Tracing analysis and security protection method and device based on SIP protocol identifier

Abstract

The invention discloses a source tracing analysis and safety protection method and device based on SIP (Session Initiation Protocol) identification, and the method comprises the steps: collecting historical operation, weather and power generation data of a monitoring station through the Internet of Things, and constructing an equipment environment energy consumption library and an environment power generation library; next, future meteorological prediction data is acquired, and the future power generation amount is predicted by using an LSTM algorithm in combination with the environmental power generation library. And training an equipment energy consumption prediction model by using historical operation data, and obtaining future equipment energy consumption based on weather prediction. And then the continuous standby time is calculated through an energy balance formula in combination with the current battery electric quantity. And finally, dynamically adjusting an equipment operation mode according to the time, and generating a maintenance prompt. The system improves the energy utilization efficiency of the monitoring station, achieves intelligent management, guarantees the stable operation of the monitoring station, and reduces the operation and maintenance cost.

Description

Technical Field

[0001] This invention relates to the field of computer network communication technology, and specifically to a method and apparatus for source tracing analysis and security protection based on SIP protocol identifiers. Background Technology

[0002] SIP (Session Initiation Protocol), as a core protocol for real-time communication over IP networks, has been widely used in various real-time communication systems, including but not limited to IP voice communication, video conferencing systems, multimedia communication gateways, and security monitoring and remote broadcasting systems. In these systems, the SIP protocol plays a crucial role in signaling transmission, responsible for establishing, modifying, and terminating real-time communication sessions, and is fundamental to ensuring the implementation of real-time interactive functions.

[0003] However, existing real-time communication systems based on the SIP protocol have significant security and management deficiencies in signaling transmission: on the one hand, they cannot effectively monitor, identify, and control the transmitted signaling, making it difficult to quickly locate the root cause of problems when signaling anomalies occur; on the other hand, they lack effective means of identifying and warning against unauthorized signaling, which means that forged, tampered, or illegally accessed signaling may bypass security mechanisms, causing security risks such as communication interruption and information leakage, seriously affecting the stability and security of real-time communication systems.

[0004] Therefore, how to invent a source tracing analysis and security protection method based on SIP protocol identifiers that can quickly locate the root cause of the problem and reduce security risks such as communication interruption and information leakage has become an urgent problem to be solved. Summary of the Invention

[0005] To address this, the present invention provides a method and apparatus for source tracing analysis and security protection based on SIP protocol identifiers. By adding a SID field containing device identifier and signature to the SIP signaling header, and combining device certificate verification and source tracing, the invention solves the problems of existing SIP signaling being unable to effectively monitor, identify, and control, and lacking early warning of non-existent signaling. This reduces security risks such as communication interruption and information leakage, and improves the stability and security of real-time communication systems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a source tracing analysis and security protection method based on SIP protocol identifiers, comprising:

[0007] Deploy a signaling security gateway device in front of the signaling equipment; generate a device public key and a device private key through the signaling security gateway device; send a device certificate issuance application to the certificate management center based on the device public key; after receiving the device certificate issuance application, the certificate management center generates a device certificate and distributes it to the signaling security gateway device.

[0008] The signaling security gateway device receives network data packets from the network interface card; based on the SIP protocol port and protocol characteristics, it filters the network data packets to obtain SIP signaling messages;

[0009] The SIP signaling message is parsed. If the header of the SIP signaling message does not have a SID field, a SID field is added and set. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified and updated for the first time.

[0010] The SIP signaling message with the added or updated SID field is subjected to signaling identifier verification. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0011] By analyzing the SID field of the abnormal signaling message, the signaling security gateway device through which the abnormal signaling message passed can be traced to determine the origin and transmission path of the abnormal signaling.

[0012] As a preferred method for source tracing analysis and security protection based on SIP protocol identifiers, in the process of adding the configured SID field to the SIP signaling message that does not have a SID field:

[0013] Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field;

[0014] The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain a signature value; the signature value is then used as the second part of the set SID field value.

[0015] The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

[0016] As a preferred solution for traceability analysis and security protection methods based on SIP protocol identifiers, during the initial verification and update of the SID field signature:

[0017] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0018] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0019] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the verification is successful, the device identifier of the current signaling security gateway device is appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device. The new signature value is used as the second part of the SID field.

[0020] As a preferred solution for source tracing analysis and security protection methods based on SIP protocol identifiers, during the second verification of the SID field signature:

[0021] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0022] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0023] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification is successful, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0024] As a preferred solution for source tracing analysis and security protection based on SIP protocol identifiers, after the second verification of the SID field signature fails, the device identifier of the previous signaling security gateway device is whitelisted. If the verification passes, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0025] This invention also provides a source tracing analysis and security protection device based on SIP protocol identifiers. Based on the above source tracing analysis and security protection method based on SIP protocol identifiers, it includes:

[0026] The device certificate issuance module is used to deploy a signaling security gateway device in front of the signaling device; generate a device public key and a device private key through the signaling security gateway device; send a device certificate issuance application to the certificate management center based on the device public key; after receiving the device certificate issuance application, the certificate management center generates a device certificate and issues it to the signaling security gateway device.

[0027] The signaling message filtering module is used by the signaling security gateway device to filter SIP signaling messages from network data packets received from the network interface card based on the SIP protocol port and protocol characteristics.

[0028] The signaling identifier addition module is used to parse the SIP signaling message. If the header of the SIP signaling message does not have a SID field, the module adds and sets the SID field. If the header of the SIP signaling message has a SID field, the module performs the first verification and update of the signature of the SID field.

[0029] The signaling identifier verification module verifies the signaling identifier of the SIP signaling message after adding or updating the SID field. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0030] The signaling tracing module is used to analyze the SID field of the abnormal signaling message to trace the signaling security gateway device through which the abnormal signaling message passes, and to determine the origin and transmission path of the abnormal signaling.

[0031] As a preferred embodiment of a source tracing analysis and security protection device based on SIP protocol identifiers, the signaling identifier adding module, during the process of adding the set SID field to the SIP signaling message that does not have a SID field:

[0032] Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field;

[0033] The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain a signature value; the signature value is then used as the second part of the set SID field value.

[0034] The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

[0035] As a preferred solution for a source tracing analysis and security protection device based on SIP protocol identifiers, in the signaling identifier adding module, during the first verification and update of the signature of the SID field:

[0036] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0037] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0038] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the verification is successful, the device identifier of the current signaling security gateway device is appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device. The new signature value is used as the second part of the SID field.

[0039] As a preferred solution for a source tracing analysis and security protection device based on SIP protocol identifiers, in the signaling identifier verification module, during the second verification of the signature of the SID field:

[0040] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0041] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0042] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification is successful, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0043] As a preferred solution for source tracing analysis and security protection devices based on SIP protocol identifiers, the signaling identifier verification module performs whitelist verification on the device identifier of the previous signaling security gateway device after the second verification of the SID field signature fails. If the verification passes, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0044] This invention has the following advantages: It deploys a signaling security gateway device in front of the signaling equipment; the signaling security gateway device generates a device public key and a device private key; based on the device public key, it sends a device certificate issuance application to the certificate management center; after receiving the device certificate issuance application, the certificate management center generates a device certificate and distributes it to the signaling security gateway device; the signaling security gateway device receives network data packets from the network interface card; based on the SIP protocol port and protocol characteristics, it filters and obtains SIP signaling messages from the network data packets; it parses the SIP signaling messages, and if the header of the SIP signaling message does not have a SID field, it adds and sets the SID field; ... If the header of the SIP signaling message contains a SID field, the signature of the SID field is verified and updated for the first time. For SIP signaling messages with an added or updated SID field, signaling identifier verification is performed. If the header of the SIP signaling message does not contain a SID field, it is determined to be an abnormal signaling message, and the signaling flow is blocked. If the header of the SIP signaling message contains a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be legitimate; if the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked. By analyzing the SID field of the abnormal signaling message, the signaling security gateway devices through which the abnormal signaling message passes are traced, determining the origin and transmission path of the abnormal signaling. This invention, by adding a SID field containing device identifier and signature to the SIP signaling header, combined with the device certificate distribution and verification mechanism, achieves convenient monitoring, rapid identification, and real-time control of transmitted signaling. By leveraging the device certificate management of the certificate management center, it ensures the security and integrity of signaling identifiers. Through the filtering, identifier addition, and verification process of the signaling security gateway, it can effectively identify abnormal signaling and block it in a timely manner. At the same time, based on the SID field, the signaling path can be traced, clarifying the source of the anomaly and the scope of its impact. This provides a reliable basis for network operation and maintenance personnel to handle problems and strengthen security strategies, significantly improving the security of SIP signaling in network transmission. Attached Figure Description

[0045] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0046] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0047] Figure 1 This is a flowchart illustrating the source tracing analysis and security protection method based on SIP protocol identifiers provided in Embodiment 1 of the present invention;

[0048] Figure 2 This is a schematic diagram illustrating the specific implementation process of the source tracing analysis and security protection method based on SIP protocol identifier provided in Embodiment 1 of the present invention;

[0049] Figure 3 This is a schematic diagram of the SIP signaling format in the source tracing analysis and security protection method based on SIP protocol identifier provided in Embodiment 1 of the present invention;

[0050] Figure 4 This is a schematic diagram of the signaling identifier addition and signaling identifier verification process in the source tracing analysis and security protection method based on SIP protocol identifier provided in Embodiment 1 of the present invention;

[0051] Figure 5 This is a schematic diagram of the architecture of the traceability analysis and security protection device based on SIP protocol identifier provided in Embodiment 2 of the present invention. Detailed Implementation

[0052] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Example 1

[0054] See Figure 1 and Figure 2 Embodiment 1 of the present invention provides a method for source tracing analysis and security protection based on SIP protocol identifiers, including the following steps:

[0055] S1. Deploy a signaling security gateway device in front of the signaling device; generate a device public key and a device private key through the signaling security gateway device; send a device certificate issuance application to the certificate management center based on the device public key; after receiving the device certificate issuance application, the certificate management center generates a device certificate and issues it to the signaling security gateway device.

[0056] S2. The signaling security gateway device receives network data packets from the network card; based on the SIP protocol port and protocol characteristics, it filters and obtains SIP signaling messages from the network data packets.

[0057] S3. Parse the SIP signaling message. If the header of the SIP signaling message does not have a SID field, add and set the SID field. If the header of the SIP signaling message has a SID field, perform the first verification and update of the signature of the SID field.

[0058] S4. Perform signaling identifier verification on the SIP signaling message after adding or updating the SID field. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, perform a second verification on the signature of the SID field. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0059] S5. By analyzing the SID field of the abnormal signaling message, trace the signaling security gateway device through which the abnormal signaling message passes, and determine the origin and transmission path of the abnormal signaling.

[0060] In this embodiment, in step S1, a signaling security gateway device is deployed in front of the signaling device; a device public key and a device private key are generated through the signaling security gateway device; a device certificate issuance application is sent to the certificate management center based on the device public key; after receiving the device certificate issuance application, the certificate management center generates a device certificate and issues it to the signaling security gateway device.

[0061] Specifically, in the SIP signaling transmission path, a signaling security gateway device is deployed in front of the signaling equipment. This gateway first generates a device key pair containing a public key and a private key. Then, the gateway uses the device public key to create a certificate request and submits a device certificate application to the certificate management center. After the certificate management center approves the application, it issues a device certificate associated with the gateway device identifier, stores the correspondence between the certificate and the device identifier, and distributes the certificate to the signaling security gateway device. The signaling security gateway device periodically replaces its certificates, regenerates the key pair and applies for a new certificate when the certificate expires, and periodically retrieves the certificate revocation list from the certificate management center to check the validity of the certificates.

[0062] In this embodiment, in step S2, the signaling security gateway device receives network data packets from the network card; based on the SIP protocol port and protocol characteristics, it filters and obtains SIP signaling messages from the network data packets;

[0063] Specifically, the signaling security gateway device receives all network data packets flowing through the network interface card (NIC). It then filters the network data packets based on the standard port (e.g., 5060) and protocol characteristics (e.g., the "SIP / 2.0" identifier in the message header). After filtering, only signaling messages conforming to the SIP protocol specification are retained, while other non-SIP network data is excluded, providing target objects for subsequent signaling identifier addition and verification.

[0064] In this embodiment, in step S3, the SIP signaling message is parsed. If the header of the SIP signaling message does not have a SID field, a SID field is added and set. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified and updated for the first time.

[0065] Specifically, the SID field format of the SIP signaling message is as follows: Figure 3 As shown. The process of adding a signaling identifier is as follows. Figure 4 As shown:

[0066] The signaling security gateway device parses and filters the SIP signaling message headers. If the SID field is not found, the gateway will add it.

[0067] The specific addition process is as follows:

[0068] Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field;

[0069] The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain a signature value; the signature value is then used as the second part of the set SID field value.

[0070] The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

[0071] If the SID field already exists, extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0072] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0073] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the verification is successful, the device identifier of the current signaling security gateway device is appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device. The new signature value is used as the second part of the SID field.

[0074] In this embodiment, in step S4, the SIP signaling message after adding or updating the SID field is subjected to signaling identifier verification. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0075] Specifically, such as Figure 4 As shown, the signaling security gateway device verifies the SIP signaling packets processed in step S3. If the packet header lacks an SID field, it is directly identified as abnormal and blocked.

[0076] If a SID field exists, extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0077] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0078] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification is successful, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0079] If the verification fails, the device identifier of the previous signaling security gateway device is whitelisted. If the verification passes, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0080] In this embodiment, in step S5, the SID field of the abnormal signaling message is analyzed to trace the signaling security gateway device through which the abnormal signaling message passes, thereby determining the origin and transmission path of the abnormal signaling.

[0081] Specifically, when step S4 determines that a signaling message is abnormal, the signaling security gateway device parses the SID field of the abnormal signaling message. Starting from the device identifier sequence in the first part of the SID field (e.g., “device_id1; device_id2”), it traces all the signaling security gateway devices that the signaling message passed through. Combining this with the deployment information of each gateway, it clarifies the origin of the abnormal signaling message (the gateway corresponding to the first device identifier) ​​and its complete transmission path. Simultaneously, it associates the asset information of the signaling devices to determine the scope of the abnormal signaling message's impact, providing a basis for problem localization in network operations and maintenance.

[0082] In summary, this invention, through the deployment of a signaling security gateway device in an IP voice communication system, filters, adds identifiers, and verifies SIP signaling during voice calls. This effectively monitors forged or tampered call signaling, prevents malicious call hijacking, and, in the event of call anomalies, traces the signaling path based on the SID field to quickly locate the problem node.

[0083] In video conferencing and remote collaboration systems, the identification and verification mechanism of this invention can identify signaling sent by unauthorized devices for SIP signaling such as meeting establishment and member joining / leaving, thereby preventing unauthorized access to the meeting and ensuring the security of meeting signaling transmission. Furthermore, when signaling anomalies cause meeting interruptions, the scope of impact can be determined through source tracing analysis, helping maintenance personnel to restore the system in a timely manner.

[0084] In multimedia communication gateway scenarios, the gateway acts as a forwarding node for SIP signaling between different networks. By applying this invention, the gateway can perform end-to-end identification and verification of the signaling passing through it, preventing cross-network signaling attacks. At the same time, through certificate management and revocation mechanisms, the gateway device's identity can be ensured to be legitimate, thereby improving the security of cross-network communication.

[0085] In security monitoring and remote broadcasting systems, this invention enables real-time monitoring and anomaly blocking of SIP signaling related to device control and video stream transmission, preventing malicious signaling from tampering with monitoring instructions or interrupting broadcast streams. Furthermore, in the event of an anomaly, the source of the signaling can be traced through the SID field, providing a basis for handling security incidents.

[0086] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0087] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0088] Example 2

[0089] See Figure 5 Embodiment 2 of the present invention also provides a source tracing analysis and security protection device based on SIP protocol identifiers, including:

[0090] The device certificate issuance module 001 is used to deploy a signaling security gateway device in front of the signaling device; generate a device public key and a device private key through the signaling security gateway device; send a device certificate issuance application to the certificate management center based on the device public key; after receiving the device certificate issuance application, the certificate management center generates a device certificate and issues it to the signaling security gateway device.

[0091] The signaling message filtering module 002 is used by the signaling security gateway device to filter SIP signaling messages from network data packets received from the network card based on the SIP protocol port and protocol characteristics.

[0092] The signaling identifier addition module 003 is used to parse the SIP signaling message. If the header of the SIP signaling message does not have a SID field, the SID field is added and set. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified and updated for the first time.

[0093] The signaling identifier verification module 004 verifies the signaling identifier of the SIP signaling message after adding or updating the SID field. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0094] The signaling tracing module 005 is used to analyze the SID field of the abnormal signaling message to trace the signaling security gateway device through which the abnormal signaling message passes, and to determine the origin and transmission path of the abnormal signaling.

[0095] In this embodiment, during the process of adding the set SID field to the SIP signaling message that does not have a SID field in the signaling identifier adding module 003:

[0096] Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field;

[0097] The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain a signature value; the signature value is then used as the second part of the set SID field value.

[0098] The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

[0099] In this embodiment, during the first verification and update of the signature in the SID field in the signaling identifier adding module 003:

[0100] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0101] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0102] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the verification is successful, the device identifier of the current signaling security gateway device is appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device. The new signature value is used as the second part of the SID field.

[0103] In this embodiment, during the second verification of the signature of the SID field in the signaling identifier verification module 004:

[0104] Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field;

[0105] Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is queried from the local certificate cache list; if no corresponding device certificate is found, a request is made to the certificate management center to obtain it.

[0106] The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification is successful, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0107] In this embodiment, the signaling identifier verification module 004 performs a whitelist verification on the device identifier of the previous signaling security gateway device after the second verification of the SID field signature fails. If the verification passes, it is determined to be a legitimate signaling message; if the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked.

[0108] It should be noted that the information interaction and execution process between the modules of the above system are based on the same concept as the method embodiment in Embodiment 1 of this application, and the resulting technical effects are the same as those in the method embodiment of this application. For details, please refer to the description in the method embodiment shown above in this application, and it will not be repeated here.

[0109] Example 3

[0110] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium storing program code for a source tracing analysis and security protection method based on SIP protocol identifiers. The program code includes instructions for executing the source tracing analysis and security protection method based on SIP protocol identifiers of Embodiment 1 or any possible implementation thereof.

[0111] Computer-readable storage media can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives, SSDs).

[0112] Example 4

[0113] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0114] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor can call the program instructions to execute the source tracing analysis and security protection method based on SIP protocol identifier of Embodiment 1 or any possible implementation thereof.

[0115] Specifically, a processor can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0116] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable system. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0117] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using program code executable by a computing system, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0118] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A method for source tracing analysis and security protection based on SIP protocol identifiers, characterized in that, include: Deploy a signaling security gateway device in front of the signaling equipment; Generate device public and private keys through the signaling security gateway device; Based on the device's public key, the device sends a certificate issuance application to the certificate management center; after receiving the certificate issuance application, the certificate management center generates a certificate and issues it to the signaling security gateway device. The signaling security gateway device receives network data packets from the network interface card; Based on the SIP protocol port and protocol characteristics, SIP signaling messages are obtained by filtering from the network data packets; The SIP signaling message is parsed. If the header of the SIP signaling message does not have a SID field, a SID field is added and set. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified and updated for the first time. The SIP signaling message with the added or updated SID field is subjected to signaling identifier verification. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. By analyzing the SID field of the abnormal signaling message, the signaling security gateway device through which the abnormal signaling message passed can be traced to determine the origin and transmission path of the abnormal signaling.

2. The source tracing analysis and security protection method based on SIP protocol identifier according to claim 1, characterized in that, During the process of adding the configured SID field to the SIP signaling message that does not have a SID field: Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field; The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain the signature value; Use the signature value as the second part of the set SID field; The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

3. The source tracing analysis and security protection method based on SIP protocol identifiers according to claim 2, characterized in that, During the initial verification and update of the signature in the SID field: Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field; Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is retrieved from the local certificate cache list; If there is no corresponding device certificate, request one from the certificate management center; The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked; If the verification is successful, the device identifier of the current signaling security gateway device will be appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device; Use the new signature value as the second part of the SID field.

4. The source tracing analysis and security protection method based on SIP protocol identifier according to claim 3, characterized in that, During the second verification of the signature in the SID field: Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field; Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is retrieved from the local certificate cache list; If there is no corresponding device certificate, request one from the certificate management center; The signature value of the second part of the SID field is verified using the obtained device certificate; if the verification is successful, it is determined to be a legitimate signaling message. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked.

5. The source tracing analysis and security protection method based on SIP protocol identifiers according to claim 4, characterized in that, If the second verification of the SID field signature fails, the device identifier of the previous signaling security gateway device is whitelisted. If the verification passes, it is determined to be a legitimate signaling message. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked.

6. A source tracing analysis and security protection device based on SIP protocol identifiers, employing the source tracing analysis and security protection method based on SIP protocol identifiers as described in any one of claims 1-5, characterized in that, include: The device certificate issuance module is used to deploy signaling security gateway devices in front of signaling devices; Generate device public and private keys through the signaling security gateway device; Based on the device's public key, the device sends a certificate issuance application to the certificate management center; after receiving the certificate issuance application, the certificate management center generates a certificate and issues it to the signaling security gateway device. The signaling message filtering module is used by the signaling security gateway device to receive network data packets from the network interface card. Based on the SIP protocol port and protocol characteristics, SIP signaling messages are obtained by filtering from the network data packets; The signaling identifier addition module is used to parse the SIP signaling message. If the header of the SIP signaling message does not have a SID field, then a SID field is added and set. If the header of the SIP signaling message contains a SID field, the signature of the SID field is verified and updated for the first time. The signaling identifier verification module verifies the signaling identifier of the SIP signaling message after adding or updating the SID field. If the header of the SIP signaling message does not have a SID field, it is determined to be an abnormal signaling message and the signaling flow is blocked. If the header of the SIP signaling message has a SID field, the signature of the SID field is verified a second time. If the verification passes, it is determined to be valid. If the verification fails, it is determined to be an abnormal signaling message and the signaling flow is blocked. The signaling tracing module is used to analyze the SID field of the abnormal signaling message to trace the signaling security gateway device through which the abnormal signaling message passes, and to determine the origin and transmission path of the abnormal signaling.

7. The source tracing analysis and security protection device based on SIP protocol identifier according to claim 6, characterized in that, In the signaling identifier addition module, during the process of adding the set SID field to the SIP signaling message that does not have a SID field: Use the device identifier of the current signaling security gateway device as the first part of the value of the set SID field; The SIP message header and SID field value of the SIP signaling message are signed using the device private key of the current signaling security gateway device to obtain the signature value; Use the signature value as the second part of the set SID field; The second part of the value is separated from the first part of the value by a semicolon, forming the set SID field.

8. The source tracing analysis and security protection device based on SIP protocol identifier according to claim 7, characterized in that, In the signaling identifier addition module, during the initial verification and update of the signature in the SID field: Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field; Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is retrieved from the local certificate cache list; If there is no corresponding device certificate, request one from the certificate management center; The signature value of the second part of the SID field is verified using the obtained device certificate. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked; If the verification is successful, the device identifier of the current signaling security gateway device will be appended to the end of the first part of the SID field. The new signature value is recalculated using the device private key of the current signaling security gateway device; Use the new signature value as the second part of the SID field.

9. The source tracing analysis and security protection device based on SIP protocol identifier according to claim 8, characterized in that, In the signaling identifier verification module, during the second verification of the signature in the SID field: Extract the device identifier of the previous signaling security gateway device from the value of the first part of the SID field; Based on the device identifier of the previous signaling security gateway device, the corresponding device certificate is retrieved from the local certificate cache list; If there is no corresponding device certificate, request one from the certificate management center; The signature value of the second part of the SID field is verified using the obtained device certificate; if the verification is successful, it is determined to be a legitimate signaling message. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked.

10. The source tracing analysis and security protection device based on SIP protocol identifier according to claim 9, characterized in that, In the signaling identifier verification module, after the second verification of the signature of the SID field fails, the device identifier of the previous signaling security gateway device is whitelisted. If the verification passes, it is determined to be a legitimate signaling message. If the verification fails, it is determined to be an abnormal signaling message, and the signaling flow is blocked.

Images