| |||||||||
|
Secure Videoconferencing Project
This project is based on VIC and VAT, the Internet real-time, multi-party videoconferencing tools developed at Lawrence Berkeley National Laboratory. VIC and VAT are based on the Draft Internet Standard Real-time Transport Protocol (RTP), developed by the IETF Audio/Video Transport working group. RTP is an application-level protocol implemented entirely within VIC and VAT, so the tools run without any operating system enhancements. Although they can be run point-to-point using standard unicast IP addresses, VIC and VAT are primarily intended as multiparty conferencing applications using IP multicast over the IP Multicast Backbone (MBONE). VIC offers optional DES encryption, and a weak XOR cipher that provides a best-case performance baseline.
Viewgraphs from 11/97 presentation at IBM Hawthorne.
ps.gz, pdf , Provably Secure Videoconferencing, CITI Technical Report 97-2.
Additions to VIC
In order to create a useful security test bed, we needed the ability to both initiate a secure VIC session and to select encryption ciphers on the fly. We also needed to be able to add ciphers and key exchange algorithms, so we implemented the changes to VIC using the GSS API as an interface between VIC and the security components we wish to test. VIC uses two ip streams, the control stream and the data stream. We integrated our GSS API security modules to utilize both streams - using the control stream for key exchange components, and the data stream for encryption components. We support unicast key exchange. Distributing keys for secure multicast to a large group is currently being investigated and implemented. Working with Personal Cipher Card Corp., we have implemented Bellcore's Shoup-Rubin protocol, a smartcard-based version of a Leighton-Micali key exchange on the SGS-Thomson ST16612 smartcard.
Menu Modifications
Users are presented with a modified VIC main menu that allows either the sender or receiver to initiate security any time during the VIC session. Triggering the Initiate Secure Session button results in a message sent to the other end of the unicast over the VIC contol channel, and the user is asked if they want to start a secure session. If the Yes button is selected, a choice of ciphers is presented to each party. If the No button is selected, initiator is notified. Note that for the transmitter, their chosen cipher is used to encrypt both the control and data channels while for the receiver, their choice of cipher encrypts the return control channel. Once both parties have chosen a cipher and the smartcard key exchange succeeds, the main menu's Initiate Secure Session button is changed to show Session is Secured, and the choice of cipher is highlighted in red. Either party can change ciphers on the fly simply by choosing a different cipher from the transmit menu. The current choices are none, XOR, DES, RC4, and VRA, Bellcore's new Video Rate Algorithm. We then compare performance of the software ciphers and show the results in a statistics window.
Platforms and Codecs
Secure video transmission over the internet has its performance challenges. Working with full-motion (30 frames per second) 24-bit color 320x240 images, we need to move almost 7MB/sec (megabytes per second) from the "camera server" to the "screen server" through computers and networks. This is impractical, so we must compress the video stream. Software encoding demands more cpu cycles than our workstations can provide, so we turn to hardware for this service. We found that once we performed video compression in hardware, we have enough cpu cycles to do software encryption. Our choice of workstation hardware was limited by the availability of hardware video codecs. There are many new products evolving in this market, and we expect the commodity PC market to eventually meet our needs.
We augmented the rs6000 port of VIC to take full advantage of IBM's UltiMedia Services (UMS) hardware and software, including hardware MJPEG encoding and decoding. UMS gives high quality video transmission at 30 frames per second, which requires a bandwidth of approximately 4.0 MB/second.
We augmented the Win32 port of VIC to utilize the hardware MJPEG encoding and decoding capabilities of the miroVIDEO DC20.
 |
|
 |
