Voip - Research Proposal Example

Forensics in VoIP Services April 9, 2009 An introduction to VOIP and SIP VoIP is telephony which uses a packet switched network as against circuit switched networks. VoIP transmits packets of data between smart devices (e.g. computers) over a relatively unintelligent network, whereas traditional telephony sends voice data between dumb devices (telephones) through a super smart central network.The Session Initiation Protocol (SIP) is commonly used in VoIP implementations. It provides the ability to integrate traditional voice services with web-based data services, which include self-based provisioning, instant messaging, presence, and mobility services.

It is used for call initiation, call teardown and other call related data sent during a VoIP conversation.SIP is a text based application level protocol. It depends majorly on other protocols such as IP and UDP for transport. VoIP implementations with SIP mostly use a SIP proxy server to which the login credentials of users are authenticated. The proxy server also routes call and signaling data. Clients can establish a communication link between each and forward SIP messages via the proxy. Communications using SIP are also used for changing call parameters or other features such as integrating more callers into a conference session.

SIP registrars are used as additional servers to locate other users.Problems with using VoIPVoIP technology is likely to be misused by criminals as it often does not require verification of any details to start using the service. The security of making such calls may also attract criminals, as many implementations use strong encryption to secure both the voice payload and control messages. Skype uses 256 bit AES encryption while Google Talk does not encrypt its payload (but will support encryption in the future).

As an example, an organized crime ring may decide to use Skype software that allows ring members to communicate anonymously. Criminals could use laptops running Skype, create profiles like a regular user and communicate when necessary. Investigations by law enforcement agencies would not yield any results, as there is no line to wire tap, no call logs and no ability to identify the geographic location of a particular user.Use of Forensic Computing in VoIPMemory forensics, a relatively unexplored area of computer forensics, can be used in VoIP.

In this, the contents of the volatile memory (RAM) of a system are stored and examined for suspicious data. The RAM potentially contains information about the system including open files, active processes, terminated processes and device drivers. Imaging the memory of a target machine allows evidence to be collected without any downtime.Imaging of memory from a system needs some interface with the data. Linux systems contain a memory device, similar to devices representing hard disks, from which data can be copied to an image.

Windows XP does not have an equivalent memory device and must use a section object to gain access to the memory. The section object allows a mapping to memory pages which can then be accessed by multiple processes.The specific VoIP related evidence that can be collected from the volatile memory of a machine running VoIP is currently a topic of research, and is expected to be known in the near future.Works cited:Simon, MatthewandSlay, Jill "VoiceoverIP:ForensicComputingImplications". SECAU - Security Research Centre, (n.d.) http://scissec.scis.ecu.edu.au/anzsys08/proceedings/2006/forensics/Simon%20Slay%20-%20Voice%20over%20IP-%20Forensic%20Computing%20Implications.pdf. 9 April, 2009.