SIP Session Handling for Ghost Call DoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing wireless networks are vulnerable to stealthy denial of service (DoS) attacks through malicious ghost calls that exploit the Session Initiation Protocol (SIP) reliability mechanism, causing callees to be stuck in a waiting state and unable to receive or make calls, and concurrent call attempts from a single adversary can affect multiple users.

Innovation Solution

Implementing a SIP session manager that starts a timer for acknowledging session progress messages, increments a counter if no response is received, and drops subsequent messages when the counter reaches a threshold, thereby preventing further SIP messages from an unresponsive caller.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the SIP reliability mechanism is implemented to ensure call setup, then call establishment reliability is improved, but the system becomes vulnerable to stealthy DoS attacks where callees are stuck in waiting state

Engineering Contradiction:

Improvecall establishment reliabilityVSAvoidstealthy DoS attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by starting a timer when a SIP INVITE message is received and proactively sending session progress messages to the caller before the caller can exploit the waiting state. This preliminary action prevents the adversary from manipulating the system into a stuck state by ensuring the system has already taken the necessary acknowledgment steps.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms by monitoring whether the caller responds to session progress messages and using this feedback to control further message forwarding. When the caller remains unresponsive beyond the timer expiration, the system adjusts its behavior by incrementing a counter and potentially dropping subsequent messages, creating a feedback loop that prevents DoS attacks while maintaining normal call reliability.

Inventive Principle:

Principle #23Feedback

2Adaptability or versatility

If concurrent call attempts are allowed from a single caller, then call setup flexibility is improved, but a single adversary can affect multiple callees through ghost calls

Engineering Contradiction:

Improvecall setup flexibilityVSAvoidmulti-callee DoS attack capability

Core Design Contradiction:

Adaptability or versatilityVSObject-generated harmful factors

Solution Approach 1:

The system performs preliminary validation by checking whether a caller is currently engaged in a pending call setup before allowing new concurrent call attempts. This preliminary check prevents adversaries from launching multiple ghost calls to multiple callees simultaneously, as the system proactively blocks concurrent attempts from the same caller while still allowing legitimate sequential calls after proper completion.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the system forwards all SIP messages to ensure complete call setup, then call establishment completeness is improved, but the system consumes excessive resources processing malicious ghost calls

Engineering Contradiction:

Improvecall establishment completenessVSAvoidsystem resource consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system applies partial action by selectively forwarding SIP messages based on caller responsiveness. Instead of forwarding all session progress messages unconditionally, the system forwards messages only when the caller responds within the timer period, and stops forwarding when the counter reaches the threshold. This partial action ensures complete call setup for legitimate calls while avoiding excessive resource consumption from malicious ghost calls.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12598210B2Apparatus and method to mitigate malicious calls in a wireless network

Publication Date: 2026.04.07 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

Embodiments of invention mitigate stealthy DoS attack and the multiple concurrent ghost calls through enhancing the SIP call procedures. In one embodiment, a first SIP invite message is forwarded from a caller party to a callee party to set up a SIP session, and in response to the first SIP invite message, a timer is started and forwarding one or more session progress messages are forwarded to the caller party. If the caller party is unresponsive upon expiration of the timer, a counter is incremented once and an additional SIP invite message from the caller party is forwarded to the callee party, which responds with session progress messages. When the caller party remains unresponsive and the counter reaches a threshold, the subsequent SIP messages from the caller party are dropped.