Session Management Call Blocking for VoIP DoS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Victim agents in telecommunication networks are unable to make or receive calls during denial-of-service attacks due to the lack of acknowledgement messages from attacker agents, causing them to become stuck in a state where they cannot initiate or receive further calls.
Innovation Solution
Implementing a system where session management systems activate a connection timer for call initiation messages, deactivating it if no provisional acknowledgement is received within a predetermined period, and activating a block timer if the call counter exceeds a threshold, which blocks subsequent calls from the attacker agent, allowing the victim agent to continue making and receiving calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the victim agent waits for acknowledgement messages during call setup, then call reliability is improved, but the agent becomes vulnerable to denial-of-service attacks where the agent gets stuck and cannot make or receive other calls
Solution Approach 1:
The system performs preliminary actions by implementing connection timers and call counters before the denial-of-service attack fully impacts the victim agent. The timer is activated when a provisional response is sent, and the counter is incremented when acknowledgements are not received within the expected time frame, proactively identifying and blocking malicious call patterns before they can paralyze the agent
Solution Approach 2:
The session management system acts as an intermediary between the attacker agent and the victim agent. It monitors the call setup process, tracks acknowledgement messages, and implements blocking logic that prevents malicious calls from reaching the victim agent while allowing legitimate calls to proceed normally
2Reliability
If the system blocks calls from attacker agents, then service availability for victim agents is improved, but the device complexity increases due to additional timers and counters
Solution Approach 1:
The session management system performs multiple functions using the same infrastructure: it manages normal call setup, monitors for denial-of-service patterns, tracks call counters, and implements blocking logic. This multi-functionality reduces the need for separate dedicated components for each function, thereby limiting the increase in device complexity
Solution Approach 2:
The system uses configurable parameters such as timer thresholds and call counter limits that can be adjusted to match different network conditions and attack patterns. This flexibility allows the system to adapt to varying threats without requiring fundamental changes to the underlying architecture, keeping complexity manageable
3Difficulty of detecting and measuring
If the connection timer is activated for each call initiation message, then detection of denial-of-service attacks is improved, but the processing time and system overhead increase
Solution Approach 1:
The system applies partial action by only activating the connection timer and incrementing the call counter when specific conditions are met (e.g., when a provisional response is sent without receiving an acknowledgement). This selective activation reduces the overall processing overhead compared to activating timers for every single call initiation message, while still maintaining effective attack detection capability
Data Source
AI summary
Systems and methods for detecting and preventing a denial-of-service attack at one or more victim agents of a telecommunication network include one or more session management systems communicatively coupled to one or more attacker agents. The one or more session management systems to receive a call initiation message during a session, provide a provisional response during the session, activate a connection timer, determine whether a provisional acknowledgement message is received within a pre-determined period associated with the connection timer, deactivate the connection timer if the provisional acknowledgement message is not received within the pre-determined period, determine whether a call counter is greater than or equal to a threshold in response to the connection timer deactivation, and activate a block timer if the call counter is greater than or equal to the threshold. The block timer to block one or more calls from the attacker agent.