NAT Latching via SIP-RTP Hash Verification

Solution Overview

Problem

Existing network protection systems, such as those using Network Address Translators (NATs), are vulnerable to denial of service attacks due to improper latching on invalid media streams, which prevents legitimate endpoints from establishing calls into an enterprise network.

Innovation Solution

A system and method that uses a hashing algorithm to uniquely identify a legitimate media stream by comparing hashes in Session Initiation Protocol (SIP) messages and Real-time Transport Protocol (RTP) messages to ensure correct latching onto a communication session, thereby preventing invalid stream latching and denial of service attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the NAT latches on to the first media stream that has the IP address and/or port, then the NAT can establish media streams through the firewall, but this opens up the enterprise to denial of service attacks where malicious entities can flood ports or send packets to cause the NAT to latch on to invalid media streams

Engineering Contradiction:

Improvemedia stream establishment speedVSAvoidsecurity against denial of service attacks

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary action by incorporating a hash value in the SIP INVITE message before the media stream establishment. This hash value is calculated from the fingerprint (session key) and is used in advance to verify the legitimacy of the media stream. The NAT controller compares the hash in the INVITE with the hash calculated from the SDP in the media stream, ensuring that the latching occurs only on legitimate streams before any potential attack can succeed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback by creating a verification mechanism where the NAT controller calculates a hash from the SDP in the received media stream and compares it with the hash value received in the SIP INVITE message. This feedback loop ensures that only media streams with matching hash values (indicating legitimacy) are allowed to latch, thereby preventing denial of service attacks while maintaining efficient media stream establishment.

Inventive Principle:

Principle #23Feedback

2Object-affected harmful factors

If the NAT latches to an invalid media stream due to denial of service attacks, then the attack can disrupt service, but this prevents legitimate endpoints from establishing calls to the enterprise network

Engineering Contradiction:

Improveprotection against invalid stream latchingVSAvoidlegitimate call establishment

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent implements feedback by creating a verification mechanism where the NAT controller calculates a hash from the SDP in the received media stream and compares it with the hash value received in the SIP INVITE message. This feedback loop ensures that only media streams with matching hash values (indicating legitimacy) are allowed to latch, thereby preventing denial of service attacks while maintaining efficient media stream establishment.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent uses the hash value as an intermediary verification element between the SIP signaling and the media stream latching. This intermediary hash comparison acts as a gatekeeper that validates the legitimacy of the media stream without requiring direct inspection of the media content, thus protecting legitimate traffic while blocking attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9819745B2System and method for prevention of denial of service attacks for hosted network address translator

Publication Date: 2017.11.14 EXTREME NETWORKS INC

AI summary

To determine the correct media stream to latch onto, the system and method uses a hashing algorithm to uniquely identify a legitimate media stream. A first invite message is received at a Session Border Controller (SBC) to establish a communication session. For example a Session Initiation Protocol (SIP) INVITE is received. The first invite message comprises a first hash of a fingerprint. For example, the hash may be a hashed session key. A media message is received that contains the fingerprint to establish a media stream for the communication session. A second hash is created using the fingerprint in the media message. The first hash is compared to the second hash. In response to the first hash matching the second hash, a Network Address Translator (NAT) latches to an address and/or a port in the media message. Thus, the correct media stream is associated with the communication session.