Methods and systems for identifying and mitigating telecommunications network security threats

• US 7,401,360 B2
• Filed: 12/03/2002
• Issued: 07/15/2008
• Est. Priority Date: 12/03/2002
• Status: Active Grant

• Current Assignee: Tekelec Global, Inc. (Oracle Corporation)
• Original Assignee: Tekelec
• Inventors: Ravishankar, Venkataramaiah, Bantukul, Apirux, Long, Virgil E.
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/308,316
• Publication Number:
  US 20040107362A1
• Time in Patent Office: 2,051 Days
• Field of Search: 726/2, 726/11, 726/14
• US Class Current: 726/22
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04Q 2213/13176 Common channel signaling, CCS7
• CPC Class Codes: H04Q 2213/13256 Call screening
• CPC Class Codes: H04Q 2213/13339 Ciphering, encryption, security
• CPC Class Codes: H04Q 3/0025 Provisions for signalling

Abstract

Methods and systems for identifying and mitigating telecommunications management message security threats are disclosed. A distributed security screening platform receives management messages from external sources. The distributed security screening platform identifies messages affecting the status of the same managed resource and applies a time-based security policy to these messages. If the messages are determined to violate the time-based security policy, a mitigating action is performed to protect the managed resource.

Claims

1. A method for identifying and mitigating security threats caused by telecommunications management messages, the method comprising:

(a) receiving telecommunications signaling messages from an external source;

(b) from the telecommunications signaling messages, screening telecommunications management messages affecting the status of the same managed resource;

(c) applying a time-based security policy to the management messages affecting the status of the same managed resource;

(d) determining whether the time-based security policy is violated; and

(e) in response to determining that the time-based security policy is violated, performing a mitigating action to protect the resource.

2. The method of claim 1 wherein screening management messages affecting the status of the same managed resource includes identifying SS7 MTP3 network management messages affecting the status of the same signaling link.

3. The method of claim 1 wherein screening management messages affecting the status of the same managed resource includes identifying SS7 MTP3 network management messages affecting the status of the same signaling link group.

4. The method of claim 1 wherein screening management messages affecting the status of the same managed resource includes identifying SS7 MTP3 network management messages affecting the status of the same IP signaling link.

5. The method of claim 1 wherein screening management messages affecting the status of the same managed resource includes identifying SS7 MTP3 network management messages affecting the status of the same IP signaling link group.

6. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same remote network node.

7. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same group of remote network nodes.

8. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same route to a remote network node.

9. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same route to a group of remote network nodes.

10. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same application subsystem.

11. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same group of application subsystems.

12. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same circuit-switched trunk group carrying user data.

13. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same packet-switched trunk group carrying user data.

14. The method of claim 1 wherein screening signaling messages affecting the status of the same managed resource includes identifying telecommunications management messages affecting the status of the same network-attached customer premises equipment.

15. The method of claim 1 wherein screening telecommunications messages affecting the status of the same managed resource includes identifying session initiation protocol (SIP) management messages affecting the status of the same managed resource.

16. The method of claim 1 wherein screening telecommunications management messages affecting the status of the same managed resource includes screening H.323 messages affecting the status of the same managed resource.

17. The method of claim 1 wherein identifying network management messages affecting the status of the same managed resource includes identifying at least one of:

transfer prohibited (TFP), transfer restricted (TFR), transfer controlled (TFC), transfer cluster prohibited (TCP), and transfer cluster restricted (TCR) messages affecting the status of the same managed resource.

18. The method of claim 1 wherein screening messages affecting the status of the same managed resource includes identifying signaling connection control part (SCCP) subsystem management messages (SCMG) affecting the status of the same application subsystem.

19. The method of claim 1 wherein screening messages affecting the status of the same managed resource includes identifying ISDN user part (ISUP) circuit management messages affecting the same circuit or voice trunk.

20. The method of claim 19 wherein identifying circuit management messages affecting the same circuit or trunk includes identifying at least one of:

block (BLK), circuit group block (CGB), reset CIC (RSC), circuit group reset (CGR), and unavailable CIC (UCIC) messages relating to the same voice trunk or circuit group.

21. The method of claim 1 wherein screening messages affecting the status of the same managed resource includes screening automatic call gap messages relating to the same application.

22. The method of claim 1 wherein applying a time-based security screening policy to the management messages affecting the status of the same managed resource includes counting the frequency of the management messages.

23. The method of claim 1 wherein applying a time-based security policy to the management messages affecting the status of the same managed resource includes determining whether oscillation in status of the managed resource is present.

24. The method of claim 1 wherein performing a mitigating action to protect the resource includes at least one of:

dropping the messages, notifying an operator, and logging the messages.

25. The method of claim 1 wherein performing a mitigating action to protect the managed resource includes throttling the messages.

26. The method of claim 25 where throttling the messages includes:

(a) determining when the frequency of the messages affecting the status of the same managed resource exceeds a threshold;

(b) in response to determining that the frequency of the messages exceeds the threshold, passing the messages only at fixed intervals for a set time period; and

(c) upon expiration of the set time period, passing messages upon receipt, and repeating steps (a) and (b).

27. The method of claim 1 wherein performing a mitigating action to protect the resource includes requesting pre-confirmation form a network operator before passing future messages affecting the status of the same managed resource.

28. A system for identifying and mitigating telecommunications network security threats caused by management messages, the system comprising:

(a) a plurality of communications modules for sending and receiving signaling messages over external signaling links, each communications module including a security screening function for identifying predetermined management messages for further security screening; and

(b) a plurality of database service modules for receiving the messages identified by the communications modules as requiring further screening, each database service module including a second security screening function for identifying messages received from the communications modules that relate to the same managed entity, for applying a time-based security policy to the messages, and for performing a mitigating action in response to determining that the messages violate the time-based security policy.

29. The system of claim 28 wherein the first security screening functions associated with the communications modules are adapted to identify predetermined MTP3 network management messages as candidates for further security screening.

30. The system of claim 28 wherein the first security screening functions are adapted to identify predetermined signaling connection control part subsystem management messages as candidates for further security screening.

31. The system of claim 28 wherein the first security screening functions are adapted to identify predetermined circuit management messages as candidates for further security screening.

32. The system of claim 28 wherein the second security screening functions are adapted to count the frequency of the messages identified by the first security screening function as candidates for further screening, and, in response to the frequency exceeding a predetermined value, for performing the mitigating action.

33. The system of claim 28 wherein the second security screening functions are adapted to determine whether oscillation in status of the managed resource is present based on the management messages identified by the first security screening function as candidates for further security screening, and, in response to detecting oscillation in status of the managed resource, for performing the mitigating action.

34. The system of claim 28 wherein the second security screening functions are adapted to throttle the messages identified as candidates for further screening by the first security screening function in response to determining that the time-based security policy has been violated.

35. The system of claim 28 wherein the second security screening functions are adapted to drop messages identified as candidates for further security screening in response to determining that the time-based security policy has been violated.

36. The system of claim 28 wherein the second security screening functions are adapted to notify an operator in response to determining that the time-based security policy has been violated.

37. A computer program product comprising computer executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving telecommunications signaling messages;

(b) from the telecommunications signaling messages, screening telecommunications management messages affecting the status of the same managed resource;

(c) applying a time-based security policy to the management messages that relate to the same managed resource;

(d) determining whether the time-based security policy is violated; and

(e) in response to determining that the time-based security policy is violated, performing a mitigating action to protect the managed resource.

38. The computer program product of claim 37 wherein screening management messages affecting the status of the same managed resource includes identifying SS7 MTP3 network management messages affecting the status of the same signaling link.

39. The computer program product of claim 37 wherein identifying network management messages affecting the status of the same managed resource includes identifying at least one of:

transfer prohibited (TFP), transfer restricted (TFR), transfer controlled (TFC), transfer cluster prohibited (TCP), and transfer cluster restricted (TCR) messages affecting the status of the same managed resource.

40. The computer program product of claim 37 wherein screening messages affecting the status of the same managed resource includes identifying signaling connection control part (SCCP) subsystem management messages (SCMG) affecting the status of the same application subsystem.

41. The computer program product of claim 37 wherein screening messages affecting the status of the same managed resource includes identifying ISDN user part (ISUP) circuit management messages affecting the same circuit or voice trunk.

42. The computer program product of claim 41 wherein identifying circuit management messages affecting the same circuit or trunk includes identifying at least one of:

block (BLK), circuit group block (CGB), reset CIC (RSC), circuit group reset (CGR), and unavailable CIC (UCIC) messages relating to the same voice trunk or circuit group.

43. The computer program product of claim 37 wherein screening messages affecting the status of the same managed resource includes screening automatic call gap messages relating to the same application.

44. The computer program product of claim 37 wherein applying a time-based security screening policy to the management messages affecting the status of the same managed resource includes counting the frequency of the management messages.

45. The computer program product of claim 37 wherein applying a time-based security policy to the management messages affecting the status of the same managed resource includes determining whether oscillation in status of the managed resource is present.

46. The computer program product of claim 37 wherein performing a mitigating action to protect the resource includes at least one of:

dropping the messages, notifying an operator, and logging the messages.

47. The computer program product of claim 37 wherein performing a mitigating action to protect the managed resource includes throttling the messages.

48. The computer program product of claim 47 where throttling the messages includes:

(a) determining when the frequency of the messages affecting the status of the same managed resource exceeds a threshold;

(b) in response to determining that the frequency of the messages exceeds the threshold, passing the messages only at fixed intervals for a set time period; and

(c) upon expiration of the set time period, passing messages upon receipt, and repeating steps (a) and (b).

49. The computer program product of claim 37 wherein performing a mitigating action to protect the resource includes requesting pre-confirmation from a network operator before passing future messages affecting the status of the same managed resource.

50. A computer program product comprising computer executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving telecommunications signaling messages;

(b) identifying, from the signaling messages, messages that match a security screening policy;

(c) determining when the frequency of the messages that match the security screening policy reaches a predetermined threshold;

(d) in response to determining that the frequency reaches the predetermined threshold, throttling the messages for a set time period; and

(e) at the end of the set time period, passing the matching messages upon receipt and repeating steps (a)-(d).

51. The computer program product of claim 50 wherein identifying messages that match a security screening policy includes identifying ISDN user part (ISUP) messages that match an ISUP security screening policy.

52. The computer program product of claim 50 wherein identifying messages that match a security screening policy includes identifying transaction capabilities application part (TCAP) messages that match an TCAP security screening policy.

53. The computer program product of claim 50 wherein identifying messages that match a security screening policy includes identifying management messages that match a management message security screening policy.

54. The computer program product of claim 53 wherein identifying management messages that match a management message security screening policy includes identifying SS7 MTP3 network management messages relating to the same managed resource.

55. The computer program product of claim 53 wherein identifying management messages that match a management message security screening policy includes identifying SCCP subsystem management messages relating to the same managed resource.

56. The computer program product of claim 53 wherein identifying management messages that match a management message security screening policy includes identifying circuit management messages relating to the same managed resource.