Secure media address learning for endpoints behind NAPT devices
View Patent ↗A first media packet from a first endpoint of an access network behind a NAPT device is received by a media device between a core network and the access network. The first media packet includes a first source IP address and port combination identifying the first endpoint. An UPDATE request or a reINVITE request is transmitted by the media device. A second IP address and port combination for the media device to receive future media packets from the first endpoint is negotiated. The media device compares a first IP address of the first source IP address and port combination to a second IP address of a second source address and port combination for a second media packet received on the second IP address and port combination. If the first and second IP addresses match, the media device relays media packets from the core network to the first endpoint.
1. A method of operating a media device, comprising:
transmitting an UPDATE request or a reINVITE request corresponding to a user session having a first endpoint that uses a first IP address and port combination of the media device as part of said user session;
negotiating, during the user session, a second IP address and port combination for the media device to receive future media packets from the first endpoint during said user session;
receiving on the second IP address and port combination of the media device, during the user session, a second media packet from a second endpoint, the second media packet including a second source IP address and port combination identifying the second endpoint;
comparing a first IP address of a first source IP address and port combination to a second IP address of the second source IP address and port combination for the second media packet received on the second IP address and port combination; and
taking an action based on the result of said comparing.
2. The method of claim 1 , wherein said media device is located between a core network and an access network, the method further comprising:
receiving, prior to transmitting said UPDATE request or said reINVITE request, on a first IP address and port combination of the media device, during said user session, a first media packet from said first endpoint, said first endpoint being located on said access network behind a network address and port translation (NAPT) device of the access network, said first media packet including said first source IP address and port combination identifying the first endpoint.
3. The method of claim 2 , further comprising:
storing, in memory included in said media device, information associating said first IP address and port combination with said user session.
4. The method of claim 2 , wherein taking an action based on the result of said comparing includes, if the first IP address matches the second IP address, relaying the second media packet from the core network to the first endpoint on the access network using the second source IP address and port combination.
5. The method of claim 2 , wherein the first source IP address and port combination of the first media packet is an IP address and port combination assigned to the first endpoint by the NAPT device.
6. The method of claim 2 , further comprising:
if the first IP address does not match the second IP address, determining, by the media device between the core network and the access network, if the first media packet and the second media packet include the same configurable IPv4 subnet value or IPv6 subnet value; and
if the same configurable IPv4 subnet value or IPv6 subnet value is present in both the first media packet and the second media packet, relaying media packets from the core network to the first endpoint on the access network using the second source IP address and port combination.
7. The method of claim 6 , further comprising:
if a same configurable IPv4 subnet value or the IPv6 subnet value is not present in the first media packet and the second media packet, determining, by the media device between the core network and the access network, if the second IP address is in a trusted category or a suspect category for source IP addresses; and
if the second IP address is in the trusted category, relaying, by the media device, media packets from the core network to the first endpoint on the access network using the second source IP address and port combination.
8. The method of claim 7 , further comprising:
if the second IP address is not in the trusted category and if the second IP address is not in the suspect category, relaying, by the media device, media packets from the core network to the first endpoint on the access network using the second source IP address and port combination.
9. The method of claim 7 , further comprising:
if the second IP address is in the suspect category, relaying, by the media device, media packets from the core network to the first endpoint on the access network using a third source IP address and port combination of a third media packet received on the second IP address and port combination.
10. The method of claim 1 , further comprising:
receiving, by the media device between the core network and the access network, a plurality of media packets on the second IP address and port combination, the plurality of media packets including the second media packet from the second endpoint; and
categorizing, by the media device, source addresses for the plurality of media packets in a trusted category or a suspect category.
11. The method of claim 10 , further comprising:
if the first source IP address and port combination does not match the second source IP address and port combination and if either (i) the second IP address is in the trusted category or (ii) the second IP address is not in the trusted category and is not in the suspect category, relaying, by the media device between the core network and the access network, media packets from the core network to the first endpoint on the access network using the second IP address and port combination.
12. The method of claim 10 , further comprising:
determining, by the media device, an amount of time for a duration of a call associated with the plurality of media packets; and
if the duration is shorter than a predetermined amount of time, categorizing the source addresses for the plurality of media packets in the suspect category.
13. The method of claim 1 , further comprising:
deactivating, by the media device between the core network and the access network, at least one port of the media device;
receiving, by the media device, at least one media packet on the deactivated port; and
classifying, by the media device, the source of the at least one media packet received on the deactivated port as not trusted.
14. The method of claim 1 , further comprising:
receiving, by the media device between the core network and the access network, during a first time period, a first plurality of media packets from the first endpoint on the first IP address and port combination, the first plurality of media packets including the first media packet;
receiving, by the media device, during a second time period, a second plurality of media packets on the second IP address and port combination, the second plurality of media packets including the second media packet;
comparing, by the media device, the first time period and the second time period; and
determining, by the media device, whether the first plurality of media packets or the second plurality of media packets are transmitted by an attacker outside the network address and port translation device.
15. A media device, the media device being configured to:
transmit an UPDATE request or a reINVITE request corresponding to a user session having a first endpoint that uses a first IP address and port combination of the media device as part of said user session;
negotiate, during the user session, a second IP address and port combination for the media device to receive future media packets from the first endpoint during said user session;
receive, on the second IP address and port combination of the media device, during the user session, a second media packet from a second endpoint, the second media packet including a second source IP address and port combination identifying the second endpoint;
compare a first IP address of a first source IP address and port combination to a second IP address of the second source IP address and port combination for the second media packet received on the second IP address and port combination; and
take an action based on the result of said comparing.
16. The media device of claim 15 , wherein said media device is located between a core network and an access network, the media device being further configured to:
receive, prior to transmitting said UPDATE request or said reINVITE request, on a first IP address and port combination of the media device, during said user session, a first media packet from said first endpoint, said first endpoint being located on said access network behind a network address and port translation (NAPT) device of the access network, said first media packet including the first source IP address and port combination identifying the first endpoint.
17. The media device of claim 16 , wherein the media device is further configured to:
store, in memory included in said media device, information associating said first IP address and port combination with said user session.
18. The media device of claim 16 , wherein said media device is configured to, relay the second media packet from the core network to the first endpoint on the access network using the second source IP address and port combination, if the first IP address matches the second IP address, as part of being configured to take an action based on the result of said comparing.
19. The media device of claim 15 , wherein the first source IP address and port combination of the first media packet is an IP address and port combination assigned to the first endpoint by the NAPT device.
20. A computer program product, tangibly embodied in a computer readable storage device of a media device, the computer program product including instructions which when executed by a processor cause said processor to:
transmit an UPDATE request or a reINVITE request corresponding to a user session having a first endpoint that uses a first IP address and port combination of the media device as part of said user session;
negotiate, during the user session, a second IP address and port combination for the media device to receive future media packets from the first endpoint during said user session;
receive, on the second IP address and port combination of the media device, during the user session, a second media packet from a second endpoint, the second media packet including a second source IP address and port combination identifying the second endpoint;
compare a first IP address of a first source IP address and port combination to a second IP address of the second source IP address and port combination for the second media packet received on the second IP address and port combination; and
take an action based on the result of said comparing.