Session Initiation Protocol services worth US$150bn by 2012, but is it safe? 

IP networks deployed by fixed and mobile operators will lead to mainstream availability of voice over IP (VoIP) and Session Initiation Protocol (SIP) services. Take-up of these services, according to ABI Research, will also be driven by the increasing popularity of smart devices such as PDAs and Smartphones.

In its recent report ‘The Worldwide SIP Services Market’ ABI reckons SIP services will develop into the norm after 2010 and rapidly begin to dominate the world’s telecom markets. By 2012, says the company, almost half of all telecom users will be using at least one SIP service, but likely will have many services from multiple devices able to communicate with other users and services across the Web and between enterprise and public networks. This, it is calculated, will generate over US$150bn in service revenue annually, with cumulative infrastructure capital expenditure of over US$10bn by that date.

“New affordable price points and ease of use will allow consumers to benefit from SIP services such as instant messaging, video sharing, and conferencing, which will join VoIP as it takes over from circuit-switched voice,” ventures ABI Research principal analyst Ian Cox. “We have seen the start of a revolution, as mobile handsets become the product of choice not just for voice and simple text messaging, but also for any task that one can perform on a personal computer. And as networks are replaced by ‘flat architecture’ all-IP with SIP application servers in the core, all forms of communications become possible.”

”Using SIP, telephony becomes another Web application, which can be integrated into other Internet services,” continues Cox. “It enables service providers to build converged voice and multimedia services.”

ABI Research expects that by 2012, almost 1.2bn VoIP users will be active, with most users also subscribing to several forms of messaging and video sharing driven by interest in user-generated content. Additional services supported by SIP will include presence, click-to-dial, buddy lists, e-mail, and Web access, which are assumed to be ‘core’ services and included as standard in any service offering and bundled with broadband access. A portion of the VoIP users will also be connected to an FMC service.

SIP slips?
But it may not be all plain sailing for SIP. According to ‘SIP & VoIP: The Coming Security Crisis’, the latest edition of Light Reading's ‘VOIP Services Insider’ analysis, one of SIP's strongest assets is also one of its greatest liabilities: it may be an extremely flexible protocol for robust VoIP services, but this also means it can be manipulated easily by would-be intruders. According to Denise Culver, research analyst and report author, SIP security vendors currently expect a devastating VoIP network attack before SIP security is taken as seriously as it should be.

The point about potential SIP vulnerability is echoed by one of the findings of a new ‘Total Cost of Ownership’ study for service providers and network vendors, commissioned by network security analysis system specialist Mu Security and conducted by analyst Peter Fetterolf of Network Strategy Partners (NSP). This argued that the problems found with manual testing of a network’s robustness against attack were relatively obvious: many subtle system weaknesses and security flaws went undetected. The study then noted that VoIP system flaws - for example, in SIP - would have resulted in serious denial-of-service conditions in production Internet telephony networks, equating to opportunities for expensive network service outages.

You have been warned.
John Williamson