An Effective Calibration of VOIP Internet Telephony Performance using VPN between PAC and PNS

Transcription

1 An Effective Calibration of VOIP Internet Telephony Performance using VPN between PAC and PNS Hyung Moo Kim, and Jae Soo Yoo, Member, IEEE Abstract In this paper, we have created VoIP terminals that use Virtual Private Network (VPN) to eliminate security risks due to the complexity of protocols involved and network equipments used. Point-to-Point Tunneling Protocol (PPTP) is used on the session initiation protocol (SIP) stack, which is enabled by Internet telephony terminal to test its performance and feasibility. To measure the performance of call quality, we have built the experiment environment and observed that the delay caused by encapsulation between internet and VoIP telephones is under 8ms at most. The major delay is assumed the time required to capsulate the packet for tunneling of VPN. Because the difference of average delay time is under 4ms~5ms, the difference of call quality between VoIP and VoIP telephone adopting VPN is negligible. We have concluded that the capsulation process between PPTP access concentrator (PAC) and PPTP network server (PNS) is the major factor influencing the network load by changing the number of fames in a packet during communication. Also, we have concluded that the most suitable frame numbers is two or three by adding the frame numbers in a packet to obtain the suitable frames in a packet and setting up end to end delay to be 160ms~170ms. We have suggested, developed, and evaluated an internet telephony system that implements secure user authentication and data transmission. Through measuring the delay time between a conventional VoIP telephone and the proposed system, the quality of call made through the proposed system and its feasibility are discussed. Index Terms PPTP access concentrator(pac), PPTP network server concentrator(pns), Point-to-Point Tunneling Protocol(PPTP), Voice over Internet Telephony(VoIP), Virtual Private Network(VPN) T I. INTRODUCTION he use of Internet telephone has advantages over the conventional telephone. These include cheaper calls Manuscript received May 15, This work was supported by the Korea Research Foundation Grant funded by the Korean Government (MOEHRD) (The Regional Research Universities Program / Chungbuk BIT Research-Oriented University Consortium). An Effective Calibration of VOIP Internet Telephony Performance using VPN between PAC and PNS. Hyung Moo Kim is with the School of Electrical Electronics & Computer Engineering Chungbuk National University, Gaesindong, Heungdukgu, Cheongju, Chungbuk, , Korea (corresponding author to provide phone: ; fax: ; hyungmookim@chonbuk.ac.kr). Jae Soo Yoo is with the School of Electrical Electronics & Computer Engineering Chungbuk National University, Gaesindong, Heungdukgu, Cheongju, Chungbuk, , Korea ( yjs@chungbuk.ac.kr). and the possibility to provide not only voice services but other internet services as well. However Internet telephony uses shared network, and therefore is venerable to security issues. Internet services such as VoIP and P2P over fast fiber optic links will become common communicational channels in near future [1]. However, due to the nature of the Internet, that it uses shared networks, it is often hard to ensure the security. Measures to increase the security are increasing but in most cases, their practical implementations are often difficult. It is especially difficult to secure the VoIP system due to the complexity of protocols involved and network equipments used [2][3]. To overcome these security problems, many different solutions are in the stage of being standardized. Unfortunately, it will take some time and hence in this paper, we have developed an Internet telephony system that implements secure user authentication and data transmission. Also in this paper, the performance of the proposed system is measured. Ⅱ. Making a Call, Secure Internet Telephony The Secure Internet telephony system developed in this paper uses SIP protocol, and to prevent any eavesdrop, PPTP (Point-to-Point Tunneling Protocol) is used to implement PAC (PPTP Access Concentrator). Through measuring the delay time between a conventional VoIP telephone and the proposed system, the quality of call made through the proposed system and its feasibility are discussed. PAC controls the PPTP Client side and creates a control connect to PNS(PPTP Network Server). The control connection is created before PPTP Tunneling, and is to control the PPTP connection. To create the control connection, PAC sends a request to PNS, and after receiving a reply from PNS, it will request configuration for the call. After receiving configuration from PNS, to configure the connection link between PAC and PNS, they finished configuring the control connection through the use of Set-Link-Info message. After configuration of the control link, PPP ( Point-to- Point Protocol ) is used to configure the link and to negotiate which protocols will be used between PAC and PNS. Firstly use LCP(Link Control Protocol) to configure the PPP Link, and negotiate whether to use authentication protocol or not, and which authentication

2 protocol will be used. Also the use of the compression algorithm is negotiated. These options negotiated here in the LCP process will determine the protocols that will be used in the next process. In this paper, the authentication protocol and CHAP(Challenge Handshake Authentication Protocol) are used, so PNS sends a CHAP Challenge message to PAC to request authentication. PAC responds after analyzing data from PNS and its user-id and password with a CHAP response. If received data is OK, PNS sends a CHAP success message to successfully finish the authentication process. In LCP process, it was negotiated that a compression algorithm will be used, so it the next stage, the type the compression protocol is negotiated along with the protocol for the Network Layer. In this paper, MPPC (Microsoft Point-To-Point Compression) is used for PPP packet compression, is used for the compression protocol, Stateless Mode is selected, and 128bit encryption is used. When Stateless Mode is selected, MPPE (Microsoft Point-To-Point Encryption) packet's Coherency Count Field value is set differently for every packet, differentiating each packet. IP(Internet Protocol) is used for the Network Layer, and IPCP(Internet Protocol Control Protocol) requests network information to PNS. PAC receives IP address, network mask, gateway, IP address information and sets PAC's Network Layer. After finishing above process, the devices are then connected as one VPN. Every PAC can access the proxy server, and at each PAC, proxy server's private IP address is configured so that after connecting to the private network, its own private IP along with the pre-configured VoIP telephone number are registered at the proxy server. After registration, a call can be make by dialing a number through SIP protocol. We use of Internet telephone has advantages over the conventional telephone. These include cheaper calls and the possibility to provide not only voice services but other internet services as well. III. VPN SIGNALING PROTOCOL The Sound quality and the call quality is dependent on the network performance and network configuration of devices Hence the call quality can be determined by the quality of the sound and the voice quality. Three factors affect the call quality [4][5]. 3.1 Clarity Call Quality can be determined by the call's voice Fidelity, Clearness, Distortion, Intelligibility. Packet loss is one of the reasons that reduce call clarity. VoIP network used non-persistent protocol such as UDP where packet losses are common. These packet losses result in loss of voice data and affect the overall call quality. The call quality will degrade with the higher percentage of UDP Packet loss. Voice codec affect call clarity. Voice codec convert analog voice to digitized bit streams, and to decrease the volume of data, compression is often used and some data is striped. In this paper G codec is used, and it is mainly used for low bit stream conversion of multi-media service voice and other audio signals. Two main coders are defined namely, 5.3Kbps and 6.3Kbps, 6.3Kbps is based on MP-MLP and is higher in quality. 3.2 End-to-End Delay End to end delay in VoIP network is the delay associated with delivering voice date from the sender to the receiver, and with increasing delay, the call will feel more distant. It can be divided into the IP network delay and the VoIP equipment delay. IP network delay can be divided into the propagation delay and the handling delay. The propagation delay is the delay associated with physical delay that are existent in fiber option or copper connections, and the handling delay is sometimes called serialization delay and it is introduced in the devices handling the voice data. This handling delay can be further categorized to Packet Processing Delay, Packet Switching / Routing delay, packets arriving out of order in IP network, Queuing Delay created due to limited physical line speed at the switches, routers. Router's Queuing Delay is the most significant End-toend delay in the VoIP network, and describes packets arriving at irregular intervals due to changes in the network quality. Packets must travel from the sender to the receiver in certain time limit, and this time interval is called jitter. The VoIP equipment delay time is introduced by the voice signal process between the end terminals and the VoIP gateway. Encoding and Decoding delay is included in this delay, and depending on the codec used, more delay is possible. In VoIP equipment's receiving process, packet delay is introduced, it is the delay associated with packing voice data into packets with bigger packets the delay is introduced. Smaller packets reduce the packet delay, but increase header data and as a result decrease overall network bandwidth. End-to-end delay is caused by the delay associated in sending voice packets from the Client, the delay associated with equipment and network access, the IP packet queuing delay, the packet delay and echo the elimination delay at the gateway and the delay associated with accessing PSTN network. The VoIP system proposed in this paper, as shown in Fig. 1, has the additional encapsulation delay introduced since tunneling is used to transfer data between PAC and PNS to the conventional VoIP system. Other delays are same or similar.

3 IV. IMPLEMENT VOIP TELEPHONY CALL QUALITY Fig. 1. VoIP delays End-to-End The implemented VoIP system's VPN based test environment is described in Fig. 3. With emphasis on packet arrival interval, network delay and overload, the system will be tested to show the feasibility of VPN based SIP. Echo is voice that travels back to the original senders receiving terminal, and it is also considered when determining the overall call quality. As shown in Fig. 2, three factors can influence the call quality, they are clarity, end-to-end delay and echo, and they are closely interrelated. Hence, with decreasing Voice Quality Space, the overall call quality increases. Table 1. Cell quality in R-scale Fig. 2. Relationship among voice clarity, delay and Echo In this paper, the delay additional to the conventional VoIP system, which is introduced during encapsulation, will be tested. I.E. Clarity and Echo of the two systems does not differ significantly and hence will be omitted in the test. To test the call qualifies of VoIP telephony, test method described in ITU-T G.107 will be used [6]. With various different parameters as the default and values from 0 to 100, quality will be measure in the Rscale. If the call quality is above 70, the general quality considered good and with R-scale, MOS(Mean Option Score) is measured. MOS is used to benchmark voice codec performance. Large test group and large test samples are needed because the call quality and the sound quality are very subjective. MOS measures each test sample from 1(bad) to 5(good) in each listening test group, and calculates the average value. If MOS value is above 3.6, the quality is said to be fair and adequate for use. Parameters, which are affected the value of R, are related as below; The test network is setup as in Fig. 4, with 3 PAC and with each local network connected through routers to the proxy server and PNS. There are 10 sub-networks, PNS responsible for PPTP Server side, when a request is received from PAC for the Control-Connection, it replies and creates the tunnel between PACs. With this tunnel, a VPN network is created to PAC using PPP. PAC is responsible for PPTP Client side and becomes a member of the network by creating a tunnel to PNS. The proxy server uses SIP and to make VoIP calls, has SIP UA information. PNS is where PPTP Server Side is implemented and has PAC#1 and PAC#2's user-id and password, also has private IP pool to form VPN. There are 2 network interfaces in use. The local network interface connects the private network and the external network interface connects the Internet. There is 1 PPTP interface responsible for transferring encrypted GRE packets that are delivered from the external network interface, to the local network or to clients on other private network [7]. Here, 0 R, s I, d I, e I and A denote Signal-to Noise, Impairment transferred with voice, Delay Impairment, Low bandwidth code Impairment, Correction value, respectively. Table 1 describes user satisfactory level according to the R-scale as shown in ITU-'s G.109 Recommendation. If the R s value is below 50, then it is not practical in any use. Fig. 3. VPN Based SIP test environment PAC#1 and PAC#2 are VoIP terminals that implement PPTP Client Side, and have PNS's public IP and port number. To authenticate themselves at PNS, they also have their user-id and password information. Below are

4 the initialization and the call process. 1 1) To create the tunnel PAC#1 sends control con nection message to PNS like in PPTP control connection process. PNS replies. 2 2) Through the created tunnel, PAC#1 uses PPP to authenticate itself and receives the private IP address. 3 3) PAC#1 creates a virtual internal interface call ed pptp0 using the private IP address. 4 4) PAC#1 using SIP's registration function, regis ters its SIP information with the proxy server. From this stage VoIP calls can be made. 5 5) At PAC#2, step 1) ~ 4) is repeated and it is V oip call ready. 6 6) At PAC#1, the headpiece is lifted and PAC#2' s numbers are pressed (2134). 7 7) At PAC#1, a SIP messages travels through the tunnel to the proxy server. All messages trave ling the tunnel are encrypted. 8 8) At PNS, the packet with GRE header received from the external interface is decrypted and p rivate IP header's destination IP is retrieved. If the address is for the local network, forward to itself local interface, and if it's for a private terminal in other external network, forward to the external interface after re-encrypting through the tunnel to PAC#2. In this paper, to show that the overall quality of the calls made in the test system meets the standard quality (150ms to 200ms) by measuring the RTT value of the one-way delay. However PNS is involved with the decryption and can become a bottleneck in heavy traffic and its performance must be considered. 4.1 RTP Packet Format ERTP packet is transferred by UDP datagram's payload. It uses a very simple header format to eliminate the overload in applications. In common real-time applications needs high bandwidth, and to reduce the delay and to increase RTP transfer rate, message and header size is reduced. The Packet used in SIP using G codec has format of being a 64Byte IP packet. It is made up of an 8 Byte UDP header and a 32 Byte RTP packet. A RTP packet is further divided into a 12 Byte header and 24 Byte voice data. 64 Bytes are the overall size of the encrypted packet used in the test SIP application using G.723.1(6.3K) codec. Transferred voice data length varies with different codec used and are detailed below; G => 6.3Kbps, every 30ms transfer 24bytes G.729A => 8Kbps, every 10ms transfer 10bytes G.711 => 64Kbps, every 20ms transfer 160bytes Encapsulated IP Packet length varies as below; G (64bytes) private-ip header(20) + UDP header(8) + RTP header(12) + voice data(24) G.729A (50bytes) private-ip header(20) + UDP header(8) + RTP header(12) + voice data(10) G.711 (200bytes) private-ip header(20) + UDP header(8) + RTP header(12) + voice data(160) 4.2 Encapsulation Delay With emphasis on network overload, voice calls are tested using VoIP's SIP protocol on how many frames are most efficient in one packet for transfer. It is important to note the differences in performance when sending a packet with many frames for longer delay times and when sending a packet with lesser frames for shorter delay times. In this paper, SIP application uses 64 Byte frames in one packet. Fig. 4 shows the difference in overall delay with variation of number of frames in one packet. This is important as 64 Byte overhead header is added for encapsulation between PAC and PNS. It is important to save bandwidth with increasing number of VoIP terminals. However sending more frames in one packet will increase the delay time and the overall call quality will drop. Fig. 4. Network overload 4.3 Frames per Packet The most efficient ratio can be observed in Fig. 5. In this picture packet arrival interval is graphed against different frames per packet. Two center graphs are the optimal graphs for 99% quality, and upper and lower graphs are the worst case and the best case packet arrival graphs. To minimize the delay between terminals, the optimal number of frames is 2-3 per packet. Most commonly used internet telephony inserts pre-delay-frame in packets, and as internet telephony becomes popular, it is recommended to send 2-3 frames per packet.

5 Furthermore, RTT time varies with different codec when sending number of frames in one packet as well as the encrypted data length. For codec G.723.1, if a packet sends one frame, the total encrypted size is 64bytes, and for 2 frames, 88bytes, and 112bytes for 3 frames. In case of G.729A, the total encrypted size is 50bytes for one frame, 60bytes for two frames and 70bytes for three frames. The overall quality is acceptable as the maximum encrypted data length is 112bytes for G and 70bytes for G.729A, with the difference in total delay time being less than 4ms against the conventional VoIP telephony system. network), security issues with internet telephony can be minimized. However the PPTP protocol used in this paper dose not use encrypted Control Connection messages and authentication, and the whole system can be compromised by stealing the control connection message. This problem can be solved with L2TP. PPTP is on IP based network whereas L2TP is packet based and more versatile. It is expendable and uses certificate based IPSec. Despite that, IPSec's key management protocol ISAKMP/IKE is too complex to manage and that its implementation is limited, but with right infrastructure, these problems will vanish. For better security, VPN's L2TP and IPSec will be used which encrypts the control connection message and has authentication for future internet telephony implementation. ACKNOWLEDGMENT This work was supported by the Korea Research Foundation Grant funded by the Korean Government(MOEHRD) (The Regional Research Universities Program/Chungbuk BIT Research-Oriented University Consortium). Fig. 5. Packet arrival interval time with respect to No. frames per packet V. CONCLUSIONS Internet Telephony system proposed in this paper, measures call success rate with 10 seconds calls. A tone was sent from one PAC to another PAC, and if the confirmation time was less then 10 seconds, a call was retried to make the total call time to about 15 seconds. After testing call for 24 hours under these methods, it was confirmed that the success rate was near 100%. In the test to measure the overall call quality, it was observed that the encapsulation delay time is introduced in the proposed system was at maximum about 5ms, and the difference in total delay time against the conventional internet telephony system was roughly 4-5ms. These results reflect that the call quality between the two systems is negligible. Using VoIP's SIP protocol for make voice calls with emphasis on network over load, the optimal number of frame in one packet was measured. A 64 Byte header is added for encapsulation between PAC and PNS, and as more terminals are present, the network traffic will increase and it's important to reduce the use of network bandwidth. However, sending a large number of frames in one packet will increase the total delay time and will decrease the call quality. SIP application used in this paper uses G codec, and sends 24 Bytes of voice data in one packet. In was concluded from testing with different number of frames per packet, that the optimal ratio was 2-3 frames per packet since the encapsulation process between PAC and PNS has the most significant effect on network traffic and that the acceptable delay time between two nodes is about 160ms to 170ms. In addition, it was shown that with VPN(Virtual private REFERENCES [1]. Percy, A. Understanding Latency in IP Telephony, Brook root Technology, [2]. Uyless Black, Internet Telephony: call processing protocols, Prentice Hall PTR, [3]. Kim S.T., Yoo, S. S., Lee, S. K., A Study on Internet Telephony using VPN, Journal of the Korean Institute of Communication Sciences, 2005, 30: [4]. TIA/EIA/TSB116, Voice Quality Recommendations for IP Telephony, March [5]. ITU-T Recommendation G.109, Definition of categories of Speech Transmission Quality, September [6]. ITU-T Recommendation G.107, The E-model, a Computational Model for Use in transmission Planning, May [7]. Hamzeh, K., Pall, G., Verthein, G., Taarud, J., Little, W., Zorn, G., Point-to-Point Tunneling