SIP ALG Half-Open Session Throttling for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SIP ALG implementations are inadequate in handling denial-of-service (DoS) and distributed DoS (DDoS) attacks, as they often degrade performance and are not well-suited for throttling traffic, especially since they lack appropriate upper limits for traffic throttling.
Innovation Solution
Implementing a method that limits the number of half-open SIP sessions by starting a timer for SIP requests without responses, comparing them to a threshold, and removing the oldest sessions when the limit is reached, thereby adapting to attack rates without affecting legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SIP ALG maintains application information for each SIP session to enable gateway functions, then gateway functionality is achieved, but the SIP ALG becomes a target of DoS/DDoS attacks and performance degrades
Solution Approach 1:
The patent applies preliminary action by proactively limiting the number of half-open sessions before they can overwhelm the SIP ALG. The system pre-establishes a threshold for half-open sessions and actively monitors and enforces this limit, preventing the accumulation of excessive session state information that would make the SIP ALG vulnerable to DoS/DDoS attacks.
2Object-affected harmful factors
If traditional SIP server rate limiting methods are applied to SIP ALG, then some attack mitigation is achieved, but the methods are not well-suited for SIP ALG and may degrade performance
Solution Approach 1:
The patent applies local quality by implementing attack mitigation specifically tailored to the SIP ALG's unique characteristics rather than using generic SIP server rate limiting. The solution focuses locally on limiting half-open sessions at the ALG level, which is the precise vulnerability point, rather than applying broad rate limiting that would affect all SIP traffic processing and degrade overall ALG performance.
3Object-affected harmful factors
If the number of half-open sessions is limited by removing oldest sessions when threshold is reached, then DoS/DDoS attack impact is reduced, but legitimate traffic may be affected if threshold is set too low
Solution Approach 1:
The patent applies dynamics by making the half-open session limit adaptive rather than static. The system dynamically adjusts the threshold based on observed traffic patterns and attack characteristics, allowing it to maintain high protection levels during attacks while preserving legitimate traffic flow during normal conditions. This dynamic approach enables the SIP ALG to adapt its behavior to current network conditions.
Data Source
AI summary
In one implementation, the number of half open session initiation protocol (SIP) sessions per-destination (e.g., SIP device) or globally is limited by SIP application layer gateway (ALG) as a SIP DoS/DDoS countermeasure. Compared with traditional SIP DoS/DDoS countermeasures, the proposed solution is simple to implement and, thus, less likely to degrade SIP ALG performance. Moreover, this solution automatically adapts to DoS/DDoS attack arrival rate, while at the same time not degrading legal SIP traffic even if throttling is enforced for the SIP device.