KR20100073527A - Detection and block system for hacking attack of internet telephone using the sip-based and method thereof - Google Patents

Abstract

PURPOSE: A system for detecting and cutting off sip protocol based internet phone hacking attack is provided to perform detecting and cutting off sip protocol based internet phone hacking attack using SIP protocol. CONSTITUTION: SIP(Session Initiation Protocol) signaling attack treating module(100) performs the detection and the cut-off of SIP method flooding attack and SIP BYE / Cancel attack. RTP(Real-time Transport Protocol) media attack treating module(200) performs the detection and the cut-off of RTP Insertion attack. SIP signaling/media attach treating policy management module(300) manages the policy for the attack detection / cut-off of an application layer base and the security policy. IP / Port filtering module(400) blocks the attack of L3~L4 layer by each IP / Port / protocol.

Description

Detection and block system for hacking attack of internet telephone using the SIP-based and method

The present invention hacks using the SIP protocol which is a representative signal control protocol of Internet telephony through the configuration of the SIP signaling attack response module, the RTP media attack response module, the SIP signaling / media attack response policy management module, and the IP / Port filtering module. Detect and block attacks, detect protocol association between application layers (SIP: call setup control message transfer protocol, RTP: real-time media data transfer protocol), detect deep packet headers of application layer protocols, and call setup It is a technology related to SIP protocol based internet phone hacking attack detection and blocking system and method that can detect and block attacks specific to application layer (SIP, RTP) by having status analysis function.

In SIP (Session Initation Protocol) based application services such as Internet telephony, signaling paths for call setup and media paths for transmitting voice data are transmitted differently, and call setup address information such as IP / Port is needed to open media channels between users. It is embedded in the SIP signaling message and transmitted, and the SIP protocol structure has characteristics specific to SIP-based application services using various SIP configuration methods such as INVITE / BYE / CANCEL, but existing security devices reflect these characteristics. There is a limit in responding to various hacking attacks using layers (SIP, RTP).

The conventional firewall has a limitation in that the SIP signaling port must be opened, and even in the case of IPS and IDS technologies, the SIP layer does not analyze the application layer (SIP, RTP) protocol header fields in detail, SIP signaling packets, RTP media packets, There is a limitation in detecting and responding to attacks specific to application layer (SIP, RTP) because it does not provide cross-protocol association analysis detection and call establishment state-based statefull inspection detection.

Therefore, it is possible to detect and block hacking attacks by using SIP protocol, which is a representative signal control protocol of Internet telephony. By having a call setup status analysis function, there is an urgent need to develop a SIP protocol-based internet phone hacking attack detection and blocking system and method that can detect and block attacks specific to the application layer (SIP, RTP).

Accordingly, the present invention has been conceived to solve the above problems, the Internet signaling through the configuration of the SIP signaling attack response module, RTP media attack response module, SIP signaling / media attack response policy management module and IP / Port filtering module The purpose of the present invention is to provide a SIP protocol-based internet phone hacking attack detection and blocking system and a method for detecting and blocking hacking attacks using the SIP protocol, a representative signal control protocol.

Another object of the present invention is to detect the correlation analysis of the protocol between the application layer (SIP, RTP), Deep Packet header analysis function of the application layer protocol, and call setup state analysis function, so that the application layer (SIP, RTP) The present invention provides a SIP protocol based internet phone hacking attack detection and blocking system and method for detecting and blocking specialized attacks.

SIP protocol-based Internet phone hacking attack detection and blocking system according to an embodiment of the present invention for achieving the above object is a SIP method flooding (Flooding) attack, the attack using the SIP BYE / Cancel attack SIP call control message SIP signaling attack response module for detecting and blocking; An RTP media attack response module for detecting and blocking an RTP media data-based attack, which is an RTP Insertion attack; A SIP signaling / media attack response policy management module connected to the SIP signaling attack response module and the RTP media attack response module and managing a policy and a security policy for detecting and blocking an application layer (SIP, RTP) based attack; An IP / Port filtering module connected to the SIP signaling attack response module and the RTP media attack response module and blocking an attack of the L3 to L4 layer by IP / Port / protocol; Characterized in that it comprises a.

In the present invention, the SIP signaling attack counter module includes: a SIP signaling header decoding block for decoding a SIP signaling header according to a SIP standard; A SIP signaling attack detection / blocking block having URI based SIP packet filtering, SIP signaling DoS detection, SIP protocol anomaly detection, SIP address forgery detection, signature based SIP hacking attack detection and SIP session anomaly detection; A call establishment information transmitting agent for sending a call to SIP call establishment information; . ≪ / RTI >

In the present invention, the RTP media attack response module includes: a call establishment information receiving agent for receiving a call call SIP call establishment information; An RTP media attack detection / blocking block for detecting and blocking an RTP media attack by receiving call establishment state information (IP address to which a call is connected and dynamic port information) from a SIP signaling attack response module; An RTP media header decoding block for decoding the RTP media header according to the RTP standard specification; Characterized in that consists of.

In the present invention, the SIP signaling attack response module and the RTP media attack response module exchanges configuration information (Signaled IP address, dynamic port address) connected to the call through the transmission / reception agent channel information of the application layer ( SIP, RTP) is characterized in that the analysis of the association between protocols.

The SIP signaling attack detection / blocking block may include: a URI-based SIP packet filtering unit configured to filter SIP packets including URI address information set as a blacklist in the To, From, and Via fields after analyzing the SIP header field; A SIP signaling DoS detector for detecting and blocking a DoS attack using a SIP method such as INVITE floating; A SIP protocol anomaly detection unit for detecting and blocking SIP Malformed message attacks that violate the RFC 3261 standard specification; A SIP address forgery detection unit for detecting a spoofing attack of IP address spoofing; A signature-based SIP hacking attack detection unit for detecting SIP XSS, SQL Injection attacks, and terminal OS bug vulnerability attacks by using a pattern matching method in a signature form of a known SIP message-based attack; A SIP session anomaly detector for checking and processing suitability of a SIP call transaction state; . ≪ / RTI >

In the present invention, the RTP media attack detection / blocking block receives call setup state information from the SIP signaling attack detection / blocking module, and analyzes an IP header field and sets a blacklist in a transmission IP / Port and a receiving IP / Port field. An IP / Port packet filtering unit for filtering an RTP packet including IP / Port information; An RTP media header decoding module for receiving the RTP packet from the IP / Port packet filtering unit and decoding the header field according to the RTP standard specification and transmitting the RTP packet to the RTP media attack detection / blocking module; RTP media attack to determine the RTP stream that is normally set up, and receives the call setup status information from the SIP signaling attack response module and checks whether the IP, Port, and SSRC values are the same. Detection / blocking module; An abnormal RTP traffic response module for profiling RTP traffic, detecting abnormal RTP traffic through rate-limit, and managing network bands to prioritize normal RTP traffic; . ≪ / RTI >

In addition, in the SIP protocol-based Internet phone hacking attack detection and blocking method according to an embodiment of the present invention for achieving the above object, the RTP media attack packet detection / blocking operation process that does not set up the call to the RTP media data decoding Receiving the passed RTP packet; Querying transmit / receive IP, Port, and SSRC values, which are information on which a call is set, to determine a RTP stream by establishing a call normally; If the packet matches the IP, Port, and SSRC of the call setup state table, forwarding the packet to the next process; otherwise, dropping the packet; .

SIP protocol based internet phone hacking attack detection and blocking system and method according to the present invention has the following effects.

First, the present invention uses the SIP protocol, which is a representative signal control protocol of Internet telephony, through the configuration of the SIP signaling attack response module, the RTP media attack response module, the SIP signaling / media attack response policy management module, and the IP / Port filtering module. To detect and block hacking attacks.

Second, the present invention has an association analysis detection function of the protocol between the application layer (SIP, RTP), Deep Packet header analysis function of the application layer protocol, and call setup state analysis function, so that the application layer (SIP, RTP) Detect and block specialized attacks.

Looking at the preferred embodiment of the present invention together with the accompanying drawings as follows, when it is determined that the detailed description of the known art or configuration related to the present invention may unnecessarily obscure the subject matter of the present invention The description will be omitted, and the following terms are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of the user or the operator, and the definitions thereof are the SIP protocol-based Internet telephone hacking attack detection and the present invention. It should be made based on the contents throughout this specification that describe the blocking system and its method.

Hereinafter, a SIP protocol based internet phone hacking attack detection and blocking system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing a configuration for explaining a SIP protocol based Internet phone hacking attack detection and blocking system according to an embodiment of the present invention, Figure 2 is a SIP protocol based Internet phone hacking attack according to an embodiment of the present invention FIG. 3 is a diagram illustrating a SIP signaling attack detection / blocking block constituting a detection and blocking system, and FIG. 3 is an RTP media attack constituting an SIP protocol based internet phone hacking attack detection and blocking system according to an embodiment of the present invention. The figure shows to explain a detection / blocking block.

As shown in FIG. 1, the SIP protocol-based internet phone hacking attack detection and blocking system detects and blocks SIP method flooding attacks and attacks using SIP call control messages, which are SIP BYE / Cancel attacks. 100; An RTP media attack response module 200 for detecting and blocking an RTP media data-based attack that is an RTP Insertion attack; The SIP signaling / media attack response policy management module 300 is connected to the SIP signaling attack response module and the RTP media attack response module and manages a policy and a security policy for detecting and blocking an application layer (SIP, RTP) based attack. and; An IP / Port filtering module 400 connected to the SIP signaling attack response module and the RTP media attack response module and blocking an attack of the L3 to L4 layer for each IP / Port / protocol; It consists of.

The session initiation protocol (SIP) is a signaling protocol of an application layer used for a telephone, an internet conference, a messenger, and the like, and controls the creation, modification, and termination of a multimedia service session such as Internet-based conferencing, telephone, voice mail, event notification, and instant messaging. It plays a role. The SIP protocol is used together with the RTP protocol for voice media delivery.

Looking at the configuration and function of the technical means constituting the SIP protocol-based Internet phone hacking attack detection and blocking system of the present invention as follows.

The SIP signaling attack response module 100 detects and blocks an SIP protocol based internet phone hacking attack and response system using a SIP method flooding attack and an SIP call control message which is a SIP BYE / Cancel attack.

Here, the SIP signaling attack response module 100 includes: a SIP signaling header decoding block 110 for decoding a SIP signaling header according to a SIP standard; SIP signaling attack detection / blocking block with URI based SIP packet filtering, SIP signaling DoS detection, SIP protocol anomaly detection, SIP address forgery detection, signature based SIP hacking attack detection and SIP session anomaly detection (120) )and; A call establishment information transmitting agent 130 for transmitting a call to SIP call establishment information; It consists of.

Also, as shown in FIG. 2, the SIP signaling attack detection / blocking block 120 is a URI-based filter for filtering SIP packets including URI address information blacklisted in To, From, and Via fields after analyzing SIP header fields. SIP packet filtering unit 121; A SIP signaling DoS detector 122 for detecting and blocking a DoS attack using a SIP method such as INVITE floating; A SIP protocol anomaly detector 123 for detecting and blocking SIP Malformed message attacks that violate the RFC 3261 standard specification; A SIP address forgery detection unit 124 for detecting a spoofing attack of IP address spoofing; A signature-based SIP hacking attack detection unit 125 for detecting a SIP XSS, SQL Injection attack, and terminal OS bug vulnerability attack through a pattern matching method using a known SIP message-based attack in a signature form; A SIP session anomaly detector 126 for confirming and processing suitability of a SIP call transaction state; It consists of.

In more detail, the SIP address forgery detection unit 124 extracts the fingerprinting information from the SIP message, and detects the forgery and the modulation of the message by comparing the fingerprint value of the initial SIP INVITE message. Call-ID, MAC address, Seq #, From, To, header order, Max-Forwards, Via field are checked using the information of the current session. Determine and detect In addition, the transaction state in the SIP session anomaly detection unit 126 detects a call interruption / interruption attack that violates SIP call transaction states such as SIP BYE and CANCEL according to INVITE / Non-INVITE sever / client transaction of the standard (RFC 3261). It is.

The RTP media attack response module 200 detects and blocks an RTP media data-based attack, which is an RTP Insertion attack.

In this case, the RTP media attack response module 200 includes: a call establishment information receiving agent 210 for receiving a call by SIP call establishment information; An RTP media attack detection / blocking block 220 for detecting and blocking an RTP media attack by receiving call establishment state information (IP address to which a call is connected and dynamic port information) from the SIP signaling attack corresponding module; An RTP media header decoding block 230 for decoding the RTP media header in accordance with the RTP standard specification; .

The application layer (SIP) is exchanged between the SIP signaling attack response module 100 and the RTP media attack response module 200 by exchanging configuration information (signaled IP address, dynamic port address) to which a call is connected through a transmission / reception agent channel. It is possible to analyze the association of protocols between SIP and RTP.

The SIP signaling / media attack response policy management module 300 is connected to the SIP signaling attack response module and the RTP media attack response module, and detects and blocks an application layer (SIP, RTP) based attack and a security policy. Manage.

The IP / Port filtering module 400 is connected to the SIP signaling attack response module and the RTP media attack response module, and blocks the attacks of the L3 to L4 layers by IP / Port / protocol.

In addition, the SIP signaling attack response module 100 and the RTP media attack response module 200 process the L7 application layer from the perspective of OSI 7 layer, and the IP / Port filtering module 400 processes L3 to L4 layer based attack filtering. do.

In addition, as shown in FIG. 3, the RTP media attack detection / blocking block 220 receives call setup state information from the SIP signaling attack detection / blocking module, analyzes an IP header field, and then transmits an IP / Port and a received IP / Port field. An IP / Port packet filtering unit 221 for filtering the RTP packet including the IP / Port information set to the blacklist in the list; An RTP media header decoding module 222 which receives the RTP packet from the IP / Port packet filtering unit and decodes the header field according to the RTP standard specification and transmits the RTP packet to the RTP media attack detection / blocking module; RTP media attack to determine the RTP stream that is normally set up, and receives the call setup status information from the SIP signaling attack response module and checks whether the IP, Port, and SSRC values are the same. Detection / blocking module 223; An abnormal RTP traffic response module 224 for profiling RTP traffic, detecting abnormal RTP traffic through rate-limit, and managing network bands to prioritize normal RTP traffic; It consists of.

Therefore, RTP media attack is detected and blocked by receiving call establishment status information (IP address connected to call, dynamic port information, etc.) from SIP signaling attack response module, that is, RTP media attack through analysis of SIP call establishment information and protocol association. To detect and block them.

FIG. 4 is a diagram illustrating a flow of RTP media attack packet detection / blocking operation without call setting in the SIP protocol based internet phone hacking attack detection and blocking method according to an embodiment of the present invention.

As shown in FIG. 4, the flow of RTP media attack packet detection / blocking operation without call setting in the SIP protocol based internet phone hacking attack detection and blocking method is as follows.

First, an RTP packet that has passed RTP media data decoding is received. Subsequently, the call is normally set up to query the transmit / receive IP, port, and SSRC values, which are information on which the call is set, to determine the RTP stream. If the packet matches the IP, Port, and SSRC of the call setup state table, the packet is forwarded to the next process. Otherwise, the packet is dropped.

It will be appreciated by those skilled in the art that the present invention is not limited to the above embodiments, and that various modifications and changes can be made without departing from the spirit of the present invention.

1 is a view showing a configuration for explaining a SIP protocol-based Internet phone hacking attack detection and blocking system according to an embodiment of the present invention

2 is a diagram illustrating a SIP signaling attack detection / blocking block constituting a SIP protocol based internet phone hacking attack detection and blocking system according to an embodiment of the present invention.

3 is a diagram illustrating an RTP media attack detection / blocking block constituting a SIP protocol based internet phone hacking attack detection and blocking system according to an embodiment of the present invention.

FIG. 4 is a flowchart illustrating an RTP media attack packet detection / blocking operation without call setup in a SIP protocol based internet phone hacking attack detection and blocking method according to an embodiment of the present invention.

 <Code Description of Main Parts of Drawing>

100: SIP signaling attack response module 200: RTP media attack response module

300: SIP signaling / media attack response policy management module

400: IP / Port filtering module 110: SIP signaling header decoding block

120: SIP signaling attack detection / blocking block

130: call setup information transmitting agent 210: call setup information receiving agent

220: RTP media attack detection / blocking block 230: RTP media header decoding block

121: URI-based SIP packet filtering unit 122: SIP signaling DoS detection unit

123: SIP protocol anomaly detection unit 124: SIP address forgery detection unit

125: signature-based SIP hacking attack detection unit 126: SIP session anomaly detection unit

221: IP / Port packet filtering unit 222: RTP media header decoding module

223: RTP media attack detection / blocking module 224: Abnormal RTP traffic response module

Claims (7)

In SIP protocol based internet phone hacking attack detection and blocking system, A SIP signaling attack counter module for detecting and blocking a SIP method flooding attack and an attack using a SIP call control message which is a SIP BYE / Cancel attack; An RTP media attack response module for detecting and blocking an RTP media data-based attack, which is an RTP Insertion attack; A SIP signaling / media attack response policy management module connected to the SIP signaling attack response module and the RTP media attack response module and managing a policy and a security policy for detecting and blocking an application layer (SIP, RTP) based attack; An IP / Port filtering module connected to the SIP signaling attack response module and the RTP media attack response module and blocking an attack of the L3 to L4 layer by IP / Port / protocol; SIP protocol-based Internet phone hacking attack detection and blocking system comprising a. The method of claim 1, The SIP signaling attack counter module includes: a SIP signaling header decoding block for decoding a SIP signaling header according to a SIP standard; A SIP signaling attack detection / blocking block having URI based SIP packet filtering, SIP signaling DoS detection, SIP protocol anomaly detection, SIP address forgery detection, signature based SIP hacking attack detection and SIP session anomaly detection; A call establishment information transmitting agent for sending a call to SIP call establishment information; SIP protocol-based Internet phone hacking attack detection and blocking system, characterized in that consisting of. The method of claim 1, The RTP media attack response module includes: a call establishment information receiving agent for receiving a call by SIP call establishment information; An RTP media attack detection / blocking block for detecting and blocking an RTP media attack by receiving call establishment state information (IP address to which a call is connected and dynamic port information) from a SIP signaling attack response module; An RTP media header decoding block for decoding the RTP media header according to the RTP standard specification; SIP protocol based Internet phone hacking attack detection and blocking system, characterized in that consisting of. The method of claim 1, Protocol between application layers (SIP, RTP) by exchanging configuration information (Signaled IP address, Dynamic Port address) to which call is connected through the transmission / reception agent channel of the SIP signaling attack response module and RTP media attack response module. SIP protocol-based Internet phone hacking attack detection and blocking system, characterized in that the analysis of the correlation. 3. The method of claim 2, The SIP signaling attack detection / blocking block may include: a URI-based SIP packet filtering unit configured to filter SIP packets including URI address information set as a blacklist in the To, From, and Via fields after analyzing the SIP header field; A SIP signaling DoS detector for detecting and blocking a DoS attack using a SIP method such as INVITE floating; A SIP protocol anomaly detection unit for detecting and blocking SIP Malformed message attacks that violate the RFC 3261 standard specification; A SIP address forgery detection unit for detecting a spoofing attack of IP address spoofing; A signature-based SIP hacking attack detection unit for detecting SIP XSS, SQL Injection attacks, and terminal OS bug vulnerability attacks by using a pattern matching method in a signature form of a known SIP message-based attack; A SIP session anomaly detector for checking and processing suitability of a SIP call transaction state; SIP protocol-based Internet phone hacking attack detection and blocking system, characterized in that consisting of. The method of claim 3, wherein The RTP media attack detection / blocking block receives call setup state information from a SIP signaling attack detection / blocking module and analyzes the IP header field, and then includes IP / Port information set as a blacklist in the sending IP / Port and the receiving IP / Port fields. An IP / Port packet filtering unit for filtering the RTP packet; An RTP media header decoding module for receiving the RTP packet from the IP / Port packet filtering unit and decoding the header field according to the RTP standard specification and transmitting the RTP packet to the RTP media attack detection / blocking module; RTP media attack to determine the RTP stream that is normally set up, and receives the call setup status information from the SIP signaling attack response module and checks whether the IP, Port, and SSRC values are the same. Detection / blocking module; An abnormal RTP traffic response module for profiling RTP traffic, detecting abnormal RTP traffic through rate-limit, and managing network bands to prioritize normal RTP traffic; SIP protocol-based Internet phone hacking attack detection and blocking system, characterized in that consisting of. In the SIP protocol-based internet phone hacking attack detection and blocking method, RTP media attack packet detection / blocking operation without call establishment comprises: receiving an RTP packet that has passed RTP media data decoding; Querying transmit / receive IP, Port, and SSRC values, which are information on which a call is set, to determine a RTP stream by establishing a call normally; If the packet matches the IP, Port, and SSRC of the call setup state table, forwarding the packet to the next process; otherwise, dropping the packet; SIP protocol-based Internet phone hacking attack detection and blocking method comprising a.

Images