A Comprehensive Survey of Voice over IP Security Research

• Published in: IEEE Communications surveys and tutorials Vol. 14; no. 2; pp. 514 - 537
• Main Author: Keromytis, A. D.
• Format: Journal Article
• Language: English
• Published: IEEE 01.01.2012
• Subjects: Authentication; Internet telephony; Media; Protocols; security; Servers; SIP; Taxonomy; VoIP
• ISSN: 1553-877X
• DOI: 10.1109/SURV.2011.031611.00112

We present a comprehensive survey of Voice over IP security academic research, using a set of 245 publications forming a closed cross-citation set. We classify these papers according to an extended version of the VoIP Security Alliance (VoIPSA) Threat Taxonomy. Our goal is to provide a roadmap for researchers seeking to understand existing capabilities and to identify gaps in addressing the numerous threats and vulnerabilities present in VoIP systems. We discuss the implications of our findings with respect to vulnerabilities reported in a variety of VoIP products. We identify two specific problem areas (denial of service, and service abuse) as requiring significant more attention from the research community. We also find that the overwhelming majority of the surveyed work takes a black box view of VoIP systems that avoids examining their internal structure and implementation. Such an approach may miss the mark in terms of addressing the main sources of vulnerabilities, i.e., implementation bugs and misconfigurations. Finally, we argue for further work on understanding cross-protocol and cross-mechanism vulnerabilities (emergent properties), which are the byproduct of a highly complex system-of-systems and an indication of the issues in future large-scale systems.