VOIP DENIAL-OF-SERVICE PROTECTION MECHANISMS FROM ATTACK

• US 20160050229A1
• Filed: 05/01/2014
• Published: 02/18/2016
• Est. Priority Date: 11/23/2004
• Status: Active Grant

• Current Assignee: Kodiak Networks (Motorola Solutions, Inc.)
• Original Assignee: Kodiak Networks (Motorola Solutions, Inc.)
• Inventors: Patel, Krishnakant M., Negalaguli, Harisha M., Velayudhan, Arun, Kandula, Ramu, Khadar, Syed N., Cheedella, Shiva, Prashanth, Subramanyam N.
• Granted Patent: US 10,116,691 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04L 65/4061 Push-to services, e.g. push-to-talk or push-to-video
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 4/10 Push-to-Talk [PTT] or Push-On-Call services

Abstract

A system and method for providing advanced voice services in a wireless communications network. The system also interfaces to an Internet Protocol (IP) network to perform the advanced voice services for mobile units in the IP network and includes a protection mechanism against Voice-over-IP (VoiP) Denial-of-Service (DoS) attacks utilizing Advanced Group Services (AGS).

Claims

1. A system for providing advanced voice services in one or more wireless communications networks, comprising:

one or more servers that interface to the wireless communications networks to perform advanced voice services for one or more mobile units in the wireless communications networks, wherein the advanced voice services include an instant two-way half-duplex voice call within a group of the mobile units comprising a Push-to-Talk-over-Cellular (PoC) call session;

wherein both the servers and the mobile units that use the advanced group services communicate with each other using control messages within the wireless communications networks, and at least one of the servers switches voice messages for the advanced group services between the mobile units across the wireless communications networks;

wherein at least one of the servers manages the PoC call session by acting as an arbitrator for the PoC call session and controls the sending of the control messages and the voice messages to and from the mobile units; and

wherein at least one of the servers interfaces to an Internet Protocol (IP) network to perform the advanced voice services for the mobile units in the IP network and includes a protection mechanism against denial-of-service (DoS) attacks that may disrupt the system.

2. The system of claim 1, wherein the protection mechanism comprises a Deep Packet Inspection/Access List Controller (DPI/ACL) function that restricts traffic to trusted and valid sources in the IP network.

3. The system of claim 1, wherein the protection mechanism allows the mobile units operating in the IP network that is an untrusted IP network to access the system, but prevents unauthorized sources operating in the untrusted IP network from accessing the system.

4. The system of claim 1, wherein the protection mechanism identifies and black-lists the unauthorized sources in the IP network that attempt the DoS attacks.

5. The system of claim 1, wherein the protection mechanism identifies and white-lists the mobile units in the IP network that are known to be valid users of the system.

6. The system of claim 1, wherein the protection mechanism compares an incoming message to a black-list that identifies known bad addresses.

7. The system of claim 6, wherein any or all of the servers having knowledge of traffic patterns resulting from their functions detect suspect traffic patterns and make updates to the black-list with a source in the IP network of the suspect traffic patterns.

9. The system of claim 6, wherein a source in the IP network receiving a configured number of authentication challenges within a configured time period from at least one of the servers is added to the black-list.

10. The system of claim 6, wherein the source resides on the black-list for a configured time period.

11. The system of claim 6, wherein the protection mechanism, on receiving a User Datagram Protocol (UDP) packet from a source in the IP network, checks whether the source'"'"'s address is present in the black-list;

if so, then the UDP packet is discarded;

otherwise, if the source'"'"'s address is not present in the black-list, then an entry for the source'"'"'s address is added in a table with a value and a watch period is set;

if an entry for the source'"'"'s address already exists in the table, then the value for the entry is incremented, and if the value exceeds a configured threshold within the watch period, then the source'"'"'s address is added to the black-list.

12. The system of claim 6, wherein the protection mechanism, on receiving a Session Initiation Protocol (SIP) message from a source in the IP network, checks whether the source'"'"'s address is present in the black-list;

if so, then the SIP message is discarded;

otherwise, if the source'"'"'s address is not present in the black-list and the SIP message is a SIP REGISTER message, then an entry for the source'"'"'s address is added in a table with a value and a watch period is set;

if an entry for the source'"'"'s address already exists in the table, then the value for the entry is incremented, and if the value exceeds a configured threshold within the watch period, then the source'"'"'s address is added to the black-list.

13. The system of claim 6, wherein the protection mechanism, prior to transmitting a response from one of the servers to a source in the IP network, checks whether the response is an authentication challenge;

if so, then an entry for the source'"'"'s address is added in a table with a value and a watch period is set;

if an entry for the source'"'"'s address already exists in the table, then the value for the entry is incremented, and if the value exceeds a configured threshold within the watch period, then the source'"'"'s address is added to the black-list;

otherwise, if the response is not an authentication challenge, then if an entry for the source'"'"'s address already exists in the table, then the value for that entry is reset.

14. The system of claim 6, wherein a server responsible for handing media traffic transmitted by a mobile unit reserves a port for this purpose and authorizes the media traffic to flow through the port for a configured duration;

before the configured duration elapses, the mobile unit sends its authentication credentials to the server via the port;

upon successful authentication of the mobile unit, the mobile unit'"'"'s address in the IP network is associated with the port, so that only the mobile unit is authorized to transmit media traffic to the server through the port; and

the mobile unit'"'"'s address in the IP network is dis-associated with the reserved port when a dialog between the server and the mobile unit is terminated by the server or the mobile unit.

15. The system of claim 14, wherein the server responsible for handing the media traffic transmitted by the mobile unit opens the port to let the media traffic pass through to the server, only when the mobile unit is engaged in a PoC call session.

16. The system of claim 14, wherein the server opens the port when the server initiates a PoC call session towards the mobile unit.

17. The system of claim 1, wherein the protection mechanism compares an incoming message to a white-list that identifies known good addresses.

18. The system of claim 17, wherein, once the authentication of a mobile unit is successful, the white-list is updated to include the mobile unit'"'"'s address.

19. The system of claim 17, wherein any or all of the servers having knowledge of traffic patterns resulting from their functions make updates to the white-list.

20. The system of claim 1, wherein a mobile unit uses a unique signature token in its messages, and the protection mechanism discards any messages purportedly from the mobile unit without the unique signature token.

21. A method of providing advanced voice services in one or more wireless communications networks, comprising:

interfacing one or more servers to the wireless communications networks to perform advanced voice services for one or more mobile units in the wireless communications networks, wherein the advanced voice services include an instant two-way half-duplex voice call within a group of the mobile units comprising a Push-to-Talk-over-Cellular (PoC) call session;

wherein both the servers and the mobile units that use the advanced group services communicate with each other using control messages within the wireless communications networks, and at least one of the servers switches voice messages for the advanced group services between the mobile units across the wireless communications networks;

wherein at least one of the servers manages the PoC call session by acting as an arbitrator for the PoC call session and controls the sending of the control messages and the voice messages to and from the mobile units; and

wherein at least one of the servers interfaces to an Internet Protocol (IP) network to perform the advanced voice services for the mobile units in the IP network and includes a protection mechanism against denial-of-service (DoS) attacks that may disrupt the system.