WO2009117968A1

WO2009117968A1 - Illegal route attack defending method, system and equipment

Info

Publication number: WO2009117968A1
Application number: PCT/CN2009/071033
Authority: WO
Inventors: 张喆; 吴平; 陈斌; 赵武
Original assignee: 华为技术有限公司
Priority date: 2008-03-28
Filing date: 2009-03-26
Publication date: 2009-10-01
Also published as: CN101547124A

Abstract

An illegal route attack defending method, system and equipment. The method includes detecting whether a next-hop IP address of a SIP request message is a broadcast address when the next-hop of the SIP request message is IP address format; carrying out validity checking to the SIP request message according to an IP forbidding list and an IP permitting list configured in advance in a SIP application layer logic route table when the IP address is a non-broadcast address.

Description

The present invention claims to be filed on March 28, 2008, the Chinese Patent Office, the application number is 200810090362.9, and the invention name is "a method, system and device for preventing illegal routing attacks" Priority of Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The embodiments of the present invention relate to the field of network technologies, and in particular, to a method, system, and apparatus for preventing an illegal route attack. Background technique

With the development of network technology, IMS (IP Multimedia Subsystem, IP Multimedia Subsystem) / Generalized NGN (Next Generation Network) solutions represent the development of telecom solutions to IP (Internet Protocol). Trends, VOIP (Voice over IP, Voice IP)-based telecommunications solutions, due to their openness and integration with IP communications, have emerged from the security threats of traditional closed telecommunications networks.

In carrying out the process of the present invention, the inventors have found that the prior art has at least the following problems:

At present, the IP network of the telecommunication network represented by the IMS solution faces more security threats. The security threats of the series mainly cover network security vulnerabilities and application layer logic to implement security vulnerabilities such as SIP (Session Initiation Protocol) application layer logic. Illegal routing attacks and protocol/standard security vulnerabilities. Since VOIP solutions such as IMS/generalized NGN rely on many protocols, there may be insufficient consideration in the protocol development process. Early development protocols do not consider or have specific security problems. Later protocol standards directly refer to the protocol without Adaptation revisions and other circumstances have led to many security vulnerabilities.

At present, there is no technical solution for solving the illegal application route attack of the SIP application layer logic. Summary of the invention

The embodiment of the invention provides a method, a system and a device for preventing an illegal route attack, so as to solve the problem of the illegal application route attack of the SIP application layer.

To achieve the objective, an embodiment of the present invention provides a method for preventing an illegal route attack, which includes the following steps:

When the next hop in the SIP initial request is the IP address format, detecting whether the IP address of the next hop in the SIP request message is a broadcast address;

When the IP address is a non-broadcast address, the SIP request message is checked for validity according to an IP barring list or an IP permission list in a pre-configured SIP application layer logical routing table.

On the other hand, the embodiment of the present invention further provides a system for preventing an illegal route attack, including:

The device for preventing an illegal routing attack is configured to perform a legality detection check and a routing process on a session initial protocol SIP request message according to a pre-configured application layer logical routing table. The device for preventing an illegal route attack includes:

a detecting module, configured to detect, when the next hop in the SIP request message is an IP address format, whether the IP address of the next hop in the SIP request message is a broadcast address;

The first checking module is configured to: when the IP address is a non-broadcast address, perform a validity check on the SIP request message according to an IP prohibition list or an IP permission list in a pre-configured SIP application layer logical routing table.

In another aspect, the embodiment of the present invention further provides an apparatus for preventing an illegal routing attack, including:

The first checking module is configured to: when the IP address is a non-broadcast address, perform legality check on the SIP request message according to the IP prohibition list and the IP permission list in the pre-configured SIP application layer logical routing table. In another aspect, the embodiment of the present invention further provides a system for preventing an illegal routing attack, including an application processor AM, a service data processor SDM, and a security processing device, where: the security processing device is configured to set a routing policy, Sending, by the SDM, the road fork field bundle, to send the routing policy to the AM according to the requirement of the AM;

The AM is configured to receive a routing policy from the SDM. When receiving a SIP request message including a next hop address from the terminal, determine whether to perform the next hop routing according to the routing policy.

The embodiment of the present invention has the following beneficial effects: the embodiment of the present invention checks the validity of the SIP request message by querying the pre-configured SIP application layer logical routing table, thereby solving the problem of illegal routing attack of the SIP request message. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description For some embodiments of the present invention, other drawings may be obtained from those skilled in the art without departing from the drawings. 1 is a flowchart of a method for preventing an illegal route attack according to Embodiment 1 of the present invention; FIG. 2 is a flowchart of a method for preprocessing a SIP request message according to Embodiment 1 of the present invention; FIG. 3 is a flowchart of an IP address according to Embodiment 1 of the present invention; Flow chart of method for attack detection and routing processing;

4 is a flowchart of a method for sending a message according to Embodiment 1 of the present invention;

FIG. 5 is a flowchart of a method for preventing an illegal route attack according to Embodiment 2 of the present invention; FIG. 6 is a flowchart of a method for performing attack detection and routing processing according to a domain name according to Embodiment 2 of the present invention;

FIG. 7 is a flowchart of a method for preventing an illegal route attack according to Embodiment 3 of the present invention; FIG. 8 is a schematic structural diagram of a system for preventing an illegal route attack according to Embodiment 4 of the present invention; FIG. 9 is a schematic structural diagram of an apparatus for preventing an illegal route attack according to Embodiment 4 of the present invention;

FIG. 10 is a schematic structural diagram of another apparatus for preventing an illegal route attack according to Embodiment 4 of the present invention; FIG.

FIG. 11 is a diagram of communication between network elements of an anti-authentic route attack network based on A-IMS according to an embodiment of the present invention;

12 is a SM<->SDM data exchange diagram according to an embodiment of the present invention;

13 is a PULL route query data exchange diagram of SDM<->AM according to an embodiment of the present invention;

14 is an exchange diagram of an UPDATE route configuration data of an SDM<->AM according to an embodiment of the present invention;

15 is a flowchart of a SIP routing process according to an embodiment of the present invention;

16 is a system diagram of preventing an illegal route attack according to an embodiment of the present invention;

FIG. 17 is a PULL route query data exchange diagram applied to an IMS network according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The technical solution provided by the embodiment of the invention provides protection against illegal routing attacks of SIP request messages, and provides security log recording capability. The next hop routing format of the SIP request message is "username + @+hostname", ie user@host format, where host is called the host part. The SIP message routing method based on the Route header field and the Request-URI (Uniform Resource Identifier) is based on the host part to obtain the next hop IP. If the address or domain name is used for message routing, the IP address on which the illegal route attack is based may be the IP address from the SIP request message, or the domain name of the SIP request message may be parsed by the DNS (Domain Name Server). IP address. The network element needs to use the SIP application layer logical routing table to perform routing legality analysis in the routing process of the SIP request message.

In order to enhance the control and protection against the SIP routing message illegal routing attack, the embodiment of the present invention analyzes and proposes a routing control mechanism based on the application layer logic based on the IMS/generalized NGN SIP application layer logic, that is, adopts the SIP application layer logical routing table mechanism. Implemented with a security log to provide a record of SIP illegal routing attacks. To facilitate subsequent tracing and analysis, the application layer logical routing table format in the embodiment of the present invention is defined as shown in Table 1 below.

Different network elements in the IMS/generalized NGN network have different application layer logics. Therefore, different network elements have separate application layer logical routing tables, and specific network elements are based on different requesters. The method fills the SIP request message application layer logical routing table, and defines the allowed/rejected routing destination address (supporting host IP address, network IP address, and its wildcard) for each type of message. Since the SIP response message is directly discarded by the SIP server without a corresponding request, the embodiment of the present invention does not analyze the SIP response message.

Similarly, define the allowed/denied routing destination domain name (support for wildcards) for each type of message, as shown in Table 2.

Table 2

The request method in Table 1 or Table 2 above mainly covers: INVITE I REGISTER / OPTION / SUBSCRIBE / NOTIFY I REFER I MESSAGE I CANCEL ( Cancel) I ACK (Confirm) / etc., and focus on the INVITE / REGISTER I SUBSCRIBE I MESSAGE (message) which is relatively complex on the network side and can cause more state and resource consumption. The specific request method used to request the network element to route the SIP request message is determined by the request initiator of the SIP request message. As shown in FIG. 1 , it is a flowchart of a method for preventing an illegal route attack in the first embodiment of the present invention, which specifically includes the following steps: Step S101: Receive a SIP request message, and perform pre-processing to obtain a next hop of the SIP request message. The pre-processing flow is as shown in FIG. 2, which is specifically: After the received SIP request message is decoded, the decoded SIP request message is internally processed by the SIP proxy. Then, it is determined whether the SIP request message is routed according to the Route header field. When the SIP request message is routed according to the Route header field, the next hop of the SIP request message is obtained according to the topmost Route header field. Otherwise, the SIP request message is obtained according to the Request-URI. The next hop.

Step S102: Determine whether the acquired next hop is an IP address. When the acquired next hop is an IP address, step S106 is performed, otherwise, steps S103 to S105 are performed.

Steps S103 to S105 perform DNS resolution processing. When the acquired next hop is not an IP address, that is, the acquired next hop is a domain name, the DNS resolves the IP address corresponding to the domain name. When the domain name is successfully resolved, step S106 is performed. Otherwise, the processing fails, and the process returns. error.

Step S106: Perform attack detection and routing processing according to the IP address. The specific attack detection and routing processing is shown in Figure 3, which includes the following steps:

In step S1061, the process starts.

In step S1062, it is determined whether the IP address is a broadcast address. Checking whether the SIP request message includes a malicious attack feature with the broadcast IP address as the next hop according to the IP address. When the IP address includes the malicious attack feature with the broadcast IP address as the next hop, step S1063 is performed, otherwise step S1065 is performed. .

Step S1063: Record a security log according to the information of the request originator included in the SIP request message.

Step S1064, using the 403 response to reject the SIP request message, ending the current session. Step S1065: Query an application layer logical routing table according to the IP address.

Step S1066: Determine, according to the request method name in the SIP request message, whether the IP address appears in the forbidden IP address list of the application layer logical routing table. When the IP address does not appear in the forbidden IP address list of the application layer logical routing table, step S1067 is performed; otherwise, step S1063 and step S1064 are performed.

Step S1067: Determine application layer logic according to the request method name in the SIP request message. Whether the IP address appears in the list of allowed IP addresses of the routing table. When the IP address appears in the list of allowed IP addresses of the application layer logical routing table, step S1068 is performed, otherwise step S1064 is performed.

Step S1068: Perform message routing according to the IP address.

Step S107, performing a message transmission process. The packet sending process is shown in Figure 4: The SIP request message is encoded, and the encoded SIP request message is routed to the next hop, and the next hop route is determined to be successful. When the next hop route succeeds, the SIP request message is processed by the next hop network element, otherwise, it is retransmitted until timeout, and the response 408 is responded.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs. The foregoing embodiment of the present invention determines whether the next hop in the SIP request message is an IP address format, and when the next hop in the SIP request message is in an IP address format, detecting whether the IP address of the next hop in the SIP request message is a broadcast address. When the IP address is a broadcast address, rejecting the SIP request message; when the IP address is a non-broadcast address, according to a pre-configured SIP application layer logical routing table, an IP prohibition list and an IP allow list list The SIP request message is checked for validity. When the next hop in the SIP request message is in the domain name format, the domain name is parsed, the IP address corresponding to the domain name is obtained, and corresponding processing is performed, thereby preventing the SIP request message. Illegal routing attack.

As shown in FIG. 5, it is a flowchart of a method for preventing an illegal route attack according to Embodiment 2 of the present invention, which specifically includes the following steps:

Step S501: Receive a SIP request message, and perform pre-processing to obtain a next hop of the SIP request message. The specific pre-processing procedure refers to the first embodiment.

Step S502: Determine whether the acquired next hop is an IP address. When the acquired next hop is not an IP address, that is, the acquired next hop is a domain name, step S503 is performed; otherwise, steps S504 and subsequent steps are performed.

Step S503: When the obtained next hop is a domain name, perform legality check on the SIP request message according to the forbidden domain name list and the allowed domain name list in the pre-configured SIP application layer logical routing table, as shown in FIG. Specifically, the following steps are included:

Step S5031, querying according to the request method name in the SIP request message. List of domain names is prohibited.

Step S5032: Determine whether the domain name appears in the forbidden domain name list. When the domain name appears in the forbidden domain name list, step S5033 is performed. Otherwise, step S5034 and subsequent steps are performed.

Step S5033: When the domain name appears in the forbidden domain name list, reject the SIP request message.

In this step, when the SIP request message is rejected, the security day step S5034 may be recorded. When the domain name does not appear in the forbidden domain name list, the allowed domain name list is queried according to the request method name.

Step S5035: Determine whether the domain name appears in the allowed domain name list. When the domain name appears in the list of allowed domain names, step S5036 is performed, otherwise, step S5037 is performed.

Step S5036: When the domain name appears in the allowed domain name list, the SIP request message is routed according to the domain name.

Step S5037: When the domain name does not appear in the allowed domain name list, reject the SIP request message.

In step S504, if the acquired next hop is an IP address, the attack detection and the routing process are performed according to the IP address. For the specific attack detection and routing process, refer to step S505 in the foregoing embodiment, and the packet sending process is performed, and the specific packet is sent. The processing flow is referred to the first embodiment.

The foregoing embodiment of the present invention determines whether the next hop in the SIP request message is an IP address format, and when the next hop in the SIP request message is in an IP address format, detecting whether the IP address of the next hop in the SIP request message is a broadcast address. When the IP address is a broadcast address, rejecting the SIP request message; when the IP address is a non-broadcast address, according to a pre-configured SIP application layer logical routing table, an IP prohibition list and an IP allow list list The SIP request message is checked for legality. When the next hop in the SIP request message is in the domain name format, according to the pre-configured SIP application layer logical routing table, the prohibited domain name The list and the allowed domain name list perform a legality check on the SIP request message to prevent an illegal routing attack of the SIP request message.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs. Considering that in the actual commercial network environment, the network operator has fully considered the implementation of the network security, it is more difficult for the attacker to penetrate the network operator network to attack the IMS network, and the attack from the user side is relatively difficult. It is relatively easy, so the method considers implementing SIP request message illegal route attack detection from a PCSCF (Proxy Call Session Control Function) entity that is an IMS network entry. In general, implementing SIP request messages on PCSCF entities. Illegal routing attack detection and protection need to consider the following factors:

(1) Different processing methods of PCSCF entities in registration/session.

(2) Different processing methods of the PCSCF entity in the local domain and the roaming domain.

However, if the PCSCF entity fully considers the different methods of the route header/Request-URI attack, the local PCSCF entity/roaming PCSCF entity registration/session different processes, this part of the PCSCF routing related application layer logic will be caused. It is quite complicated. Therefore, the third embodiment of the present invention proposes a method for processing a relatively single cartridge, which is specifically as follows.

The PCSCF entity has the ability to check the correctness of the Route header field. According to the existing related technical standards, in the unregistered state, the SIP request message routing on the network side is determined by DNS domain name resolution and service subscription, instead of using the Route header field for message routing. Therefore, you can not pay attention to the problem of the Route header field in the registration process. In the normal session, the PCSCF entity can perform the correctness check on the SIP request message sent by the terminal in the route header mode. If the Route header field is incorrect, the PCSCF entity can be based on the actual situation. Fix the Route header field or reject the request to disable the SIP request message.

Therefore, the PCSCF entity of the embodiment of the present invention only needs to consider the case of the Request-URI. In the embodiment of the present invention, the network operator may use the network application layer logic and the local For a specific domain name, configure a list of allowed domain names for the PCSCF entity. In the case of the IP address, the embodiment of the present invention analyzes whether it is necessary to support the SIP request message in the IP address format of the terminal according to the application implementation details. If the IP address format is required, the IP address list is allowed to be configured, and the IP address list is strictly prohibited. The Request-URI of the broadcast IP address.

FIG. 7 is a flowchart of a method for preventing an illegal route attack according to Embodiment 3 of the present invention, which specifically includes the following steps:

Step S701: The PCSCF entity performs pre-processing on the SIP request message to obtain the next hop of the SIP request message. For the specific pre-processing procedure, refer to the foregoing Embodiment 1.

Step S702: The PCSCF entity determines whether the host part of the Request-URI is a domain name format. When the Request-URI host part is in the domain name format, step S703 is performed, otherwise, step S708 is performed.

Step S703: The PCSCF entity queries the allowed domain name list of the SIP application layer logical routing table according to the host part domain name of the Request-URI.

Step S704: The PCSCF entity determines whether it matches the host part domain name of the Request-URI. When the domain name is matched, step S705 is performed; otherwise, step S706 is performed.

Step S705: The PCSCF entity performs a legal SIP request message route according to the application logic.

Step S706: The PCSCF entity records the security log of the information of the request initiator in the SIP request message.

Step S707, the PCSCF entity rejects the current request and ends the current session.

Step S708: The PCSCF entity determines whether message routing according to the Request-URI in the IP address format is allowed on the PCSCF entity. When the message routing according to the Request-URI in the IP address format is allowed on the PCSCF entity, step S709 is performed; otherwise, step S706 and step S707 are performed.

Step S709, the PCSCF entity determines whether the IP address is a broadcast IP address. When the IP address is not a broadcast IP address, step S710 is performed, otherwise step S706 and step S707 are performed.

Step S710, the PCSCF entity queries the allowed IP list of the SIP application layer logical routing table according to the IP address. Step S711: The PCSCF entity determines whether the IP address is matched. If the IP address is matched, step S705 is performed, otherwise step S707 is performed.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs. In the embodiment of the present invention, the SIP request message is preprocessed by the PCSCF entity of the IMS network entry, and the application layer logical routing table is queried according to the result of the pre-processing to perform attack detection and routing processing, thereby querying the SIP request message by using the query application layer logical routing table. The routable range is effectively limited to prevent illegal routing attacks of SIP request messages.

FIG. 8 is a schematic diagram of a system structure for preventing an illegal route attack according to Embodiment 4 of the present invention, including: one or more devices for preventing an illegal route attack. The device for preventing an illegal route attack is configured to perform legality detection check and route processing on the SIP request message according to the pre-configured application layer logical routing table.

The device 1 for preventing an illegal route attack includes: a detecting module 11 configured to detect, when the next hop in the SIP request message is an IP address format, whether the IP address of the next hop in the SIP request message is a broadcast address. The rejecting module 12 is configured to reject the SIP request message when the IP address is a broadcast address. The first checking module 13 is configured to: when the IP address is a non-broadcast address, perform legality check on the SIP request message according to an IP prohibition list and/or an IP permission list in a pre-configured SIP application layer logical routing table. . The above apparatus 1 for preventing an illegal routing attack includes a PCSCF entity.

As shown in FIG. 9, a schematic structural diagram of an apparatus for preventing an illegal route attack according to Embodiment 4 of the present invention includes: a detecting module 1 configured to detect the SIP when a next hop in an SIP request message is in an IP address format Whether the IP address of the next hop in the request message is a broadcast address. The reject module 2 is configured to reject the SIP request message when the IP address is a broadcast address. The first checking module 3 is configured to perform a validity check on the SIP request message according to the IP barring list and the IP permission list in the pre-configured SIP application layer logical routing table when the IP address is a non-broadcast address.

The device for preventing an illegal route attack further includes: a determining module 4, configured to determine a format of a next hop in the SIP request message. The obtaining module 5 is configured to: when the next hop in the SIP request message is in a domain name format, parse the domain name, and obtain the domain name corresponding to the IP address. The configuration module 6 is configured to configure the SIP application layer logical routing table.

The first check module 3 of the foregoing apparatus includes: a first query submodule 31, configured to query, according to the request method name in the SIP request message, whether the IP address appears in the IP barring list. The first rejecting submodule 32 is configured to: when the IP address appears in the IP barring list, instruct the rejecting the SIP request message. The second query sub-module 33 is configured to query, according to the request method name, whether the IP address appears in the IP permission list. The message routing sub-module 34 is configured to: when the IP address appears in the IP permission list, route the SIP request message according to the IP address. The first rejects the SIP request message.

The apparatus of the foregoing embodiment of the present invention determines whether the next hop in the SIP request message is an IP address format, and when the next hop in the SIP request message is in an IP address format, detecting whether the IP address of the next hop in the SIP request message is Broadcast address; when the IP address is a broadcast address, rejecting the SIP request message; when the IP address is a non-broadcast address, according to a pre-configured SIP application layer logical routing table IP prohibition list and IP allow list Checking the validity of the SIP request message. When the next hop in the SIP request message is in the domain name format, the domain name is parsed, the IP address corresponding to the domain name is obtained, and corresponding processing is performed, thereby preventing the SIP request. Illegal routing attack of messages.

As shown in FIG. 10, FIG. 10 is a schematic structural diagram of another apparatus for preventing an illegal route attack according to Embodiment 4 of the present invention, including: a detecting module 1 configured to detect when a next hop in an SIP request message is in an IP address format Whether the IP address of the next hop in the SIP request message is a broadcast address. The reject module 2 is configured to reject the SIP request message when the IP address is a broadcast address. The first checking module 3 is configured to check the validity of the SIP request message according to the IP barring list and the IP permission list in the pre-configured SIP application layer logical routing table when the IP address is a non-broadcast address.

The device for preventing an illegal route attack further includes: a determining module 4, configured to determine a format of a next hop in the SIP request message. The second checking module 5 is configured to: when the next hop in the SIP request message is a domain name format, perform the combination of the forbidden domain name list and the allowed domain name list in the pre-configured SIP application layer logical routing table Legal inspection. The configuration module 6 is configured to configure the SIP application layer logical routing table.

The second checking module 5 of the foregoing apparatus includes: a first query sub-module 51, configured to query, according to the request method name in the SIP request message, whether the domain name appears in the forbidden domain name list. The first rejecting submodule 52 is configured to reject the SIP request message when the domain name appears in the forbidden domain name list. The second query sub-module 53 is configured to query, according to the request method name, whether the domain name appears in the allowed domain name list. The message routing sub-module 54 is configured to route the SIP request message according to the domain name when the domain name appears in the allowed domain name list. The second rejecting sub-module 55 is configured to reject the SIP request message when the domain name does not appear in the allowed domain name list.

The apparatus of the foregoing embodiment of the present invention determines whether the next hop in the SIP request message is an IP address format, and when the next hop in the SIP request message is in an IP address format, detecting whether the IP address of the next hop in the SIP request message is Broadcast address; when the IP address is a broadcast address, rejecting the SIP request message; when the IP address is a non-broadcast address, according to a pre-configured SIP application layer logical routing table IP prohibition list and/or IP Allowing the list to check the validity of the SIP request message. When the next hop in the SIP request message is in the domain name format, according to the pre-configured SIP application layer logical routing table, the prohibited domain name list and the allowed domain name list are The SIP request message performs a legality check to prevent an illegal routing attack of the SIP request message.

The apparatus in the fourth embodiment of the present invention may include a proxy call session control function PCSCF entity or Edge AM, and those skilled in the art may understand that the modules in the apparatus in the embodiment may be distributed in the apparatus according to the embodiment according to an embodiment, or may be Corresponding changes are made in one or more of the devices different from the present embodiment. The modules of the above embodiments may be combined into one module, or may be further split into multiple sub-modules.

As shown in FIG. 11, the A-IMS-based network architecture for preventing illegal route attacks is used in the embodiment of the present invention. The architecture can include the following A-IMS network elements:

AM (Application Manager, application processor),

SDM (Service Data Manager, Service Data Processor),

SM (Security Manager, Security Processor) SOC (Security Operation Center) The communication between the network elements based on the network architecture is as shown in FIG. 11, and includes: Step S1101: The SM/SOC defines a SIP legal/illegal routing policy and sends the policy to the SDM. The delivery policy covers inserting, deleting, querying, and modifying specific application layer SIP routing entries. The delivered routing policy includes two types: permanent routing policy and temporary routing policy.

Step S1102: The SDM sends a response message to the SM. The response message includes a confirmation message that the modification is successful, a failure message that fails to be modified, and the failure message is required to carry the failure reason. The SDM accepts the SIP legal/illegal routing policy from the SM and updates the local long-term stored application layer SIP routing table, and feeds the response message to the SM.

The data exchange between SM and SDM is as shown in Figure 12. It can include inserting, deleting, querying, and modifying specific application layer SIP routing entries.

Step S1103: Pulling PULL between the SDM and the AM or updating the UPDATE permanent/temporary routing policy.

In step S1103, the routing policy for receiving the SDM by the AM specifically includes two cases. In the first case, the PULL data exchange, as shown in FIG. 13, includes,

511031, the AM receives a SIP request sent by an AT (Access Terminal); the SIP request includes a domain name request or an IP address request.

511032, AM queries the local route according to the SIP request sent by the AT.

When the local route has a match with the SIP request of the AT, it is judged whether the route is permitted, and if permitted, the next hop is entered;

When the matching route is not queried locally, step S11033 is performed.

511033, AM sends a PULL route query request to SDM. The SDM sends a temporary routing policy to the AM according to the PULL route query request. The AM sends a PULL request to the SDM, which can be sent according to the needs of the AM.

511034, AM receives a PULL response from SDM;

511035, when the PULL response has a route matching the AT's SIP request, the AM routes to the next hop.

The AM network element checks the application layer SIP routing table to perform the SIP request routing. SIP message routing, because the illegal SIP routing request can not find the corresponding entry in the application layer SIP routing table, the effect of rejecting the illegal SIP routing request is achieved.

Case 2, UPDATE data exchange, as shown in Figure 14, including,

S11031', after the SDM routing policy is updated by the SM/SOC, the SDM sends an UPDATE routing update request to the AM;

S 11032', the AM returns an UPDATE route update response to the SDM;

_The routing policy has a long-term existence on the AM. The SDM is forced to update (UPDATE) or the SDM is forced to initiate an UPDATE when the AM is restarted. The mandatory UPDATE is also required after the SDM local storage permanent routing policy is successfully modified.

The temporary routing policy is temporarily stored on the AM. SDM can also initiate an UPDATE for the temporary routing policy.

The SIP routing table format is defined as follows:

Request source IP address: The source IP address of the route query is initiated, and the network element is configured to initiate the query. The reason is that different network elements have different routing capabilities.

Request method: Design different routing strategies for different request methods such as REGISTER/INVITE/ SUBSCRIBER;

Whether to permit: Whether the definition is a legal route or an illegal route;

Destination host IP/network address: Define the destination address of the route, including the host address and network address.

Temporary / Permanent: Defines whether it is a temporary routing table or a permanent routing table.

The above parameters can be set for SM/SOC, can be requested by AM on demand, or can be actively UPDATE to AM by SDM.

The AM queries the locally stored temporary routing policy and the permanent routing policy based on the next hop IP address of the SIP request (or the next hop IP address obtained through DNS resolution). If the local query fails, the routing policy is requested to the SDM. When the SDM has a routing policy update, the updated permanent routing policy and temporary routing policy are updated to the AM based on the UPDATE.

In the case of using the LRU/N-LRU aging algorithm, the terminal initiates a malicious call to the illegal routing destination address, thereby causing malicious refresh of the application layer SIP routing table, and consuming SDM<->AM communication resources through the bump of the routing table and Increase network latency. This attack requires a signaling-based flood prevention DoS attack mechanism at the AM network boundary. The use of independent storage space for the permanent routing table, the temporary routing table legal SIP routing definition part, and the temporary routing table illegal SIP routing definition part also helps to protect against this attack.

15 is a flow chart of a SIP routing process, which performs an application layer SIP routing table query and attack detection, and inputs an IP address that is a next hop, that is, the routing information of @, and includes: Step S1501: Receive a SIP request message from the AT, where The SIP request message contains the IP address of the next hop, which is @1? Routing information; The above AT may be an AT entity or a UE entity.

Step S1502, determining whether the IP address is a broadcast address; when the judgment result is yes Go to step S1507, and when the result of the determination is no, go to step S1503.

Step S1503: Query an AM logical routing table according to an IP address.

Step S1504, determining whether the AM local has a matching route; if the determination result is yes, then proceeding to step S1505, if the determination result is otherwise, proceeding to step S1509;

Step S1505: Determine whether to grant the route according to the SIP routing table; if the determination result is yes, go to step S1506, and if the result of the determination is otherwise, go to step S1507.

Step S1506: Perform message routing according to the IP address.

In step S1507, the request initiator information in the request message is recorded in the security log. Step S1508: The 403 response is used to reject the SIP request message, and the current session is ended. Step S1509: Initiating an inquiry for the SDM according to the destination IP. The routing table information is found from the SDM, and is written into the AM local routing table.

Step S1510, determining whether the SDM application layer has a matching route; when the determination result is yes, the process goes to step S1511, and when the determination result is no, the process goes to step S1508;

Step S1511: The routing table information is found from the SDM, and is written into the AM local routing table. In this embodiment, the implementation of the combination of PULL and UPDATE reduces the consumption of the storage resources of the SIP routing table on the AM device as much as possible, and improves the efficiency of routing table query through the AM local temporary storage routing table, and reduces the Cx interface. Performance requirements.

As shown in FIG. 16, a system for preventing an illegal routing attack includes an application processor AM 1610, a service data processor SDM 1620, and a security management device 1630.

The security management device 1630 is configured to set a routing policy and send a routing policy to the SDM.

The SDM 1620 is configured to store a routing policy and send a routing policy to the AM 1610 according to the requirements of the AM 1610.

The AM 1610 is configured to determine whether to perform the next hop route when receiving the SIP request message including the next hop address sent by the access terminal 1640.

SOC 1632.

Delete the interface between the SM/SOC and the SDM, and insert the routing entry of the SDM. After the functions such as /delete/query/modify are integrated into the IMS network BMS system, the data exchange diagram of the PULL route query applied to the IMS network is as shown in FIG.

The various units of the system of the embodiments of the present invention may be integrated into one device or may be distributed to multiple devices. The above units may be combined into one unit, or may be further split into a plurality of subunits.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware, or can be implemented by means of software plus necessary general hardware platform, and the technical solution of the present invention. It can be embodied in the form of a software product that can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for making a computer device (may It is a personal computer, a server, or a network device, etc.) that performs the methods described in various embodiments of the present invention.

In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for preventing an illegal route attack, comprising the steps of: detecting an IP address of a next hop in the SIP request message when a next hop in the SIP protocol request message is in an IP address format Is the broadcast address;

The method for preventing an illegal route attack according to claim 1, wherein the detecting whether the IP address of the next hop in the SIP request message is a broadcast address further comprises: when the IP address is a broadcast address When the SIP request message is rejected.

The method for preventing an illegal route attack according to claim 1, wherein when the next hop in the SIP request message is in an IP address format, detecting whether the IP address of the next hop in the SIP request message is a broadcast address Previously, it also included:

Determining the format of the next hop in the SIP request message.

The method for preventing an illegal route attack according to claim 3, further comprising:

When the next hop in the SIP request message is in the domain name format, the domain name is parsed, and the IP address corresponding to the domain name is obtained;

Alternatively, when the next hop in the SIP request message is in the domain name format, the legality check is performed on the SIP request message according to the forbidden domain name list and the allowed domain name list in the pre-configured SIP application layer logical routing table.

The method for preventing an illegal route attack according to claim 1, wherein the legality check is performed on the SIP request message according to an IP prohibition list or an IP permission list in a pre-configured SIP application layer logical routing table. Specifically, including:

Querying, according to the request method name in the SIP request message, whether the IP address appears in the IP barring list; when the IP address appears in the IP barring list, rejecting the SIP request message;

Otherwise, querying whether the IP permission list appears in the IP address according to the request method name The IP address; when the IP address appears in the IP permission list, the SIP request message is routed according to the IP address, otherwise, the SIP request message is rejected.

The method for preventing an illegal route attack according to claim 4, wherein the legality check is performed on the SIP request message according to the forbidden domain name list and the allowed domain name list in the pre-configured SIP application layer logical routing table. Includes:

Querying, according to the request method name in the SIP request message, whether the domain name appears in the forbidden domain name list; when the domain name appears in the forbidden domain name list, rejecting the SIP request message;

Otherwise, querying whether the domain name appears in the allowed domain name list according to the request method name; when the domain name appears in the allowed domain name list, routing the SIP request message according to the domain name, otherwise, rejecting The SIP request message.

A system for preventing an illegal route attack, comprising: a device for preventing an illegal route attack, configured to perform a legality detection check and a route processing on a session initial protocol SIP request message according to a pre-configured application layer logical routing table. The device for preventing an illegal routing attack includes:

The system according to claim 7, wherein the device further comprises: a rejecting module, configured to reject the SIP request message when the IP address is a broadcast address.

A device for preventing an illegal route attack, comprising: a detecting module, configured to: when the next hop in the SIP request message is in an IP address format, detecting whether an IP address of a next hop in the SIP request message is Is the broadcast address;

The first checking module is configured to: when the IP address is a non-broadcast address, perform legality check on the SIP request message according to the IP prohibition list and the IP permission list in the pre-configured SIP application layer logical routing table.

10. The apparatus of claim 9, further comprising: a rejecting module, configured to reject the SIP request message when the IP address is a broadcast address.

The device for preventing an illegal route attack according to claim 9, further comprising:

The determining module is configured to determine a format of a next hop in the SIP request message.

The device for preventing an illegal route attack according to claim 11, further comprising:

An obtaining module, configured to: when the next hop in the SIP request message is in a domain name format, parse the domain name, and obtain an IP address corresponding to the domain name;

Or the second checking module is configured to: when the next hop in the SIP request message is a domain name format, perform the SIP request message according to the forbidden domain name list and the allowed domain name list in the pre-configured SIP application layer logical routing table. Legality check.

The device for preventing an illegal route attack according to claim 9, wherein the first checking module comprises:

a first query submodule, configured to query, according to the request method name in the SIP request message, whether the IP address appears in the IP barring list;

a first rejecting submodule, configured to: when the IP address appears in the IP barring list, instructing to reject the SIP request message;

a second query submodule, configured to query, according to the request method name, whether the IP address appears in the IP permission list;

a message routing submodule, configured to: when the IP address appears in the IP permission list, route the SIP request message according to the IP address;

And a second rejecting submodule, configured to reject the SIP request message when the IP address does not appear in the IP permission list.

The device for preventing an illegal route attack according to claim 12, wherein the second checking module comprises:

a first query submodule, configured to query, according to the request method name in the SIP request message, whether the domain name appears in the forbidden domain name list;

a first reject submodule, configured to: when the domain name appears in the forbidden domain name list, Rejecting the SIP request message;

a second query submodule, configured to query, according to the request method name, whether the domain name appears in the allowed domain name list;

a message routing submodule, configured to: when the domain name appears in the allowed domain name list, route the SIP request message according to the domain name;

And a second rejecting submodule, configured to reject the SIP request message when the domain name does not appear in the allowed domain name list.

15. The apparatus for preventing an illegal route attack according to claim 9, wherein the type of the apparatus comprises: a proxy call session control function PCSCF entity.

A system for preventing an illegal route attack, comprising: an application processor AM, a service data processor SDM, and a security processing device, wherein:

And the security processing device is configured to send a routing policy to the SDM, and send the routing policy to the AM according to the requirement of the AM;

17. The system of claim 16, wherein the type of security management device comprises: a security processor SM or a security control center SOC.