Patent Application
20070300304
The present invention involves the use of a SIP washing machine. The SIP washing machine acts as SIP redirect server. In most cases, clients such as botnets that generate false SIP traffic simply transmit SIP messages without any stateful functionality. In the present invention, when the SIP washing machine asks a client to redirect its messages to a different IP address/other SIP server, the “fake” clients do not understand the redirection request, while valid clients understand the redirection request and act appropriately. Therefore, by acting as a redirect server, the SIP washing machine of the present invention “cleans” the useless SIP traffic, while the operator's service still works for legitimate users.
DoS attacks commonly comprise thousands of streams with random IP source addresses, with a single DoS attack often generating several Gbps of peak traffic. The load on the SIP server 110 increases due to fake SIP messages and/or a huge amount of user traffic that blocks the access link(s) to the SIP server 110. An incoming DoS attack can be recognized by conventionally known methods, e.g., from SIP proxy statistics or various commercial applications. One such commercial application is marketed under the name “Peakflow SP” and is sold by Arbor Networks.
In response to the DoS attack, and as shown in
In one embodiment of the invention, the SIP washing machine 130 is connected to the Internet 100 with a high capacity link, at least a gigabit Ethernet link in one embodiment, and is connected to an operator core node that is capable of handling the high amounts of traffic caused by the DoS attack.
Because in various embodiments, the SIP washing machine 130 uses the IP address of the original SIP server 110 that was under attack, the SIP washing machine 130 cannot redirect the SIP traffic to the same address. The SIP requests can be either forwarded to another SIP server, as shown in
In various embodiments of the present invention, the SIP washing machine 130 discussed above can also implement washing functionality for SYN floods, as SYN floods can also be used to bring down SIP servers. Additionally, the SIP washing machine 130 can be even more universal in nature, such that it can be used also for non-SIP services as well.
The functionality of a SIP washing machine 130 of the present invention can be kept quite simple in order to make it scalable. For example, the redirection of traffic can comprise a static function that automatically replies to incoming SIP messages with a redirection. In other embodiments of the invention, the SIP washing machine 130 may perform additional functions as well, such as checking registration credentials of clients that have transmitted messages or requests.
The present invention is described in the general context of method steps, which may be implemented in one embodiment by a program product including computer-executable instructions, such as program code, executed by computers in networked environments. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps.
Software and web implementations of the present invention could be accomplished with standard programming techniques with rule based logic and other logic to accomplish the various database searching steps, correlation steps, comparison steps and decision steps. It should also be noted that the words “component” and “module,” as used herein and in the claims, is intended to encompass implementations using one or more lines of software code, and/or hardware implementations, and/or equipment for receiving manual inputs.
The foregoing description of embodiments of the present invention have been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the present invention to the precise form disclosed, and modifications and variations are possible in light of the above teachings or may be acquired from practice of the present invention. The embodiments were chosen and described in order to explain the principles of the present invention and its practical application to enable one skilled in the art to utilize the present invention in various embodiments and with various modifications as are suited to the particular use contemplated.
