KR20160027841A - Voip security system and method - Google Patents

Abstract

A voice over internet protocol (VoIP) security system comprises: a VoIP security device for discriminating illegal usage or hacking of a VoIP packet and blocking a VoIP packet of which the illegal usage or the hacking is detected; and a switch for delivering a VoIP packet, satisfying a condition of a flow entry generated according to a flow delivery rule of the VoIP security device, among received VoIP packets to the VoIP security device, and processing the VoIP packet with security according to a flow blocking setting of the VoIP security device or forwarding the VoIP packet through a path in accordance with the flow entry.

Description

[0002] VOIP Security System and Security Processing Method [

The present invention relates to a VoIP security system and a security processing method, and more particularly, to a technology for detecting illegal use of a VoIP packet and a hacking attempt in a software defined network (SDN).

In recent years, the standardization of technology for efficiently operating the communication system by separating the traffic forwarding function of the switch and the control function of the switch has been carried out by the ONF (Open Networking Foundation), IETF (Internet Engineering Task Force), ETSI ISG NFV ) And International Telecommunications Union Telecommunication (ITU-T).

SDN (Software Defined Network) refers to a user-oriented network in which a user has control authority regardless of basic network equipment such as a router or a switch, and a separate software controller controls traffic flow.

Of the SDN standardization organizations that are promoting OpenFlow technology standardization, ONF defines the interface between hardware (switch) and controller (network OS). This is a protocol for interacting with the data transfer function (Data Plane) by separating the control plane from the physical network in order to control how to transmit data packets through the network.

In recent years, IP telephony has rapidly spread and corporate IP-PBX, which is purchased directly by the customer, can be easily identified by a simple program using the ID (Identification, ID) and password (PassWord, PW) The ID and the password are easily stolen by the hacker and the ID and the password of the Internet phone terminal are illegally used to induce an illegal international call so that the owner of the terminal is able to change the phone number from several millions of won to tens of thousands of won per month Of the total billing amount.

However, there is currently no way to detect such hacking attempts and illegal international phone calls in real time. There is a method of detecting and blocking based on a statistical technique using some billing information. However, since this method detects a large amount of international telephone billing damage after occurrence thereof, it can fundamentally prevent damage There is no problem.

In addition, when a hacking attempt or illegal use is detected, a manager or an operator manually performs a setting operation to manually prevent the terminal or the apparatus from being damaged, so that there is a problem that it is impossible to prevent damage through rapid interception.

Therefore, the technical problem to be solved by the present invention is to use a software defined network (SDN) controller and a switch to detect illegal use of hackers' hacking attempts, illegal international calls, etc., A VoIP security system, and a security processing method.

According to an aspect of the present invention, a VoIP security system includes a VoIP security device for determining whether or not an illegal use or hacking of a Voice over Internet Protocol (VoIP) packet is detected, a VoIP packet for which illegal use or hacking is detected is blocked, The VoIP security device transmits a VoIP packet satisfying the condition of the flow entry generated according to the flow delivery rule of the VoIP security device to the VoIP security device and performs security processing of the VoIP packet according to the flow blocking setting of the VoIP security device Or for forwarding to a path according to a flow entry.

And a controller for requesting the switch to generate flow entry information according to the flow forwarding rule when the flow forwarding rule setting is requested from the VoIP security apparatus.

The controller comprising:

And may request the switch to set a flow entry according to the flow blocking rule of the VoIP security device.

The VoIP security apparatus includes:

And a security processor for performing security processing according to whether the VoIP packet received from the switch is a request message, an option message, a register message, or an invite message according to the flow forwarding rule.

The security processing unit,

If the VoIP packet is the option message, extracts header information of the VoIP packet and counts the number of times of extraction, and requests the controller to block if the cumulative count exceeds the threshold inflowing count, If the number of times is not exceeded, information can be requested to the controller if the information is registered in the predefined black list.

The security processing unit,

If the VoIP packet is the option message, extracts header information of the VoIP packet to determine whether the header information matches the previously registered normal header information, and if the VoIP packet does not match, The controller may be requested to block.

The security processing unit,

If the VoIP packet is the invite message, it is determined whether the VoIP packet is an international call by extracting header information of the VoIP packet. If it is determined that the call is an international call, If the black list is not included in the black list, the count is accumulated. If the count is exceeded, the controller is requested to interrupt the controller. If the count is not exceeded, And then request the controller to interrupt.

The VoIP security apparatus includes:

Further comprising a flow propagation rule setting unit for setting a flow propagation rule classified for each IP layer,

The flow-

(L7) rule including a static blacklist user agent, a blacklist outgoing / incoming number, a specific header field value, and a 4th layer (L4) specifying a case where traffic exceeds a threshold pre- ) Rules, and a three-layer (L3) rule that includes source IP values with hacking attempts and history of illegal use and major blacklisted country IP block values.

According to another aspect of the present invention, a security processing method is a method of processing security for a VoIP packet in a Software Defined Network (SDN), wherein a VoIP security device connected to the controller establishes a flow forwarding rule Receiving a VoIP packet satisfying the flow forwarding rule from a switch connected to the controller; determining whether the VoIP packet is illegally used or hacked; if the illegal use or hacking is detected, Requesting the controller to block flow blocking settings and returning the VoIP packet to the switch to be forwarded to the flow entry path if not illegally used or hacked.

Wherein the determining step comprises:

Determining whether the VoIP packet is a request message and performing a routine process according to whether the VoIP packet is an option message, a register message, or an invitation message upon determining that the VoIP packet is a request message, And a step of detecting.

Wherein the detecting comprises:

Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the option message; counting and accumulating the number of times of extraction; Determining whether the header information is included in the black list if the threshold inflow count is not exceeded, determining whether the header information is included in the black list if the threshold inflow count is not exceeded, And if so included in the blacklist, requesting the controller to block the packet.

Wherein the detecting comprises:

Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the registration message; extracting header information of the VoIP packet including the User-agent, Agent, the Contact, and the IP in the black list, and if at least one of the User-agent, the Contact, and the IP is registered in advance And registering the non-matching information in the black list if it does not match the information.

Wherein the detecting comprises:

Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the invite message; determining whether the VoIP packet is an international call based on the header information of the VoIP packet; Determining whether header information of the VoIP packet includes a black list if the VoIP packet is an international call; requesting the controller to block the VoIP packet if it is included in the black list; Counting the number of counts corresponding to the country included in the black list and requesting the controller to interrupt the count if the number of counts exceeds a threshold value; and if the count is not exceeded, And requesting a blocking operation.

According to an embodiment of the present invention, when a hacking attempt of a hacker's VoIP terminal and equipment account is detected using a SDN (Software Defined Network) -based controller and a switch, and illegal use occurs using the stolen account information In real time.

In addition, SDN-based VoIP security devices can detect and block hacking attempts and illegal use in real time, and can automatically apply settings for detection, blocking, and bypassing using SDN controller and switch.

In addition, to detect hacking attacks that change key parameters from time to time in order to avoid hacking attempts such as IP and telephone number, and blocking illegal use, real-time detection and blocking can be realized, dramatically reducing the cost of settlement It is possible to reduce it.

FIG. 1 is a block diagram schematically illustrating a configuration of a Voice Over Internet Protocol (VoIP) security system based on a Software Defined Network (SDN) according to an embodiment of the present invention.
2 is an overall flow diagram of a VoIP security method in a software defined network according to an embodiment of the present invention.
3 is a flowchart illustrating a hacking attempt detection process of a VoIP security device according to an embodiment of the present invention.
FIG. 4 is a detailed flowchart of step S215 in FIG.
FIG. 5 is a detailed flowchart of step S217 in FIG.
FIG. 6 is a detailed flowchart of step S219 in FIG.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

Also, the terms of " part ", "... module" in the description mean units for processing at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software.

The term 'controller' as used herein refers to a functional entity that controls related components (eg, switches, routers, etc.) to control the flow of traffic. And the like. For example, a controller may refer to a controller functional entity defined by ONF, IETF, ETSI, and / or ITU-T.

The 'switch' described in the specification means a functional element for substantially forwarding, switching, or routing traffic (or packet). The switch may be a switch, a router, a router, or the like defined by ONF, IETF, ETSI and / or ITU- A switch element, a router element, a forwarding element, and the like.

Hereinafter, a VoIP security system and a security processing method according to an embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram schematically illustrating a configuration of a Voice Over Internet Protocol (VoIP) security system based on a Software Defined Network (SDN) according to an embodiment of the present invention.

Referring to FIG. 1, the wired access network 1, the core network 2, and the radio access network 3 all include a plurality of switches 100. At this time, the wired access network 2 and the radio access network 3 are connected to the core network 2, respectively.

At this time, the wired access network 1 and the radio access network 3 may include a mobile VoIP using Voice over Internet Protocol (VoIP), voice over LTE (VoLTE), WiFi, or the like.

A plurality of switches (100) are connected to the controller (200). The controller 200 is connected to the VoIP security device 300 that performs VoIP hacking detection.

The plurality of switches 100 has a flow table, and each entry of the flow table describes how the switch 100 processes a flow conforming to a specific rule. In addition, statistics on the flow of the condition may be stored together.

The plurality of switches 100 receives commands from the controller 200 and transmits packets transmitted and received on the networks 1, 2 and 3 to the VoIP security apparatus 300 or blocks transmitted and received by the VoIP security apparatus 300. [ And performs flow processing so as to actually block or bypass according to the detour command.

Here, the flow includes a switch port, a VLAN ID, a sender MAC address, a receiver MAC address, an Ethernet type, a sender IP address, a receiver IP address, an IP protocol type, Such as a port, a recipient port, and the like. A discriminator can be used to define a rule in which certain flows are treated as the same flow or treated as different flows.

The controller 200 may inject specific flow conditions and processing instructions (Rule, Action) to the switch 100 to control the path through which the specific flow is transmitted. The controller 200 receives the flow policy to be applied to the switch 100 from the VoIP security apparatus 300 and changes the flow entry into a flow entry according to the policy of the switch 100 to be applied.

The VoIP security device 300 instructs the hacker to detect and block illegal use of the terminal, such as a hacking attempt and an international call.

The flow forwarding rule setting unit 310 analyzes a signal message transmitted from the Internet telephone terminal or received signaling message from the switch 100 and transmits a flow corresponding to the condition to the VoIP security apparatus 300. When the flow advances to the VoIP security apparatus 300, And an illegal use flow. And sends a request message to the controller 200 to block and bypass the flow. Then, the controller 200 changes the request message received from the VoIP security device 300 to a message for applying to the switch 100, and transmits the message to the switch 100 so that the corresponding flow is blocked and bypassed, To prevent damage caused by hacking.

The security processing unit 330 determines whether or not the packet transmitted from the switch 100 is hacked or illegally used, and sets the flow blocking to the controller 200 when hacking or illegal use is detected.

2 is an overall flow diagram of a VoIP security method in a software defined network according to an embodiment of the present invention.

Referring to FIG. 2, the flow delivery rule setting unit 310 of the VoIP security apparatus 300 sets a flow delivery rule to the controller 200 (S101). That is, a forwarding rule of the SDN-based Internet telephony signaling message is set.

At this time, dynamic setting can be performed for each layer (L3 to L7 layers).

According to one embodiment, the flow forwarding rule is sent to the controller 200 to receive a VoIP signaling message for a hacking attempt and an illegal usage decision. It can be classified by IP layer, as shown in Table 1.

hierarchy Contents About L7 static black-list User-Agent, black-list Foot / called number, specific SIP header field value About L4 With a specific port number (5060 for SIP) If traffic exceeds the pre-specified threshold About L3 Source IP values with hacking attempts and illegal usage history
Major Blacklist Country IP Block Value

Then, the controller 200 requests the switch 100 to generate the flow entry information according to the flow delivery rule (S103). That is, the controller 200 transmits a flow entry creation message to the switch such that the information requested by the VoIP security device 300 is normally transmitted to the VoIP security device 300.

The switch 100 sets a flow entry at the request of the controller 200 (S105). That is, it is a step of setting a flow condition to be transmitted to the VoIP security device 300 by the switch in order to determine a hacking attempt and illegal use.

Then, the switch 100 generates the flow entry requested by the controller 200 in the flow table. Here, the flow entries are shown in Table 2.

Match fields Actions Counters Layer Remarks / Examples sip.User-Agent == specific value Forward to output port
(-> Hacking detection system) L7 Friendly-Scanner etc.
User-Agent name used mainly for hacking sip.To == specific value No setting or threshold (ex: 3 times / sec) L7 International calls beginning with 001, 00727, etc. sip.From == "1234567" L7 Attempted hacking and illegal use of caller ID src ip == black-list IP Threshold
(ex: 10 times / sec) L4 Threshold can be set by counter and max bit rate for each flow dst port == 5060 L3 Hacking detection system port can be both physical and virtual port (tunneling)

Referring to Table 2, Match fields are items describing conditions to be satisfied in order to perform Actions. Actions describe the actions that the SDN switch should perform when a flow that satisfies the match fields occurs. Counters are the number of packets in a flow satisfying a match condition and used for judging whether a packet exceeds a predetermined threshold value for hacking attempts or illegal use judgments.

The switch 100 determines whether the incoming packet satisfies the condition set in the flow entry created in step S105 (S109).

At this time, if the flow condition is satisfied, the VoIP security device 300 transmits the incoming packet to the VoIP security device 300 (S111).

The security processing unit 330 of the VoIP security device 300 performs detection of an Internet telephone hacking attempt and illegal use detection logic on the received packet.

At this time, the VoIP security device 300 divides the OPTIONS scanning, the REGISTER authentication step, and the INVITE call attempting step and judges whether a hacking attempt or illegal use is made (S113).

If it is determined that the hacking attempt is illegal, the security processing unit 330 sets the flow blocking to the controller 200 (S115). That is, the blocking process is performed for the flow detected by the hacking attempt and illegal use.

At this time, it is possible to combine various tuple information ranging from L3 to L7 layers in the flow blocking setting. For example, IP, port, message type, User-Agent, Expire time, and incoming / outgoing phone number can be combined.

Also, the flow blocking setting includes setting the blocking time period for setting the valid time of the flow entry for blocking: and setting the idle / hard timeout value.

Then, the controller 200 requests the switch 100 to create a flow entry according to the flow blocking setting (S117).

The switch 100 generates a flow entry according to the match fields and action (drop, redirect, etc.) of the tuple information received from the VoIP security device 300 and blocks the corresponding flow according to the generated flow entry S119). At this time, the switch 100 performs a flow drop or a redirection in the case of a flow detected by a hacking attempt and illegal use.

division Match fields timeout Actions Example 1 src ip == a.a.a.a, src port == 1111, sip.Request == "REGISTER", sip.UA == "friendly-scanner" idle timeout = 3600 drop Example 2 dst ip == b.b.b, dst port == 2222, sip.Request == "INVITE", sip.Expire <= 600 drop Example 3 dst ip == bbbb, dst port == 2222,
sip.From == "111111" hard timeout = 3600 drop Example 4 src ip == aaaa, src port == 1111,
sip.From == "444444" redirect
a sink hole,

Referring to Table 3, according to the first embodiment, the flow entry (flow entry) for allowing the user agent to drop (block) a flow of "friendly-scanner" in the REGISTER of the source IP and the source port is 11a, ). The Idle timeout value is set to automatically delete the flow entry if the flow satisfying the match fields is no longer in the specified time (eg 3600 seconds). That is, when the hacker recognizes that the flow is blocked and does not attempt to hack in the flow for a certain period of time, the operator does not need to manually delete the flow, The flow entry can be deleted.

In addition, the second embodiment is an example of a flow entry in which the destination IP is bbbb, the destination port is 2222, and a signal message (dropping a flow whose session expire value is less than 600 in the INVITE of the invention type) is shown. This is an example in which an operator determines that an illegal international call is an illegal international call and drops an abnormally short expiration time during a call to a destination IP or port designated as an illegal call receiving apparatus.

The third example is a flow entry example in which the destination IP is bbbb, the destination port is 2222, and the calling number drops a flow of a specific number designated by the operator (in this example, "111111"). Is set so that the flow entry is set only for the designated time (3600 seconds in this example) regardless of whether the match field is satisfied or not, and then the flow entry is automatically deleted.

In addition, in the fourth embodiment, when a flow of which the source IP is aaaa, the source port is 1111, and the calling number is "444444" (the manipulated originating telephone number used for hacking) is inputted, A redirect key is an example of a flow entry so that it is not sent to the exchange equipment and is sent to any device that processes the sink hole and does not waste network resources of the provider.

Meanwhile, if it is determined that the VoIP security device 300 is not a hacking attempt or illegal use, the VoIP security device 300 returns the packet received in step S111 to the controller 200 again (S121).

In step S123, the VoIP security device 300 forwards the packet according to the original path, that is, the flow table, if the delivery condition is not satisfied in step S107 or if the packet is returned in step S121.

3 is a flowchart illustrating a hacking attempt detection process of a VoIP security device according to an embodiment of the present invention.

Referring to FIG. 3, the security processing unit 330 of the VoIP security device 300 loads an information mapping table (S201). Here, the information mapping table is a table that stores information such as IP, User-Agent, and Contact for each phone number of the terminal. This information mapping table is used to determine whether or not a value mapped to a specific telephone number normally matches with a comparison value when determining a black list registration in FIG.

When the SIP packet is received from the switch 100 (S203), the VoIP security apparatus 300 determines whether it is a request message (S205).

At this time, if the request message is not determined, the process returns to step S203.

On the other hand, if it is determined to be a request message, it is determined whether the message is an option message (S207) or whether it is a register message (S209) or an INVITE message (S211).

If it is determined in step S207 that the message is an option message, processing according to the option processing routine is performed (S213).

At this time, the option message is a message used in SIP to grasp the capability of the terminal or equipment. The hacker uses this message to find VoIP equipment such as Internet phone terminal or IP-PBX. Since a large number of SIP messages are transmitted by arbitrarily specifying an IP range, a case where a source IP (source IP) or a destination IP (destination IP) is generated in excess of a threshold value per unit time is detected.

If it is determined in step S209 that the message is a register message, processing according to the register processing routine is performed (S215).

At this time, the register is a message used in an authentication step performed in order to provide a normal call service to the terminal in SIP. The hacker uses this message to steal accounts of VoIP equipment such as VoIP terminal or IP-PBX. The VoIP security device 300 stores the User-Agent, Contact, and IP values of the terminal normally used and the IP-PBX device, compares the value with the header value of the register message used when attempting to acquire the account, .

If it is determined in step S211 that the message is an invite message, processing according to the invite processing routine is performed (S217).

If step S207, step S209, and step S211 are not satisfied, step S203 is performed.

FIG. 4 is a flowchart illustrating in detail step S215 in FIG. 3, and particularly, a flowchart illustrating a hacking scanning detection procedure through an option.

4, the security processing unit 330 of the VoIP security apparatus 300 extracts From, User-agent, Contact, and IP from the SIP packet transmitted from the switch 100 (S301) and accumulates the counts (S303 ).

The VoIP security device 300 determines whether the number of critical inflows of the SIP packet exceeds the accumulated count based on the accumulated count (S305). That is, it is determined whether the cumulative number of received SIP packets exceeds a predetermined number.

If the VoIP security device 300 exceeds the threshold entry count, the VoIP security device 300 requests the controller 200 to block the corresponding SIP packet (S307).

On the other hand, if the number of critical inflows is not exceeded, it is determined whether the information extracted in step S301 is included in the black list (S309).

At this time, if it is included in the black list, the controller 200 requests the controller 200 to block the corresponding SIP packet (S307).

FIG. 5 is a flowchart illustrating in detail step S217 in FIG. 3, which is a flowchart for explaining an authentication information hacking attempt detection procedure using a register REGISTER.

5, the security processing unit 330 of the VoIP security device 300 extracts From, User-agent, Contact, and IP from the SIP packet transmitted from the switch 100 (S401).

The VoIP security device 300 determines whether the user-agent extracted in step S401 matches a predefined value that is normally used (S403).

At this time, if they match, it is determined whether the contact extracted in step S401 matches a predefined value that is normally used (S405).

At this time, if they match, it is determined whether the IP extracted in step S401 matches a predefined value that is normally used (S407).

At this time, if they match, it is regarded as a normal process and the process is terminated.

On the other hand, if it is determined in step S403 that they do not coincide with each other, it is determined whether the contact extracted in step S401 matches a predefined value that is normally used (S409).

At this time, if they match, step S415 is performed.

On the other hand, if they do not match, it is determined whether the IP extracted in step S401 matches a predefined value that is normally used (S411).

At this time, if they do not match, the controller 200 is requested to block the packet (S413). Then, the user-agent, contact, and IP extracted in step S401 are stored in the blacklist DB (S415).

If it is determined in steps S405 and S407 that they do not match, step S415 is performed.

FIG. 6 is a flowchart illustrating step S219 in FIG. 3 in detail.

6, the security processing unit 330 of the VoIP security device 300 extracts From, User-agent, Contact, and IP from the SIP packet transmitted from the switch 100 (S501).

Here, From indicates the sender of the SIP packet, User-agent indicates the model and version information of the terminal or equipment that transmitted the packet, and Contact can include the SIP URI that can directly contact the exchange and the fixed terminal. The IP includes a source address and a destination address.

The VoIP security apparatus 300 determines whether it is an international call based on the information extracted in step S501 (S503).

If this is not an international call, end the step.

On the other hand, if the call is an international call, it is determined whether the User-agent, Contact, and IP extracted in step S401 are included in the black list (S505).

At this time, if it is included in the black list, the controller 200 is requested to block the received packet (S507).

On the other hand, if it is not included in the blacklist, it is determined whether it belongs to the blacklist country (S509).

At this time, if it belongs to the blacklist country, the count is accumulated (S511), and it is determined whether the accumulated count exceeds the threshold value (S513).

At this time, if the threshold value is exceeded, the information extracted in step S501 is registered in the black list (S515). Then, step S507 is performed.

On the other hand, if it does not belong to the blacklisted country, the step ends.

The embodiments of the present invention described above are not implemented only by the apparatus and method, but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (13)

A VoIP security device for judging whether or not a VoIP packet is illegally used or hacked and for blocking a VoIP packet in which illegal use or hacking is detected, and
A VoIP packet transmission unit for delivering, to the VoIP security apparatus, a VoIP packet that satisfies a condition of a flow entry generated according to a flow delivery rule of the VoIP security apparatus among the received VoIP packets, A switch for performing processing or for forwarding to a path according to a flow entry
Gt; VoIP &lt; / RTI &gt; The method according to claim 1,
A controller for requesting the switch to generate flow entry information according to the flow forwarding rule when the flow forwarding rule setting is requested from the VoIP security apparatus,
The VoIP security system further comprising: 3. The method of claim 2,
The controller comprising:
And requests a flow entry setting to the switch according to a flow blocking rule of the VoIP security device. The method of claim 3,
The VoIP security apparatus includes:
A security processing unit that performs security processing according to whether the VoIP packet received from the switch is a request message, whether it is an option message, a register message, or an invite message according to the flow delivery rule;
Gt; VoIP &lt; / RTI &gt; 5. The method of claim 4,
The security processing unit,
If the VoIP packet is the option message, extracts header information of the VoIP packet and counts the number of times of extraction, and requests the controller to block if the cumulative count exceeds the threshold inflowing count, And notifies the controller of the blocking if the information is registered in the predefined black list. 5. The method of claim 4,
The security processing unit,
If the VoIP packet is the option message, extracts header information of the VoIP packet to determine whether the header information matches the previously registered normal header information, and if the VoIP packet does not match, And requesting the controller to block the VoIP security system. 5. The method of claim 4,
The security processing unit,
If the VoIP packet is the invite message, it is determined whether the VoIP packet is an international call by extracting header information of the VoIP packet. If it is determined that the call is an international call, If the black list is not included in the black list, the count is accumulated. If the count is exceeded, the controller is requested to interrupt the controller. If the count is not exceeded, And then requests the controller to block the VoIP security system. 5. The method of claim 4,
The VoIP security apparatus includes:
Further comprising a flow propagation rule setting unit for setting a flow propagation rule classified for each IP layer,
The flow-
A static black list user agent, a black list footer / called number, a seven layer (L7) rule including a specific header field value,
A four-layer (L4) rule for specifying a case where traffic exceeds a predetermined threshold specified by a specific port number, and
3-tier (L3) rules containing source IP values and major blacklist country IP block values with hacking attempts and illegal usage history
Gt; VoIP &lt; / RTI &gt; A method of handling security for VoIP packets in a Software Defined Network (SDN)
The VoIP security device connected to the controller establishing a flow forwarding rule to the controller,
Receiving a VoIP packet satisfying the flow delivery rule from a switch connected to the controller,
Determining whether the VoIP packet is illegally used or hacked,
Requesting, from the controller, a flow blocking setting for blocking the VoIP packet if the illegal use or hacking is detected; and
Returning the VoIP packet to the switch to be forwarded to the path of the flow entry if it is not illegally used or hacked;
. 10. The method of claim 9,
Wherein the determining step comprises:
Determining whether the VoIP packet is a request message, and
If it is determined that the VoIP packet is an option message, a register message, or an invitation message, it is determined whether the VoIP packet is illegal or hacked
. 11. The method of claim 10,
Wherein the detecting comprises:
Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the option message,
The number of extraction times is counted and accumulated,
Determining whether the accumulated number of times exceeds a threshold inflow number,
Requesting the controller to block the packet if the number of critical inflows is exceeded,
Determining whether the header information is included in the black list if the number of critical inflows is not exceeded, and
Requesting the controller to block the packet if it is included in the blacklist
. 11. The method of claim 10,
Wherein the detecting comprises:
Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the registration message;
If the user-agent, the contact, and the IP do not agree with the previously registered information, the controller requests the controller to block and registers the User-agent, the Contact, and the IP in the blacklist.
Registering the non-matching information in the black list if at least one of the User-agent, the Contact, and the IP does not match the previously registered information
. 11. The method of claim 10,
Wherein the detecting comprises:
Extracting header information of the VoIP packet including From, User-agent, Contact and IP when the VoIP packet is the invite message;
Determining whether the call is an international call based on the header information of the VoIP packet,
Determining whether header information of the VoIP packet includes a black list if the VoIP packet is an international call;
Requesting the controller to block if it is included in the blacklist,
Determining whether the user belongs to a country included in the black list if the user is not included in the black list,
Accumulating counts corresponding to the countries included in the black list, and requesting the controller to block if the counts are exceeded; and
And if it does not exceed the threshold, requesting the controller to block after adding to the blacklist
.

Images