Session Border Controller Trust Classification Against VoIP Amplification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VoIP infrastructure is vulnerable to amplification-based DDoS attacks, particularly when a priori knowledge of trusted entities is unavailable, as current mitigation efforts are inadequate in such scenarios.
Innovation Solution
Implement a dynamic trust classification system at the session border controller (SBC) to classify peer devices as untrusted, semi-trusted, or trusted based on communication patterns, using a 3-tier policer system to prioritize packet processing according to trust levels, ensuring only trusted packets are processed at full capacity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a priori knowledge of trusted entities is unavailable, then the system can be deployed in more scenarios, but the system becomes vulnerable to amplification-based DDoS attacks
Solution Approach 1:
The patent implements dynamic trust classification that adapts peer trust levels in real-time based on communication patterns rather than relying on static a priori configuration. The system transitions from fixed trust lists to dynamic assessment, adjusting trust levels (untrusted, semi-trusted, trusted) based on observed behavior, which resolves the contradiction by maintaining security adaptability without requiring pre-configured trusted entity knowledge
Solution Approach 2:
The system performs self-assessment of peer trustworthiness through automated analysis of communication patterns. Instead of requiring external configuration or pre-knowledge of trusted entities, the system autonomously evaluates and classifies peers based on their communication behavior, enabling deployment flexibility while maintaining security through self-service trust evaluation
2Productivity
If all packets are processed at full capacity, then system performance is maximized, but downstream application logic is overwhelmed by unverified traffic
Solution Approach 1:
The patent applies different processing qualities to different packets based on their trust classification. Trusted packets receive full-capacity processing, semi-trusted packets receive limited processing, and untrusted packets receive minimal processing. This local differentiation of processing quality allows the system to maintain high productivity for verified traffic while protecting downstream applications from being overwhelmed by unverified traffic
Solution Approach 2:
The system applies partial processing action to semi-trusted and untrusted packets, providing just enough processing to assess trustworthiness without fully processing all packets at maximum capacity. This partial action approach maintains system productivity for legitimate traffic while preventing downstream application overload from malicious traffic
3Object-affected harmful factors
If dynamic trust classification is implemented, then security against amplification attacks is enhanced, but device complexity increases
Solution Approach 1:
The patent segments the trust assessment process into distinct, manageable classification levels (untrusted, semi-trusted, trusted) with specific criteria for each level. This segmentation of the complex trust evaluation into discrete categories simplifies the decision-making process while maintaining comprehensive security coverage against amplification attacks
Solution Approach 2:
The system changes the parameter of trust level from a static binary state to a multi-level dynamic parameter with three distinct states. This parameter transformation enables more nuanced security classification while maintaining manageable complexity through clear transition criteria between trust levels based on communication patterns
Data Source
AI summary
Methods, devices, and systems for providing dynamic protection against amplification attacks are described herein. One communications method includes receiving, at a session border controller (SBC), a first request message from a peer device that does not have an assigned trust level, determining, based on a type of communication that is received from the peer device, whether the peer device should be classified as an untrusted level, semi-trusted level, or trusted level peer device, and assigning the classification to the peer device for use in subsequent communications with the peer device.