【作者】 李娟；

【导师】 黄本雄；

【作者基本信息】 华中科技大学 ， 通信与信息系统， 2005， 硕士

【摘要】 软交换技术是下一代网络的核心技术,它采用了分层、开放的体系结构,从而打破了传统电信网封闭的格局,实现了多种异构网络间的融合。IP技术本身存在的许多问题以及软交换技术作为一个新的技术而存在的问题,都是软交换技术在发展过程中需要面对和解决的问题。如何解决软交换的安全问题成为下一代网络作为一个可运营系统能否安全、稳定运行的关键。本文通过定义电信对网络信息安全的需求,列举目前流行的安全攻击方式,指出系统应提供的安全服务。并从网络的安全、用户数据的安全和业务的安全三个方面提出了一些安全保护措施。分析了VoIP 体系中的安全状况和安全隐患后,提出了采用两种方式加强其安全机制:1)VoIP协议内部的安全机制,包括SIP协议中安全措施(HTTP Digest 方式的身份认证,逐跳加密),以及H.323体系中的H.235协议提供的安全保障。2)采用外部协议的安全机制:IPsec 和TLS,提供端到端的数据加密。在保护软交换核心设备方面,提出用较成熟的MPLS VPN技术构建软交换核心网络,确保软交换、应用服务器、媒体网关、信令网关等重要设备的安全; 另外,给出了多种解决防火墙/NAT 穿越的技术方案,综合考虑组网应用和安全性,选取了媒体信令代理的方案,作为隔离软交换核心网络及IP网的安全实施方案,并能有效地解决穿越问题。最后按照APPRDD 安全模型,从网络层、系统层、应用层、业务层和网管五个层面部署软交换网络的安全策略,着重在软交换安全的网络组织模式方面进行探讨,提出了三种安全组网模式:媒体信令分离模式、媒体信令代理模式和专网安全模式。媒体信令分离模式采用专线传送信令流,IP网传送媒体流的方式,对信令部分和软交换的控制网实施了较高的安全保证; 媒体信令代理模式则是部署媒体信令代理到软交换控制网络与其它网络连接处,从而屏蔽软交换的核心设备; 专网安全模式的思路是将软交换关键网络设备通过安全的数据通道技术MPLS VPN组成一个安全的内部网络。通过分析三种组网模式的利弊及应用范围,给出了组网建议。更多还原

【Abstract】 Softswitch is the pivotal technology in Next Generation Network. It adopts layer and open system structure, which break traditional telecom network structure and realize the combination of multi-isomerous network. The problem exists in IP technology and new Softswich technology need to be solved. Especially security problems for Softswitch must not be ignored. And for the sake of security and stability of NGN as an exercisable system, how to solve current security problems in Softswitch network becomes the pivotal problem. By defining the requirement for network information security in Telecom, this paper lays out the popular attack methods currently and point out security service that system should provide. And according to network security, user data security and service security these three aspects, give some security protection measures. This paper analyzes security situation and vulnerability in Voice over IP system and it can strengthen security mechanism by two aspects: 1) Security mechanism in protocol of VoIP system, including security measures in SIP protocol( Authentication by HTTP Digest, hop-to-hop encryption), and security defense provided in H.235 for H.323. 2) Security mechanism outside protocol of VoIP system: such as IPsec and TLS, providing peer-to-peer data encryption. In order to protect the core devices in Softswitch network, use mature technology-MPLS VPN to build Softswitch core security network, guarantee security of Softswitch server, application server, media gateway, signaling gateway etc. Then discuss several solutions for Firewall/NAT traversal, after comparing and analyzing, pick up media-signal proxy as the solution to separate Softswitch core security network from IP network and also well settle traversal problem for FW/NAT. Eventually, on base of APPRDD security model, from network layer, system layer, application layer, service layer and management layer, five sections, deploy security policy in Softswitch network. Then how to set up security Softswitch network is discussed, three kinds of network architecture for Softswitch (isolation signal from media, media-signal proxy and private security network) are brought forward. For model of isolation signal from media, it transfers signaling by private network and media by IP network, which give fairly high security to signaling part and Softswitch core network. For model of media-signal proxy, media-signal proxy is deployed at junction between Softswitch core network and other network, so that shield core devices in Softswitch; For model of private security network, put all the important devices of Softswitch in a security internal network with data tunnel technology like MPLS VPN. Through analyzing pros&cons in these three models, due to the applicable category, give advice on build security Softswitch architecture.更多还原