A Tool for Detecting Theft-of-Service in SIP-based Systems
Lead Inventors: Henning Schulzrinne, Ph.D.Problem or Unmet Need:Session Initiation Protocol (SIP) based Voice-over-IP (VoIP) services are more susceptible to theft of service since calls are established over an IP-based network. Theft of service can happen due to various reasons such as identity assurance, multiple call endpoints, unsolicited intrusion in the VoIP network and of services such as emergency dialing and voicemail access. Many computers may run a soft-phone or a physical phone with Java virtual machine and can be exploited to circumvent security schemes including TLS, S/MIME, or digest authentication mechanisms. Additionally, calls can be routed to unauthorized multiple end-points. Finally, processing spurious SIP requests can lead to compromise of SIP servers. The technology is a software tool that can detect three types of theft of service, i.e., those of identity, multiple call end points, and unsolicited SIP requests. The tool provides a modular web-based interface. It checks if the SIP servers are processing unsolicited messages, whether user is allowed launch simultaneous calls, and the robustness of SIP systems against crafted messages, all in an automated manner.
An easy to configure single tool that can be used by the network/security departments of an organization to find vulnerabilities in their VoIP networks An organization interested in purchasing a VoIP system can request potential sellers to verify their security claims against this tool
Organizations deployinng VoIP networks Comprehensive tool set for use in QA for telephone service providers Carrier grade VoIP providers
The technology is a software tool that can detect three types of theft of service, i.e., those of identity, multiple call end points, and unsolicited SIP requests. The tool provides a modular web-based interface. It checks if the SIP servers ar...
美國
