Kuro RS

Kuro RS is the programmable interface to all IrDa devices. Kuro learns and remember IrDa signaling from the remote control, and it can control the devices using that signalling by command from computer programming.

Reference: http://www.kuroutoshikou.com/modules/display/?iid=928

Home DLNA

DLNA = Digital Living Network Alliance

DLNA is the alliance networking devices which can work together. If the device had passed to check following the DLNA specifiation, it could show DLNA logo. The sound likes BDA standard in Blu-Ray DVD.

In the easy way to understand DLNA:
DLNA is established to work interoperate between network devices by focus on sharing multi-media in the home network. DLNA must be supported uPnP (Universal Plug and Play). uPnP is a network sharing protocol with zero configuration. However, it have to config in the server side. After the devices is plugged, other connected devices can see files in the server.

An Experimental in OpenIMS

Prerequisites
Tested under Linux Ubuntu 8.10

Software :
gcc , g++, make, java 6 , bison, flex, ant, svn, mysql, libmysql, libxml2, ipsec-tools, openssl, bind, apache, php5, libapache2-mod-php5, phpmyadmin, libosip2, libexosip2

Hardware :
CPU : Intel Core 2 Duo E8400 3.00 GHz, Memory : 4 GHz

IMS Client

OpenIC Lite: http://www.fokus.fraunhofer.de/en/fokus_testbeds/ open_ims_playground/components/openic/index.html
UTC IMS Client: http://uctimsclient.berlios.de/
IMS Communicator: http://imscommunicator.berlios.de/


Result:


====================== P-CSCF Register and Subscription ===================
4(6922) INF:P-CSCF:---------- P-CSCF Dialog List begin --------------
4(6922) INF:P-CSCF:[ 79] Dir:[0] Call-ID:<1038497194> AOR:1://147.127.240.91:5062
4(6922) INF:P-CSCF: Method:[2] State:[3] Exp:[600000]
4(6922) INF:P-CSCF: RR:
4(6922) INF:P-CSCF:---------- P-CSCF Dialog List end --------------

5(6923) INF:P-CSCF:---------- Registrar Contents begin --------
5(6923) INF:P-CSCF:[ 241] C: <0://147.127.240.91:5062> Exp:[599998] R:[ 1]

5(6923) INF:P-CSCF: SR:
5(6923) INF:P-CSCF: NAT:<1://127.0.0.1:5062>
5(6923) INF:P-CSCF: P: D[X]
5(6923) INF:P-CSCF:---------- Registrar Contents end ----------
5(6923) INF:P-CSCF:---------- Subscription list begin ---------
5(6923) INF:P-CSCF:[ 3] P: D:[600030]
E:[-1228484943] Att:[ 0]
5(6923) INF:P-CSCF:---------- Subscription list end -----------


====================== I-CSCF Register ===================
18(7081) DBG:sm_process(): Peer hss.open-ims.test State R_Open Event R_Rcv_Message
1(7063) INFO:I-CSCF:new_scscf_entry:
18(7081) DBG:sm_process(): Peer hss.open-ims.test State R_Open Event R_Rcv_Message
2(7064) INFO:I-CSCF:new_scscf_entry:


====================== S-CSCF Register ===================
5(7039) INF:S-CSCF:---------- Registrar Contents begin --------
5(7039) INF:S-CSCF:[ 3] P: R[ 1] Early-IMS: <> Barred: [ ]
5(7039) INF:S-CSCF: CCF1: CCF2: <>
5(7039) INF:S-CSCF: C: Exp:[599527]
5(7039) INF:S-CSCF: Path:
5(7039) INF:S-CSCF: UA:
5(7039) INF:S-CSCF: S: Event[0] Exp:[599527]
5(7039) INF:S-CSCF: S: Event[0] Exp:[599559]
5(7039) INF:S-CSCF:---------- Registrar Contents end ----------



=============== UTC IMS Client Register ===================
15:02:33> REGISTER
15:02:33> Unauthorized - Challenging the UE (for REGISTER)
15:02:33> REGISTER with credentials
15:02:33> OK - SAR succesful and registrar saved (for REGISTER)
15:02:33> IMPUs:
15:02:33> SUBSCRIBE (reg event)
15:02:33> Subscription to REG saved (for SUBSCRIBE)
15:02:34> NOTIFY
15:02:34> OK (NOTIFY)

----------- Invite ------------------------------------
15:12:26> INVITE
15:12:26> trying -- your call is important to us (for INVITE)
15:12:26> Ringing (for INVITE)
15:12:35> OK (for INVITE)
15:12:35> ACK

----------- Bye ------------------------------------
15:13:41> BYE
15:13:41> OK (BYE)

----------- De-Register ------------------------------------
15:02:46> Unauthorized - Challenging the UE (for REGISTER)
15:02:46> OK - SAR succesful and registrar saved (for REGISTER)
15:02:49> NOTIFY
============================================================

More details: http://docs.google.com/Doc?id=d64gtmn_216hq7ckfdj

SAML

Security Assertion Markup Language (SAML)

SAML is the XML Framework for exchanging security information across the internet. SAML does not provide Identity management, security algorithm.SAML just provide the security exchanging framework.Same as M$ Passport but it can be use with any product.

Advantage: Single Sign On (SSO) , Limitations of Browser Cookies (cannot cross session), Identiy Federation, and Web Services.

SAML has 4 layers: Assertion, Protocol, Binding, and Profile

1. Assertion -> Key with associate to the subject (Authen, Attribute, Authorization)
2. Protocol -> Request and Response pairs for obtaining assertions [Service Provide <--> Identity provider]
3. Binding -> Map SAML message with SOAP
4. Profile -> Set of rules describing how SAML assertions are exchanged, e.g., Browser/POST profile. It combines assertion, protocol and binding for specific scenario (Web SSO Profile)

This is an SAML example.

Reference: http://www.infoq.com/presentations/saml

OpenIMS Tutorial

How to install Open IMS (http://www.openimscore.org/ ) in Linux

http://letsgoustc.spaces.live.com/blog/cns!89AD27DFB5E249BA!180.entry?_c=BlogPart

IPSec vs. TLS/SSL

IPSec - IPSeic is Security protocol, run at IP Layer, suit consist of Authentication Header (AH) and Encapsulation Security Payload (ESP). IPSec is common use with Site - to - Site configuration.

TLS/SSL - Transport Layer Secure, Socket Secure Layer, run at transport layer, application aware ssl support.

TLS/SSL has advantange than IPSec following topics below:
- Most application e.g. SIP Client, Web browser already supported TLS/SSL. It's easier than IPSec which require complexity Security Association configuration. Although, there is IPv6 , supported IPsec, but it's quite so long time that all users + applications will use IPv6 with IPSec.

- TLS/SSL doesn't have problem with NAT, but IPSec has.

- All ISPs (router) allow SSL port (e.g. 443 ) because there are lots of users use this port for doing the bank statements etc. , but some ISP don't allow for IPSec traffic unless you pay more for enterprise solution.

DW CS3 & Vista

Today, I edit the web page for a conference.
I try to edit with notepad or editplus but it doesn't support Unicode. That mean, I cannot save French language in the file. So, I look for another html tool that's Dreamweaver!!

After I install to install Dreamweaver (DW) CS3. After it finished, I found 2 problems.
1) file.mxt does not support design view in CS3, you need to add extension in DW for 3 files
- C:\Users\[username]\AppData\Roaming\Adobe\Dreamweaver 9\Configuration\Extensions.txt
- C:\Program Files\Adobe\Adobe Dreamweaver CS3\configuration\Extensions.txt
- C:\Program Files\Adobe\Adobe Dreamweaver CS3\Configuration\DocumentTypes MMDocumentTypes.xml

Reference: http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_16410

2) if you use M$ Vista, please run notepad.exe with administrator right, and open the file from notepad. Don't forget to use funtion wordwarp to see all text.

Restart DW CS3 and get it!

OpenIMS KDE #2

Start Windows Manager
# startx

This will start classical X-windows manager

If you'd like to start KDE Windows Manager
/etc/init.d/xdm start

OpenIMS KDE

Problem:
OpenIMS KDE image file in "http://www.openimscore.org/vm" is too large
for open in VMware player 2.0?

Solution:
There is no problem in VMware 1.0.3, but in the VMware verion 2.5.0, there is a problem with this message:

VMware workstation cannot open one of the virtual disks needed by this VM because it is larger than the maximum file size

You have to do this =>

Adding diskLib.sparseMaxFileSizeCheck= "FALSE"' to OpenIMS.vmx file.

And get it!!

SIP Security

SIP Security define mechanism for secure SIP in RFC 3261 following topics below:

- HTTP Digest => Easiest, still vulnerability
- S/MIME => Using PKI, authen on SIP header, encrypt on SDP, use X. 509 Certificate to vertify public key
- Open PGP => Same as S/MIME but Open PGP must be trust "public key" before using. (Deprecated)
- IPSec => Use PKI that work in IP layer, Network aware, complex setup for Key exchange and Security Association setup
- TLS/SSL => Use PKI that work in Transport layer, Software awareness only,easier than IPSec

My Asterisk Testbeded

Today, I had setup asterisk testbeded at ENSEEIHT.

There are 3 computers.

Linux: Ubuntu 8.04
SIP Client: LinPhone (recommend) , Ekiga (there is sound problem)
SIP Client: X-Lite (Windows)
SIP Server: Asterisk

Asterisk acts as SIP proxy+registra server.
Linphone acts as SIP phone client.

Step by step:
1. Just install it by using synaptic => Asterisk & LinPhone

2. Modify sip.conf and extension.conf following below:

/etc/asterisk/sip.conf

 
[general]
context=default
bindport=5060
bindaddr=0.0.0.0
srvlookup=yes

[100]                         ; this is the sip user name
secret=100                 ; this is the password
type=friend







host=dynamic            ;anyone can connect







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833















[200]







secret=200







type=friend







host=dynamic







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833















[300]







secret=300







type=friend







host=dynamic







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833

/etc/asterisk/extension.conf

[from-internal]







exten => 100,1,Dial(SIP/100)







exten => 200,1,Dial(SIP/200)







exten => 300,1,Dial(SIP/300)

3. Start asterisk service => #/etc/init.d/asterisk start [it normally starts after you install by synaptic]
4. Connect to asterisk terminal => #asterisk -r
5. You will have SIP console => *CLI>

6. CLI> sip show peers
// this command for check the sip status

7. CLI> sip show users
// this command show users

8. Start linphone (SIP Phone client), there is error message about port because linphone also use UDP: port 5060 same as asterisk service. So, you should change port of linphone. However, you can use #gconf-edit command for changing "Ekiga" listening port. In my case, I use UDP: port 5100

9. Go to client machine and start linphone (SIP Phone client). Client machine will not have port collision since it does not run asterisk server.

10. Register user with asterisk (SIP server). Account & User name is the same that specified in sip.conf.
eg. there are

Account Name=100,user=100, pass=100
Account Name=200,user=200, pass=200
Account Name=300,user=300,pass=300

SIP URI looks like => 100@asteriskIP.fr

11. After you registed with asterisk, please check the status in asterisk server with
*CLI> sip show peers
The status should label with "O.K."

12. You can call any one who already registered in asterisk server.

3G-IMS Tutorial

Good tutorials:

• 3G-IMS Tutorial
• Network Security Slides
• Distributed Computing (Java)

By Professor : Jae-Oh, Lee

Sybil Attack

What is Sybil Attack?

Ans: Sybil is forging identities.

- It is the process of counterfeiting multiple identities with malicious intent.
- A set of faulty identities are represented through a set of large identities.

Sybil works liked man-in-the middle attack which intercept data from the sender but the different is the counterfeiting (bogus) nodes (which is vulnerable with Sybil attack) in the routing path that does not existing, then, the receiver will not get data from the sender.

This attack will be threat in the P2P environment, esp. DHT protocol.

Finally, the Sybil name comes from "the women possessed with multiple personality disorder".

P2PSIP Open Source

Open-Source Implementations

• Cisco P2PSIP Project (draft-jennings-p2psip-asp)
• Columbia P2PP Project (draft-baset-p2psip-p2pp)
• SIPDHT2 Project (draft-marocco-p2psip-xpp, draft-marocco-p2psip-xpp-pcan)
• SIPDHT Project (draft-bryan-sipping-p2p) (no longer maintained)
• University of Parma Kademlia dSIP Implementation (draft-cirani-p2psip-dsip-dhtkademlia, draft-bryan-p2psip-dsip)
• Huawei's implementation of SEP peer and client protocols (draft-jiang-p2psip-sep, draft-zheng-p2psip-client-protocol)
• P2PNS: A Secure Distributed Name Service for P2PSIP (draft-baumgart-p2psip-p2pns)

Reference: http://www.p2psip.org/

VoIP and SIP Video

Interested links:

VoIP: http://www.voip-info.org/

SIP Video: http://news.zdnet.com/2422-13569_22-153763.html

Simple Chord Protocol

I wrote an article for easy to under stand how chord protocol work.

You can read it at =>
http://docs.google.com/Doc?id=d64gtmn_212cpx4mwgh

Joyeux Anniversaire

Joyeux Anniversaire:

Aujourd'hui, c'est mon professeur de l'anniversaire. Quel âge est-elle? Non, je ne peux pas le noter dans mon blog. :-)

Cependant, je vous souhaite tout le meilleur, que tous vos rêves, des souhaits et des plans pour l'avenir mai se réaliser en tant que tel que vous le souhaitez!

Translate:

Today is my professor birthday. How old is she? No, I cannot note it in my blog. :-)

However, I wish you all the best, that all your dreams, wishes and plans for the future may come true as such as you like!

Onion Routing

Onion routing for anonymous communication

There are all routers in the network with number 1...N.

Onion Router s has a public key Su and a private key Sr. The public key is well-know to onion proxies. Private keys are only known to the router.

It protects data content and identity by using public key in the proxy table to encrypt the packet like the onion. Intermediate nodes along the path will decrypt the packet using its private key.

Reference: http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group10/index.html

My slide version #2

Don't hasitate to comment it. :-)

DHT: Chord Routing

Chord is one kind of distributed hash table which provides fast distributed computation of a hash function mapping keys to nodes responsible for them.
Chord improves the scalability of consistent hashing by avoiding the requirement that every node know about every other nodes.
In N-node network, each node maintains information about only O(log N) other nodes, and a lookup requires O(log N) messages.

It looks simple but quite slow because it goes to every hop in the circle.

Chord can lookup node in peer-to-peer faster because of it searches by finger table which stores the hop in 2^i series.

e.g. N8+1 (2^0) => N9 , there is no N9, then go to N14,
N8+2 (2^1) => N10, there is no N10, then go to N14,
...
N8+32 (2^5) => N40, there is no N40, then go to N42, etc..

Note: Remember that chord always works on the clockwise for finding the successor.

However, N8 cannot determine the successor of key 34 by itself, as this successor (N38) does not appear in N8's finger table.

We will query K54, lookup(54) from N8.

First, open the finger of N8 and find the closest K54.
That's N8+32 => N40 => N42.
Next, go to N42 and open the finger table of N424
That's N42+8 => N50 => N51
Finally, go to N51 and open the finger table of N51
That's N56. Finish!!

Reference:
Paper Title: Chord: A Scalable Peer-to-peer Lookup Protocol for Internet Applications
By: Ion Stoicay , Robert Morrisz, David Liben-Nowellz, David R. Kargerz, M. Frans Kaashoekz, Frank Dabekz, Hari Balakrishnan

Privacy ISO15408

Common Criteria (Privacy) ISO 15408

Common Criteria Privacy is categorized in 4 types:
- anonymity Hide identities (Don't have details about sender or receiver)
- unlinkability Hide the session (There are 2 packets, don't know which packet belong to which session or sender)
- unobservability Hide the route and the path (Don't know the route of the packet in session)
- pseudonymity Anonymity and Responsability (Repudiation )

Ps: Merci Dr. Anas

What is DHT Network?

What is DHT Network?

DHT(Distributed Hash Table) is method of a distributed storage for pairs. There is no center server in DHT Network, every client take charge of a small range of routing, a small set of data storage, so that in the whole DHT network, data can be found, read and write.

key = put (data)
data = get (key)

For example:
Without DHT network, the client must download files based on the location of the original tracker.
On the otherhand, with DHT network, the client can download files from other trackers. It will query the hash key from other clients which open the hash key and downloading...

Advantage and disadvantage:
- Decentralization: the nodes collectively form the system without any central coordination.
- Scalability: the system should function efficiently even with thousands or millions of nodes.
- Fault tolerance: the system should be reliable (in some sense) even with nodes continuously joining, leaving, and failing.

Interested DHT protocols:
CAN (Content Addressable Network), Chord , Pastry, Tapestry

Peer to peer routing

This is a P2P Routing example in gnutella network:



Explaination:
'a' sends query to its peer (included 'b') for asking the files.
'i' and 'h' do not have the files and network, but 'b' has its local network.
So, 'b' forward the query to check its local, and 'e' forward it again .
After propataion, 'g' is matched and reply back to 'a'.

Ref: http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group6/index.html

Security and P2P review

P2P global view
- Client/Server VS. P2P

Security problems

P2P classification & details
- routing
- transport
- services management

How to secure
- Analysis
- Solutions

My first draft version: