Method for protecting a packet-based network from attacks, and security border node

• US 20090313698A1
• Filed: 06/01/2009
• Published: 12/17/2009
• Est. Priority Date: 06/12/2008
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Wahl, Stefan
• Granted Patent: US 8,365,284 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

The invention relates to a security border node (2a) for protecting a packet-based network from attacks, comprising: an anomaly detection unit (10) for performing an anomaly detection, in particular a statistical analysis, on session control messages (11), in particular on SIP messages contained in a packet stream (5) received in the security border node (2a). The security border node further comprises a message context provisioning unit (13) for providing at least one session control message (11) to the anomaly detection unit (10) together with message context information (12, 17, 24) related to a client (22) and/or to a session (23) to which the session control message (11, 11a to 11f) is attributed. The invention also relates to a method for protecting a packet-based network from attacks, to a computer program product, and to a packet-based network.

Claims

1-14. -14. (canceled)

15. Method for protecting a packet-based network from attacks, comprising:

performing an anomaly detection on session control messages contained in a packet stream received in a security border node of the network, wherein

the performing step performs the anomaly detection on at least one session control message together with message context information about the session control message being related to a session to which the session control message is attributed, the message context information comprising session history information.

16. Method according to claim 15, further comprising the step of including the message context information in the session control message.

17. Method according to claim 15, further comprising:

addressing a database for storing and retrieving the message context information using information contained in the session control messages, in particular a client ID, a session ID, a source IP address and/or a message type.

18. Method according to claim 15, wherein further message context information is chosen from the group consisting of:

session state information, in particular about a message sequence and/or an allowed next message type, message interarrival times, and client history information.

28. Computer program product comprising code means configured to perform all the steps of the method according to claim 15.

19. Security border node for protecting a packet-based network from attacks, comprising:

an anomaly detection unit configured to perform an anomaly detection on session control messages contained in a packet stream received in the security border node;

wherein;

a message context provisioning unit configured to provide at least one session control message to the anomaly detection unit together with message context information related to a session to which the session control message is attributed, the message context information comprising session history information.

20. Security border node according to claim 19, wherein the message context provisioning unit is configured to include the message context information into the session control message.

21. Security border node according to claim 19, further comprising:

a database configured to store and retrieve the message context information, wherein

the message context provisioning unit is configured to address the database using information contained in the session control messages, in particular a client ID, a session ID, a source IP address and/or a message type.

22. Security border node according to claim 21, wherein the database is configured to store message context information chosen from the group consisting of:

session history or session state information, in particular about a message sequence and/or an allowed next message type, message interarrival times, and client history information.

23. Security border node according to claim 21, wherein the message context provisioning unit is configured to provide timestamps of the session control messages to the database.

24. Security border node according to claim 19, further comprising:

a decision unit configured to decide if a session control message has to be dropped or forwarded based upon the result of the anomaly detection, the decision unit preferably providing context information about the result of the decision to the database and/or removing the message context information from the session control message.

25. Security border node according to claim 21, further comprising:

a session control message stack, in particular a SIP stack, configured to process the session control messages, preferably being adapted to provide information about the result of the processing as a message context information to the database.

26. Security border node according to claim 24, further comprising:

a message handling unit configured to handle session control messages in a different way depending on the message context information about the result of the decision and/or the information about the result of the processing of previous session control messages attributed to the same client and/or session.

27. Packet-based network, comprising at least one security border node according to claim 19.