WO2008095430A1 - A method and a system for preventing a media agency from hacker attacking - Google Patents

Abstract

A method and a system for preventing a media agency from hacker attacking belongs to the field of network information security. The method for preventing a media agency from hacker attacking includes: receiving a call instruction, generating randomly an authentication code and registering it, identifying terms of a media conversation list, and appending the authentication code to the call instruction and transmitting it by the media agent device; receiving the call instruction, parsing the authentication code from the call instruction, and sending a media message with the authentication code by a terminal; receiving the media message, then processing the media message and updating the terms of the media conversation list according to the authentication code and the identifying state of the media conversation list by the media agent device. Accordingly hacker attacking is prevented efficaciously.

Description

 Method and apparatus for preventing media agents from being attacked by hackers

[1] Technical field

 [2] The present invention relates to the field of network information security, and in particular, to a method and apparatus for preventing a media agent from being attacked by a hacker.

[3] Background of the invention

 [4] With IP (internet)

 Protocol, Internet Protocol) The growing maturity of technology, next generation networks with softswitch and IP packet switching technology as the core (Next Generation

 Network, NGN) technology has become one of the hotspots in the industry due to its broad application prospects and meeting the diverse and personalized business needs of people. SBC (Session Border

 Controler, Session Border Controller) As a signaling agent and media proxy device, it is one of the important devices in NGN. Its functions mainly include signaling agent and media agent:

[5] 1. Signaling Agent (Signalling Proxy, SP for short)

 [6] As shown in Figure 1, the SBC can be regarded as a softswitch system for the NGN terminal 1, that is, the user's registration and call messages are sent to the SBC first, and the SBC will process the received message after signaling. Forwarded to the core softswitch system. Similarly, the SBC can be regarded as a user of the core softswitch system. The core softswitch system first sends a request for calling the called party to the SBC, and the SBC forwards the request to the actual called party after signaling processing. Generally SBC can support SIP (Session Initiation)

 Protocol, session initiation, Η·323, MGCP (Media Gateway Control)

 Proxy function of one or more of Protocol, Media Gateway Control Protocol, H.248, etc. Since the SBC participates in the entire process, the SBC can obtain detailed information such as user registration, call, and so on.

 [7] 2. Media Proxy (MP)

[8] The SBC can also act as a proxy for media streams in its peers as a signaling agent. Figure 2 is a schematic diagram of the transmission of a signaling stream (dashed line) and a media stream (solid line). All media streams communicated by the users of the SBC and the outside world need to be processed and forwarded by the SBC. When the user under the SBC acts as the calling party, the called party sees the called party from the SBC. When the user under the SBC acts as the called party, the called party sees the called address as SBC. the address of.

 Clients in home and corporate networks are usually located behind the customer premises NAT/firewall, which poses a problem for signaling and media streams that need to be delivered to the client because NAT/firewall can only be "opened" for outgoing traffic. ", and sessions that flow into the client are often blocked. Since the private IP address and port inserted by the client device cannot correspond to the public IP address and port after NAT conversion in the payload of the IP packet, the NAT device hinders the two-way voice and multimedia communication.

 The SBC full proxy technology can solve the above private network NAT/firewall penetration problem. The solution is as follows: As shown in Figure 3, assume that the IP address of terminal 1 is "A", NAT.

The IP address is "B", the media address of the SBC client side is

"C", the media address on the server side of the SBC is "D"

 The address of the server is "E", and the IP address of terminal 2 is "F". After the signaling interaction is completed, the SBC will follow the S DP (Session Description

 Protocol, Session Description Protocol) Information creation media session (Aa, Cc) <->( Dd, Ff

 After the first packet of the media packet sent by the terminal 1 or the terminal 2 is sent to the SBC, the SBC learns the session entry as (Bb, Cc) <->

(Dd, Ff). However, the existing proxy technology will cause the SBC media agent to learn errors if the SBC media agent is attacked by the hacker before the first packet of the media message arrives, which may result in the service being unavailable. Figure ₄ shows the schematic diagram of the hacker attacking the SBC media agent: Suppose the source IP address of the hacker is "H", before the first packet of the media message arrives, because the IP address of the SBC media proxy

"C" is publicly available. The hacker can use the port scanning method to update the media session of the SBC media proxy device to the source address and port designed by the hacker, ie (Aa, Cc) <->( Dd, Ff ) will be updated to (Hh, Cc ) <->( Dd, Ff ), resulting in business unavailability.

 Summary of the invention

 In order to solve the problem that the media proxy device may be hacked and the service is interrupted before the first packet of the legal media message arrives, the embodiment of the present invention provides a method for preventing the media agent from being attacked by a hacker. Includes:

The media proxy device receives the call signaling, randomly generates and records an authentication code, and adds the authentication code to the Forwarded in the call signaling;

 [14] The media proxy device receives the media packet sent by the terminal, and after determining that the media session entry needs to be learned, and the authentication code carried in the media packet matches the recorded authentication code, The media message updates the media session entry.

An embodiment of the present invention further provides an apparatus for preventing a media agent from being attacked by a hacker. The apparatus includes: [16] generating a record identification module, configured to randomly generate and record an authentication code after receiving call signaling, Outputting the generated authentication code and the received call signaling;

[17] The adding module is configured to receive the authentication code and the call signaling sent by the generated record identification module, add the received authentication code to the received call signaling, and output the call signaling with the added authentication code. ;

[18] The media message sending module is configured to receive the call signaling sent by the adding module, parse the authentication code from the received call signaling, and send the media packet that includes the authentication code;

[19] The media packet forwarding processing module is configured to receive the media packet sent by the media packet sending module, and determine that the media session entry needs to be learned, and the authentication code carried in the media packet is After the recorded authentication codes are matched, the media session entries are updated according to the media messages.

[20] The embodiment of the present invention further provides a media proxy device, where the media proxy device includes:

[21] generating a record identification module, configured to: after receiving the call signaling, randomly generate and record an authentication code, and output the generated authentication code and the received call signaling;

[22] The adding module is configured to receive the authentication code and the call signaling sent by the generated record identification module, add the received authentication code to the received call signaling, and send the call with the added authentication code to the terminal. [23] The media packet forwarding processing module is configured to receive the media packet sent by the terminal, and determine that the media session entry needs to be learned, and the authentication code carried in the media packet is related to the record. After the authentication code is matched, the media session entry is updated according to the media packet.

[24] The embodiment of the present invention further provides a terminal device, where the terminal device includes:

 [25] The media message sending module is configured to receive call signaling sent by the media proxy device, parse the authentication code from the received call signaling, and send the media packet including the authentication code to the media proxy device. .

[26] The embodiment of the present invention randomly generates an authentication code on the media proxy device, and records the authentication code, and the peer carries the authentication code in the media packet, so that the first packet of the legal media packet does not arrive. Previously, the media proxy device did not incorrectly update the media session even if it received a hacker attack on the media message. The entry causes the business to be interrupted.

[27] BRIEF DESCRIPTION OF THE DRAWINGS

 [28] FIG. 1 is a schematic diagram of a typical networking of an SBC in an NGN network in the prior art;

 2 is a schematic diagram of a principle of implementing media stream and signaling stream transmission by an SBC media proxy in the prior art;

[30] FIG. 3 is a schematic diagram of a principle of implementing media message transmission by an SBC media proxy in the prior art;

 [31] FIG. 4 is a schematic diagram showing the principle of a hacker attacking an SBC media agent in the prior art;

 FIG. 5 is a flowchart of a method for preventing a media agent from being attacked by a hacker according to an embodiment of the present invention; FIG.

 6 is a schematic diagram of a signaling interaction process according to an embodiment of the present invention;

 7 is a schematic structural diagram of an apparatus for preventing a media agent from being attacked by a hacker according to an embodiment of the present invention.

[35] Mode for carrying out the invention

 The invention is further described below in conjunction with the drawings and specific embodiments, but not as a limitation of the invention. [37]

 [38] The embodiment of the present invention provides a method for preventing a media agent from being attacked by a hacker, and the involved signaling process is as shown in FIG. 6. The method for preventing the media agent from being attacked by a hacker is shown in FIG. 5, which specifically includes the following steps:

 Step 101: The terminal 1 sends an invitation signaling message Invite to the NAT firewall (ie, step 1 in FIG. 6), and the N AT firewall sends the signaling message Invite to the media proxy device (ie, step 2 in FIG. 6).

 Step 102: After receiving the invitation signaling packet Invite, the media proxy device modifies its internal signaling IP address, and allocates an IP address and port for transmitting media packets on its uplink port, and invites the signaling signal to the packet. The In vite is forwarded to the terminal 2 through the softswitch (ie, steps 3, 4 in Figure 6).

 [41] Step 103: After receiving the invite signaling message Invite, the terminal 2 sends a ringing signaling message to the softswitch.

Ring, softswitch will ring signaling message 180

 Ring is forwarded to the media proxy device (ie, steps 5, 6 in Figure 6).

[42] Step 104: The ringing signaling message that the media proxy device will receive 180

 Ring is forwarded to terminal 1 through the NAT firewall (ie, steps 7, 8 in Figure 6).

[43] Step 105: Terminal 1 receives a ringing signaling message 180 Ring.

[44] Step 106: The terminal 2 sends a signaling message 200 OK to the softswitch, and the softswitch sends the signaling message 200. OK forwarded to the media proxy device (ie step in Figure 6), steps 9, 10

 Step 107: The media proxy device receives the signaling packet 200

 After the OK, a string is generated as the authentication code, and the string is recorded, and the string is added to the 1 signaling packet 200 OK, and the signaling packet is 200.

 OK is forwarded to terminal 1 through the NAT firewall (ie, steps 11, 12 in Figure 6).

 [46] The media proxy device receives the signaling message 200

 After the OK, in addition to performing the operations of this step, the media proxy device also needs to modify its internal signaling IP address, and at the same time, allocates an IP address and port for transmitting media packets on its downlink port, and generates a session for media packets. An entry that identifies the session entry as having no learning completion.

 [47] Step 108: After receiving the signaling message 200 OK, the terminal 1 receives the signaling packet 200

 In OK, the string that is the authentication code is parsed, and the string is saved, and the response is sent to the NAT firewall. The NAT firewall forwards the response to the terminal 2 through the media proxy device and the softswitch (ie, steps 13, 14, 15 in Figure 6). , 16).

 [48] So far, the signaling interaction process of establishing a session connection is completed between the terminal 1 and the terminal 2.

[49] The following steps are the process of media message exchange between terminal 1 and terminal 2.

 [50] Step 109: The terminal 1 sends a media packet containing the character string as the authentication code to the NAT firewall, and the NAT firewall forwards the media packet containing the string to the media proxy device.

[51] Step 110: After receiving the media packet containing the string, the media proxy device matches the destination address and port in the media session entry in the media proxy device according to the destination address and port of the media packet. If the matching is successful, step 111 is performed, otherwise step 116 is performed.

[52] Step 111: The media proxy device checks whether the media session entry is completed. If the learning is completed, step 112 is performed, otherwise step 113 is performed.

[53] Step 112: The media proxy device removes the string in the media packet, and forwards the media packet to the terminal 2 through the softswitch according to the media session entry.

[54] Step 113: The media proxy device checks whether the received media packet carries a string. If no string is carried, step 116 is performed; otherwise, step 114 is performed.

[55] Step 114: The media proxy device compares the string in the media packet with the string recorded in the media session entry. If the two strings are the same, step 115 is performed; otherwise, step 116 is performed. [56] Step 115: The media proxy device updates the source address and port of the media session entry, and records the session entry as a learning completion state, removes the string in the media packet, and mediaizes according to the media session entry. The message is forwarded to the terminal 2 through the softswitch.

 [57] Step 116: The media proxy device discards the received media message.

 [58] In this embodiment, the media proxy device randomly generates a character string as an authentication code in the process of signaling interaction, and records the authentication code, and the peer carries the authentication code in the media packet, so the media proxy device Before the first packet of a legitimate media message arrives, even if it is attacked by a media message, the media session entry will not be updated incorrectly, and the service will not be interrupted. The authentication code may be in other forms, such as carrying a number, etc., in this embodiment, in the signaling 200.

 The OK carries a string as the authentication code, and can also be carried in other signaling, such as 180 Ring in SIP signaling.

 The technical solution described in the embodiments of the present invention is not only suitable for implementation on an SBC device, but also can be implemented on other devices having signaling proxy and media proxy functions.

[59] Referring to FIG. 7, an embodiment of the present invention further provides an apparatus for preventing a media agent from being attacked by a hacker. The device includes a record identification module, an add module, a media message sending module, and a media packet forwarding processing module.

 [60] The generated record identification module is configured to randomly generate and record an authentication code, generate a media session entry, and identify a status of the media session entry, and generate the generated authentication code and the received call letter. Send to the add module;

 [61] The adding module is configured to receive the authentication code and the call signaling sent by the generated record identification module, add the received authentication code to the received call signaling, and send the call signaling with the added authentication code to the media. Message sending module;

 [62] The media message sending module is configured to receive the call signaling sent by the adding module, parse the authentication code from the received call signaling, and send the media packet containing the authentication code to the media packet forwarding module.

 [63] The media packet forwarding processing module is configured to receive the media packet sent by the media packet sending module, and process the media packet and update according to the authentication code in the media packet and the status of the media session entry identified by the record identification module. Media session entry.

[64] generating a record identification module, including an allocation unit, a media session entry establishment unit, and a recording unit; [65] The allocating unit is configured to allocate an IP address and a port of the transmission media packet according to the call signaling received by the generating record identification module, and send the allocated IP address and port information to the media session entry establishing unit; [66] The media session entry establishing unit is configured to receive the IP address and port information sent by the allocation unit, and establish a media session entry according to the IP address and the port information;

[67] The recording unit is configured to record the authentication code randomly generated by the generated record identification module into the media session entry established by the media session entry establishment unit.

[68] The media message forwarding processing module includes a matching unit, an updating unit, and a comparing unit;

[69] The matching unit is configured to match the IP address and port of the media packet with the IP address and port in the media session entry established by the media session entry establishment unit, and if the matching is successful, send the media packet to the comparison. Unit, if the match is unsuccessful, discard the received media message;

 [70] The comparing unit is configured to receive the media packet sent by the matching unit, and compare the authentication code in the media packet with the authentication code in the media session entry established by the media session entry establishing unit, if the two authentication codes are consistent. And sending a message for updating the media session entry to the update unit, and discarding the received media message if the two authentication codes are inconsistent;

 [71] The update unit is configured to receive the message sent by the comparison unit, and update the media session entry established by the media session entry establishment unit.

 [72] In this embodiment, the generating record identification module randomly generates an authentication code in the process of signaling interaction, and records the authentication code, and the same carries the authentication code in the media packet sent by the media packet sending module. Therefore, before the first packet of the legal media packet arrives, the media proxy device does not erroneously update the media session entry even if it receives the hacker attack of the media packet, and the service interruption is not caused.

 The embodiment described above is only a preferred embodiment of the present invention, and the usual changes and substitutions made by those skilled in the art within the scope of the present invention are included in the scope of the present invention.

Claims

Claim  [1] A method for preventing a media agent from being attacked by a hacker, the method comprising: the media agent device receiving call signaling, randomly generating and recording an authentication code, adding the authentication code to the The media proxy device receives the media packet sent by the terminal, and determines that the media session entry needs to be learned, and the authentication code carried in the media packet matches the recorded authentication code. Afterwards, the media session entry is updated according to the media message.  [2] The method for preventing a media agent from being attacked by a hacker according to claim 1, wherein the media proxy device records the authentication code in a media session entry created according to the call signaling, and The media session entry is identified as having no learning completion status.  [3] The method for preventing a media agent from being attacked by a hacker according to claim 2, wherein the media agent device determines that the media session entry needs to be learned includes:  The media proxy device matches the destination IP address and port of the received media packet with the destination IP address and port recorded in the media session entry;  After the matching is successful and the matched media session entry is not in the learning completion state, it is determined that the media session entry needs to be learned.  [4] The method of claim 3, wherein the method further comprises:  When the destination IP address and port of the media packet match the destination IP address and port recorded in the media session entry, and the matched media session entry is in the learning completion state, the media proxy device removes the media report. The authentication code in the text forwards the media message according to the matched media session entry.  [5] The method for preventing a media agent from being attacked by a hacker according to claim 1, wherein the updating, by the media proxy device, the media session entry comprises: the media proxy device updating the media session The source address and port in the entry. [6] 6. The device for preventing a media agent from being attacked by a hacker, wherein the device comprises: a record identification module, configured to: after receiving the call signaling, randomly generate and record an authentication code, and output the generated authentication. Code and received call signalling; The adding module is configured to receive the authentication code and the call signaling sent by the generated record identification module, add the received authentication code to the received call signaling, and output a call signaling media message with the added authentication code. a sending module, configured to receive call signaling sent by the adding module, parse an authentication code from the received call signaling, and send a media packet that includes an authentication code;  The media packet forwarding processing module is configured to receive the media packet sent by the media packet sending module, and determine that the media session entry needs to be learned, and the authentication code carried in the media packet and the authentication of the record are After the code is matched, the media session entry is updated according to the media message. [7] The device for preventing a hacker from being attacked by a hacker according to claim 6, wherein the generating the record identification module comprises:  An allocating unit, configured to allocate an IP address and a port of the transmission media message according to the call signaling, and output the allocated IP address and port information;  a media session entry establishing unit, configured to receive an IP address and port information sent by the allocating unit, and establish a media session entry according to the IP address and the port information;  And a recording unit, configured to record the randomly generated authentication code into a media session entry established by the media session entry establishment unit.  [8] The apparatus for preventing a media agent from being attacked by a hacker according to claim 7, wherein the media message forwarding processing module comprises:  a matching unit, configured to match an IP address and a port of the media packet with an IP address and a port in the media session entry, and if the matching succeeds, send the media packet to the comparison unit, if the matching is unsuccessful, Discard the received media message;  The comparing unit is configured to receive the media packet sent by the matching unit, compare the authentication code in the media packet with the authentication code in the matched media session entry, and update the two authentication codes if they are consistent The unit sends a message for updating the media session entry, and if the two authentication codes are inconsistent, discarding the received media message;  And an update unit, configured to receive a message sent by the comparison unit, and update a media session entry established by the media session entry establishment unit. [9] 9. A media proxy device, wherein the media proxy device comprises: Generating a record identification module, configured to: after receiving the call signaling, randomly generate and record an authentication code, and output the generated authentication code and the received call signaling; The adding module is configured to receive the authentication code and the call signaling sent by the generated record identification module, add the received authentication code to the received call signaling, and send the call signaling with the added authentication code to the terminal; a media packet forwarding processing module, configured to receive a media packet sent by the terminal, and after determining that the media session entry needs to be learned, and the authentication code carried in the media packet matches the recorded authentication code, according to The media message updates the media session entry.  10. A terminal device, the terminal device comprising: The media message sending module is configured to receive the call signaling sent by the media proxy device, parse the authentication code from the received call signaling, and send the media message including the authentication code to the media proxy device.