Web Server Token Generation for SBC Call Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the legacy SIP domain, Session Border Controllers (SBCs) face challenges in distinguishing between valid and unauthorized call attempts initiated from web browsers, leading to difficulties in protecting call center infrastructure from excessive call rates and potential denial of service attacks, as they cannot reliably verify IP addresses in real-time.
Innovation Solution
A method where a web page server generates and issues a call authorization token in response to user input, which is then used by the client device to initiate a communication session, allowing the SBC to validate the token and authorize legitimate calls, thereby reducing the burden on the SBC and minimizing processing delays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SBC performs real-time authorization queries for each call attempt, then call security is improved, but processing delays and system load increase
Solution Approach 1:
The web server performs authorization checks and generates authorization tokens before the actual call attempt occurs. This preliminary authorization is embedded in the web page or session data, allowing the SBC to validate calls without real-time queries, thus eliminating processing delays while maintaining security
Solution Approach 2:
The authorization decision-making process is extracted from the SBC and relocated to the web server. The SBC no longer needs to perform complex authorization queries for each call, instead receiving pre-validated authorization tokens that it simply verifies, significantly reducing its processing load and delays
2Reliability
If the SBC validates each call attempt in real-time, then call authorization reliability is improved, but system complexity and processing load increase
Solution Approach 1:
The authorization system is segmented into distinct components: the web server handles complex authorization logic and token generation, while the SBC handles simple token validation and call routing. This segmentation allows each component to specialize, reducing overall system complexity while maintaining authorization reliability
Solution Approach 2:
An authorization token acts as an intermediary between the web server's authorization decision and the SBC's call validation. This token encapsulates the authorization result, allowing the SBC to validate calls reliably without needing complex authorization logic, thus reducing system complexity
3Ease of operation
If the SBC processes all incoming calls without pre-authorization, then ease of operation is improved, but vulnerability to malicious attacks increases
Solution Approach 1:
Authorization validation is performed preliminarily by the web server before calls reach the SBC. The authorization token is generated and validated in advance, allowing calls to be initiated simply by the end user while malicious attempts are blocked before reaching the SBC, maintaining both ease of operation and security
Solution Approach 2:
The system applies preliminary anti-action by validating authorization tokens before calls are processed by the SBC. This pre-validation prevents malicious calls from reaching the SBC, countering potential attacks before they can cause harm, while legitimate users experience no additional complexity in initiating calls
Data Source
AI summary
A client device, e.g., a smartphone including a web browser, requests a call authorization token from a web server, e.g., a web page server. The web server, acting on behalf of a company, whose web page is hosted and whose phone corresponds to the called party, screens incoming requests and decides whether or not to issue an authorization token, e.g., a signed token including an encrypted portion. The web server issues a call authorization token and communicate the issued token to the client device. The client device includes the received issued call authorization token in a signal, e.g., a SIP INVITE signal, which it generates and sends to a session border controller (SBC). The session border controller processes the received authorization token and checks the authorization token to validate the received token. The SBC establishes a communications session if the received token passes the validation check.