According to the traditional definition, network security comprises integrity, confidentiality, and availability. Message integrity ensures that if an unauthorized party modifies a message between the sender and the receiver, the receiver is able to detect this modification. In addition to message integrity, integrity mechanisms always provide some type of proof of data origin. Knowing that a message has not been modified without knowing who initially created the message would be useless. . | Chapter 11 Security on the Internet According to the traditional definition network security comprises integrity confidentiality and availability. Message integrity ensures that if an unauthorized party modifies a message between the sender and the receiver the receiver is able to detect this modification. In addition to message integrity integrity mechanisms always provide some type of proof of data origin. Knowing that a message has not been modified without knowing who initially created the message would be useless. Confidentiality mechanisms keep unauthorized parties from gaining access to the contents of a message. Confidentiality is typically achieved through encryption. Denial of Service DoS attacks compromise the system s availability by keeping authorized users from accessing a particular service. The most common DoS attacks consist of keeping the servers busy performing an operation or sending the servers more traffic than they can handle. SIP provides several security mechanisms to address integrity confidentiality and availability. Some of the security mechanisms come from the world of the web some come from the world of email and some of them are SIP-specific. We analyze these mechanisms in the following sections and describe how they relate to the three security properties just described. HTTP Digest Access Authentication The first problem a SIP server faces is authenticating users who are requesting services. SIP has inherited an authentication mechanism from HTTP called HTTP Digest Access Authentication specified in RFC 2617 145 . In the SIP context the server authenticating the user . the caller can be a proxy a registrar a redirect server or a user agent the callee s user agent . The WWW-Authenticate and Authorization header fields are used with registrars redirect servers and user agents and the Proxy-Authenticate and Proxy-Authorization header fields are used with proxies. When using HTTP Digest Access Athentication the client and the .
