1. Authentication Methods
and Security
in Videoconferencing Systems
TERENA AA-Workshop Malaga, November 2003
Dimitris Daskopoulos
GRNET

2. Contents
 Videoconferencing practices
 Problematic points
 Security standards
 Current techniques in H.323
 Future developments in H.323

3. Video conferencing worlds
 H.323
 SIP
 MBONE
 other: VRVS, AG, proprietary VC s/w

4. The importance of
videoconference security
 identity
 confidentiality
 trust

5. Current practices
 authentication assumed,
but rarely examined
 ad hoc authentication solutions
 point-to-point vs. multi-party call
practices

6. Requirements for
videoconferencing security
 endpoint authentication
 call signaling security
 media encryption

7. Problematic points
 telephony-world preconceptions
 people vs. endpoints
 room-based systems
 users vs. executives
 multi-party conferences
 multi-domain conferences

8. Conferencing:
a three-step process
 endpoint registration (authentication)
 dialing (authorization)
 media exchange

9. Protocols involved in H.323
conferencing
 H.225 - RAS (UDP):
Registration, Admission, Status
 H.225 - Q.931 (TCP):
Call Signaling (Setup & Termination)
 H.245 (TCP):
Call Control (Capabilities, Preferences,
Channel Opening and Flow Control)
 RTP (UDP):
media streams

10. Security standards for
videoconferencing:
 H.323 - H.235
 shared secret - symmetric (Annex D)
 certificates - assymetric (Annex E)
 secure media streams - S/RTP (Annex G)
 SIP
 SSL Digest Authentication
 S/MIME media

11. Current security options in
H.323
H.235 not widely supported by endpoints.
What options are we left with?
 Identification by IP and alias
 IPSec
 other tricks

12. Current authentication
techniques in H.323
 point-to-point conferences (registration)
 IPand alias authentication
 web enhanced methods
 multi-party conferences (calling)
 generated target number
 central calling

13. Security in H.323:
the Gatekeeper
 H.235
 Cisco MCM: user/password piggy-back
 Radvision ECS: predefined endpoints
 GNU GK: predefined endpoints, Q.931
signaling filters

14. Security in H.323:
Gatekeeper backends
 Gatekeeper APIs (SNMP or proprietary)
 Cisco GKAPI
 Radvision ECS API (SNMP-based H.348?)
 Radius
 Cisco MCM
 GNU GK
 DBMS
 Radvision ECS
 GNU GK
 LDAP
 Radvision ECS
 GNU GK

15. Security in H.323:
web integration of backends
 web-based flexible custom interfaces
 SSL enabled
 allow user control of IP and aliases
 allow scheduling and reservation of
resources (an added benefit)

16. Current problems in H.323
 securing registration of multiple aliases
is difficult
 ad-hoc authentication techniques do not
accommodate all endpoints
 mobility is hindered
 firewall/NAT traversal is difficult
 media stream protection is lacking

17. Future developments in
H.323 security
 H.350:
 LDAP authentication
 LDAP endpoint setup
 H.235:
 wider support in products
 certificate support
 media stream encryption

18. Links and References
 Internet2 - 2003 fall MM: securing video
 The TERENA IP Telephony Cookbook
 The VIDE VideoConf CookBook
 The VIDE Development Initiative
 Internet2 - Video Middleware (VidMid)
 Internet2 - VC SiteCoordinatorsTraining
 Internet2 - VidMid H.350
 Packetizer References

19. Questions ?

20. The END!