/1/2008:11:00:00 123@sip.gr dgen@sip.gr gkar@sip.gr 200 OK 1/1/2008:11:00:01 123@sip.gr dgen@sip.gr gkar@sip.gr BYE 1/1/2008:11:05:04 Let us consider a User A (caller) who wishes to establish a voice connection with a User B (callee), through some specific SIP based VoIP service. First of all, the caller generates a SIP INVITE message and sends it to the corresponding SIP proxy, which in turn forwards it to the callee. It is assumed that the caller must have been previously authenticated by the local AAA server which is responsible to authorize Fig. 1. Call Establishment procedure in SIP based IP Telephony Services
Page 1 and 2:
Lecture Notes in Computer Science 5
Page 3 and 4:
Volume Editors Steven Furnell Unive
Page 5 and 6:
Program Committee General Chairpers
Page 7 and 8:
Invited Lecture Table of Contents B
Page 9 and 10:
Biometrics - How to Put to Use and
Page 11 and 12:
Biometrics-HowtoPuttoUseandHowNotat
Page 13 and 14:
Biometrics-HowtoPuttoUseandHowNotat
Page 15 and 16:
7 Outlook Biometrics-HowtoPuttoUsea
Page 17 and 18: A Map of Trust between Trading Part
Page 27 and 28: Implementation of a TCG-Based Trust
Page 37 and 38: A Model for Trust Metrics Analysis
Page 47 and 48: Patterns and Pattern Diagrams for A
Page 51 and 52: Policy Model AC model Patterns and
Page 53 and 54: Broker Investor Doctor Patient 1
Page 57 and 58: A Spatio-temporal Access Control Mo
Page 67: A Mechanism for Ensuring the Validi
Page 71 and 72: A Mechanism for Ensuring the Validi
Page 77 and 78: Multilateral Secure Cross-Community
Page 87 and 88: Fairness Emergence through Simple R
Page 99 and 100: Combining Trust and Reputation Mana
Page 109 and 110: Controlling Usage in Business Proce
Page 119 and 120:
Controlling Usage in Business Proce
Page 121 and 122:
Page 123 and 124:
A Semantics Rules for POLPA-Control
Page 125 and 126:
Page 127 and 128:
Spatiotemporal Connectives for Secu
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
5.2 Expressiveness Spatiotemporal C
Page 135 and 136:
Acknowledgement Spatiotemporal Conn
Page 137 and 138:
BusiROLE: A Model for Integrating B
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
The Problem of False Alarms: Evalua
Page 149 and 150:
The Problem of False Alarms 141 pro
Page 151 and 152:
The Problem of False Alarms 143 To
Page 153 and 154:
The Problem of False Alarms 145 mad
Page 155 and 156:
The Problem of False Alarms 147 Des
Page 157 and 158:
The Problem of False Alarms 149 3.
Page 159 and 160:
A Generic Intrusion Detection Game
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167 and 168:
Page 169 and 170:
Page 171 and 172:
On the Design Dilemma in Dining Cry
Page 173 and 174:
Page 175 and 176:
Page 177 and 178:
Page 179 and 180:
Page 181 and 182:
Obligations: Building a Bridge betw
Page 183 and 184:
Page 185 and 186:
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
Page 193 and 194:
A User-Centric Protocol for Conditi
Page 195 and 196:
Page 197 and 198:
Page 199 and 200:
Identity Escrow: A User-Centric Pro
Page 201 and 202:
Page 203 and 204:
Preservation of Privacy in Thwartin
Page 205 and 206:
Page 207 and 208:
Page 209 and 210:
Page 211 and 212:
Page 213:
Agudo, Isaac 28 Aich, Subhendu 118
show all

Lecture Notes in Computer Science 5185

Create successful ePaper yourself

Delete template?

Save as template?