System and method for providing network level and nodal level vulnerability protection in VoIP networks

• US 20070121596A1
• Filed: 08/09/2006
• Published: 05/31/2007
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Sipera Systems Inc (Avaya Incorporated)
• Inventors: Joglekar, Sachin, Kurapati, Krishna, Tyagi, Satyam, Khandelwal, Pravin, Thodime, Raghavendra, Iyengar Prasanna, Venkatesan, Singh, Mukesh, Thodime, Guru, Manchenella, Chandrasekhar
• Granted Patent: US 8,582,567 B2
• Time in Patent Office: Days
• US Class Current: 370/356
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

The present invention provides a system, method and apparatus for providing network level and nodal level vulnerability protection in VoIP networks by receiving a communication, filtering the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane, and either allowing or denying the received communication based the filtering step. The stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof. In addition, the stages can be implemented within a single device or are distributed across a network (e.g., SIP network, a UMA network, an IMS network or a combination thereof).

Claims

1. A method for protecting one or more communications devices comprising the steps of:

receiving a communication;

filtering the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane; and

either allowing or denying the received communication based the filtering step.

2. The method as recited in claim 1, wherein the stages further comprise an authentication plane and an encryption plane.

3. The method as recited in claim 1, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

4. The method as recited in claim 1, wherein the method is implemented in one or more subsystem including a signaling subsystem, a media subsystem, an intelligence subsystem, an EMS subsystem, a verify subsystem or a combination thereof.

5. The method as recited in claim 1, wherein the stages are implemented within a single device or are distributed across a network.

6. The method as recited in claim 1, wherein the method is implemented within a SIP network, a UMA network, an IMS network or a combination thereof.

7. The method as recited in claim 1, wherein the denied communication comprises a DoS attack, blended attack, VoIP SPAM or a combination thereof.

8. A computer program embodied on a computer readable medium for protecting one or more communications devices comprising:

a code segment for receiving a communication;

a code segment for filtering the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane; and

a code segment for either allowing or denying the received communication based the filtering step.

9. The computer program as recited in claim 8, wherein the stages further comprise an authentication plane and an encryption plane.

10. The computer program as recited in claim 8, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

11. The computer program as recited in claim 8, wherein the method is implemented in one or more subsystem including a signaling subsystem, a media subsystem, an intelligence subsystem, an EMS subsystem, a verify subsystem or a combination thereof.

12. The computer program as recited in claim 8, wherein the stages are implemented within a single device or are distributed across a network.

13. A system for protecting one or more communications devices comprising:

one or more signaling subsystems;

an intelligence subsystem communicably connected to the one or more signaling subsystems; and

wherein the signaling subsystem receives a communication, filters the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane, and either allows or denies the received communication based the filtering step.

14. The system as recited in claim 13, further comprising:

one or a media subsystems communicably connected to one of the signaling subsystems;

an intelligence subsystem communicably connected to the signaling subsystems;

an EMS subsystem communicably connected to the signaling subsystems;

or

a verify subsystem communicably connected to the signaling subsystems.

15. The system as recited in claim 13, wherein the stages further comprise an authentication plane and an encryption plane.

16. The system as recited in claim 13, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

17. The system as recited in claim 13, wherein the method is implemented in one or more subsystem including a signaling subsystem, a media subsystem, an intelligence subsystem, an EMS subsystem, a verify subsystem or a combination thereof.

18. The system as recited in claim 13, wherein the stages are implemented within a single device or are distributed across a network.

19. The system as recited in claim 13, wherein the system is implemented within a SIP network, a UMA network, an IMS network or a combination thereof.

20. The system as recited in claim 13, wherein the denied communication comprises a DoS attack, blended attack, VoIP SPAM or a combination thereof.