System and method for providing network level and nodal level vulnerability protection in VoIP networks

• US 8,582,567 B2
• Filed: 08/09/2006
• Issued: 11/12/2013
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Thodime, Guru, Tyagi, Satyam, Iyengar Prasanna, Venkatesan, Joglekar, Sachin Purushottam, Kurapati, Srikrishna, Thodime, Raghavendra Venkata, Singh, Mukesh Kumar, Manchenella, Chandrasekhar, Khandelwal, Pravin
• Primary Examiner(s): Phung, Luat
• Assistant Examiner(s): Ansari, Najeebuddin
• Application Number:
  US11/502,244
• Publication Number:
  US 20070121596A1
• Time in Patent Office: 2,652 Days
• Field of Search: 370352-356
• US Class Current: 370/356
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

The present invention provides a system, method and apparatus for providing network level and nodal level vulnerability protection in VoIP networks by receiving a communication, filtering the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane, and either allowing or denying the received communication based the filtering step. The stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof. In addition, the stages can be implemented within a single device or are distributed across a network (e.g., SIP network, a UMA network, an IMS network or a combination thereof).

Claims

1. A method for protecting one or more communications devices comprising the steps of:

receiving a communication at a first processor communicably coupled to the one or more communications devices via a network;

filtering the received communication using the first processor wherein the first processor executes three or more stages selected from the group comprising a media protection and filtering plane, a policy-based filtering plane, a signature-based filtering plane, a protocol anomaly detection and filtering plane, and a behavioral learning-based filtering plane;

either allowing or blocking the received communication using the first processor based on the selected stages;

wherein the media protection and filtering plane blocks the received communication whenever the communication falls outside one or more communication media-based parameters comprising signaling media integrity, media validation and anomaly detection;

wherein the policy-based filtering plane blocks the received communication whenever one or more user defined media and time policies are violated;

wherein the signature-based filtering plane blocks the received communication whenever the received communication matches one or more known attack signatures;

wherein the protocol anomaly detection and filtering plane blocks the received communication whenever the received communication violates one or more protocol policies comprising a protocol misuse policy, a protocol message scrubbing policy, and a device specific policy;

wherein the behavioral learning-based filtering plane uses a probability analysis to detect anomalies based on one or more learned parameters and resolve probable false alarms into a correct decision to either block or allow the received communication;

further comprising;

one or more media subsystems having a second processor communicably and securely connected to one or more signaling subsystems and deployed as a security and monitoring interface between the network and the one or more communications devices; and

an element management system (EMS) subsystem having a third processor communicably and securely connected to the one or more signaling subsystems;

or

a verify subsystem having a fourth processor communicably and securely connected to the one or more signaling subsystems.

2. The method as recited in claim 1, wherein the stages further comprise an authentication plane and an encryption plane.

3. The method as recited in claim 1, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

4. The method as recited in claim 1, wherein the method is implemented in one or more subsystems including the one or more signaling subsystems, the one or more media subsystems, an intelligence subsystem, the EMS subsystem, the verify subsystem or a combination thereof.

5. The method as recited in claim 1, wherein the stages are implemented within a single device or are distributed across the network.

6. The method as recited in claim 1, wherein the method is implemented within a SIP network, a UMA network, an IMS network or a combination thereof.

7. The method as recited in claim 1, wherein the denied communication comprises a DoS attack, blended attack, VoIP SPAM or a combination thereof.

8. A non-transitory computer readable medium for protecting one or more communications devices comprising program instructions when executed by a first processor causes the first processor to perform the steps of:

receiving a communication at the first processor communicably coupled to the one or more communications devices via a network;

filtering the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy-based filtering plane, a signature-based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning-based filtering plane;

either allowing or blocking the received communication based on the selected stages;

wherein the media protection and filtering plane blocks the received communication whenever the received communication falls outside one or more communication media based parameters comprising signaling media integrity, media validation and anomaly detection;

wherein the policy-based filtering plane blocks the communication whenever one or more user defined media and time policies are violated;

wherein the signature-based filtering plane blocks the received communication whenever the received communication matches one or more known attack signatures;

wherein the protocol anomaly detection and filtering plane blocks the received communication whenever the received communication violates one or more protocol policies comprising a protocol misuse policy, a protocol message scrubbing policy and a device specific policy;

wherein the behavioral learning-based filtering plane uses a probability analysis to detect anomalies based on one or more learned parameters and resolve probable false alarms into a correct decision to either block or allow the received communication;

further comprising;

one or more media subsystems having a second processor communicably and securely connected to one or more signaling subsystems and deployed as a security and monitoring interface between the network and the one or more communications devices; and

an element management system (EMS) subsystem having a third processor communicably and securely connected to the one or more signaling subsystems;

or

a verify subsystem having a fourth processor communicably and securely connected to the one or more signaling subsystems.

9. The computer readable medium as recited in claim 8, wherein the stages further comprise an authentication plane and an encryption plane.

10. The computer readable medium as recited in claim 8, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

11. The computer readable medium as recited in claim 8, wherein the program instructions are executed by one or more processors within one or more subsystems including the one or more signaling subsystems, the one or more media subsystems, an intelligence subsystem, the EMS subsystem, the verify subsystem or a combination thereof.

12. The computer readable medium as recited in claim 8, wherein the stages are implemented within a single device or are distributed across the network.

13. A system for protecting one or more communications devices comprising:

a network communicably coupled to the one or more communications devices;

one or more signaling subsystems having a first processor deployed as a security and monitoring gateway between the one or more communications devices and the network;

an intelligence subsystem having a second processor communicably and securely connected to the one or more signaling subsystems;

wherein the first processor of the one or more signaling subsystems receives a communication, filters the received communication using three or more stages selected from the group comprising a media protection and filtering plane, a policy-based filtering plane, a signature-based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning-based filtering plane, and either allows or denies the received communication based the selected stages;

wherein the media protection and filtering plane blocks the received communication whenever the received communication falls outside one or more communication media based parameters comprising signaling media integrity, media validation and anomaly detection;

wherein the policy-based filtering plane blocks the received communication whenever one or more user defined media and time policies are violated;

wherein the signature-based filtering plane blocks the received communication whenever the received communication matches one or more known attack signatures;

wherein the protocol anomaly detection and filtering plane blocks the received communication whenever the received communication violates one or more protocol policies comprising a protocol misuse policy, a protocol message scrubbing policy and a device specific policy;

wherein the behavioral learning-based filtering plane uses a probability analysis to detect anomalies based on one or more learned parameters and resolve probable false alarms into a correct decision to either block or allow the received communication;

further comprising;

one or more media subsystems having a third processor communicably and securely connected to the one or more signaling subsystems and deployed as a security and monitoring interface between the network and the one or more communications devices; and

an element management system (EMS) subsystem having a fourth processor communicably and securely connected to the one or more signaling subsystems;

or

a verify subsystem having a fifth processor communicably and securely connected to the one or more signaling subsystems.

14. The system as recited in claim 13, wherein the stages further comprise an authentication plane and an encryption plane.

15. The system as recited in claim 13, wherein the stages are applicable to one or more protocols including SIP, IMS, UMA, H.248, H.323, RTP, CSTA/XML or a combination thereof.

16. The system as recited in claim 13, wherein the stages are implemented within a single device or are distributed across the network.

17. The system as recited in claim 13, wherein the system is implemented within a SIP network, a UMA network, an IMS network or a combination thereof.

18. The system as recited in claim 13, wherein the denied communication comprises a DoS attack, blended attack, VoIP SPAM or a combination thereof.