SIP Server Challenge Tokens for Stateless DoS Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for mitigating denial of service attacks, particularly those involving dumb bots or devices, are resource-intensive and inefficient, as they often require per-user information or credentials, leading to increased workload and vulnerability.
Innovation Solution
A stateless denial of service (DOS) filtering method for SIP servers that uses a cryptographic secret to generate a challenge token, which dumb devices cannot respond to, allowing legitimate traffic to proceed while blocking malicious requests without the need for core network access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-user information or credentials are used for filtering DOS attacks, then the ability to distinguish legitimate traffic improves, but the workload and resource consumption increase
Solution Approach 1:
The patent extracts the authentication challenge mechanism from the core network authentication process and implements it independently at the edge router. The edge router generates and verifies cryptographic challenges without needing to access user credentials or communicate with the core network, thereby reducing core network workload while maintaining traffic filtering capability
Solution Approach 2:
The patent introduces cryptographic challenge-response pairs as an intermediary mechanism between the edge router and incoming traffic. Instead of directly examining per-user credentials, the system uses cryptographic challenges that legitimate users can respond to while dumb bots cannot, effectively mediating the authentication process without exposing sensitive user information
2Reliability
If per-user information or credentials are used for filtering DOS attacks, then the ability to distinguish legitimate traffic improves, but the vulnerability of the system increases
Solution Approach 1:
The patent removes the dependency on per-user credentials from the edge-level DOS filtering process. By extracting the authentication challenge generation and verification to use only cryptographic secrets stored at the edge router, the system eliminates the vulnerability associated with exposing or transmitting user credentials through the network
Solution Approach 2:
The patent uses disposable cryptographic challenge-response pairs that are generated on-the-fly and discarded after verification. These temporary cryptographic objects replace persistent per-user credentials in the authentication process, making the system more resistant to credential theft and replay attacks while maintaining authentication capability
3Reliability
If stateful filtering methods are used, then the accuracy of DOS detection improves, but the resource consumption and latency increase
Solution Approach 1:
The patent segments the authentication process into two independent parts: cryptographic challenge generation and verification. The challenge is generated at the edge router before traffic enters the core network, and the verification is performed locally without requiring stateful tracking or core network involvement, thereby reducing latency while maintaining detection accuracy
Solution Approach 2:
The patent performs preliminary authentication by generating cryptographic challenges at the edge router before traffic reaches the core network. Legitimate users respond to these challenges in advance, allowing the system to filter DOS attacks at the edge without requiring real-time stateful inspection or core network participation during the actual traffic flow
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach is lightweight, scalable, and effective in mitigating DOS attacks by filtering out dumb bot traffic at the edge of the network, reducing latency and resource consumption.
Implementation Method 1
computes a token from a cryptographic secret and a property of the request
Data Source
AI summary
A session initiation protocol (SIP) server contributes to defending against denial of service attacks. It receives, from a sending SIP endpoint in a communications network, such as a 5G communications network, a request to establish a communications session with a destination SIP endpoint in the communications network; computes a token from a cryptographic secret and a property of the request; drops the request and forms a challenge message comprising the token. The SIP server sends the challenge message to the sender to trigger a second request from the sender comprising the token.