H.323的安全性分析及评估工具集的设计.pdfVIP

中国科技论文在线 H.323 的安全性分析及评估工具集的设计 姚天厚，辛阳** （北京邮电大学计算机学院，北京100876 ） 5 摘要：近年来，VoIP 技术广泛普及，而作为VoIP 的标准之一，H.323 标准发展迅猛， 其 产品的应用范围也越来越广泛，已经成为了最主流的VoIP 标准之一。然而，H.323 标准中 存在着一些潜在的安全隐患，不同的 H.323 产品的安全性也各有差异，因此一些攻击手段 可能会对H.323 会话造成影响。这给使用H.323 技术带来了一定的安全风险。本文对H.323 10 标准进行了介绍，对其安全性进行了分析，列举了 H.323 产品可能存在的若干安全缺陷， 并提出了相应的攻击手段。之后本文根据这些攻击手段设计了一个安全评估工具集，用于 对H.323 产品的安全性进行测试。 关键词：信息安全；IP 电话；H.323；网络攻击；安全性测试 中图分类号：TP393.0 15 Analysis on Security of H.323 and Design of Evaluation Toolkit YAO Tianhou, XIN Yang (School of Computer Science, Beijing University of Posts and Telecommunications, Beijing 20 100876) Abstract: In recent years, VoIP technology is widely spread, and as one of the standards of VoIP, H.323 recommendation is developing rapidly, and the range of application of its product is increasingly widely. H.323 has become one of the most mainstream VoIP standards. However, there are some potential safety hazards exist in H.323 recommendation, and security of different 25 H.323 products also varies, so H.323 session may be vulnerable to some means of attack. That brings a certain security risk to using H.323 technology. In this paper, the H.323 recommendation was introduced, and its security was analyzed. Furthermore, some potential security flaws exist in H.323 were listed, and the corresponding means of attack were proposed. After that, a security evaluation toolkit based on these attacks was designed, used for H.323 product security testing. 30 Key words: Information Security; VoIP; H.323; Network Attack ; Security Testi