KR20050002542A - The method for protection DOS attack traffic by setting time frequency number which has multi-thresholds in access gateway or media gateway - Google Patents

Abstract

PURPOSE: A method for cutting off a DOS(Denial Of Service) attack in an NGN(Next Generation Network) is provided to determine different time threshold values by subscriber feature, and to store the determined time threshold values to cut off traffic when a lot of traffic received from a subscriber enters within the time threshold values, thereby cutting off DOS attack-type traffic. CONSTITUTION: An attack traffic cutoff manager checks information on each subscriber, and perceives subscriber features(S310). The cutoff manager sets threshold values according to each subscriber packet and each call(S320). The cutoff manager supplies the set threshold values of each subscriber to access gateways which take charge of the subscribers(S330). Each access gateway stores threshold value information on self subscribers, calculates statistics, and manages the threshold value information(S340).

Description

{The method for protection DOS attack traffic by setting time frequency number which has multi-thresholds in access gateway or media gateway}

The present invention relates to Next Generation Network (NGN), and more particularly, to a method of blocking denial of service (DOS) from a malicious attacker.

The denial of service attack (hereinafter referred to as 'DOS attack') refers to generating a large amount of traffic to the target host to temporarily or completely stop the network service function of the target host, and the traffic is transmitted to the bearer channel of the NGN. It is divided into packet traffic and call traffic of a signaling channel.

Recently, as the Internet is popularized and services such as electronic commerce through the Internet are spreading, the importance of security issues is increasing. Intrusion detection systems and intrusion prevention systems have been developed to solve these security problems.

Intrusion detection system and intrusion blocking system are effective systems to detect and block electronic infringement behaviors. They are installed inside subscriber networks and public networks or inside subscriber networks to detect abnormalities of input / output traffic and block intrusion of abnormal traffic. .

However, most companies and subscribers are so small that they are not equipped with the security device or otherwise have no dedicated security personnel. Moreover, even if security personnel are operated, most of them are not skilled workers, so it is difficult to maintain high security services or respond to new hacking methods.

As a result, service providers need to provide security functions on behalf of small companies or subscribers, and the need for blocking on the service providers' own side is increasing in preparation for the possibility of congestion of their network traffic by DOS attacks. .

At present, NGN does not provide any method for security against DOS attack of transport network signal or signaling network traffic. However, since the NGN terminal can automatically generate a large number of calls or generate traffic to paralyze the soft switch or congest the network, the NGN network is in urgent need of blocking measures against DOS attacks.

The present invention has been made to solve the above-mentioned conventional problems, and an object thereof is to block DOS attacks from malicious attackers. In addition, an object of the present invention is to block DOS attack at low network construction cost without having a separate device in the NGN network.

1 is a block diagram of a general NGN network.

2 is a simplified diagram showing the configuration of an NGN network according to an embodiment of the present invention.

Figure 3 is a flow chart showing the operation of the attack traffic blocking management unit according to an embodiment of the present invention.

Figure 4 is a flow chart showing the operation of the abnormal traffic blocking unit according to an embodiment of the present invention.

The present invention for achieving the above technical problem is expensive to introduce a separate security block device, it is characterized by blocking the DOS attack using the existing NGN network configuration without having a separate security block device There is this.

The present invention is designed to have a function of detecting and blocking a DOS attack on the access GW (media GateWay) or media GW (media GateWay) that is the access equipment of the subscriber access stage in the NGN. That is, the present invention sets each traffic threshold for the amount of packet generation in the transmission network and the amount of call generation traffic in the signaling network to the access GW (or media GW) so as to discriminate whether it is a normal subscriber or a malicious attacker.

In this case, since the amount of traffic generated according to the characteristics of each subscriber (for example, the characteristics of individual subscribers and subscribers using a large capacity server) is different, the traffic thresholds are differentially applied in consideration of this. Since the amount is different, the traffic thresholds are applied differently according to time slots. That is, the present invention differentially applies traffic thresholds by subscriber (or group) and by time zone.

Accordingly, the present invention for achieving the above technical problem is a method for blocking denial of service attacks in the NGN network including an access GW (or media GW) connected to the subscriber terminal, the number of subscribers according to the NGN network usage type A second step of classifying, a second step of setting different time thresholds for traffic for each classified group and providing the set time thresholds to at least each access GW to which the corresponding subscriber is connected, and wherein each access GW is a received packet A third step of determining whether to block the traffic received two or more times by identifying the subscriber through the IP included in and applying the time threshold for the checked traffic to the reception time interval of the received traffic two or more times It includes.

The traffic is preferably a packet or call.

Hereinafter, a method of blocking service denial attack in an NGN network according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a block diagram of a general NGN network.

As shown in FIG. 1, the NGN network includes a softswitch 11 that is in charge of a call, various gateways that receive various subscriber stations and perform protocol processing and media conversion for connection with the softswitch 11. (12, 13, 14), an application server 15 providing various services to these subscribers, a backbone delivery network 16 for transferring information between these elements, and a media server storing and providing resources necessary for various subscriber services. (17). The access GW 12 then connects the NGN subscriber station with the packet delivery network. Here, the media GW may be located at the access GW 12 location. In the NGN network configured as described above, in order to access the NGN network, the terminal first accesses the NGN network through an access GW 12 installed at the subscriber side.

The present invention configures the NGN network as shown in FIG. 2 to prevent DOS / DDOS attacks in the NGN network configured as shown in FIG. 1.

Figure 2 is a simplified view showing the configuration of the NGN network according to an embodiment of the present invention, the configuration shown only based on the configuration that is modified to achieve the present invention.

As shown in FIG. 2, the NGN network for the present invention incorporates the abnormal traffic blocking unit 100 in a plurality of access GWs (AGs) that perform the same function. Since the abnormal traffic blocking unit 100 of each of the access GW (AG) all have the same function, it is described with the same reference numerals.

In general, an access GW (AG) is connected to a terminal of a plurality of users. That is, one access GW (AG) is responsible for multiple subscribers to the extent that capacity permits.

The abnormal traffic blocking unit 100, when a malicious user introduces or leaks an attack packet or an attack call traffic of DOS / DDOS (Distributed Denial Of Service) type through the NGN terminal to the NGN network, together with normal user traffic. Effectively detect and block mixed attack traffic.

The operation of the abnormal traffic blocking unit 100 detects and blocks the abnormal traffic according to the time threshold information provided by the attack traffic blocking management unit 201 of the operation management system 200. The abnormal traffic blocking unit 100 classifies subscriber characteristics such as NGN network access time, packet generation amount, and call generation amount of subscribers, and sets different time threshold information. That is, when subscribers A, B, C, and D have different subscriber characteristics, different thresholds, that is, multiple thresholds, are applied to each subscriber. The subscriber characteristics are clearly described in the following description.

Hereinafter, operations of the attack traffic blocking management unit and the abnormal traffic blocking unit will be described with reference to FIGS. 3 and 4.

Figure 3 is a flow chart showing the operation of the attack traffic blocking management unit according to an embodiment of the present invention.

The operation management system 200 of the NGN network stores all subscriber information subscribed to the NGN network. Each subscriber has different traffic characteristics such as connection speed, frequently used service, packet generation amount, call generation amount, etc., depending on individual communication device or surrounding conditions. That is, each subscriber has different time intervals (referred to as reception rates in the NGN network side) between transmission packets according to characteristics of transmission packets sent to the NGN network, and time intervals between call occurrences according to call generation characteristics. These also differ by hour and day of the week.

The attack traffic blocking management unit 201 checks the reception rate, the packet generation amount, the call generation amount, etc. for each subscriber by time and day of week to determine characteristics of each subscriber (S310).

The subscriber characteristics are almost determined according to the packet generation amount, and additionally, the reception rate is considered when protecting the subscriber from the DOS attack.

The attack traffic blocking management unit 201 sets the threshold of packet generation and the threshold of call generation by time and day of the week according to subscriber characteristics (S320). The threshold is a condition value that determines whether a packet (or call) passes, and is a frequency of time (ie, a time interval at which a packet or call arrives). In general, a high threshold is set for a large subscriber and a low threshold is set for a general subscriber.

When the attack traffic blocking management unit 201 sets a threshold for each subscriber as described above, the attack traffic blocking management unit 201 provides a threshold for each subscriber to the corresponding access GW in charge of the subscriber (S330). Accordingly, each access GW stores threshold information on the subscriber in charge of the subscriber and calculates and manages statistics (S340).

Here, the attack traffic blocking management unit 201 designates the subscriber or service requiring security by the network administrator, and provides the abnormal traffic blocking unit 100 with information of the subscriber and the service requiring the specified security. .

On the other hand, the attack traffic blocking management unit 201 of the present invention can be designed to classify into a plurality of groups for each subscriber characteristics determined in the step (S310), and to determine the threshold for each classified group.

Hereinafter, referring to FIG. 4, the operation of the access GW, in particular, the abnormal traffic blocking unit, which stores the threshold information of each subscriber as described above, will be described.

4 is a flowchart illustrating an operation of an abnormal traffic blocking unit in terms of packet generation amount according to an exemplary embodiment of the present invention. As shown in FIG. 4, when the abnormal traffic blocking unit 100 receives a packet from the NGN terminal (S401), the abnormal traffic blocking unit 100 checks an IP address and a port number included in the received packet (S402).

The IP address is a data that allows the subscriber information to be known, and the port number is a data that allows the subscriber to know what service is required.

The abnormal traffic blocking unit 100 compares the received packet's IP with subscriber information requiring security provided by the attack traffic blocking management unit 201, that is, an IP list and a list of port numbers requiring security. It is determined whether to apply the security mode to (S403).

In the determination (S403), the abnormal traffic blocking unit 100 applies the IP security mode when the IP of the received packet is included in the IP list requiring security, the IP list of which the port number of the received packet requires security If included in the port security mode is applied, if there is no corresponding to pass the packet (S404).

Hereinafter, the case where the abnormal traffic blocking unit 100 applies the IP security mode will be described as an example. Even when the port security mode is applied, it is almost the same as the following description, so it can be easily understood.

If it is determined in step S403 that the security mode should be applied to the received packet, the abnormal traffic blocking unit 100 checks whether the blocking timer for the received packet is operating, and thus the received packet is in an initial state (ie, The first received) or not (S405).

In the above, it is not the initial state if the cutoff timer is assigned, and it is the initial state if the cutoff timer is not assigned. If the initial state, the abnormal traffic blocking unit 100 allocates a blocking timer for the packet, and sets and drives a threshold corresponding to the IP (ie, subscriber) of the packet (S406).

Here, the threshold is set according to the subscriber or the corresponding group characteristics of the subscriber, the value is already determined by the attack traffic blocking management unit 200 is stored in the abnormal traffic blocking unit 100. The cutoff timer counts down the threshold value as a threshold value, and becomes 0 when the threshold value is exceeded. For example, if the threshold is 3 seconds, the cutoff timer counters the time, and if it exceeds 3 seconds, the cutoff timer is 0 and ends.

After the process (S406), when the abnormal traffic blocking unit 100 receives a packet from the same subscriber (S401), by checking the IP and port number of the received packet (S402), it determines whether to apply the security mode (S403) ).

If the IP and the port number of the received packet are the same as the packet previously received from the same subscriber, the abnormal traffic blocking unit 100 sets the security mode and a timer is generated for the packet. You know it's not a condition. The abnormal traffic blocking unit 100 checks whether the timer count value has expired (S407), and determines whether the received packet is abnormal traffic or normal traffic.

That is, the abnormal traffic blocking unit 100 determines that the time interval with the previously received packet is smaller than the threshold value if the timer counter value is not 0, and determines the currently received packet as abnormal traffic and blocks the packet transmission ( S409). The abnormal traffic blocking unit 100 drives the blocking timer again from the time point at which the blocked packet is received and resets the threshold value (S410).

On the other hand, the abnormal traffic blocking unit 100 determines that the timer counts to 0, and determines that the packet is a normal packet. Then, the abnormal traffic blocking unit 100 sets the threshold again (S408) and passes the packet (S404).

When the abnormal traffic blocking unit 100 blocks the abnormal packet, the abnormal traffic blocking unit 100 generates information on the blocked packet and transmits the information to the operation management system 200 (S411).

The description with reference to FIG. 4 relates to traffic security for subscriber A shown in FIG. 2, and the same applies to subscribers B, C, and D. However, if subscribers B, C, and D have different traffic characteristics from subscriber A, other timers having different thresholds are allocated and applied.

5 is a flowchart illustrating an operation of an abnormal traffic blocking unit on the side of a call generation amount according to an exemplary embodiment of the present invention. As shown in FIG. 5, when the abnormal traffic blocking unit 100 receives a call from the NGN terminal M1 (S501), the abnormal traffic blocking unit 100 checks an IP address and a signaling protocol included in the received packet (S502).

The IP address is a data that allows the subscriber information to be known, and the signaling protocol is a data that allows the subscriber to know what kind of call is required.

The abnormal traffic blocking unit 100 checks the source IP of the received call against subscriber information requiring security provided by the attack traffic blocking management unit 201, that is, whether the security mode is applied to the received call. (S503).

In the determination (S503), the abnormal traffic blocking unit 100 sets the call security mode when the IP of the received call is included in the call security list requiring security, and passes the call if there is no corresponding item (S504).

If the call security mode is set by the determination (S503), the abnormal traffic blocking unit 100 checks whether a blocking timer for the received call is generated and the received call is in an initial state (that is, the first received call). It is determined whether or not (S505), if it is the initial state by assigning a blocking timer to set the threshold corresponding to the IP (ie, subscriber) of the call to drive (S506).

Here, the threshold is set in accordance with the characteristics of the subscriber, the value is already determined by the attack traffic blocking management unit 200 is stored in the abnormal traffic blocking unit 100.

After the process (S506), when the abnormal traffic blocking unit 100 receives a call from the same subscriber (S501), by checking the IP and the signaling protocol of the received call (S502), it determines whether to apply the security mode (S503) .

If the IP of the received call and the signaling protocol are the same as the previously received call from the same subscriber, the abnormal traffic blocking unit 100 applies the security mode and the timer is generated for the packet, so the currently received call has an initial state. I know not. The abnormal traffic blocking unit 100 checks whether the timer count value is terminated (S507), and determines whether the received call is an abnormal call or a normal call.

That is, the abnormal traffic blocking unit 100 determines that the time interval with the previously received call is smaller than the threshold value when the timer counter value is not 0, and determines that the currently received call is an abnormal call and blocks the call transmission. S509). The abnormal traffic blocking unit 100 drives the blocking timer again from the time point at which the blocked call is received and resets the threshold value (S510).

On the other hand, the abnormal traffic blocking unit 100 determines that it is a normal call when the timer counter value is 0, drives the blocking timer again, sets a threshold (S508), and passes the call (S504).

When the abnormal traffic blocking unit 100 blocks the abnormal call, the abnormal traffic blocking unit 100 generates information on the blocked call and transmits the information to the operation management system 200 (S511).

The description with reference to FIG. 5 relates to signal network traffic security for subscriber A shown in FIG. 2, and the same applies to subscribers B, C, and D. However, if subscribers B, C, and D are subscriber groups having different signal network traffic characteristics from subscriber A, other timers having different thresholds are allocated and applied.

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only and not intended to limit the present invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

The present invention determines different time thresholds for each subscriber characteristic, and stores the determined time thresholds for each subscriber characteristic, such as access GW or media GW of the NGN network, so as to block traffic when a plurality of traffic received from the subscriber enters within the time threshold. It can block traffic in the form of DOS attacks from subscribers.

The present invention can reduce network construction costs and manpower by blocking traffic in the form of DOS attacks by adding a separate device to an existing device without building a separate device in the NGN network.

The present invention induces a deep trust from subscribers to provide a base for securing subscribers and prevent subscriber churn to create profitable services.

Claims (9)

A method for preventing a denial of service attack in an NGN network including an access GW (or media GW) connected to a subscriber station, Classifying subscribers into a plurality of groups according to NGN network usage types; A second step of setting different time thresholds for traffic for each classified group and providing the set time thresholds to each access GW connected to the corresponding subscriber; And Each of the access GWs checks the subscriber through the IP included in the received packet and applies the time threshold for the checked traffic to the receiving time interval of the received traffic two or more times. And a third step of determining whether to block the service denial of service attack in the NGN network. The method according to claim 1, The NGN network usage type of the subscriber includes a connection speed of the subscriber and the traffic generation amount. The method according to claim 2, The second step, The time threshold is a service denial attack blocking method of the NGN network, characterized in that the high traffic generation and the connection speed is set in the order of the user group. The method according to claim 3, The third step is a service denial attack blocking method in the NGN network, characterized in that performed for traffic requiring security. The method according to claim 4, And the traffic is a transport network traffic and a unit thereof is a packet. The method according to claim 4, The traffic is a signal network traffic, the unit is a call (call), characterized in that the denial of service attack blocking method in the NGN network. The method according to claim 5, The third step, A first substep of checking an IP and a port number of the received packet; A second sub-step of determining a security mode setting by comparing the checked IP and the port number with the IP security list and the port security list, respectively; Setting a security mode, a third sub-step of determining whether a received packet is a first received packet; If it is the first packet received, a blocking timer is assigned and driven, and a time threshold corresponding to the identified IP is set and passed. If the packet is not received for the first time, the received packet is blocked before the blocking timer ends the time threshold. And a fourth sub-step, the service denial attack blocking method in the NGN network. The method according to claim 6, The third step, A first substep of confirming the IP and the call of the received packet; A second sub-step of determining a security mode setting by comparing the checked IP and the call to a call security list, respectively; Setting a secure mode, determining whether the received call is a first received call; If the call is received for the first time, it allocates and operates a cutoff timer, sets a time threshold corresponding to the call of the IP identified above, and passes it. If not, the received call is blocked before the cutoff timer ends the time threshold. The service denial attack blocking method of the NGN network, characterized in that it comprises a fourth sub-step. The method according to claim 1, The time threshold is a denial of service attack blocking method in the NGN network, characterized in that different values for each hour, day of the week for the same subscriber group.