Server Authentication for SIP Networks Using Identifier Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The lack of authentication at servers in SIP-based communication networks makes them vulnerable to security threats, such as hackers obtaining valid MDNs and launching denial of service attacks by consuming system resources.

Innovation Solution

Implementing an authentication mechanism at the server level that extracts and verifies device and address identifiers from incoming messages, ensuring they match registered identifiers to authenticate legitimate communications and ignore unauthorized messages.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authentication is performed only at the network level rather than at the server level, then network access is secured, but the server becomes vulnerable to unauthorized access and denial of service attacks

Engineering Contradiction:

Improvenetwork access securityVSAvoidserver vulnerability to unauthorized access

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The authentication function is segmented between the network level (for access control) and the server level (for communication validation). The server independently performs authentication by verifying device identifiers and address identifiers in SIP messages against registered pairs, creating a separate authentication layer that prevents unauthorized access without compromising network access security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The server acts as an intermediary that performs its own authentication function independent of network-level authentication. By validating the pairing of device identifiers and address identifiers in SIP messages, the server mediates between network access security and communication security, ensuring that even authenticated network users cannot access the server without proper credentials.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If the server processes all incoming SIP messages without authentication, then communication is convenient and fast, but system resources are consumed by unauthorized denial of service attacks

Engineering Contradiction:

Improvecommunication convenienceVSAvoidsystem resource consumption

Core Design Contradiction:

Ease of operationVSLoss of energy

Solution Approach 1:

The server performs preliminary authentication by extracting and verifying device identifiers and address identifiers before processing any SIP message content. This preliminary action filters out unauthorized messages early, preventing system resources from being consumed by denial of service attacks while maintaining fast processing for authenticated users.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The authentication mechanism extracts only the essential identifiers (device identifier and address identifier) from SIP messages for verification purposes. By taking out only these critical fields rather than processing the entire message, the server maintains processing speed while effectively preventing unauthorized access and resource consumption by malicious messages.

Inventive Principle:

Principle #2Taking out (Extraction)

3Adaptability or versatility

If the server stores and processes all MDNs from network authentication, then subscriber access is enabled, but hackers can obtain valid MDNs and launch attacks against the server

Engineering Contradiction:

Improvesubscriber access capabilityVSAvoidserver security against MDN theft

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The server maintains local authentication state by storing registered device identifiers and address identifiers as paired credentials. This local quality approach allows the server to verify each incoming message against its own authentication records, enabling subscriber access while preventing hackers from using stolen MDNs since the server validates the complete identifier pairing rather than accepting any single MDN.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8964633B2Method, apparatus, and computer program product for authenticating subscriber communications at a network server

Publication Date: 2015.02.24 CELLCO PARTNERSHIP INC

AI summary

An apparatus for authenticating subscriber communications at a network server includes a determining element and an identification element in communication with the determining element. The determining element may be configured to receive an incoming message. The identification extractor may be configured to extract a device identifier and an address identifier from the incoming message. The determining element may be further configured to determine whether the device identifier and the address identifier of the incoming message match both a registered device identifier and a registered address identifier associated with the registered device identifier, respectively.