SIP Server Access Control Component for Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SIP servers face challenges in managing high volumes of legitimate and malicious traffic, leading to service disruptions and resource overload, with existing solutions requiring additional processing that can exacerbate issues during DoS or DDoS attacks.
Innovation Solution
Implementing an access control component that filters and discards incoming data packets before SIP processing, using criteria such as fragmentation information, transport protocol, and SIP data to determine if packets conform to a permitted configuration, thereby preventing resource exhaustion and distinguishing legitimate from illegitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SIP servers process all incoming packets without filtering, then legitimate traffic is handled, but resource exhaustion occurs during DoS attacks
Solution Approach 1:
The patent applies preliminary action by implementing an access control component that filters incoming packets before they reach the SIP processing stack. This component performs preliminary checks on packet configuration (UDP protocol, unfragmented, valid SIP method) and discards non-conforming packets before SIP processing begins, preventing resource exhaustion from malicious traffic while allowing legitimate traffic to proceed to the SIP stack.
2Object-affected harmful factors
If additional filtering processing is implemented, then malicious traffic is blocked, but processing overhead increases
Solution Approach 1:
The patent applies local quality by implementing filtering at a specific local point in the processing architecture - the access control component positioned before the SIP processing stack. This component performs localized configuration checks (protocol type, fragmentation status, SIP method validity) on incoming packets, providing targeted protection without requiring complex system-wide changes. The filtering logic is confined to this specific component rather than distributed throughout the entire SIP server.
3Productivity
If packet filtering is performed before SIP processing, then resource consumption is reduced, but legitimate packets may be incorrectly discarded
Solution Approach 1:
The patent applies parameter changes by establishing specific configuration parameters that define legitimate traffic patterns: UDP protocol type, unfragmented packet structure, and valid SIP method identifiers (REGISTER, OPTIONS, MESSAGE, BYE). The access control component checks incoming packets against these predefined parameters, allowing packets that match the legitimate configuration while discarding those that don't. This parameter-based approach ensures consistent and accurate filtering of legitimate versus malicious traffic.
Data Source
AI summary
A method, system and computer program product are described for managing network communications to a Session Initiation Protocol (SIP) server capable of SIP processing using a SIP stack. A data packet is received from a network device. It is determined, from the data packet, whether the network device is a device recognized by the SIP server. Responsive to this determination, and before SIP processing using the SIP stack, it is determined whether the data packet conforms to a permitted configuration. The permitted configuration includes that data of the data packet indicates an unfragmented User Datagram Protocol (UDP) packet and that data indicative of SIP data in the received data packet matches a parsing rule. If the data packet conforms to the permitted configuration, it is passed to the SIP stack, if not it is discarded.