VoIP gateway device, method, communication system, and program

Abstract

To minimize an influence on a call by discarding an illegal RTP packet when a DoS attack is received in a VoIP network.SOLUTION: The VoIP gateway apparatus includes a voice frequency analysis section for performing spectrum analysis of a payload included in an RTP packet received from the VoIP network to acquire a peak frequency and a level, an illegal voice data decision section for deciding that an RTP packet received by a DoS attack is an illegal RTP packet if the peak frequency and the level analyzed and outputted by the voice frequency analysis section are outside a predetermined frequency range and a predetermined level range set in advance by a user, and a packet processing section for discarding an RTP packet decided to be an illegal RTP packet by the illegal voice data decision section and outputting a notification that the illegal RTP packet has been processed to a maintenance terminal.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present disclosure relates to a VoIP gateway device, method, communication system, and program.

Background Art

[0002] In a VoIP (Voice over Internet Protocol) network, since various user terminals transmit and receive RTP (Real Time Transport Protocol) packets, a DoS (Denial of Service attack) attack by a malicious terminal becomes an issue. When a DoS attack is received, it causes system downtime and has an adverse effect on the call quality between users, making it difficult to continue the service, so sufficient countermeasures are required.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Figure 1 shows an example of a voice communication system configuration using a VoIP network and a PSTN network, illustrating how voice signals from a VoIP network subscriber are successfully forwarded to a PSTN network subscriber, who is the VoIP network subscriber's destination. Referring to Figure 1, the VoIP network consists of a user terminal 100, an LC (Line Circuit: subscriber circuit) 200, a VoIP access gateway 300, and an IP network 400. The PSTN network consists of a user terminal 800, an LC (Line Circuit: subscriber circuit) 700, and a TDM (Time Division Multiplexing) switch 600. A Media Gateway (MG) 500 is located between these PSTN and VoIP networks to interconnect user data and realize voice communication via VoIP. User data on the VoIP network is packetized using RTP (Real Time Protocol) and forwarded across the IP network. User data on the PSTN network is incorporated into time slots via time division multiplexing and forwarded.

[0005] Figure 2 shows an example where malicious RTP packets sent from a DoS (Distributed Denial of Service Attack) attack terminal are mixed into the voice signal from the VoIP network to the PSTN network, resulting in malicious data 1 and 2 being mixed into the voice signal output by the MG500. Such mixing of malicious data can cause serious problems such as a decrease in call quality between subscribers and system failure of the MG500.

[0006] In other words, in a typical VoIP network, SBCs (Session Border Controllers) and MGs (Media Gateways) have packet filtering functions that detect and discard malicious RTP packets. However, their monitoring targets are L2, L3, L4, and the RTP header. Packets with header values ​​set to appropriate values ​​and malicious data stored in the RTP payload pass through the packet filtering functions of each communication system, resulting in the problem that malicious data cannot be detected except through user reports.

[0007] Patent Document 1 discloses that received packets are processed by a packet interface and sent to a denial-of-service (DOS) protection block, which prevents a DOS attack from extending to the next packet processing and from degrading that processing. [Means for solving the problem]

[0008] The VoIP gateway device according to this disclosure is connected to a maintenance terminal via a communication line and is a VoIP gateway device that connects a VoIP network and a PSTN network, and comprises: an audio frequency analysis unit that performs spectral analysis of the payload contained in an RTP packet received from the VoIP network and obtains the peak frequency and the level; a malicious audio data determination unit that determines that the RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and the level output by the audio frequency analysis unit fall outside a predetermined frequency range and a predetermined level range set in advance by the user; and a packet processing unit that discards the RTP packet determined to be a malicious RTP packet by the malicious audio data determination unit and outputs to the maintenance terminal that the malicious RTP packet has been processed.

[0009] The method disclosed herein is a method for operating a VoIP gateway device that is connected to a maintenance terminal via a communication line and connects a VoIP network and a PSTN network, wherein the device performs spectral analysis of the payload contained in an RTP packet received from the VoIP network to obtain the peak frequency and level, and if the peak frequency and level fall outside a predetermined frequency range and level range set in advance by the user, it determines that the RTP packet received by the DoS attack is a malicious RTP packet, discards the RTP packet determined to be a malicious RTP packet, and outputs to the maintenance terminal that the malicious RTP packet has been processed.

[0010] The VoIP gateway system according to this disclosure comprises a VoIP gateway device that connects a VoIP network and a PSTN network, and a maintenance terminal connected to the VoIP gateway device via a communication line, wherein the VoIP gateway device includes: a voice frequency analysis unit that performs spectral analysis of the payload contained in an RTP packet received from the VoIP network and obtains the peak frequency and the level; a malicious voice data determination unit that determines the RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and the level output by the voice frequency analysis unit fall outside a predetermined frequency range and a predetermined level range set in advance by the user; and a packet processing unit that discards the RTP packet determined to be a malicious RTP packet by the malicious voice data determination unit and outputs to the maintenance terminal that the malicious RTP packet has been processed.

[0011] The program described herein is connected to a maintenance terminal via a communication line and is usable on a VoIP gateway device that connects a VoIP network and a PSTN network. The program performs spectral analysis of the payload contained in RTP packets received from the VoIP network to obtain the peak frequency and level. If the peak frequency and level fall outside a predetermined frequency range and level range set in advance by the user, the program determines that the RTP packet received by the DoS attack is a malicious RTP packet. The program discards the RTP packet determined to be a malicious RTP packet and outputs a message to the maintenance terminal indicating that the malicious RTP packet has been processed. [Effects of the Invention]

[0012] This allows the system to discard malicious RTP packets in the event of a DoS attack on the VoIP network, minimizing the impact on calls. [Brief explanation of the drawing]

[0013] [Figure 1] This is an example of a voice communication system configuration using related VoIP and PSTN networks. [Figure 2] This figure shows an example where malicious RTP packets sent from a DoS attack terminal were mixed into the audio signal transmitted from the related VoIP network to the PSTN network, resulting in malicious data being mixed into the output audio signal. [Figure 3] This figure shows an example configuration of a VoIP gateway device related to this disclosure. [Figure 4] This figure shows an example of the configuration of the communication system related to this disclosure. [Figure 5] This diagram shows an example of a detection threshold set on the maintenance server related to this disclosure. [Figure 6A] This is a sequence diagram of the communication system related to this disclosure. [Figure 6B] This is a sequence diagram of the communication system related to this disclosure. [Figure 7] This is a diagram showing an example of the management table for the fraudulent audio data detection unit related to this disclosure. [Figure 8] This figure shows an example of the results of spectral analysis of the male voice related to this disclosure. [Figure 9] This figure shows the results of spectral analysis of a typical fraudulent RTP payload in which all RTP payloads related to this disclosure are set to 0. [Modes for carrying out the invention]

[0014] Embodiment 1 The following describes an example configuration of the VoIP gateway device 1 with reference to the diagram. Figure 3 shows an example configuration of the VoIP gateway device 1. As shown in Figure 3, the VoIP gateway device 1 is a gateway device that connects the VoIP network and the PSTN network, and includes a voice frequency analysis unit 11, a fraudulent voice data detection unit 12, and a packet processing unit 13. A maintenance terminal 14 is connected to the VoIP gateway device 1 via a communication line or the like.

[0015] The voice frequency analysis unit 11 performs spectral analysis on the payload included in the RTP packet received from the VoIP network. Here, the voice frequency analysis unit 11 can obtain the peak frequency and the level as the result of the spectral analysis.

[0016] When the peak frequency and the level analyzed and output by the voice frequency analysis unit 11 are outside the predetermined frequency range and the predetermined level range set by the user in advance, the illegal voice data determination unit 12 determines that the RTP packet analyzed by the voice frequency analysis unit 11 is an illegal RTP packet received by a Dos attack.

[0017] Note that when the level of the spectrum analyzed and output by the voice frequency analysis unit 11 exceeds the threshold set by the user in advance, the illegal voice data determination unit 12 can regard it as being outside the predetermined level range.

[0018] The packet processing unit 13 discards the RTP packet determined to be an illegal RTP packet by the illegal voice data determination unit 12. In addition, the packet processing unit 13 notifies the maintenance terminal 14 that the illegal RTP packet has been processed.

[0019] Thereby, in the VoIP gateway device 1, when a DoS attack is received in the VoIP network, it is possible to discard the illegal RTP packet and minimize the impact on the call.

[0020] Embodiment 2 Hereinafter, the configuration of the communication system 2 using the VoIP gateway device 1 according to the present embodiment will be described in detail with reference to the drawings. In the present embodiment, it is intended to detect illegal data stored in the payload part of the received RTP packet as shown in FIG.

[0021] The VoIP gateway device 1 according to this embodiment can be deployed in communication systems that handle RTP packets, such as MGs, SBCs, and VoIP access gateways. However, in this example, we will assume deployment in an MG and explain using the example configuration of the communication system 2 shown in Figure 4.

[0022] Figure 4 shows an example configuration in which the functions of the VoIP gateway device 1 according to this embodiment are provided within the MG500. In other words, when the MG500 operates as a gateway that interconnects user data between the PSTN network and the VoIP network, it can perform the function of the VoIP gateway device 1 described in Embodiment 1, which includes detecting malicious data stored in the payload portion of received RTP packets.

[0023] The configuration shown in Figure 4, consisting of a user terminal 100, LC200, VoIP access gateway 300, and IP network 400 on the VoIP network side, and a user terminal 800, LC700, and TDM switch 600 on the PSTN network side, as well as the placement of an MG500 between the PSTN network and the VoIP network to interconnect user data, is the same as the configuration shown in Figure 1, and voice communication via VoIP is realized. User data on the VoIP network is packetized into RTP packets and transmitted over the IP network. User data on the PSTN network is incorporated into time slots using time division multiplexing and transmitted.

[0024] User terminal 100 is a terminal owned by a user on the VoIP network side, and may be, but is not limited to, a smartphone, a personal computer, or a dedicated IP phone.

[0025] The VoIP access gateway 300 is a device that converts and relays analog and digital data. In this case, the VoIP access gateway 300 can convert voice data input as analog data from the user terminal 100 via the LC200 into digital data that can be used on the IP network 400, and output it to the IP network 400.

[0026] IP network 400 is a computer network connected via the Internet Protocol, where data communication takes place, and it is connected to MG500.

[0027] The MG500 is a gateway that interconnects user data between the PSTN network and the VoIP network. The configuration for operating as a VoIP gateway device that detects malicious data stored in the payload portion of received RTP packets will be described in detail later.

[0028] User terminal 800 is an analog landline telephone or similar device owned by a user on the PSTN network side, and receives voice calls via MG500, TDM exchange 600, and LC700.

[0029] The maintenance server 900 has detection threshold settings configured by the maintenance personnel. The maintenance server 900 corresponds to the maintenance terminal 14 shown in Embodiment 1. Figure 5 shows an example of detection threshold settings configured in the maintenance server 900.

[0030] Here, we will describe the detailed configuration of the MG500. The MG500 comprises a packet header check function unit 510, a packet header analysis unit 520, a decoding function unit 530, an audio frequency analysis unit 540, an encoding function unit 550, a TDM data processing unit 560, a fraudulent audio data detection unit 570, and a device control unit 580.

[0031] The packet header check function unit 510 analyzes the L2, L3, L4, and RTP headers of digital data input from the IP network 400 and has the function of discarding the packet if a header value containing invalid header information is set. This packet header check function unit 510 is a function that is generally provided in communication nodes, and the input packets are RTP packets, making it possible to prevent the inclusion of RTP packets with invalid packet header values. The packet header check function unit 510 outputs RTP packets that were not discarded to the packet header analysis unit 520.

[0032] The packet header analysis unit 520 has the function of identifying the sequence number included in the RTP header of the RTP packet input from the packet header check function unit 510 and notifying the fraudulent voice data determination unit 570 of the identified sequence number. The packet header analysis unit 520 also outputs the RTP packet to the decoding function unit 530.

[0033] The decoding function unit 530 has the function of decoding the payload contained in the RTP packet input from the packet header analysis unit 520 into linear PCM. The source codec type is specified in advance by a call control protocol such as MEGACO (Media Gateway Control Protocol). The decoding function unit 530 outputs the data in which the payload has been decoded into linear PCM to the audio frequency analysis unit 540, and also outputs it to the encoding function unit 550 via the audio frequency analysis unit 540.

[0034] The audio frequency analysis unit 540 has the function of performing frequency spectrum analysis on the data contained in the RTP payload decoded into linear PCM, obtaining the peak values ​​and levels of the frequencies, and notifying the fraudulent audio data detection unit 570.

[0035] The encoding function unit 550 has the function of converting linear PCM data received from the decoding function unit 530 into a codec predetermined by the control protocol when the discard judgment flag (ON / OFF) is OFF, according to the discard judgment flag (ON / OFF) set by the fraudulent audio data detection unit 570 described later. The encoding function unit 550 also has the function of discarding a single packet of payload determined to be fraudulent audio data when the discard judgment flag is ON, and supplementing it with PLC (Packet Loss Concealment).

[0036] For example, the encoding function unit 550 has a memory unit that receives a determination from the invalid audio data determination unit 570 and stores a discard determination flag. The encoding function unit 550 initially sets the discard flag to OFF, and when it receives an output from the encoding function unit 550 indicating that the discard flag should be turned ON, it turns the discard flag ON for a predetermined period of time.

[0037] The TDM data processing unit 560 has the function of terminating the TDM line and sending and receiving user data with the TDM exchange 600.

[0038] The fraudulent audio data determination unit 570 compares the detection thresholds shown in Figure 5, which are set in advance by the maintenance server 900, with the frequency peak values ​​and levels notified by the audio frequency analysis unit 540, and determines that the data is fraudulent if the threshold is exceeded. Specifically, if the cumulative number of detections exceeds the threshold, the fraudulent audio data determination unit 570 sets the discard flag of the encoding function unit 550 to ON and sends a threshold exceedance notification to the device control unit 580. The fraudulent audio data determination unit 570 corresponds to the fraudulent audio data determination unit 12 in Embodiment 1.

[0039] The device control unit 580 has a function to notify the fraudulent voice data determination unit 570 of the detection threshold shown in Figure 5, which has been set by the maintenance server 900. Furthermore, the device control unit 580 has a function to send a notification of fraudulent voice data reception to the maintenance server 900 when it receives a threshold detection exceedance notification from the fraudulent voice data determination unit 570. In other words, the encoding function unit 550 and the device control unit 580 can realize the functions of the packet processing unit 13 in Embodiment 1.

[0040] Next, an example of the operation of the communication system 2 will be described. Figures 6A and 6B show the sequence before and after the start of a call. In this embodiment, the call control processing between the call control server and MG conforms to the standard SIP (Session Initiation Protocol) and MEGACO (Media Gateway Control Protocol), and the details of the call connection sequence are omitted. In addition, the G.711μ-law format is used for decoding the voice data. Furthermore, Figures 6A and 6B are sequence diagrams showing a series of operations, and the points marked with symbol A are considered to be consecutive.

[0041] Pre-call processing The maintenance server 900 is assumed to have the detection threshold settings shown in Figure 5 already configured by the maintenance personnel. The maintenance server 900 then sets the configured detection threshold settings shown in Figure 5 to the device control unit 580.

[0042] The device control unit 580 further sets the detection threshold to the fraudulent audio data determination unit 570. Here, the detection threshold has four parameters: the upper and lower limits of the normal frequency range, the level threshold, the threshold for considering fraudulent audio data reception, and the number of times it has been exceeded.

[0043] Processing after the call starts The MG500 receives an RTP packet containing voice data from the first user (subscriber 1 in Figures 6A and 6B) via the VoIP access gateway 300 from the user terminal 100. Then, it starts processing the data within the MG500.

[0044] The packet header check function unit 510 checks the L2, L3, L4, and RTP header values ​​of the RTP packet and discards the RTP packet if it contains invalid header information. This processing function by the packet header check function unit 510 is a function that is generally available in communication nodes and is intended to prevent the inclusion of RTP packets with invalid packet header values. If there are no abnormalities in each header value, the packet header check function unit 510 forwards the RTP packet to the packet header analysis unit 520.

[0045] The packet header analysis unit 520 obtains the sequence number from the RTP header of the received RTP packet and transfers the RTP payload to the decoding function unit 530. The sequence number is used for managing the frequency peak value and level value in the fraudulent audio data detection unit.

[0046] The decoding function unit 530 converts the RTP payload from G.711μ-law to linear PCM format and transfers it to the audio frequency analysis unit 540.

[0047] The audio frequency analysis unit 540 performs frequency spectrum analysis on the entire 320 bytes of linear PCM data representing one packetization period (20 ms). There are several methods for spectrum analysis, but for example, the Fast Fourier Transform (FFT) is used to obtain the peak frequency [Hz] and level [dB] of the target 320 bytes and notify the fraudulent audio data detection unit 570.

[0048] The fraudulent audio data detection unit 570 registers the acquired information in a management table, as shown in Figure 7. Typically, the management table consists of the RTP sequence number as the index, and the peak frequency [Hz], level [dB], and cumulative threshold exceedance count [times].

[0049] More specifically, the fraudulent audio data detection unit 570 compares the information registered in the management table with the fraudulent audio data detection thresholds shown in Figure 5, in the order of frequency peak threshold and level exceedance threshold. If either threshold is exceeded, the unit counts up the cumulative number of exceedances.

[0050] In this case, the malicious voice data detection unit 570 assumes that the peak frequency is generally set within the frequency range of human speech, which is 100 to 1000 Hz. If a peak exists outside of 100 to 1000 Hz, it is considered abnormal voice data and determined to be a malicious RTP packet. Furthermore, since non-vocalization intervals during a conversation may also be subject to spectral analysis, the malicious voice data detection unit 570 monitors the signal level in addition to the frequency.

[0051] More specifically, in non-vocalized sections, either silence or background noise will appear in the audio signal, but generally, background noise is lower than the level of human speech. Therefore, the invalid audio data detection unit 570 determines that the audio data is abnormal if it is outside the frequency range and above the signal level threshold.

[0052] As an example, Figure 8 shows the results of spectral analysis of a male voice. The fraudulent voice data detection unit 570 determines that the voice is normal because the peak frequency is 230 Hz, which is within the peak frequency range shown in Figure 5.

[0053] On the other hand, Figure 9 shows the spectral analysis results of a typical fraudulent RTP payload where all RTP payloads are set to 0. The fraudulent audio data detection unit 570 determines that the peak frequency is 43 Hz, which is outside the frequency range shown in Figure 5, and the signal level also exceeds the threshold of -20 dB, so it is determined to be abnormal audio.

[0054] If the cumulative value of detected abnormalities in the audio data exceeds a threshold, the fraudulent audio data detection unit 570 determines that it is a fraudulent RTP packet, sets the discard determination flag in the encoding function unit 550 to ON, and sends a fraudulent audio detection notification to the device control unit 580.

[0055] Furthermore, upon receiving a notification of detection of unauthorized audio from the unauthorized audio data determination unit 570, the device control unit 580 issues a notification of detection of unauthorized audio data to the maintenance server 900.

[0056] The encoding function unit 550 checks a discard determination flag before encoding the RTP payload. If the discard flag is OFF, it transfers the G.711μ-law encoded data to the TDM data processing unit 560. In other words, the encoding function unit 550 encodes the audio data so that it can ultimately be output by the user terminal 800 on the PSTN network side.

[0057] On the other hand, if the discard judgment flag is ON, the encoding function unit 550 discards the data and performs PLC processing to complete the data. Furthermore, the encoding function unit 550 transfers the data completed by the PLC to the TDM data processing unit 560.

[0058] In other words, the encoding function unit 550 discards RTP packets that have been determined to be invalid RTP packets by the invalid audio data determination unit, and the device control unit 580 notifies the maintenance server 900 that the invalid RTP packets have been processed.

[0059] The G.711μ-law data transferred to the TDM data processing unit 560 is transmitted to the TDM exchange 600 via the TDM line, and finally to the user terminal 800 held by the second user (subscriber 2 in Figures 6A and 6B).

[0060] In this way, the communication system 2 using the VoIP gateway device 1 can minimize the impact on calls by discarding the malicious RTP packets and supplementing them with the PLC function when a DoS attack occurs on the VoIP network.

[0061] More specifically, in the past, when the various header values ​​of the received RTP packet were correct but only the payload portion was abnormal, the call quality deteriorated due to noise and malicious voice interference in the user-to-user call, and there was no way to detect this other than through user reporting. Furthermore, not all users would report it, and until a report was made, it would cause multiple similar call failures, leading to a wider impact. However, with the VoIP gateway device 1 according to Embodiment 1, and the communication system 2 using the VoIP gateway device 1 according to Embodiment 2, it is possible to detect DoS attacks from user reports, notify maintenance personnel early, and take prompt action.

[0062] Although the present disclosure has been described above with reference to embodiments, the present disclosure is not limited to the embodiments described above. Various modifications to the structure and details of the present disclosure can be made as can be understood by those skilled in the art within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0063] Each drawing is merely illustrative to illustrate one or more embodiments. Each drawing may be associated with one or more other embodiments rather than with only one specific embodiment. As those skilled in the art will understand, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings, for example, to create embodiments not explicitly shown or described. Not all features or steps shown in any one drawing to illustrate an exemplary embodiment are necessarily required, and some features or steps may be omitted. The order of steps shown in any of the drawings may be changed as appropriate.

[0064] Embodiments of the present disclosure may be implemented in hardware or in dedicated circuitry, software, logic, or any combination thereof. Some embodiments may be implemented in hardware, while others may be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device.

[0065] This disclosure also provides at least one computer program product tangibly stored on a non-temporary computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions contained in a program module, and is executed on a device on a target real or virtual processor to perform the processes or methods of this disclosure. The program module includes routines, programs, libraries, objects, classes, components, data structures, etc., that perform a specific task or implement a specific abstract data type. The functionality of the program module may be combined or divided among the program module as desired in various embodiments. The machine-executable instructions of the program module can be executed on a local or distributed device. On a distributed device, the program module can reside on both local and remote storage media.

[0066] Program code for performing the methods of this disclosure may be written in any combination of one or more programming languages. These program codes are provided to a processor or controller of a general-purpose computer, a dedicated computer, or other programmable data processing device. When the program code is executed by the processor or controller, the functions / operations in the flowchart and / or block diagrams it implements are performed. The program code may run entirely on a machine, partially on a machine, partially as a standalone software package, partially on a machine, partially on a remote machine, or entirely on a remote machine or server.

[0067] Programs can be stored and supplied to a computer using various types of non-temporary computer-readable media. Non-temporary computer-readable media include various types of tangible recording media. Examples of non-temporary computer-readable media include magnetic recording media, magneto-optical recording media, optical disc media, and semiconductor memory. Magnetic recording media include, for example, flexible disks, magnetic tapes, and hard disk drives. Magneto-optical recording media include, for example, magneto-optical disks. Optical disc media include, for example, Blu-ray discs, CD (Compact Disc)-ROM (Read Only Memory), CD-R (Recordable), and CD-RW (ReWritable). Semiconductor memory includes, for example, solid-state drives, mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (random access memory). Programs may also be supplied to a computer using various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable media can supply programs to a computer via wired communication channels such as electric wires and optical fibers, or via wireless communication channels.

[0068] Some or all of the above embodiments may also be described as follows, but are not limited to the following: (Note 1) A VoIP gateway device that is connected to a maintenance terminal via a communication line and also connects a VoIP network and a PSTN network, The audio frequency analysis unit performs spectral analysis of the payload contained in RTP packets received from the VoIP network, and obtains the peak frequency and level. A malicious audio data determination unit determines that an RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and level output by the audio frequency analysis unit fall outside a predetermined frequency range and level range set in advance by the user. The system includes a packet processing unit that discards RTP packets determined to be fraudulent RTP packets by the fraudulent voice data detection unit, and outputs a message to the maintenance terminal indicating that the fraudulent RTP packets have been processed. VoIP gateway device. (Note 2) The fraudulent audio data detection unit is: It has a management table that records the peak frequency [Hz], level [dB], and cumulative threshold exceedance count [times], using the RTP sequence number as an index. The frequency peak threshold and the level overload threshold are compared in that order. If both are exceeded, the cumulative number of overloads is counted. If the cumulative value of the count exceeds a predetermined threshold, it is determined that the packet is an invalid RTP packet and should be discarded. The VoIP gateway device described in Appendix 1. (Note 3) The packet processing unit, If the fraudulent voice data detection unit determines that the RTP packet should be discarded, the RTP packet is discarded; if the RTP packet is not discarded, the encoding function unit encodes the linear PCM into a format that can be output by terminal equipment on the PSTN network side. The device includes a device control unit that outputs to the maintenance terminal that it has processed an unauthorized RTP packet, The VoIP gateway device described in Appendix 2. (Note 4) The encoding function unit performs data completion by performing PLC processing when discarding RTP packets. The VoIP gateway device described in Appendix 3. (Note 5) A packet header analysis unit that analyzes the packet header of RTP packets received from a VoIP network, The system further includes a decoding function unit that decodes the payload contained in the RTP packet analyzed by the packet header analysis unit into linear PCM and outputs it to the audio frequency analysis unit. The VoIP gateway device described in Appendix 4. (Note 6) The aforementioned audio frequency analysis unit, Frequency spectral analysis is performed using FFT processing. The VoIP gateway device described in Appendix 5. (Note 7) The fraudulent audio data detection unit is: Based on the analysis by the aforementioned audio frequency analysis unit, if a frequency peak exists outside the 100-1000Hz range, it is determined to be abnormal data. The VoIP gateway device described in Appendix 6. (Note 8) A method for operating a VoIP gateway device that is connected to a maintenance terminal via a communication line and also connects a VoIP network and a PSTN network, The spectral analysis of the payload contained in RTP packets received from the VoIP network is performed to obtain the peak frequency and level. If the aforementioned peak frequency and level fall outside a predetermined frequency range and level range set by the user in advance, the RTP packet received by the DoS attack is determined to be a malicious RTP packet. The system discards RTP packets that are determined to be malicious RTP packets, and outputs a message to the maintenance terminal indicating that the malicious RTP packets have been processed. method. (Note 9) A VoIP gateway device that connects the VoIP network and the PSTN network, A VoIP gateway system comprising a maintenance terminal connected to the VoIP gateway device via a communication line, The VoIP gateway device is The audio frequency analysis unit performs spectral analysis of the payload contained in RTP packets received from the VoIP network, and obtains the peak frequency and level. A malicious audio data determination unit determines that an RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and level output by the audio frequency analysis unit fall outside a predetermined frequency range and level range set in advance by the user. The system includes a packet processing unit that discards RTP packets determined to be fraudulent RTP packets by the fraudulent voice data detection unit, and outputs a message to the maintenance terminal indicating that the fraudulent RTP packets have been processed. Communication system. (Note 10) A program that is connected to a maintenance terminal via a communication line and is usable on a VoIP gateway device that connects a VoIP network and a PSTN network, The spectral analysis of the payload contained in RTP packets received from the VoIP network is performed to obtain the peak frequency and level. If the aforementioned peak frequency and level fall outside a predetermined frequency range and level range set by the user in advance, the RTP packet received by the DoS attack is determined to be a malicious RTP packet. The system discards RTP packets that are determined to be malicious RTP packets, and outputs a message to the maintenance terminal indicating that the malicious RTP packets have been processed. program.

[0069] Some or all of the elements described in Appendices 2 through 7 that are dependent on Appendice 1 may also be dependent on Appendices 8, 9, and 10 in the same way as those described in Appendices 2 through 7. Some or all of the elements described in any appendice may be applicable to various hardware, software, recording means, systems, and methods for recording software. [Explanation of Symbols]

[0070] 1. VoIP gateway device 2. Communication System 11. Audio frequency analysis unit 12. Fraudulent audio data detection unit 13. Packet Processing Unit 14 Maintenance terminals 100 user terminals 300 VoIP Access Gateways 400 IP Networks 510 Packet Header Check Function Unit 520 Packet Header Analysis Unit 530 Decode function unit 540 Audio Frequency Analysis Unit 550 Encoding Function Unit 560 TDM Data Processing Unit 570 Fraudulent Audio Data Detection Unit 580 Device Control Unit 600 TDM exchanger 700 subscriber circuit 800 user terminals 900 Maintenance Servers

Claims

1. A VoIP gateway device that is connected to a maintenance terminal via a communication line and also connects a VoIP network and a PSTN network, A voice frequency analysis unit performs spectral analysis of the payload contained in RTP packets received from a VoIP network, and obtains the peak frequency and level. A malicious voice data determination unit determines that an RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and level output by the voice frequency analysis unit fall outside a predetermined frequency range and level range set in advance by the user. The system includes a packet processing unit that discards RTP packets determined to be fraudulent RTP packets by the fraudulent voice data detection unit, and outputs a message to the maintenance terminal indicating that the fraudulent RTP packets have been processed. VoIP gateway device.

2. The aforementioned fraudulent audio data detection unit, It has a management table that records the peak frequency [Hz], level [dB], and cumulative threshold exceedance count [times], using the RTP sequence number as an index. The frequency peak threshold and the level overload threshold are compared in that order. If both are exceeded, the cumulative number of overloads is counted. If the cumulative value of the count exceeds a predetermined threshold, it is determined that the packet is an invalid RTP packet and should be discarded. The VoIP gateway device according to claim 1.

3. The packet processing unit, If the fraudulent voice data detection unit determines that the RTP packet should be discarded, the RTP packet is discarded; otherwise, the voice data is encoded into a format that can be output by terminal devices on the PSTN network side. The device includes a control unit that outputs to the maintenance terminal that it has processed an unauthorized RTP packet, The VoIP gateway device according to claim 2.

4. The encoding function unit performs PLC processing to complete the data when discarding the RTP packets. The VoIP gateway device according to claim 3.

5. A packet header analysis unit that analyzes the packet header of RTP packets received from a VoIP network, The system further includes a decoding function unit that decodes the payload contained in the RTP packet analyzed by the packet header analysis unit into linear PCM and outputs it to the audio frequency analysis unit. The VoIP gateway device according to claim 4.

6. The aforementioned audio frequency analysis unit, Frequency spectrum analysis is performed using FFT processing. The VoIP gateway device according to claim 5.

7. The fraudulent audio data detection unit is: Based on the analysis by the aforementioned audio frequency analysis unit, if a frequency peak exists outside the 100-1000 Hz range, it is determined to be abnormal data. The VoIP gateway device according to claim 6.

8. A method for operating a VoIP gateway device that is connected to a maintenance terminal via a communication line and also connects a VoIP network and a PSTN network, The spectral analysis of the payload contained in RTP packets received from the VoIP network is performed to obtain the peak frequency and level. If the aforementioned peak frequency and level fall outside a predetermined frequency range and level range set by the user in advance, the RTP packet received by the DoS attack is determined to be a malicious RTP packet. The RTP packets determined to be malicious RTP packets are discarded, and a message indicating that the malicious RTP packets have been processed is output to the maintenance terminal. method.

9. A VoIP gateway device that connects the VoIP network and the PSTN network, A VoIP gateway system comprising a maintenance terminal connected to the VoIP gateway device via a communication line, The VoIP gateway device is A voice frequency analysis unit performs spectral analysis of the payload contained in RTP packets received from a VoIP network, and obtains the peak frequency and level. A malicious voice data determination unit determines that an RTP packet received by a DoS attack is a malicious RTP packet if the peak frequency and level output by the voice frequency analysis unit fall outside a predetermined frequency range and level range set in advance by the user. The system includes a packet processing unit that discards RTP packets determined to be fraudulent RTP packets by the fraudulent voice data detection unit, and outputs a message to the maintenance terminal indicating that the fraudulent RTP packets have been processed. Communication system.

10. A program that is connected to a maintenance terminal via a communication line and is usable on a VoIP gateway device that connects a VoIP network and a PSTN network, The spectral analysis of the payload contained in RTP packets received from the VoIP network is performed to obtain the peak frequency and level. If the aforementioned peak frequency and level fall outside a predetermined frequency range and level range set by the user in advance, the RTP packet received by the DoS attack is determined to be a malicious RTP packet. The system discards RTP packets that have been determined to be malicious RTP packets, and outputs a message to the maintenance terminal indicating that the malicious RTP packets have been processed. program.

Images