end-to-middle security, since not all the intermediate nodes are trusted for processing all sorts of signaling information. Other authors propose various schemes for the improvement of SIP authen- tication services, in an attempt to eliminate the impersonation threat and consequently confine signaling attacks [27-29]. For example, Cao and Jennings focus on ways to guarantee the authenticity and integrity of SIP response mes- sages [27]. The proposed solution is particularly effective in cases of signaling attacks where a rogue SIP proxy (acting as MITM) generates a "spoofed" response to redirect the session to an unauthorized user. A similar approach is presented by Geneiatakis and Lambrinoudakis where a lightweight scheme ensures authenticity and integrity across the entire signaling path, for both requests and responses [28]. Yang et al. suggest the replacement of the HTTP digest by a scheme based on Diffie-Hellman key agreement and pre-shared secrets aiming to eliminate the HTTP digest-oriented security flaws [29]. Elsewhere monitoring systems are introduced that are able to detect signaling attacks and thus prevent modifications to the HTTP Digest mechanism that is currently supported by most SIP clients [30,31]. © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security TABLE 18.3 Security Requirements Fulfilled by the Security Mechanisms Proposed by the Research Community Reference [27,28] [30,31] [18,32] [33-37] Confidentiality Integrity Authenticity Availability Lately, significant effort is being spent towards the development of dedi- cated intrusion detection and prevention systems that can maintain a high availability for the SIP-based services [18-35]. Geneiatakis et al. present a framework that can protect SIP parsers against malformed messages. Also, Zhang et al. propose a solution for protecting SIP proxies against flooding attacks that are attempted through falsified DNS messages containing irre- solvable addresses [32]. It is important to stress that any unavailabili