Patent Application
20050273855
The invention is based on a priority application EP 04291418.4 which is hereby incorporated by reference.
The present invention refers to a method for preventing attacks on a network server. The server is connected to a network. Data is transmitted between the network server and the network across means for restricting access to the network server. The network server comprises an attack-detection-device for detecting and identifying attacks from the network on the network server.
Furthermore, the invention refers to an attack-prevention-device for preventing attacks on a network server connected to a network via means for restricting access to the network server from the network. The attack-prevention-device is adapted to control the access restricting means.
The method and the attack-prevention-device, for example, can be used for preventing attacks on a call server within a call-based-services-environment. In that case, the network server would be a so-called call server. The call-based-services-environment can also be referred to as session-based-services-environment. Examples for call-based-services are Voice-over-Internet-Protocol (VoIP)-services or multi-media-services. Call-based or session-based means that data transmission across the network is initiated by a call.
A call server is adapted to control the set-up, maintenance and tear-down of a data-transmission-connection (i.e. communication link or media-path) to be established between at least one first user agent and at least one second user agent across the network. Signaling messages are used for controlling the communication link. Of course, the network-environments within which the present invention is realized can comprise more than one network server, all connected to the network. A call server comprises means for establishing calls through the network. The user agents can be IP-telephones or any kind of computers equipped with appropriate audio/visual and networking hardware, and appropriate signaling software. The access restricting means usually are referred to as a firewall. Firewalls can be individually controlled in order to let certain messages pass through from the network to the call server and to filter, block and/or throttle other messages.
Protocols used to signal Voice-over-IP (VoIP) connections are, for example, the Session Initiation Protocol (SIP), H.323.
It is known from the state of the art to install a device with static packet filtering rules and bandwidth limitation (for example on SIP-signaling default port 5060) between a SIP call server (so called SIP proxy server) and the network in order to protect the SIP proxy server from overload. However, such a device cannot detect and remove malicious SIP messages attacking the SIP proxy server.
Furthermore, dynamic border gate technologies (for example the Aravox firewall from former Aravox Technologies Inc., 4201 Lexington Avenue North, Suite 1105, Arden Hills, Minn. 55126, USA, recently taken over by Alcatel) are known in the art, which offer layer 3 and 4 firewalling, flow-based pinholing and bandwidth limitation. As dynamic firewalling concept it is controlled by a MIDCOM-style interface. Firewall rules are compiled and inserted into the access-restricting means (firewall logic). Usually, at present only the media path and not the signaling path is considered.
To detect attacks, the call server itself may have the ability to internally classify all received messages and then to remove the malicious messages after inspection directly at the input. Though this keeps the call server from holding too many uncompleted call states in memory, it does not inhibit the overload situation at the call server input because messages have to reach the call server, where each message is classified and removed in case it is malicious. This means that in the art messages indeed have to be processed but eventually are deleted, hopefully without causing any harm to the call server.
Since the firewall in front of the call server itself has no application awareness, in particular it cannot differentiate between correct messages and attacks, all messages have to reach the call server for inspection. This means that the ratio of valid to malicious messages at the input of the call server is not changed and the availability of the call server for valid callers remains unsatisfying. So static packet filtering rules and bandwidth limitation give only a very basic security to the call server, as long as not all application information (messages) is thoroughly checked.
The known methods for preventing attacks on a call server within a VoIP-environment usually have an attack-detection-device assigned to or even incorporated into the call server. The attack-detection-device comprises algorithms and rules for analyzing the traffic received by the call server and for detecting potential attacks. For example, the call server can observe the call completion rate (CCR). If the CCR is below a certain level, this may be a sign for a denial of service (DoS)-attack or a distributed DOS (DDoS)-attack on the call server. In that case the attacking user agent sends numerous signaling messages to the call server requesting the set-up of VoIP-communication links to other user agents (for example, “Invite”-messages in SIP). The attack can be driven from one user agent (DoS-attack) or from numerous distributed user agents (DDoS-attack). Another sign for an attack on the call server is an exaggerated number of call attempts per second (CAPS). For example an exaggerated 10.000 CAPS/sec. instead of a normal number of about 100 to 200 CAPS/sec. indicates an attack on the call server).
In the state of the art, the access restricting means are controlled directly by the call-server. This means that the call-server has to handle and process each message coming in, even if later on during firewalling it is regarded as a malicious message and is consequently removed. Processing and handling of each messages provokes an excessive workload for the call server.
It is an object of the present invention to provide a method for preventing attacks on a call server within a VoIP-environment, the method on the one hand assuring a secure and reliable filtering of malicious messages destined for the call server and on the other hand reducing the workload of the call server for handling, processing and filtering the messages coming in.
This object is achieved by a method of the kind mentioned above which is characterized by the following steps:
According to the present invention an advanced method is provided by a fast and highly responsive combination of an attack-detection-device with an attack-prevention-device operating with a special black-list. The type and realization of the attack-detection-device is not part of the present invention. In a possible embodiment, the detection-device should be easily programmable, in order to quickly react on concrete new attacking types and scenarios. The attack-detection-device can be disposed separately from the network server. Alternatively, it can be partly or completely included within the network server.
It is necessary to derive distinguishing information of conspicuous or malicious messages of the traffic, for example characteristic attributes and parameters of these messages. The distinguishing information is entered in the black-list and is used by the attack-prevention-device for distinguishing malicious messages (making part of an attack) from normal messages (making part of a signaling procedure or of a media flow).
The attack-prevention-device can perform thorough data packet inspection and pattern matching operations, in order to achieve filtering, blocking and/or throttling of messages, whose distinguishing information matches with the distinguishing information contained in the black-list. A possible most efficient pattern matching method can be easily implemented as hash table look-ups. Although the attack-prevention-device can perform inspection and analyzing operations, that is it can identify the content of the inspected messages, it does not understand the content of the messages or perform any processing of the content. The attack-prevention-device can scan any kind of data for a certain content, irrespective of the protocol of the data transmission and/or a signaling protocol.
The content of the black-list is an important issue of the present invention. The black-list holds the complete information required by the attack-prevention-device to handle each message or each data-packet respectively addressed to the network server. The content of the black-list is created by the attack-detection-device according to certain definition parameters for defining the messages or the data-packets.
The attack-prevention-device has a restricted intelligence. Its function can be compared to the duty of a gate-keeper, who has to control access to a restricted area (corresponding to the network server). The gate-keeper looks at a person (corresponding to the messages), who desires access into the restricted area, and has to decide according to certain algorithms, rules or lists, etc. (contained in the black-list) whether the person is allowed in or not. Depending on the outcome of the gate-keeper's decision, the gate-keeper opens the gate (corresponding to the access restricting means) and lets the person pass or leaves the gate closed and refuses entrance of the person. The gate-keeper acquires no knowledge why the person wants to enter the restricted area or what the person carries with him. The gate-keeper simply checks, whether certain obvious conditions are fulfilled (for example, if the person carries a weapon, or if the person carries an appropriate ID-card) and lets the person pass through or refuses entrance of the person accordingly.
The attack-prevention-device is blocking or limiting traffic destined to the network server, based on the content of the black-list. The black-list, for example, contains patterns or attributes, describing malicious or conspicuous traffic. In a Voice-over-Internet-Protocol (VoIP)-environment, possible attributes or patterns could be for example in SIP: “to”-, “from”-, “via”-fields, IP-addresses, TCP (Transmission Control Protocol)/UDP (User Datagram Protocol)-ports, etc. and combinations thereof. The patterns and attributes are created by the attack-detection-device, are entered into the black-list and are transferred to the attack-prevention-device. The patterns and attributes can be entered into the black-list in the realm of the attack-detection-device and then be transmitted to the attack-prevention-device in the black-list. In this case the black-list is created by the attack-detection-device and transmitted as a whole to the attack-prevention-device.
Alternatively, the patterns and attributes of messages identified to be conspicuous or malicious can be transmitted to the attack-prevention-device and entered into the black-list in the realm of the attack-prevention-device. This has the advantage that every time the black-list is updated, only the changes of the patterns and attributes and not the entire black-list have to be transmitted to the attack-prevention-device.
According to a preferred embodiment of the present invention it is suggested that the network server is a call server making part of a call-based-services-environment. The environment comprises the network, the call server connected to the network and at least one user agent connected to the network. The call server is adapted for setting up a data transmission connection between the at least one user agent and at least one other user agent by means of signaling messages. The signaling messages are transmitted between the call server and the user agents across the network and across the access restricting means. The attack-prevention-device inspects and analyzes the signaling messages of the traffic directed from the network to the call server. Preferably, the call-based-services-environment is a Voice-over-Internet-Protocol (VoIP)-environment.
It is suggested that patterns and/or attributes defining conspicuous or malicious traffic directed from the network to the network server are entered in the black-list as characteristic parameters. Preferably, the patterns and/or attributes defining traffic directed to the network server are identified as being conspicuous or malicious by the attack-detection-device. For that purpose, attributes and characteristics of the malicious and conspicuous traffic messages have to be derived and defined before the method according to the invention can be properly executed. In SIP, for example, the combination of attributes depends on the scenario and the a-priori knowledge of the SIP provider. For example, if address spoofing is inhibited for its network access customers, a filtering can leverage the relation between the SIP “from”-field and the IP source address, so that DoS-attacks from its own realm can be blocked. If a DDoS-attacker uses a specific pattern within any SIP-header field—or specific meta information between the regular header fields—it can be detected and blocked at wire-speed.
According to a preferred embodiment of the present invention, the content of the black-list is constantly and dynamically updated during operation of the network server.
According to another preferred embodiment of the invention, it is suggested that the content of the black-list is transmitted to the attack-prevention-device via a feedback-path. According to this embodiment, a path for data-transmission is provided between the attack-detection-device and the attack-prevention-device. Preferably, the path allows wire-speed data transmission.
According to yet another preferred embodiment of the invention, the steps of
It is suggested that the attack-prevention-device performs an inspection and analysis of the traffic directed from the network to the network server, in order to determine whether the messages directed to the network server correspond to or comprise patterns and/or attributes contained in the black-list. In particular, the analysis of the traffic comprises comparing the characteristic parameters entered into the black-list and defining traffic identified as being conspicuous or malicious.
Preferably the attack-prevention-device performs a filtering, blocking and/or throttling of the inspected traffic whose characteristic parameters match with the characteristic parameters entered into the black-list and defining traffic identified as being conspicuous or malicious. For performing the filtering, blocking and/or throttling of the inspected messages of the traffic, the attack-prevention-device sends appropriate control signals to the access-restricting-means. Of course, the attack-prevention-device and the access-restricting-means can be incorporated in a single common device, which can be referred to as a session-enabled-firewall.
It is particularly important to prevent attacks on the network server with conspicuous or malicious signaling messages. Therefore, it is suggested that the attack-prevention-device performs an inspection and analysis of signaling messages of the traffic directed from the network to the network server. Preferably, the attack-prevention-device performs an inspection and analysis of signaling messages according to the SIP (Session Initiation Protocol)-standard. Alternatively, the attack-prevention-device performs an inspection and analysis of signaling messages according to the H.323-standard.
Further, the above-mentioned object is achieved by an attack-prevention-device of the kind mentioned above, comprising
According to a preferred embodiment of the invention it is suggested that the means for performing an inspection and analysis of the traffic directed from the network to the network server inspect and analyze signaling messages of the traffic. In particular, it is suggested that the network server is a call server making part of a call-based-services-environment. The environment comprises the network, the call server connected to the network and at least one user agent connected to the network. The call server is adapted for setting up a data transmission connection between the at least one user agent and at least one other user agent by means of signaling messages. The signaling messages are transmitted between the call server and the user agents across the network and across the access restricting means. The means for performing an inspection and analysis of the traffic inspect and analyze the signaling messages of the traffic directed from the network to the call server.
Preferably, the means for performing an inspection and analysis of the traffic directed from the network to the call server inspect and analyze signaling messages according to a SIP (Session Initiation Protocol)-standard.
According to another preferred embodiment of the invention it is suggested that the black-list contains patterns and/or attributes describing malicious and/or conspicuous traffic and that the means for performing an inspection and analysis of the traffic directed from the network to the network server perform a pattern and/or attribute matching operation in order to determine whether the inspected and analyzed traffic comprises an attack on the network server.
Further features and advantages of the present invention are explained in more detail below with reference to the accompanying drawings. The figure shows:
Now by way of example and referring to
In
The firewall 4 is controlled by an attack-prevention-device 5, namely a SIP-gate. The SIP-gate 5 tells the firewall 4 when to open letting certain SIP-messages pass and when to close preventing certain SIP-messages from entering the secure-side 1′ of the network 1 and from reaching the SIP Proxy-Server 3. The SIP-gate 5 has a restricted intelligence allowing it to inspect and analyze incoming messages for the presence of certain characteristic parameters of the messages. The SIP-gate 5 does not understand the content of the scanned messages nor does it process the content to such an extent that it performs certain actions as a result of the content. This allows the SIP-gate 5 to work independent of the signaling protocol (e.g. SIP) used in the environment.
The SIP-gate 5 receives a so-called black-list 6 from the SIP-proxy-server 3 across a feedback-path 7. The black-list 6 comprises information on those SIP-messages, which are to be blocked or at least restricted in number. The black-list 6 does not contain individual information on each SIP-message to be blocked or restricted. Rather, the black-list 6 comprises characteristic parameters, for example certain patterns or attributes, defining that kind of SIP-messages, which is to be blocked or restricted. The SIP-gate 5 inspects and analyzes the SIP-messages directed to the SIP Proxy-Server 3 in order to determine, whether the inspected and analyzed SIP-messages comprise an attack on the SIP-proxy-server 3 or not. Inspecting and analyzing the SIP-messages comprises comparing the characteristic parameters of the inspected SIP-messages with the respective characteristic parameters contained in the black-list 6 and defining conspicuous or malicious SIP-messages. In particular, the inspection and analyses of the SIP-messages by the SIP-gate 5 comprises pattern- and/or attribute-matching operations. The firewall 4 and the SIP-gate 5 together constitute a so-called session enabled firewall.
The content of the black-list 6 is created in an attack-detection-device 8 situated in or near to the SIP Proxy-Server 3. The rules, attributes and/or patterns defining conspicuous and malicious SIP-messages are entered in the black-list 6 and then transmitted to the SIP-gate 5 across the feedback-path 7. Alternatively the rules, attributes and/or patterns defining conspicuous and malicious SIP-messages are transmitted to the SIP-gate 5 and entered in the black-list 6 there. The attack-detection-device 8 may perform a static attack-detection-algorithm for detecting attacking SIP-messages in a way, known in the art. It is possible that the attack-detection-device 8 performs new algorithms for detecting attacking SIP-messages as quickly and as reliably as possible, which are not known in the art. However, the algorithms used by the attack-detection-device 8 are not subject of the present invention.
A main issue of the present invention is the fact, that an intelligent device, namely the attack-detection-device 8, performs the actual detection of attacking SIP-messages and creates the rules, patterns and/or attributes for defining those SIP-messages, which constitute an attack on the SIP Proxy-Server 3. The rules, patterns and/or attributes for these SIP-messages are entered into the black-list 6. Furthermore, a device with restricted intelligence, namely the attack-prevention-device or the SIP-gate 5, performs the control of the firewall 4 depending on the content of the black-list 6. That has the advantage that conspicuous or malicious SIP-messages are blocked or restricted before and not after reaching the SIP-proxy-server 3. For inspecting and analyzing incoming SIP-messages, the SIP-gate 5 just looks at the content of the SIP-messages, for example at the information contained in the header or at the payload-information, but does not have to understand the content. The SIP-gate 5 has to perform simple pattern- and/or attribute-matching operations. The reduced intelligence of the SIP-gate 5 allows a very fast processing speed of the SIP-gate 5. Furthermore, the reduced intelligence of the SIP-gate 5 makes it very hard for potential attackers to actually drive an attack on the SIP-gate 5 thereby manipulating the firewall 4 and opening the way for a subsequent attack on the SIP Proxy-Server 3.
To allow a fast reaction on a detected attack on the SIP Proxy-Server 3, preferably the steps of:
The idea of the present invention is to source out the low-level data-packet analyzing from the SIP Proxy-Server 3 to the SIP-gate 5. By doing so, malicious and conspicuous data-packets can be detected and removed by the firewall 4 before reaching the SIP Proxy-Server 3 and consuming resources there. However, only low-level analyzing is outsourced to the SIP-gate 5, in order to assure fast processing within the session enabled firewall 4, 5. Preferably the session enabled firewall 4, 5 works at wire-speed or in real-time.
| Number | Date | Country | Kind |
|---|---|---|---|
| 04291418.4 | Jun 2004 | EP | regional |
