IP Multimedia Subsystem (IMS) Faces Security Issues

Concept

IP Multimedia Subsystem (IMS) is a rapidly developing standard that is meant to deliver multimedia applications through multiple wireless and wireline networks. IMS is a part of standardization work for 3G mobile phone systems in UMTS networks. It is the topic that turned upside down the telecommunication world.

It has several releases starting with the release 5 (evolution from 2G to 3G networks). This release added SIP-based multimedia and Supported GSM and GPRS networks. Later, there was released CDMA2000 Multimedia Domain (MMD) on 3GPP IMS. Then release 6 added interworking with WLAN and release 7 added support for fixed networks.

Until 2011, fixed and mobile network operators plan to invest about $10.1 billion in IMS infrastructure. The generated revenue from IMS-enabled applications is expected to be about $49.6 , according to ABI Research.

Security Issues

What really discourages the users is the issue of securing an IMS network. Its architecture proves to be vulnerable, first of all because security specifications are completely lacking.

Some companies such as Verizon Wireless have proceeded to develop upgradings to IMS (A-IMS) in order to exclude the gaps in IMS.

Sipera Systems organization (VoIP products manufacturer) has authored an article in a monthly industry periodical which contained a list of unique and inherited vulnerabilities of IMS. There have been identified about 90 unique vulnerabilities and over 20,000 potential attacks to be launched against IMS networks. It will be fair to mention that these lacks are something common to IP data and VoIP networks as well.

Securing IMS

Securing IMS is a very tough task. To build an attack mechanism for IMS is quite easy and inexpensive. The potential threats for the IMS networks are:

1. Hackers are the major danger for IMS as they can use specifications and other components published as open source software on the official 3GPP web site. Hackers can write scripts to read IMS SIM cards to gain access to the IMS network.

This is why securing IMS is a very difficult work to do.

2. Protocol fuzzing can also make IMS networks vulnerable, though it is used to test applications. It works by sending semi-valid input to determine how the application reacts, and then fixing it if necessary.

The 3rd Generation Partnership Project (3GPP) creates security standards for those parts of the system that need to be standardized, never intending to standardize security alternative available to carriers for IMS. What 3GPP standardizes are security protocols between terminal and network, and interfaces between network elements so they can interoperate. 3GPP also writes guidelines for others helping them to secure IMS.

Low implementation

Low implementation is the only vulnerability of IMS, which actually is characteristic to any network. Bad implementation of the IMS architecture refers to induction of a buffer overflow on an IMS server.

Today IMS security is improving with any new release by adding innovative features. 3GPP collaborates with WiMax Forum and the packet cable industry to secure IMS networks accessed by broadband networks.

Nevertheless, the IMS is incumbent upon carriers to contain their IMS networks, its framework requires intense security works.