Secure mobile multimedia over all-IP wireless heterogeneous networks

Abstract

The specification of IP Multimedia Subsystem (IMS) in the 3rd Generation (3G) of mobile communications signifies the importance of multimedia delivery in future wireless systems. The introduction of a separate subsystem responsible exclusively for multimedia session management is a result of the special characteristics and requirements of multimedia applications; while these applications can tolerate a certain amount of data loss, they cannot tolerate delayed delivery of data. IMS, however, is not only limited to mobile communications since it is IP-based and its core protocols, namely SIP and Diameter, can be found on the Internet world as well. Moreover, current trends reveal that in the near future the convergence of most wireless systems will become reality over a common platform; that is IP, the Internet Protocol. In this heterogeneous network architecture multimedia delivery solutions will converge as well, since they will use the very same protocols; SIP and Diameter. While this convergence will create numerous possibilities for multimedia applications, it will also create security threats since end users will have a large number of operators to interact with in this multidomain environment. This thesis focuses on security for multimedia delivery over all-IP wireless heterogeneous networks. A number of issues are analyzed and defeated by proposed mechanisms that can operate under very demanding circumstances, e.g. while a mobile node handoffs to a new cell and/or administrative domain. These vulnerabilities and proposed mechanisms are related with the signaling phase of multimedia delivery, i.e. before the actual delivery of multimedia takes place. The effectiveness and efficiency of the proposed mechanisms are qualitatively and quantitatively evaluated through appropriate comparisons and experimental testbed setup. The vulnerabilities analyzed in this thesis concern the privacy protection of end users when they roam through different administrative domains which are generally considered unknown or untrusted or both. The mechanisms proposed here can be perceived as two modules which can be used either in conjunction or individually. The first one includes two privacy enhanced secure handoff optimization schemes suitable for wireless heterogeneous networks which protect end user’s privacy while transferring context information necessary for fast re-authentication and service re-establishment to candidate networks. This context can carry almost every type of information whether this is related to security material or other data required for system and application configuration. The second module is a framework, named PrivaSIP, with a number of variations depending on privacy and performance requirements and is limited to the application layer since it protects end users’ identity privacy in the SIP protocol. The combination of these two modules can be realized with the inclusion of SIP re-authentication and re-configuration information into the aforementioned context. The proposed schemes are compared to existing solutions based on well defined criteria; for PrivaSIP an extensive series of experiments were conducted on an appropriately designed testbed in order to measure its performance.