The impact of TLS on SIP server performance: Measurement and modeling

IEEE/ACM Transactions on Networking

Volumn 20, Issue 4, 2012, Pages 1217-1230

  Shen, Charles ^a   Nahum, Erich ^b   Schulzrinne, Henning ^c   Wright, Charles P ^b  

^a AT and T Security Research Center   (United States)

^b IBM T J WATSON RESEARCH CENTER   (United States)

^c Fu Foundation School of Engineering and Applied Science   (United States)

Author keywords

Computer networks; Internet telephony; performance evaluation; security

Indexed keywords

COST MODELS; NETWORK OPERATOR; OPEN SSL; OPERATION MODE; PERFORMANCE EVALUATION; PERFORMANCE IMPACT; PRIMARY FACTORS; SECURITY; SERVER RESOURCES; SESSION INITIATION PROTOCOL; SIP SERVER; SYMMETRIC KEYS; TRANSPORT LAYER SECURITY; TRANSPORT PROTOCOLS; VOICE OVER IP;

COMPUTER NETWORKS; COMPUTER OPERATING SYSTEMS; COSTS; INTERNET PROTOCOLS; INTERNET TELEPHONY;

SEEBECK EFFECT;

EID: 84865329284     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2011.2180922     Document Type: Article

References (63)

1. "Global IP network latency," AT&T, 2011 [Online]. Available: http://ipnetwork.bgtmo.ip.att.net/pws
2. "MySQL," 2011 [Online]. Available: http://www.mysql.org
3. "The network simulator-ns-2," 2011 [Online].Available: http://www. isi.edu/nsnam/ns/
4. "OpenSSL," 2011 [Online]. Available: http://www.openssl.org
5. "OProfile," 2011 [Online]. Available: http://oprofile. sourceforge.net
6. "SIP forum," 2011 [Online]. Available: http://www.sipforum.org
7. "VoIP Security Alliance," VOIPSA [Online]. Available: http://www. voipsa.org
8. A. Abdelal and W. Matragi, "Signal-based overload control for SIP servers," in Proc. 7th Annu. IEEE Consumer Commun. Netw. Conf., Las Vegas, NV, Jan. 2010, pp. 1-7.
9. A. Acharya, X.Wang, and C.Wright, "A programmable message classification engine for session initiation protocol (SIP)," in Proc. 3rd ACM/IEEE Symp. Archit. Netw. Commun. Syst., Orlando, FL, Dec. 2007, pp. 185-194.
10. G. Apostolopoulos, V. Peris, and D. Saha, "Transport layer security: How much does it really cost?," in Proc. 18th Annu. IEEE INFOCOM, New York, NY, Mar. 1999, vol. 2, pp. 717-725.
11. V. Balasubramaniyan, A. Acharya, M. Ahamad, M. Srivatsa, I. Dacosta, and C. Wright, "SERvartuka: Dynamic distribution of state to improve SIP server scalability," in Proc. 28th Int. Conf. Distrib. Comput. Syst., Beijing, China, Jun. 2008, pp. 562-572.
12. D. Butcher, X. Li, and J. Guo, "Security challenge and defense in VoIP infrastructures," IEEE Trans. Syst., Man, Cybern., Part C. Appl. Rev., vol. 37, no. 6, pp. 1152-1162, Nov. 2007. (Pubitemid 350130708)
13. B. Campbell, J. Rosenberg, H. Schulzrinne, C. Huitima, and D. Gurle, "Session Initiation Protocol (SIP) extension for instant messaging," RFC 3428, 2002.
14. E. Cha, H. Choi, and S. Cho, "Evaluation of security protocols for the session initiation protocol," in Proc. 16th Int. Conf. Comput. Commun. Netw., Honolulu, HI, Aug. 2007, pp. 611-616. (Pubitemid 351403517)
15. C. Coarfa, P. Druschel, and D.Wallach, "Performance analysis of TLS Web servers," in Proc. Internet Soc. Symp. Netw.Distrib. Syst. Security, San Diego, CA, Feb. 2002.
16. "Sun Crypto Accelerator 6000 PCIe card," Oracle Corporation, Redwood Shores, CA [Online]. Available: http://www.oracle.com/us/products/ servers-storage/networking/031146.htm
17. M. Cortes, J. Ensor, and J. Esteban, "On SIP performance," IEEE Netw., vol. 9, no. 3, pp. 155-172, Nov. 2004. (Pubitemid 44616303)
18. I. Dacosta, V. Balasubramaniyan, M. Ahamad, and P. Traynor, "Improving authentication performance of distributed SIP proxies," in Proc. 3rd Int. Conf. Principles, Syst. Appl. IP Telecommun., Atlanta, GA, Jul. 2009, pp. 1-11.
19. I. Dacosta and P. Traynor, "Proxychain: Developing a robust and efficient authentication infrastructure for carrier-scale VoIP networks," in Proc. USENIX Annu. Tech. Conf., Boston, MA, Jun. 2010, p. 10.
20. T. Dierks and E. Rescorla, "The Transport Layer Security (TLS) Protocol version 1.2," RFC 5246, 2008.
21. E. Nahum, J. Tracey, and C. Wright, "Evaluating SIP server performance," Perform. Eval. Rev., vol. 35, no. 1, pp. 349-350, Jun. 2007. (Pubitemid 350158097)
22. D. Eastlake and P. Jones, "US Secure Hash Algorithm1 (SHA1)," RFC 3174, 2001.
23. J. Fabini, N. Jordan, P. Reichl, A. Poropatich, and R. Huber, "IMS in a bottle: Initial experiences from an OpenSER-based prototype implementation of the 3GPP IP multimedia subsystem," in Proc. Int. Conf. Mobile Bus., Copenhagen, Denmark, Jun. 2006, p. 13.
24. "RT for openssl.org," 2011 [Online]. Available: http://rt.openssl.org/Ticket/Display.html?id=598&user=guest&pass=guest
25. A. Freier, P. Karlton, and P. Kocher, "The SSL Protocol version 3.0," Internet draft, Netscape Communications, 1996 [Online]. Available: http://wp.netscape.com/eng/ssl3/ssl-toc.html
26. R. Gayraud and O. Jacques, "SIPp," 2010 [Online]. Available: http://sipp.sourceforge.net
27. V. Gurbani, S. Lawrence, and A. Jeffrey, "Domain certificates in Session Initiation Protocol (SIP)," RFC 5922, 2010.
28. V. Gurbani, R. Mahy, and B. Tate, "Connection reuse in the Session Initiation Protocol (SIP)," RFC 5923, 2010.
29. V. Gurbani, D. Willis, and F. Audet, "Cryptographically transparent session initiation protocol (SIP) proxies," in Proc. IEEE Int. Conf. Commun., Jun. 2007, pp. 1185-1190. (Pubitemid 351145698)
30. V. Hilt, E. Noel, C. Shen, and A. Abdelal, "Design considerations for Session Initiation Protocol (SIP) overload control," RFC 6537, 2011.
31. V. Hilt and I. Widjaja, "Controlling overload in networks of SIP servers," in Proc. IEEE Int. Conf. Netw. Protocols, Orlando, FL, Oct. 2008, pp. 83-93.
32. "SIP express router (SER)," IPTel.org, 2007 [Online]. Available: http://www.iptel.org/ser
33. K. Kent, R. Iyer, and P. Mohapatra, "Architectural impact of secure socket layer on Internet servers," in Proc. Int. Conf. Comput. Design, Austin, TX, Oct. 2000, pp. 7-14.
34. A. Keromytis, "Voice over IP: Risks, threats and vulnerabilities," in Proc. Cyber Infrastruct. Protection Conf., New York, NY, Jun. 2009.
35. J. Kim, S. Yoon, H. Jeong, and Y. Won, "Implementation and evaluation of SIP-based secure VoIP communication system," in Proc. IEEE/IFIP Int. Conf. Embedded Ubiquitous Comput., Shanghai, China, Dec. 2008, vol. 2, pp. 356-360.
36. E. Nahum, J. Tracey, and C.Wright, "Evaluating SIP proxy server performance," in Proc. 17th Int.Workshop Netw. Oper. Syst. Support Digital Audio Video, Urbana-Champaign, IL, Jun. 2007.
37. "Data Encryption Standard (DES)," NIST, Boulder, CO, 1993 [Online]. Available: http://www.itl.nist.gov/fipspubs/fip46-2.htm
38. "Advanced Encryption Standard (AES)," NIST, Boulder, CO, 2001 [Online]. Available: http://www.csrc.nist.gov/publications/fips/fips197/fips- 197.pdf
39. E. Noel and C. Johnson, "Novel overload controls for SIP networks," in Proc. 21st Int. Teletraffic Cong., Paris, France, Sep. 2009, pp. 1-8.
40. K. Ono and H. Schulzrinne, "One server per city: Using TCP for very large SIP servers," in Proc. 2nd Int. Conf. Principles, Syst. Appl. IP Telecommun., Heidelberg, Germany, Oct. 2008, pp. 133-148.
41. "The Open SIP Server," OpenSIPS, 2011 [Online]. Available: http://www.opensips.org
42. K. K. Ram, I. Fedeli, A. Cox, and S. Rixner, "Explaining the impact of network transport protocols on SIP proxy performance," in Proc. IEEE Int. Symp. Perform. Anal. Syst. Softw., Austin, TX, Apr. 2008, pp. 75-84.
43. "Light Reading. VoIP security: Vendors prepare for the inevitable," VoIP Services Insider vol. 5, no. 1, Jan. 2009.
44. E. Rescorla, "Openssl-examples," 2002 [Online]. Available: http://www.rtfm.com/openssl-examples
45. E. Rescorla, SSL and TLS: Designing and Building Secure Systems. Reading, MA: Addison Wesley, 2000.
46. E. Rescorla and N. Modadugu, "Datagram transport layer security," RFC 4347, 2006.
47. R. Rivest, "The MD5 message digest algorithm," RFC 1321, 1992.
48. R. Rivest, A. Shamir, and L. Adleman, "Cryptographic communication systems andmethod,"MIT Lab for Computer Science, Cambridge, MA, Tech. Rep. TR-212, 1979.
49. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, and E. Schooler, "SIP: Session Initiation Protocol," RFC 3261, 2002.
50. S. Salsano, L. Veltri, and D. Papalilo, "SIP security issues: The SIP authentication procedure and its processing load," IEEE Netw., vol. 16, no. 6, pp. 38-44, Nov. 2002.
51. B. Schneier, Applied Cryptography (2nd Edition). New York:Wiley, 1996.
52. H. Schulzrinne, "SIPd," [Online]. Available: http://www.cs.columbia. edu/IRT/cinema
53. H. Schulzrinne, S. Casner, R. Frederick, and V. Jacobson, "RTP: A transport protocol for real-time applications," RFC 3550, 2003.
54. H. Schulzrinne, S. Narayanan, J. Lennox, and M. Doyle, "SIPstone-Benchmarking SIP server performance," 2002 [Online]. Available: http://academiccommons.columbia.edu/catalog.ac:109963
55. C. Shen, E. Nahum, H. Schulzrinne, and C. Wright, "The impact of TLS on SIP server performance," Comput. Sci. Dept., Columbia Univ., New York, NY, Tech. Rep. cucs-022-09, 2009.
56. C. Shen and H. Schulzrinne, "On TCP-based SIP server overload control," in Proc. Principles, Syst. Appl. IP Telecommun., Munich, Germany, Aug. 2010, pp. 71-83.
57. C. Shen, H. Schulzrinne, and E. Nahum, "Session initiation protocol (SIP) server overload control: Design and evaluation," Proc. Principles, Syst. Appl. IP Telecommun., Services Security Next Generation Netw., vol. 5310/2008, pp. 149-173, Oct. 2008.
58. S. V. Subramanian and R. Dutta, "Comparative study of secure vs. Non-secure transport protocols on the SIP proxy server performance: An experimental approach," in Proc. Int. Conf. Adv. Recent Technol. Commun. Comput., Kottayam, India, Oct. 2010, pp. 301-305.
59. V. Tzvetkov and H. Zuleger, "Service provider implementation of SIP regarding security," in Proc. 21st Int. Conf. Adv. Inf. Netw. Appl.Workshops, Niagara Falls, Canada, May 2007, vol. 1, pp. 30-35. (Pubitemid 47565356)
60. X. Wang, R. Zhang, X. Yang, X. Jiang, and D. Wijesekera, "Voice pharming attack and the trust of VoIP," in Proc. 4th Int. Conf. Security Privacy Commun. Netw., Istanbul, Turkey, Sep. 2008, pp. 1-11.
61. C. Wright, E. Nahum, D.Wood, J. Tracey, and E. Hu, "SIP server performance on multicore systems," IBM J. Res. Dev., vol. 54, no. 1, Feb. 2010.
62. Y. Zeng and O. Cherkaoui, "Performance study of COPs over TLS and IPsec secure session," in Proc. 13th IFIP/IEEE Int. Workshop Distrib. Syst., Oper. Manage, Montreal, QC, Canada, Oct. 2002, pp. 133-144.
63. L. Zhao, R. Iyer, S. Makineni, and L. Bhuyan, "Anatomy and performance of SSL processing," in Proc. Int. Symp. Perform. Anal. Syst. Softw., Austin, TX, Mar. 2005, pp. 197-206. (Pubitemid 43804317)