Method and System for Managing a SIP Server

• US 20130185445A1
• Filed: 07/11/2012
• Published: 07/18/2013
• Est. Priority Date: 07/11/2011
• Status: Active Grant

• Current Assignee: Metaswitch Networks Limited (Microsoft Corporation)
• Original Assignee: Metaswitch Networks Limited (Microsoft Corporation)
• Inventors: Larkin, Nicholas Peter
• Granted Patent: US 9,191,414 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 47/323 Discarding or blocking control packets, e.g. ACK packets
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04Q 2213/13204 Protocols
• CPC Class Codes: H04Q 2213/13348 Channel/line reservation
• CPC Class Codes: H04Q 2213/13389 LAN, internet

Abstract

A method, system and computer program product are described for managing network communications to a Session Initiation Protocol (SIP) server capable of SIP processing using a SIP stack. A data packet is received from a network device. It is determined, from the data packet, whether the network device is a device recognised by the SIP server. Responsive to this determination, and before SIP processing using the SIP stack, it is determined whether the data packet conforms to a permitted configuration. The permitted configuration includes that data of the data packet indicates an unfragmented User Datagram Protocol (UDP) packet and that data indicative of SIP data in the received data packet matches a parsing rule. If the data packet conforms to the permitted configuration, it is passed to the SIP stack, if not it is discarded.

Claims

1. A method of managing network communications to a Session Initiation Protocol (SIP) server capable of SIP processing using a SIP stack based on a received data packet, the method comprising:

receiving a data packet from a network device, the data packet comprising data indicative of fragmentation information, transport protocol information and SIP data;

determining, from the data packet, whether the network device is a device recognised by the SIP server; and

responsive to a determination that the network device is a device that is not recognised by the SIP server and before SIP processing using the SIP stack;

determining whether the data packet conforms to a permitted configuration, said permitted configuration comprising at least that said data indicative of fragmentation information and transport protocol information indicates an unfragmented User Datagram Protocol (UDP) packet and that at least a portion of data indicative of SIP data in the received data packet matches a parsing rule based on data indicative of a REGISTER request,

discarding the received data packet if it is determined that the data packet does not conform to the permitted configuration, and

passing the received data packet for SIP processing by the SIP stack if it is determined that the data packet does conform to the permitted configuration.

2. The method according to claim 1, wherein the step of determining whether the network device is a device recognised by the SIP server comprises:

determining a network address of the network device;

determining if said network address matches a permitted network address; and

if it is determined that said network address matches a permitted network address, passing said received data packet for SIP processing.

3. The method according to claim 2, wherein the step of determining if the network address matches a permitted network address comprises:

applying a Bloom filter configured with one or more permitted network addresses.

4. The method according to claim 3, further comprising:

adding the network address of the network device to the Bloom filter if the network address does not match a permitted network address and the network device successfully registers following SIP processing.

5. The method according to claim 3, further comprising:

determining a network address of a network device that results in one or more false positive matches when applying the Bloom filter; and

discarding data packets from said determined network address.

6. The method according to claim 2, further comprising:

removing a network address of a network device from a set of permitted network addresses.

7. The method according to claim 1, wherein the step of determining whether the data packet conforms to a permitted configuration comprises:

determining whether the transport protocol information indicates that the received data packet is destined for a UDP port associated with the SIP processing.

8. A system comprising an access control component for managing network communications to a Session Initiation Protocol (SIP) server, the access control component being communicatively coupled to a SIP processing component capable of SIP processing based on a received data packet using a SIP stack, the access control component being arranged to:

receive a data packet sent from a network device to the SIP server, the data packet comprising data indicative of fragmentation information, transport protocol information and SIP data;

determine, from the data packet, whether the network device is recognised by the SIP server; and

responsive to a determination that the network device is a device that is not recognised by the SIP server and before SIP processing using the SIP stack, determine whether the data packet conforms to a permitted configuration, said permitted configuration comprising at least that said data indicative of fragmentation information and transport protocol information indicates an unfragmented User Datagram Protocol (UDP) packet and that at least a portion of data indicative of SIP data in the received data packet matches a parsing rule based on data indicative of a REGISTER request,

wherein the access control component is arranged to discard the received data packet if it determines that the data packet does not conform to the permitted configuration and pass the received data packet to the SIP processing component if the data packet conforms to the permitted configuration.

9. The system according to claim 8, wherein the access control component is arranged to access a set of one or more access control rules, said access control rules specifying one or more permitted network addresses that indicate whether a network device is recognised by the SIP server, the access control component being arranged to pass messages received from network devices with network address that comply with the access control rules to the SIP processing component.

10. The system according to claim 9, wherein the access control component is arranged to apply a Bloom filter configured with one or more permitted network addresses to determine whether the network device is recognised by the SIP server.

11. The system according to claim 10, wherein the access control component is arranged to add the network address of the network device to the Bloom filter if the network device successfully registers after being passed to the SIP processing component.

12. The system according to claim 10, wherein the access control component is arranged to provide a network address of a network device that results in one or more false positive matches when the Bloom filter is applied.

13. The system according to claim 10, wherein the access control component is arranged to remove a network address of a network device from the Bloom filter.

14. The system according to claim 8, wherein the access control component is arranged to determine whether the transport protocol information indicates that the received data packet is destined for a UDP port associated with the SIP processing component.

15. A computer program product comprising a non-transitory computer-readable storage medium having computer readable instructions stored thereon, the computer readable instructions being executable by a computerized device to cause the computerized device to perform a method of managing network communications to a Session Initiation Protocol (SIP) server capable of SIP processing using a SIP stack based on a received data packet, the method comprising:

receiving a data packet from a network device, the data packet comprising data indicative of fragmentation information, transport protocol information and SIP data;

determining, from the data packet, whether the network device is a device recognised by the SIP server; and

responsive to a determination that the network device is a device that is not recognised by the SIP server and before SIP processing using the SIP stack;

determining whether the data packet conforms to a permitted configuration, said permitted configuration comprising at least that said data indicative of fragmentation information and transport protocol information indicates an unfragmented User Datagram Protocol (UDP) packet and that at least a portion of data indicative of SIP data in the received data packet matches a parsing rule based on data indicative of a REGISTER request;

discarding the received data packet if it is determined that the data packet does not conform to the permitted configuration; and

passing the received data packet for SIP processing by the SIP stack if it is determined that the data packet does conform to the permitted configuration.