Cloud & Telecom Security

本文回顾综述了业界在移动核心网中利用对等网络技术的进展，以及中国电信业界在此领域内的努力和贡献等。对相关的性能和安全问题进行了研究分析。最后，文章给出了未来研究方向的分析和展望。
关键词：对等网络  分布式技术
International Standards of Mobile Core Network Based On P2P Technology
Abstract: This paper reviewed the new progress at mobile core network based on P2P technology. Technological challenges, including performance and security problems, are investigated. Finally, the trend analysis and roadmap were given.
Key Words: Peer to Peer Network, Distributed Network Technology Read more…

前面关于架构师如何思考(参见http://sbin.cn/blog/2008/06/16/perfect-architect/ 以及 http://sbin.cn/blog/2008/11/17/architecture-thinking/)进行了一些探讨，架构师应该充分理解业务背景和需求、综合运用IT的多领域技术，对企业IT的战略、发展路线、以及某些具体的实际的需求提出分析或解决方案。所以，架构师注定要是双语的 – 可以使用业务语言和管理层沟通，可以使用很技术的语言和技术专家和工程师们沟通。

在前文中还多次强调了架构师应该充分掌握并熟练运用分类学 – 从多维度、多角度来观察、思考，并深入浅出地阐述展现自己的分析和解决方案。在实际工作中，架构师经常需要面对具有很多不确定性的需求，在具有很多不确定性的环境下开发战略、路线图或解决方案，制定预算等。这时候，通常是两难的： 没有清晰的战略和路线图，制订了不了预算和项目计划；没有预算分析，管理层又很难批准什么战略或路线图。是Top-down呢，还是bottom-up呢？  要解决这种困境，需要架构师们主动地、灵活地出击，抓住问题的主要“矛盾”和关键环节，拿出“高”、“中”、“低”，“近”、“中”、“远”，等一些组合的分析，以便于管理层进行决策。

在诸多不确定性的环境下，要作出较为准确、切中要害的分析，架构师的个人经验和专业知识非常重要。除了分类学一个工具之外，还有一个小工具叫估算。 Read more…

读到下面这则Gartner发布的分析报告，一丝凉意从心里悄悄地弥漫到周围。金融风暴之IT冬天要来了吗？中国的IT会怎么样？IT安全有会怎样？从新闻上来，华为在国内超低价拿下中国电信C网大合同，又刚刚在北美加拿大斩获无线大单，而中兴也在海外收颇丰。联想作为中国公司全球化的先锋，最近负面消息不断 – 股价下跌，分析公司下调预期，裁员，不一而足。从数字上看似乎已经在开始体会金融风暴的冷风，但是CFO也讲了，这也正是业务拓展的机会啊，该出手时还是要出手。

扯远了，回来说Gartner和IT。 Read more…

2008年10月16日，Gartner如期推出了今年对于2009年前十位最重要的战略性技术的瞻望和预测。以下是我的不算翻译的一个翻译，希望方便大家的阅读分享。

1 虚拟化 Virtualization。 虚拟化这个词已经流行了较长一段时间了，还有更早些的按需(On-demand)计算。大概五年前，我刚刚加入CA后一个月，还特地赶到CA在美国的总部，参加了一次管理按需计算的Workshop和培训。时光荏苒，白驹过隙，当下服务器厂商已经将虚拟化功能技术特色作为重要的售前方案元素来推荐和比较。
2 云计算 Cloud Computing。按照Gartner的描述，云计算具有以下几个关键特征：a 将容量能力按照服务交付；b 服务的交付高度可扩展并充满弹性；c 使用互联网技术和技巧来开发和交付服务；d 用以对外部客户交付服务的设计。可以认为，设计之初就具备的高度弹性和扩展性是“云计算”能够带来的最大收益。 Read more…

After years of rumors, the final picture of China telco re-org got announced today. It’s somewhat the same as the gossip inside the circle.
China Netcom(CNC) will be merged into China Unicom to be the new China Unicom. Meanwhile, The “C” and “G” networks of China Unicom will be splitted, while the “C” part will be merged into China Telecom. China Railcom (CRC) will be merged into China Mobile(CMCC).

The executives of the new companies are also mentioned:

• CMCC – Wang Jianzhou, Zhang Chunjiang(from CNC);
• CT – Wang Xiaochu, Shangbin(from CUC);
• CUC – Chang Xiaobing, Zuo Xunsheng(from CNC);

This re-grouping is interlocked with the 3G licenses. It’s said that the new CMCC will get TD-SCDMA, while new CUC will get WCDMA, and CT will get CDMA2000.

It’s interesting to watch back to what I summarized the evolvement of China telecommunication industry in the past 10 years.

All the world know there will be an important event at China at Auguest – Beijing Olympic Games 2008, however, here is a reminder to related IT people on network circuit ordering,engineering and changes.

As a traditional custom or non-formal regulation, mainland China will require China telecom companies to “make sure there are uninterrupted communications during the gaming period.”, in other words, aLL major China carriers will freeze their network during the period. This will affect all cities in mainland China.

By network freezing, there will be no change to existing network allowed. This includes addition of circuits, upgrade, downgrade, disconnect and all planned maintenance work.

Although it’s not clear of the exact time period for this network freeze yet, but the effects will most likely be felt from beginning of July to end of September.

Please pay attention to this and plan your infrastructure engineering at China with proper lead time.

SPIT是指Spam over Internet Telephony，在互联网电话（稍微不同于IP电话）上的垃圾骚扰性活动，可能是个莫名奇妙的留言、广告，或者一段自动播放的恶意、其他蓄意的电话等。很多报道和文章中都将它列为VoIP的一个重要安全威胁之一。换句话说，那时的电话不像当前的PSTN那样被运营商严格控制，从信令到话音信息都在当前这个极具威胁的互联网上传输，这样就可能会被Man-In-The-Middle攻击，可能会被窃听，可能会被劫持，可能会被插入，欺骗等等。

Gartner的专家Lawrence Orans在一篇报道中指出SPIT不会和当前的SPAM这样泛滥起来，原因是SPIT没有SPAM那样的业务模式 – business model.

SPAM – 发出垃圾邮件，用户看到了其中的诱惑性内容，点击链接，引导到某个网站，可能完成某种交易或者操作。从而，SPAMMER就盈利了。而SPIT则不会，播放一段录音，用户即使耐心的听完，也不可能、不方便拿笔记下来某个链接，到某个website上输入，完成某个交易。所以，SPIT不会带来特别明显的利益，所以也就不会泛滥。

据说未来可能会出现，听广告、打免费电话的业务。LO的观点有道理，但是SPIT也可能会出现新的业务模式，从而带来前来的利欲熏心者。

According to Zeroday Initiative report, Skype has a vulnerability, which could result in a denial of service or arbitrary code execution. A remote attacker could attempt to exploit this issue by convincing a user to visit a specially-crafted Web page. To remove this vulnerability, all clients need to be updated or installed as of 11/15/2007 or later versions.

In order to avoid other guys to break into your computer, please upgrade your Skype to 3.6. Read more…

Today Network World Asia reported that security flaw was discovered at iPhone, the most buzzing product from Apple. Attackers could exploit a bug in this feature to trick a victim into making phone calls to expensive “900″ numbers or even keep track of phone calls made by the victim over the Web, said Billy Hoffman, lead researcher with SPI Labs. The iPhone could even be stopped from dialing out, or set to dial out endlessly, he said. Read more…

I noticed the report by Infonetics betrayed a fact that “VoIP Equipment Revenue Declines in Q1 07″. According to the author, “This is a seasonal effect more than anything else,” . I don’t think so. I doubt the benefit of VoIP to the end users by posting “VoIP save money?” three months ago. It should be reflecting something more than seasonal effect.

VoIP is a novel technology that can improve the productivity of the fibers and circuits by mulplexing or converging more business into one pipe. So the prediction is the how much you can multiplex into your existing IP pipe. For telco operators, they can easily consolidate adequate voice traffic and multiplex them to make full use of their existing infrastructure. But it’s not always true for average enterprises.

See the full story by Infonetics: Read more…

We have talked about VOIP legal monitoring and source location. In H.323 , softswitch or IMS VOIP network, it can possibly be done through signaling analysis. But as to P2P VOIP, especially encrypted P2P VOIP such as SKYPE, it is very difficult to identify P2P voice traffic.

Traffic classification and traffic identification can be useful in both ISP and enterprise environment, as well as in various occasions:

• Network planning and design
• Security policy such as legal monitoring, blocking
• QOS policy such as rate limitation, prioritization
• Pricing

Now there are two kinds of P2P traffic identification algorithms: transport layer based or payload based. Read more…

As an annual meeting, China VOIP Conference & EXPO, China FMC/IMS Summit, China Enterprise IP communication Solutions Conference had hold on 23~24th, May, Beijing. Check here for its official website. I like to share some highlights of this meeting.

1. Three kinds of VOIP tech in China
Following the steps of VOIP standard development, there are three kinds of VOIP networks in China.

# H.323
H.323 is ITU-T standard framework for multimedia service in Non-QoS guaranteed network. The main service providers in china all have their own H.323 network. China Unicom has the biggest H.323 network in the world providing both audio and video services. It covers almost the whole China, has more than 1800K gateways and carries one billion mintues calls every month. This may own to the original multi-layer GK network structure which greately improves the scalability of H.323.

# Softswitch
Softswitch is a next generation network infrastructure based on SIP, H.248 and other protocols proposed by IEEE and ITU-T. Now, all 17951 call of China mobile and more than one third long distance call of China Telecom are carried by softswitch. China Netcom has been using softswitch to replace the Class 4 switch since 2005. CRC(China Railway Communication CO..,Ltd.) and China Satcom (China Satellite Communication Corporation) also have their softswitch network.

# IMS
The first proposal by 3GPP Release 5, IMS(IP multimedia subsystem) has the advantage in providing mobile and multimedia service. It is also the most promising framework of fix and mobile Convergence. ETSI TISPAN and ITU-T began work on IMS infrastructure in the end of 2005. Thus, the main service providers in China are paying attention to IMS and deploying trial network of IMS now. Read more…

VoIP security is an interesting topic in the circle. VoIPsa is a very good community where you can find much of valued discussions and knowledge sharing. It’s highly recommended to register to their mailing list if you are interested to keep in touch with the latest research on VoIP security.

I recommend a very good article to you. It’s from DataStronghold, by Mr. Michael Talbert, where you can find very comprehensive summary of security threats to VoIP systems. The below is some points of the article.

• SPIT: The new Spam for VoIP
• Eavesdropping
• Phishing the Waters of Voice over IP
• SIP Registration Hijacking
• Spoofing Read more…

There have been a lot of discussions and even debate on whether or not enterprises should permit Skype. The focus point here is its security issues. I list out ten security concerns to Skype before. However, it’s indeed of value. It can help lower the voice communication cost and very convenient. There are more and more value-added service on it. Anyway, nobody can oversee the existence of hundreds of millions subscribers of Skype. It means business opportunity to many startups and technical geeks. They are proud of their hacking and breaking-into of Skype. Read more…

Solomon’s blog shared an very interesting idea: to use Skype as a home security system. When you work at office or go out for travel, you can connect back to watch what’s happening at your home. So cool !

1. Open two new accounts.
* 2. On account 1 add new user two as your ONLY contact
* 3. Re-log in as account 1 and set as follows:
Go to tools–>options–>advanced–>(tick) automatically answer Incoming calls–>
Then go to Tools–>options–>Video–>(tick) start video automatically and Only People in My contacts–>save.
Leave this account online
* 4)Log in as account 2 from another PC.

But I am wondering if there is not some security here, the world will share your home view with you, as long as they find that account. So please do remember to configure youself as the only person can talk with this account.