CN118214803A

CN118214803A - RTP interception detection and bypass method, equipment and medium based on PBX

Info

Publication number: CN118214803A
Application number: CN202410626952.8A
Authority: CN
Inventors: 廖慧海; 陈炳杉
Original assignee: Xiamen Yeastar Digital Technology Co ltd
Current assignee: Xiamen Yeastar Digital Technology Co ltd
Priority date: 2024-05-21
Filing date: 2024-05-21
Publication date: 2024-06-18
Anticipated expiration: 2044-05-21
Also published as: CN118214803B

Abstract

The invention relates to a RTP interception detection and bypass method, equipment and medium based on PBX, wherein the method comprises the following steps: the PBX1 and the PBX2 establish call completion, if the PBX2 does not receive the RTP packet from the PBX1, the PBX2 actively sends the Re-INVITE packet to the PBX1 and carries a header field in the packet to inform the opposite party that the opposite party is in an RTP interception environment; after receiving the Re-INVITE, the PBX1 detects the header field to know that RTP interception exists in the network environment, and adopts a corresponding way of bypassing the RTP interception based on the value of the header field. The invention solves the problems of RTP interception by hackers and RTP misinterception by routers, and ensures normal transmission of real-time audio and video communication.

Description

RTP interception detection and bypass method, equipment and medium based on PBX

Technical Field

The invention relates to the field of network calls, in particular to an RTP interception detection and bypass method, equipment and medium based on a PBX.

Background

RTP (Real-time Transport Protocol) is a protocol for transmitting audio and video data over the internet, typically for Real-time audio-video communication applications such as VoIP (Voice over Internet Protocol) telephony, video conferencing, etc. RTP interception refers to the act of intercepting, limiting, or blocking RTP traffic in a network. RTP interception may be caused by a network administrator, network device, or network policy, the purpose of which may be due to network management, security control, resource optimization, or other considerations. RTP interception typically has the following application scenarios: 1. hackers monitor information based on RTP interception; 2. RTP misinterception by the router.

The existing RTP interception is mostly in the following form:

(1) Port blocking: and blocking the UDP port used by the RTP to prevent the transmission of RTP data packets.

(2) And (3) protocol identification: identifying the characteristic or sign of RTP protocol, and filtering the identified RTP flow.

(3) And (3) flow control: and limiting or controlling the flow of a specific port or protocol so as to prevent the RTP data packet from being normally transmitted.

(4) Firewall rules: rules are set in the network firewall to limit traffic transmissions for a particular IP address, port or protocol, including RTP packets.

Conventional PBX's fail to provide an effective solution when encountering RTP interception problems, resulting in blocked real-time audio-video communications.

Disclosure of Invention

In order to solve the above problems, the present invention proposes a method, apparatus and medium for detecting and bypassing RTP interception based on a PBX.

The specific scheme is as follows:

the RTP interception detection and bypass method based on the PBX sets that a telephone and a first PBX are both in an RTP interception environment, and a second PBX is not in the RTP interception environment, and when the telephone calls into the second PBX, the following steps are executed:

after the telephone is in butt joint with the first PBX, a call is established between the first PBX and the second PBX;

The second PBX judges whether an RTP packet from the first PBX is received within a rated time after the call is established successfully, if not, the first PBX is judged to be in an RTP interception environment, an RE-INVITE request is sent to the first PBX, and whether the RTP packet from the first PBX is received within the rated time after the call is established successfully is judged; if not, another RE-INVITE request is sent to the first PBX, and whether RTP packets from the first PBX are received in the rated time is judged; if not, the last RE-INVITE request is sent to the first PBX, and whether the RTP packet from the first PBX is received in the rated time is judged; if not, judging that negotiation fails and hanging up the call;

The RE-INVITE request is to add a header field for identifying that the PBX is in an interception environment to a conventional INVITE request, and the RE-INVITE request includes three types, and the three types of RE-INVITE requests correspond to the following three different interception environments through the difference of the values of the header fields:

(1) The first interception environment is: detecting whether the first packet is an RTP packet or not, if so, directly intercepting a port for RTP interaction;

(2) The second interception environment is: detecting whether each packet is an RTP packet or not, if so, directly intercepting a port for RTP interaction;

(3) The third interception environment is: directly intercepting a port for RTP interaction based on SIP packet negotiation;

When the first PBX receives the RE-INVITE request, judging which interception environment is in by analyzing the value of the corresponding header field, and taking the following measures according to the different interception environments:

(1) When in the first interception environment, first, transmitting an empty packet to the second PBX before transmitting the RTP packet to the second PBX;

(2) When the first interception environment is in the second interception environment, changing the values of the front two bits of the packet header of the RTP packet to be transmitted into a fixed value, and setting that the front two bits of the packet header of the RTP packet are not checked by the first PBX and the second PBX;

(3) When the third interception environment is in, changing the port for RTP interaction into a new port calculated based on the negotiated port for RTP interaction and a fixed algorithm, and transmitting RTP packets through the new port.

Further, the process of establishing a call between the first PBX and the second PBX includes the steps of:

s101: the first PBX sends an INVITE request to the second PBX;

S102: after receiving the INVITE request sent by the first PBX, the second PBX replies a 200OK message to the first PBX;

S103: after receiving the 200OK message replied by the second PBX, the first PBX sends an ACK message to the second PBX;

S104: and after the second PBX receives the ACK message sent by the first PBX, judging that the call establishment is successful.

Further, after receiving the RE-INVITE request, the first PBX replies the second PBX with a 200OK message, and then takes measures according to the interception environments corresponding to the RE-INVITE request.

Further, the port for RTP interaction of the negotiated second PBX is determined by SDP carried in the RE-INVITE request sent to the first PBX by the second PBX; the port of the negotiated first PBX for RTP interaction is determined by the SDP carried in the 200OK message sent by the first PBX to the second PBX.

Further, a fixed value to which the values of the first two bits of the header of the RTP packet to be transmitted are changed is binary 00.

Further, the fixed algorithm for calculating the new port is: negotiated port +1 for RTP interactions.

The RTP interception detection and bypassing terminal equipment based on the PBX comprises a processor, a memory and a computer program which is stored in the memory and can run on the processor, wherein the processor realizes the steps of the method according to the embodiment of the invention when executing the computer program.

A computer readable storage medium storing a computer program which, when executed by a processor, implements the steps of the method described above for embodiments of the present invention.

The invention adopts the technical scheme and has the beneficial effects that:

(1) Under the scene that a hacker monitors the RTP, the RTP interception can be effectively bypassed, and the normal transmission of real-time audio and video communication is ensured.

(2) The method solves the problem of RTP misinterception of the router, ensures normal transmission of real-time audio and video communication, improves service availability and reliability of the PBX system, ensures that communication service of enterprises or users is not affected by network limitation, and maintains continuous and stable communication connection.

Drawings

FIG. 1 is a flow chart of a method according to an embodiment of the invention.

Detailed Description

For further illustration of the various embodiments, the invention is provided with the accompanying drawings. The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate embodiments and together with the description, serve to explain the principles of the embodiments. With reference to these matters, one of ordinary skill in the art will understand other possible embodiments and advantages of the present invention.

The invention will now be further described with reference to the drawings and detailed description.

Embodiment one:

the precondition of this embodiment is the following three RTP interception environments:

(1) The first interception environment is: and detecting whether the first packet is an RTP packet, and if so, directly intercepting a port for RTP interaction.

(2) The second interception environment is: and detecting whether each packet is an RTP packet, if so, directly intercepting a port for RTP interaction.

(3) The third interception environment is: ports for RTP interactions based on SIP packet negotiations are directly intercepted.

For the three interception environments, the embodiment constructs the Re-INVITE request on the basis of the INVITE request for identifying the three interception environments. The Re-INVITE request is to add header fields RTP-Disguise for identifying that the PBX is in an interception environment to a conventional INVITE request, and three different identifications are set as values of header fields RTP-Disguise for three interception environments to correspond to three Re-INVITE requests. Specifically, the value of the header field in the Re-INVITE request corresponding to the first interception environment is set to SEND EMPTY PACKET (null packet is sent); setting a header field value in the Re-INVITE request corresponding to the second interception environment to HIDE HEADER (hide header); the value of the header field in the Re-INVITE request corresponding to the first interception environment is set to Hidden port (Hidden port). In other embodiments, the person skilled in the art can set the identification representing different interception environments according to the requirements, which is not limited herein.

Based on the above-mentioned settings, in this embodiment, a method for detecting and bypassing RTP interception based on a PBX is provided, as shown in fig. 1, a first PBX is named as a PBX1, and a second PBX is named as a PBX2, when both a telephone and the PBX1 are in an interception environment, and the PBX2 is not in an RTP interception environment, when the telephone needs to call into the PBX2, the following steps are executed:

S1: the telephone interfaces with PBX1 through the private network and sends an INVITE request to PBX2 through PBX1 to establish a connection.

S2: after receiving the INVITE request sent by the PBX1, the PBX2 replies a 200OK message to the PBX1 to establish a call.

S3: after receiving the 200OK message sent by the PBX2, the PBX1 sends an ACK message to the PBX 2.

S4: after receiving the ACK message sent by the PBX1, the PBX2 determines that the call is established successfully, determines whether an RTP packet from the PBX1 is received within a rated time after the call is established successfully, if not, determines that the PBX1 is in an RTP interception environment, and sends a first RE-INVITE request to the PBX1, wherein a value of a header field RTP-Disguise carried in the RE-INVITE request is SEND EMPTY PACKET.

S5: after receiving the RE-INVITE request sent by the PBX2, the PBX1 first replies a 200OK message to the PBX2, then parses the RE-INVITE request, extracts the value "SEND EMPTY PACKET" of the header field RTP-Disguise, and further knows that it is in the first interception environment, so that a corresponding measure is adopted, that is, before sending the RTP packet to the PBX2, firstly sends an empty packet to the PBX2 to bypass the first RTP interception environment.

The RE-INVITE request belongs to SIP, which carries the port of the PBX2 that SDP uses to negotiate the two-end RTP interactions. The 200OK message also belongs to SIP, which carries the port of PBX1 that SDP uses to negotiate both RTP interactions.

S6: the PBX2 judges whether an RTP packet from the PBX1 is received or not in the rated time after the first RE-INVITE request is sent, and if so, the RTP interaction is normal without the subsequent steps; if not, indicating that the PBX1 is not in the first interception environment, RE-sending a second RE-INVITE request to the PBX1, the RE-INVITE request carrying a header RTP-Disguise having a value of HIDE HEADER.

S7: after the PBX1 receives the RE-INVITE request sent by the PBX2 for the second time, which indicates that the previous measures cannot bypass RTP interception, firstly replying the PBX2 with a 200OK message, then resolving the RE-INVITE request, extracting the value "HIDE HEADER" of the header field RTP-Disguise, and further knowing that the RE-INVITE request is in the second interception environment, so that corresponding measures are adopted, namely changing the values of the two front bits of the header of the RTP packet to be sent into fixed values, and setting that neither the PBX1 nor the PBX2 verifies the two front bits of the header of the RTP packet.

According to the introduction of RFC3550 to the RTP protocol, the first two bits of the header of RTP default to 10, the decimal number 2, represent RFC1889 version. In the second RTP interception environment, the first two bits of the header of the RTP need to be checked. In this embodiment, the PBX1 and the PBX2 are set to not check the first two bits of the header of the RTP, and by changing the values of the first two bits of the header, the second RTP interception environment can be bypassed. The modified fixed value can be set by the person skilled in the art, and is set to 00 binary in this embodiment.

In a specific implementation process, after the PBX2 sends a second RE-INVITE request to the PBX1, setting that the PBX2 does not check the first two bits of the packet header of the RTP packet received later, and continuing until the PBX2 ends after sending another RE-INVITE request to the PBX 1; when the PBX1 receives the second RE-INVITE request, it is set that the PBX1 does not check the first two bits of the header of the RTP packet sent later, until the PBX1 receives another RE-INVITE request and ends.

S8: the PBX2 judges whether an RTP packet from the PBX1 is received or not in the rated time after the second RE-INVITE request is sent, and if so, the RTP interaction is normal without the subsequent steps; if not, indicating that the PBX1 is not in the second interception environment, RE-sending a third RE-INVITE request to the PBX1, wherein the value of the header field RTP-Disguise carried in the RE-INVITE request is Hidden port.

S9: after the PBX1 receives the RE-INVITE request sent by the PBX2 for the third time, which indicates that the previous measures cannot bypass RTP interception, firstly replying a 200OK message to the PBX2, then analyzing the RE-INVITE request, extracting the value "Hidden port" of the header field RTP-Disguise, and further knowing that the RE-INVITE request is in the third interception environment, so that the corresponding measures are adopted, namely, changing the port for RTP interaction into a new port calculated based on the negotiated port for RTP interaction (hereinafter referred to as negotiation port) and a fixed algorithm, and sending an RTP packet through the new port.

The fixed algorithm used to calculate the new port is set in this embodiment as: negotiated port +1 for RTP interactions. If the negotiation port of SDP negotiation in RE-INVITE of PBX2 is 10000, and the negotiation port of SDP negotiation in 200OK of PBX1 reply is 20000. Both parties default to send packets to the negotiation port-1 of the other party. I.e., PBX1 sends packets to the 9999 port of PBX2, and PBX2 sends packets to the 19999 port of PBX 1.

In a specific embodiment, after the PBX2 sends the third RE-INVITE request to the PBX1, the PBX2 is set to issue packets to the negotiation port-1 of the PBX1 until the PBX2 sends another RE-INVITE request to the PBX 1; when the PBX1 receives the third RE-INVITE request, the PBX1 is set to issue packets to the negotiation port-1 of the PBX2 until the PBX1 receives another RE-INVITE request.

S10: the PBX2 judges whether an RTP packet from the PBX1 is received or not in the rated time after the third RE-INVITE request is sent, and if so, the RTP interaction is normal and is ended; if not, judging that the negotiation fails and hanging up the call.

In the above embodiment, the first interception environment, the second interception environment, and the third interception environment are sequentially determined according to the sequence of the first interception environment, the second interception environment, and the third interception environment, and in other embodiments, the person skilled in the art may replace the sequence according to actual needs, which is not limited herein.

Embodiment two:

the invention also provides a PBX-based RTP interception detection and bypass terminal device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor realizes the steps in the method embodiment of the first embodiment of the invention when executing the computer program.

Further, as an executable scheme, the PBX-based RTP interception detection and bypass terminal device may be a computing device such as a desktop computer, a notebook computer, a palm computer, and a cloud server. The PBX-based RTP intercept detection and bypass terminal devices may include, but are not limited to, processors, memory. It will be appreciated by those skilled in the art that the above-described constituent structure of the PBX-based RTP interception detection and bypass terminal device is merely an example of the PBX-based RTP interception detection and bypass terminal device, and does not constitute a limitation on the PBX-based RTP interception detection and bypass terminal device, and may include more or fewer components than those described above, or may combine some components, or different components, for example, the PBX-based RTP interception detection and bypass terminal device may further include an input/output device, a network access device, a bus, and the like, which is not limited by the embodiment of the present invention.

Further, as an executable scheme, the Processor may be a central processing unit (Central Processing Unit, CPU), other general purpose Processor, digital signal Processor (DIGITAL SIGNAL Processor, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), field-Programmable gate array (Field-Programmable GATE ARRAY, FPGA), or other Programmable logic device. The general purpose processor may be a microprocessor or the processor may be any conventional processor or the like, which is a control center of the PBX-based RTP intercept detection and bypass terminal equipment, and connects the entire PBX-based RTP intercept detection and bypass terminal equipment with various interfaces and lines.

The memory may be used to store the computer program and/or module, and the processor may implement the various functions of the PBX-based RTP intercept detection and bypass terminal device by running or executing the computer program and/or module stored in the memory and invoking data stored in the memory. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, at least one application program required for a function; the storage data area may store data created according to the use of the cellular phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, memory, plug-in hard disk, smart memory card (SMART MEDIA CARD, SMC), secure Digital (SD) card, flash memory card (FLASH CARD), at least one disk storage device, flash memory device, or other volatile solid-state storage device.

The present invention also provides a computer readable storage medium storing a computer program which when executed by a processor implements the steps of the above-described method of an embodiment of the present invention.

The module/unit of the PBX-based RTP interception detection integrated with the bypass terminal device may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a separate product. Based on such understanding, the present invention may implement all or part of the flow of the method of the above embodiment, or may be implemented by a computer program to instruct related hardware, where the computer program may be stored in a computer readable storage medium, and when the computer program is executed by a processor, the computer program may implement the steps of each of the method embodiments described above. Wherein the computer program comprises computer program code which may be in source code form, object code form, executable file or some intermediate form etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a software distribution medium, and so forth.

While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

1. The RTP interception detection and bypassing method based on the PBX is characterized in that: setting the telephone and the first PBX to be in an RTP interception environment, wherein the second PBX is not in the RTP interception environment, and executing the following steps when the telephone calls into the second PBX:

2. The PBX-based RTP intercept detection and bypass method according to claim 1 wherein: the process of establishing a call between a first PBX and a second PBX comprises the following steps:

s101: the first PBX sends an INVITE request to the second PBX;

3. The PBX-based RTP intercept detection and bypass method according to claim 1 wherein: after receiving the RE-INVITE request, the first PBX replies a 200OK message to the second PBX, and then takes measures according to the different interception environments corresponding to the RE-INVITE request.

4. A PBX-based RTP intercept detection and bypass method according to claim 3 wherein: the port for RTP interaction of the negotiated second PBX is determined by SDP carried in RE-INVITE request sent by the second PBX to the first PBX; the port of the negotiated first PBX for RTP interaction is determined by the SDP carried in the 200OK message sent by the first PBX to the second PBX.

5. The PBX-based RTP intercept detection and bypass method according to claim 1 wherein: the fixed value to which the values of the first two bits of the header of the RTP packet to be transmitted are changed is binary 00.

6. The PBX-based RTP intercept detection and bypass method according to claim 1 wherein: the fixed algorithm for calculating the new port is: negotiated port +1 for RTP interactions.

7. The RTP interception detection and bypassing terminal equipment based on the PBX is characterized in that: comprising a processor, a memory and a computer program stored in the memory and running on the processor, the processor implementing the steps of the method according to any one of claims 1 to 6 when the computer program is executed.

8. A computer-readable storage medium storing a computer program, characterized in that: the computer program when executed by a processor performs the steps of the method according to any one of claims 1 to 6.