KR101379779B1 - Caller Information Modulated Voice/Message Phishing Detecting and Blocking Method - Google Patents

Abstract

The present invention is for Internet phones that can detect and block all voice phishing and text phishing attacks, including international calls and messages manipulated by public institutions, financial representative numbers, etc., and calls and messages manipulated via domestic Internet phone-separated companies abroad. The purpose is to provide security equipment. The present invention for achieving the above object in the Voice Over Internet Protocol (VoIP) security equipment located between a SIP server and an Internet Protocol (IP Phone) terminal, receiving a packet from the Internet terminal, A SIP message receiver for transmitting the packet to the SIP message parsing unit if the packet is a SIP message and for transmitting the packet to the SIP message transmitter if the packet is not a SIP message; The SIP message parsing unit parses the SIP message according to the SIP grammar, drops if the SIP message is a malformed SIP message, and delivers the SIP message to a SIP message filtering unit when the SIP message is a normal SIP message. ; The SIP message filtering service transmits the service registration request message to the SIP subscriber management unit, the Internet telephone request message and the message request message to the SIP call information storage unit, and the message other than the message to the SIP message transmitter. part; A SIP subscriber manager which stores subscriber information of the service registration request message and delivers the service registration request message to the SIP message transmitter; The SIP which determines whether the originating number of the Internet call request message and the message request message conforms to the SIP grammar, drops if an abnormal SIP message, and stores calling information and outgoing IP information when the SIP message has normal calling information. Calling information storage unit; A SIP message monitoring unit for storing the Internet call request message and the message request message as monitoring information based on a calling number or calling IP and transmitting the same to the calling information modulation filtering unit; The calling information modulation filtering unit for blocking if the Internet call request message and the message request message are calling number modulation attacks, and otherwise transferring the calling number type filtering unit to the calling number type filtering unit; The calling number type filtering unit for blocking if the Internet call request message and the message request message are calling number type attacks, and if not, delivering to the SIP message transmitting unit; And the SIP message transmitter for transmitting the received message to the SIP server. The VoIP security device detects and blocks a voice phishing and text phishing attack in which outgoing information is modified. According to the present invention, it is possible to secure an algorithm using a combination of IP address information, SIP message information, and RTP information, thereby maximizing Internet telephone security equipment function and maximizing utilization. In addition, according to the present invention, there is an effect that the voice phishing and text phishing manipulated by the calling number can be blocked before reaching the user.

Description

Caller Information Modulated Voice / Message Phishing Detecting and Blocking Method}

The present invention relates to a technique for detecting and blocking voice phishing and text phishing attacks in which an outgoing number has been tampered with by operating a Session Initiation Protocol (SIP) message for an Internet phone and a message targeted at subscribers of an unspecified communication service in an Internet telephone network. will be. More specifically, the present invention relates to a SIP message real-time monitoring technology based on call information that prevents an attack from being delivered to an Internet telephone service subscriber by real-time monitoring of voice phishing and text phishing attacks in a security device.

The existing security equipment for Internet telephony functions to protect servers such as service provider call processing servers and IP-PBX (Internet Protocol-Private Branch Exchange) in the enterprise. Existing Internet phone security features include abnormal message attacks, flooding attacks, SIP access control lists (ACLs), and detection / blocking of Internet phone and message spam.

The existing security equipment for Internet telephony performs a SIP security function to protect a server by monitoring incoming SIP messages based on SIP signaling IP / PORT of a call processing server and IP-PBX system to be protected.

The function of the existing security equipment for the Internet phone is as follows. (1) When the SIP message is received, if the source / destination IP / PORT / URL information matches according to the SIP ACL information, the SIP message is processed according to the allow and block settings. (2) It determines whether SIP flooding (SIP DoS / SIP DDoS) attack occurs on the received SIP message and processes the SIP message according to the allow and block setting when the attack occurs. (3) SIP parsing of received SIP message is processed in case of SIP syntax error attack according to SIP syntax error enable and block setting. (4) If the received SIP message is an attack transmitted in violation of Call status, the attack is a message sent from a subject other than the calling party, or an attack transmitted without normal authentication, allow and block abnormal numbers. Handle in accordance with. (5) When a received SIP message transmits a large number of Internet phones to an arbitrary user, and when a message containing advertising and promotional purposes is sent to a large number of users, it is processed according to the spam allowance and blocking setting. (6) If the SIP server is not a security attack, the SIP message is sent to the server to terminate the security function.

Recently, voice phishing and text phishing that deceive money by deceiving users are prevalent. Existing internet phone security equipment is equipped with only SIP server protection function, so it is unprotected to prevent socially problematic voice phishing and text phishing. It is in a state. Therefore, international calls and messages, whose originating numbers are operated by public institutions and representatives of financial institutions, etc., and calls and messages operated via domestic Internet phone-separated companies from abroad, There is a need for security devices for Internet telephony that can detect and block all voice and text phishing attacks.

Evidence law that can detect and block outbound international calls is expected to pass through the National Assembly as early as 2012. In this case, major 10 key telecommunications carriers such as KT, SKBB, LGU +, Samsung SDS, and Internet telephony service providers should Equipment must be built, and small and medium-sized telecommunications carriers must build after a period of grace. Therefore, there is a need for a security device for Internet telephony that can block international calls from which the calling number is manipulated.

The present invention is an international call and messages that are tampered with international telephone calls and messages that are imported from Korea from abroad and manipulated by public institutions, financial representatives, etc. An object of the present invention is to provide a detection and blocking method for voice phishing and text phishing attacks that detect and block voice phishing and text phishing such as messages.

An object of the present invention is to provide a real-time monitoring method of SIP messages based on source information to prevent attacks in advance by real-time monitoring of voice phishing and text phishing attacks.

The technical objects to be achieved by the present invention are not limited to the above-mentioned technical problems, and other technical subjects which are not mentioned can be clearly understood by those skilled in the art from the description of the present invention .

The present invention for achieving the above object in the Voice Over Internet Protocol (VoIP) security equipment located between a SIP server and an Internet Protocol (IP Phone) terminal, receiving a packet from the Internet terminal, A SIP message receiver for transmitting the packet to the SIP message parsing unit if the packet is a SIP message and for transmitting the packet to the SIP message transmitter if the packet is not a SIP message; The SIP message parsing unit parses the SIP message according to the SIP grammar, drops if the SIP message is a malformed SIP message, and delivers the SIP message to a SIP message filtering unit when the SIP message is a normal SIP message. ; The SIP message filtering service transmits the service registration request message to the SIP subscriber management unit, the Internet telephone request message and the message request message to the SIP call information storage unit, and the message other than the message to the SIP message transmitter. part; A SIP subscriber manager which stores subscriber information of the service registration request message and delivers the service registration request message to the SIP message transmitter; The SIP storing the outgoing information and the outgoing IP information in case of a SIP message having normal outgoing information by blocking whether it is an abnormal SIP message by determining whether the outgoing information of the Internet call request message and the message request message conforms to the SIP grammar. Calling information storage unit; A SIP message monitoring unit for storing the Internet call request message and the message request message as monitoring information based on a calling number or calling IP and transmitting the same to the calling information modulation filtering unit; The calling information modulation filtering unit for blocking if the Internet call request message and the message request message are calling number modulation attacks, and otherwise transferring the calling number type filtering unit to the calling number type filtering unit; The calling number type filtering unit for blocking if the Internet call request message and the message request message are calling number type attacks, and if not, delivering to the SIP message transmitting unit; And the SIP message transmitter for transmitting the received message to the SIP server. The VoIP security device detects and blocks a voice phishing and text phishing attack in which outgoing information is modified.

The present invention provides a VoIP security device for detecting and blocking voice phishing and text phishing attacks in which the calling information is modified, wherein the SIP calling information storage unit includes a From header or a P-Asserted-Identity header in which a calling number is stored in a SIP message. And a VoIP security device that detects and blocks voice information and text phishing attacks in which outgoing information has been tampered with, by determining whether a header value conforms to the SIP standard, determining an abnormal message, and storing outgoing information about the normal message. .

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the outgoing information is modified, wherein the SIP outgoing information storage unit parses a Session Data Protocol (SDP) unit in a SIP message to obtain a Realtime Tranfer Protocol (RTP). The present invention provides VoIP security equipment that detects and blocks voice information and text phishing attacks in which outgoing information is modified, which stores IP.

The present invention provides a VoIP security device that detects and blocks voice phishing and text phishing attacks in which the calling information is tampered with, wherein the monitoring information stores the Internet call request and the message request as the number of attempts per unit time, and stores the calling number and the calling IP. It provides a VoIP security equipment that detects and blocks voice phishing and text phishing attacks in which outgoing information, which is collected as a reference, is modified.

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the calling information is modified, wherein the calling information tampering attack uses a calling number of a SIP message having an originating IP of the SIP message. It provides a VoIP security device that detects and blocks voice phishing and text phishing attacks in which outgoing information is altered, including a case where a domestic telephone number is modified.

The present invention provides a VoIP security device for detecting and blocking a voice phishing and text phishing attack in which the calling information is modified, wherein the calling information tampering attack uses the domestic telephone number as the calling number of a SIP message having the RTP IP of an overseas IP band. The present invention provides a VoIP security device for detecting and blocking voice phishing and text phishing attacks in which outgoing information is modified, including a case where the information is modified.

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the calling information is modulated. The present invention provides a VoIP security device for detecting and blocking voice phishing and text phishing attacks in which outgoing information is modified, including a case where a telephone number is modified.

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the calling information is modified, wherein the calling information tampering attack analyzes the subscriber information and modulates the calling information to a calling number different from the number registered by the corresponding subscriber. It provides a VoIP security equipment that detects and blocks the voice number and text phishing attack in which the calling number is altered, characterized in that it comprises a case.

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the calling information is tampered with, wherein the calling number type attack indicates that the calling IP number of the SIP message is 001 to 009 while the calling IP is set by the user. In case of defined IP band, it provides VoIP security equipment to detect and block voice phishing and text phishing attack in which outgoing information is tampered with.

The present invention provides a VoIP security device that detects and blocks a voice phishing and text phishing attack in which the calling information is tampered with, wherein the calling number type attack indicates that the calling IP number of the SIP message is 010 to 019. In case of defined specific IP band, it provides VoIP security equipment that detects and blocks voice information and text phishing attack in which outgoing information is modified, which is determined as a caller's mobile communication type attack.

The present invention provides a VoIP security device that detects and blocks voice phishing and text phishing attacks in which the calling information is modified, and includes a calling number type attack DB including calling number modulation type information. Voice phishing and text phishing attack in which outgoing information has been tampered with, if the outgoing number header value of the SIP message exists in the outgoing number type attack DB and the outgoing IP is a specific IP band defined by the user. Provides VoIP security equipment to detect and block

According to the present invention, it is possible to secure an algorithm using a combination of IP address information, SIP message information, and RTP information, thereby maximizing Internet telephone security equipment function and maximizing utilization. In addition, according to the present invention, there is an effect that the voice phishing and text phishing manipulated by the calling number can be blocked before reaching the user.

FIG. 1 illustrates a voice phishing and text phishing attack environment in which outgoing information is modified in an Internet telephone-only security device according to an embodiment of the present invention. FIG. FIG. 3 is a diagram illustrating a functional block diagram of a method for securing an Internet telephone service, and FIG. 3 is a method for detecting and blocking a voice phishing and text phishing attack in which outgoing information has been tampered with, in a security device exclusively for Internet telephony according to an embodiment of the present invention. This is a diagram showing the order for.

In recent years, the use of Internet telephony is rapidly increasing due to the reduction of communication costs and the use of various additional services. However, Internet telephony is based on IP network. In addition, there are several security vulnerabilities compared to the existing landline telephones, such as a service misuse attack for free use of an Internet phone and a denial of service attack.

One of these vulnerabilities can attempt to make Internet calls and messages by manipulating outgoing phone numbers to an unspecified number through pre-collected personal information. As such, the outgoing telephone number can be easily manipulated by an Internet telephone attacker, and if the telephone number is used by an attacker such as a public agency or a personal telephone number, it can cause serious damage. Recently, outgoing telephone number manipulation is widely used in prank calls and voice phishing, which makes it difficult to track callers by investigative agencies, and many people are suffering from the situation. Among them, voice phishing or phone scams, which have caused social problems in recent years, are fraudulent methods that call offenders to talk about false facts, demand remittances or collect certain personal information. Existing landline telephone networks have been on the decline due to the international call origination system, but recently they are increasing again by using new techniques such as manipulating outgoing numbers with phone numbers of domestic public organizations through internet phones without international phone numbers. It is grasped.

Internet phone security equipment operating in Korea mainly detects and blocks VoIP based DoS / DDoS attacks, detects and blocks attacks through abnormal signals and voice messages, detects and blocks voice and message spam, detects SIP ACL, Most of the call processing servers are protected by blocking functions, so there is no detection function for Internet telephones and messages with outgoing numbers. Voice phishing and text phishing are difficult to detect and block with an algorithm provided by a conventional security device because it is necessary to determine whether there is an error by combining IP address information and calling number information.

According to an embodiment of the present invention, in a Voice Over Internet Protocol (VoIP) security device located between a SIP server and an Internet Protocol (IP Phone) terminal, a packet is received from the Internet terminal, and the packet is SIP. If the message is sent to the SIP message parsing unit 220, and if the packet is not a SIP message, the SIP message receiving unit 210 to deliver to the SIP message transmitter 290, parsing the SIP message according to the SIP grammar (Parsing) And a SIP message parsing unit 220 which drops when the SIP message is a malformed SIP message, and delivers the SIP message to the SIP message filtering unit 230 when the SIP message is a normal SIP message. The service registration request message of the SIP message is delivered to the SIP subscriber management unit 240, the Internet telephone request message and the message request message is delivered to the SIP call information storage unit 250, the message The other message stores the subscriber information of the SIP message filtering unit 230 and the service registration request message delivered to the SIP message transmitter 290, and transfers the service registration request message to the SIP message transmitter 290. The SIP subscriber management unit 240 determines whether the originating number of the Internet call request message and the message request message conforms to the SIP grammar, and blocks the abnormal SIP message, and if the SIP message has the normal calling information, the calling information and The SIP call information storage unit 250 for storing the caller IP information, the Internet call request message and the message request message is stored as the monitoring information based on the caller information or caller IP information, and forwarded to the caller information modulation filter 270 SIP message monitoring unit 260, if the Internet call request message and the message request message is a call number modulation attack Drop, if the call information modulation filtering unit 270, and if the Internet call request message and the message request message that is forwarded to the call number type filtering unit 280 (Drop) blocked If not, the voice information modulated by the source number type filtering unit 280 for transmitting to the SIP message transmitter 290 and the SIP message transmitter 290 for transmitting the received message to the SIP server. It provides VoIP security equipment to detect and block phishing and text phishing attacks.

Voice phishing and text phishing attacks can be largely divided into calling number modulation attacks and calling number type attacks, and an embodiment of the present invention can detect and block the two voice phishing and text phishing attacks described above.

If the calling information is tampered with by comparing the IP information in the SIP message with the IP information of the actually received SIP message, it is determined as a calling number tampering attack and detected and blocked. The classification is made as follows according to the IP information type in the SIP message.

(1) Detection and blocking of outgoing number tampering attacks on IP headers

By analyzing the originating IP and the originating number (From / P-Asserted-Identity) of the SIP message, if the SIP message with the foreign IP address band is modified with a domestic telephone number, it can be determined by blocking the IP header / calling number modulation attack. That is, a case where a SIP message obtained by modifying a domestic telephone number, such as a country / public agency, as a calling number is received from an external IP band is determined as a calling number tampering attack.

(2) Detection and blocking of outgoing number tampering attacks on RTP session information

Analyzing SDP information including RTP (Realtime Transfer Protocol) session information through which voice and video will be transmitted, the SIP message origination number (From / P-Asserted-Identity) is a domestic phone number, And if you want to use as a video traffic network can be determined by blocking the call number modulation attack.

(3) Detection and blocking of originating number tampering attacks on IP information of SIP header

Analyzes the message (From, Via, Contact, etc.) that contains the IP value among the header values in the SIP message and compares the IP information with the calling number (From / P-Asserted-Identity). It can be blocked by selling. That is, if a SIP message including a domestic telephone number as a calling number, such as a national public agency, includes an external IP band as a header value, it is determined as a calling number tampering attack.

(4) Detection and blocking of outgoing number tampering attacks on subscription information

SIP message which stores subscriber information normally registered in SIP server through REGISTER method message, and tries with From / P-Asserted-Identity which is not available to corresponding subscriber by referring subscriber information normally registered in SIP server. Can be blocked by judging it as a tampering attack. In other words, when the SIP message is transmitted by modulating the information with the registered information different from the registered subscription information, it is determined as the originating number modulation attack.

If the From / P-Asserted-Identity Prefix matches the international call, mobile call, or user-defined call, it can be blocked by determining the originating number type attack. According to the characteristics of origination information prefix, it is classified as follows.

(1) Detect and block international call type attack of calling number

If a SIP message in which 001 to 009 exists as a prefix in a From / P-Asserted-Identity header value is received, and the originating IP is a specific IP band defined by a user, it may be determined to be blocked by an international call type attack.

(2) Mobile phone type attack detection and blocking of calling number

When receiving a SIP message in which 010 to 019 exists as a prefix in the From / P-Asserted-Identity header value, and the originating IP is a specific IP band defined by the user, it may be determined as a mobile phone type attack and blocked.

(3) Detect and block custom type attack of calling number

User-defined type attacks can be detected and blocked by using the caller type attack DB, which includes the phone number information subject to the caller's number in voice phishing such as major public institutions. Since the calling number type attack DB may be defined by the system operator, the voice phishing calling number of the new pattern may also be defined and blocked. The calling number type attack DB as a prefix in the From / P-Asserted-Identity header value. If the prefix included in the SIP message is received and the originating IP is a specific IP band defined by the user, it can be determined as a user-defined type attack and blocked.

One embodiment of the present invention provides a function for monitoring voice phishing and character phishing attacks in real time. In order to prevent voice phishing and text phishing attacks in advance, real-time monitoring technology based on calling information can be divided into monitoring technology based on calling number and calling IP.

(1) Real time monitoring technology based on calling number and message

By monitoring the number of phone and message service request attempts in real time based on the SIP message caller number (From / P-Asserted-Identity), the caller number is provided in the order that the most attempts have been made for a certain period of time. By using the voice and text phishing attacks that attempt to randomly call or message service requests can be detected and blocked in advance.

(2) Real time monitoring technology for outgoing IP based telephone and message

By monitoring the number of phone and message service request attempts in real time based on the originating IP of the SIP message, it provides outgoing IP information in the order that the most attempts were made for a certain period of time to detect and block voice phishing and text phishing attacks in advance. You can do that.

Hereinafter, a method for detecting and blocking a voice phishing and text phishing attack in which the VoIP information is modified by the VoIP security equipment according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The Internet telephone network in which the outgoing number modulation attack to which the present invention is applied can be made is operated in the environment as shown in FIG. Attack route (110) for requesting Internet phone calls and messages using subscriber numbers different from the subscriber number successfully registered by the first Internet phone service subscriber, and SIP messages with foreign IP bands through overseas Internet phone service providers. The attack path 120 for requesting Internet calls and messages by converting the domestic phone number of the caller to a calling number, and a SIP message with an overseas IP band sends domestic phone numbers such as national / public institutions through overseas telecommunications Internet phone providers. The attack path 130 for requesting an Internet phone call and a message by modifying the number, and the SIP message including the foreign IP band information through the domestic telecommunications Internet phone service provider modulates the domestic phone number of the country / public institution, etc. into the calling number. Specific caller IDs from attack vectors and Internet IP calling routes that request Internet calls and messages. The attack vector 140 to request an Internet call and a message type may be present. If the system to which the present invention is applied to such an attack path is constructed, voice phishing and text phishing attacks can be detected and blocked.

2 is a block diagram showing the components and their interrelationships of the VoIP security equipment according to an embodiment of the present invention. Figure 3 shows the operation of the VoIP security equipment according to an embodiment of the present invention as a chart. Hereinafter, the operation of the present invention will be described with reference to FIGS. 2 and 3.

When the SIP message receiving unit 210 receives the IP packet, the SIP message receiving unit 210 determines whether the SIP message is a SIP message. If the SIP message receiving unit 210 is not a SIP message, the SIP message transmitting unit 210 transmits the corresponding IP packet through the SIP message transmitting unit 290. Among the various types of IP packets, the target of the originating number tampering attack is the SIP message, so only the SIP message is selected for inspection. In the case of a SIP message, it is transmitted to the SIP message parsing unit 220.

The SIP message parsing unit 220 parses the received SIP message according to the SIP standard (RFC 3261) according to the SIP grammar. If the SIP message does not meet the SIP standard, the corresponding SIP message is blocked (DROP). When normal SIP message parsing is performed, the SIP message is delivered to the SIP message filtering unit 230.

The SIP message filtering unit 230 first determines whether the message is a " REGISTER " method for requesting the registration of the Internet telephony service among the SIP messages, and enables the SIP subscriber management unit 240 to perform service registration management. Pass the corresponding IP packet through (290) (PASS). The SIP subscriber management unit 240 stores the corresponding subscriber information when normal subscriber registration is performed, and sends the corresponding subscriber information when the subscriber information is requested by the outgoing information modulation filtering unit 270 later.

The SIP message filtering unit 230 stores SIP originating information in the case of an "INVITE" method for making an Internet call request or a "MESSAGE" method message for making a message request, among all SIP messages not delivered to the SIP subscriber management unit 240. Sending to the unit 250, all the remaining messages pass (PASS) the IP packet through the SIP message transmitter 290.

The SIP caller ID storage unit 250 determines whether the header value of the From header or the P-Asserted-Identity header configured with the calling number in the SIP message is configured according to the SIP standard, and thus has a message with abnormal calling information. In case of, the corresponding SIP message is blocked (DROP), and if the caller has normal call information, the caller ID and the sender IP information that transmits the corresponding SIP message are stored in the SIP message, and the call information modulation filtering unit 270 subsequently stores the IP information. Make it available. In addition, the SIP call number storage unit 250 parses a Session Data Protocol (SDP) unit in a SIP message in which the RTP information to which voice and video are to be transmitted is stored, and stores the RTP IP information to which actual RTP traffic is transmitted, and then sends the information later. Modulation filtering unit 270 to use the RTP IP information. The SIP call number storage unit 250 stores the call information and the RTP IP information of the SIP message and transmits the received SIP information to the SIP message monitoring unit 250.

The SIP message monitoring unit 260 analyzes the SIP message and stores the Internet call and the message request as the number of attempts per unit time based on the calling information. Separates outgoing number and outgoing IP information, and saves Internet call and message request as the number of attempts per unit time, and saves the number of attempts of unit call and message request per unit time in order of most attempts. It is possible to output the number of times and call number / SIP message / attempt, outgoing IP call / internet call / attempt and outgoing IP / SIP message / attempt. The monitored SIP message is sent to the outgoing information modulation filtering unit 270.

The outgoing information modulation filtering unit 260 first uses the outgoing IP information stored in the SIP outgoing number storage unit 250 so that a SIP message having an external IP band modulates a domestic phone number such as a country / public institution into a outgoing number. In case of internet phone call and message request, it determines that the calling number tampering attack blocks the corresponding SIP message (DROP). The outgoing information modulation filtering unit 260 is an Internet telephone in which a SIP message having RTP IP information stored in the SIP calling number storage unit 250 has a foreign IP band and modulated a domestic phone number such as a country / public institution as a calling number; In case of a message request, the SIP message is blocked by determining that the calling number is tampered with. Outgoing information modulation filtering unit 260 is a SIP message whose header value of the SIP header, which may store the IP-related information such as Via, Contact parsed by the SIP calling number storage unit 250 in the country outside the country In case of internet phone call and message request in which domestic phone number of public institution, etc. is converted into calling number, it judges that the calling number is tampering and blocks the SIP message. The outgoing information tampering filtering unit 260 determines that the outgoing number tampering attack is a case where the Internet telephone service subscriber managed by the SIP subscriber management unit 240 modulates the outgoing number of the outgoing phone number used in registration and the message of the outgoing number. To block the SIP message. After performing the calling information modulation filtering function, the SIP message is sent to the calling number type filtering unit 280.

Calling number type filtering unit 280 is 001 to 009 that the prefix of the calling number is determined to be an international call, and user-defined In case of internet phone call and message request of SIP message with specific IP band, it judges that it is calling number type attack and blocks the SIP message.

Calling number type filtering unit 280 is 010 to 019 which is determined that the prefix of the calling number is a mobile phone, and user defined In case of internet phone call and message request of SIP message with specific IP band, it judges that it is calling number type attack and blocks the SIP message.

Calling number type filtering unit 280 is a user defined number of the prefix of the calling number defined by the user In case of internet phone call and message request of SIP message with specific IP band, it judges that it is calling number type attack and blocks the SIP message.

The specific IP band defined by the user refers to an IP band directly input by the user for an IP band in which the originating IP cannot come from, and an IP band in which voice phishing and text phishing attacks occur.

SIP messages not detected in all the above attacks are finally delivered through the SIP message transmitter 290.

The terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms and should be construed in a sense and concept consistent with the technical idea of the present invention. It should be noted that the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention and are not intended to represent all of the technical ideas of the present invention so that various equivalents And variations.

110: attack path for requesting internet phone call and message using calling party number different from registered subscriber number
120: Attacking path for requesting Internet calls and messages by SIP message with foreign IP band through foreign internet telephone service provider transforming domestic / public agency number such as national / public agency into calling number
130: Attacking path for requesting Internet calls and messages by SIP messages with foreign IP bands by modifying domestic / public agency numbers, such as national / public institutions, by calling numbers
140: An attack path or an outgoing IP that requests an internet phone call and a message by converting a SIP message including foreign IP band information through a domestic telecommunications Internet telephony service provider into a calling number Attack vectors that request Internet calls and messages from the band to specific types of origins
210: SIP message receiving unit
220: SIP message parsing unit
230: SIP message filtering unit
240: SIP subscriber management unit
250: SIP call information storage unit
260: SIP message monitoring unit
270: outgoing information modulation filtering unit
280: caller type filtering unit
290: SIP message transmitter

Claims (11)

In the VoIP (Voice Over Internet Protocol) security equipment located between a SIP server and an Internet Protocol (IP Phone) terminal,
A SIP message receiving unit which receives a packet from the Internet terminal, delivers the packet to a SIP message parsing unit when the packet is a SIP message, and delivers the packet to a SIP message transmitting unit when the packet is not a SIP message;
The SIP message parsing unit parses the SIP message according to the SIP grammar, drops if the SIP message is a malformed SIP message, and delivers the SIP message to a SIP message filtering unit when the SIP message is a normal SIP message. ;
The SIP message filtering service transmits the service registration request message to the SIP subscriber management unit, the Internet telephone request message and the message request message to the SIP call information storage unit, and the message other than the message to the SIP message transmitter. part;
A SIP subscriber manager which stores subscriber information of the service registration request message and delivers the service registration request message to the SIP message transmitter;
The SIP storing the outgoing information and the outgoing IP information in case of a SIP message having normal outgoing information by blocking whether it is an abnormal SIP message by determining whether the outgoing information of the Internet call request message and the message request message conforms to the SIP grammar. Calling information storage unit;
A SIP message monitoring unit for storing the Internet call request message and the message request message as monitoring information based on a calling number or calling IP and transmitting the same to the calling information modulation filtering unit;
The calling information modulation filtering unit for blocking if the Internet call request message and the message request message are calling number modulation attacks, and otherwise transferring the calling number type filtering unit to the calling number type filtering unit;
The calling number type filtering unit for blocking if the Internet call request message and the message request message are calling number type attacks, and if not, delivering to the SIP message transmitting unit; And
And a SIP message transmitter for transmitting the received message to the SIP server. The VoIP security device for detecting and blocking voice phishing and text phishing attacks in which outgoing information is modified.
The method according to claim 1,
The SIP origination information storage unit determines an abnormal message by determining whether a header value of a From header or a header value of a P-Asserted-Identity header in which a calling number is stored in a SIP message conforms to a SIP standard, and determines outgoing information for a normal message. VoIP security equipment that detects and blocks voice phishing and text phishing attacks in which outgoing information is modified.
The method according to claim 1,
The SIP source information storage unit parses a Session Data Protocol (SDP) unit in a SIP message to store a Realtime Tranfer Protocol (RTP) IP. equipment.
The method according to claim 1,
The monitoring information stores the Internet call request and the message request as the number of attempts per unit time, and collects them based on the calling IP and calling number. .
The method according to claim 1,
The outgoing information tampering attack includes a voice phishing and text phishing attack in which the outgoing information is modulated, wherein the outgoing IP of the SIP message includes a case in which the outgoing number of the SIP message having an external IP band is modified into a domestic telephone number. VoIP security equipment to detect and block.
The method of claim 3,
The outgoing information tampering attack detects and blocks voice phishing and text phishing attacks in which outgoing information is modulated, wherein the RTP IP includes a case in which the outgoing number of a SIP message having a foreign IP band is modified into a domestic phone number. VoIP security equipment.
The method according to claim 1,
The outgoing information tampering attack detects voice phishing and text phishing attacks in which outgoing information has been tampered with, wherein the SIP message header value includes a case in which the outgoing number of a SIP message having a foreign IP band is modulated into a domestic telephone number. And VoIP security equipment to block.
The method according to claim 1,
The outgoing information tampering attack detects and blocks voice phishing and text phishing attacks in which outgoing information has been tampered with by analyzing the subscriber information and modifying the outgoing information into a different outgoing number. equipment.
The method according to claim 1,
The caller type attack is a caller ID header value of 001 to 009 of the SIP message and is a user defined specific IP band. VoIP security equipment that detects and blocks voice phishing and text phishing attacks in which outgoing information is altered, characterized in that it is determined as a caller's international call type attack.
The method according to claim 1,
The caller type attack is a caller ID number of 010 to 019 in the SIP message and is a user defined IP band. VoIP security equipment that detects and blocks voice phishing and text phishing attacks in which outgoing information is altered, characterized in that it is determined as a caller mobile communication type attack.
The method according to claim 1,
Includes the calling number type attack DB containing the calling number modulation type information,
The call number type attack is a specific IP band defined by the user while the call number header value of the SIP message exists in the call number type attack DB. VoIP security equipment that detects and blocks voice phishing and text phishing attacks in which outgoing information is altered, characterized in that it is determined as a user-defined type of attack.

Images