We assume that (1) we can monitor the Skype °ow from the black box to the Skype peer; (2) we can perturb the timing of the Skype °ow from the Skype peer to the black box.

Here we do not intend to track all the peer-to-peer VoIP calls from anyone to anyone, nor do we assume the global monitoring and intercepting capability. Instead we focus on ¯nding out if some parties in which we are interested have communicated via peer-to-peer VoIP calls anonymously, and we only need the capability to monitor and intercept IP °ows to and from those interested parties. This model is consistent with our understanding of the common practice of lawful electronic surveillance by the law enforcement agencies. Because the Skype VoIP °ows are encrypted from end to end, no correlation could be found from the °ow content.

Given that the Skype VoIP °ow could pass some intermediate Skype peers and some low latency anonymizing network, there is no correlation from the VoIP °ow headers. Among all the characteristics of the VoIP °ows, the inter-packet timing characteristics are likely to be preserved across intermediate Skype peers and low latency anonymizing network. This invariant property of VoIP °ows forms the very foundation for tracking anonymous, peer-to-peer VoIP calls on the Internet.

Source: gmu.edu

The powerful SIP client-server application supports user mobility with two operating modes: proxy and redirect. In proxy mode (shown in Figure 3), SIP clients send requests to the proxy server. The proxy server either handles the requests or forwards them to other SIP servers. Proxy servers can insulate and hide SIP users by proxying the signaling messages. To the other users on the VoIP network, the signaling invitations look as if they are coming from the proxy SIP server.

Source: Juniper Networks, Inc. White Paper