System and method for prevention of denial of service attacks for hosted network address translator
View Patent ↗To determine the correct media stream to latch onto, the system and method uses a hashing algorithm to uniquely identify a legitimate media stream. A first invite message is received at a Session Border Controller (SBC) to establish a communication session. For example a Session Initiation Protocol (SIP) INVITE is received. The first invite message comprises a first hash of a fingerprint. For example, the hash may be a hashed session key. A media message is received that contains the fingerprint to establish a media stream for the communication session. A second hash is created using the fingerprint in the media message. The first hash is compared to the second hash. In response to the first hash matching the second hash, a Network Address Translator (NAT) latches to an address and/or a port in the media message. Thus, the correct media stream is associated with the communication session.
1. A method comprising:
receiving, by a processor, a first invite message to establish a first communication session, wherein the first invite message comprises a first hash of a first fingerprint;
receiving, by the processor, a media message, containing the first fingerprint, to establish a media stream for the communication session;
creating, by the processor, a second hash using the first fingerprint in the media message;
comparing, by the processor, the first hash to the second hash; and
in response to the first hash matching the second hash, latching to an address and/or a port in the media message.
2. The method of claim 1 , further comprising:
in response to the first hash not matching the second hash, not latching to the address or the port in the media message.
3. The method of claim, 1 wherein the first hash uses at a hashing algorithm that is one of the following: BLAKE-256, BLAKE-512, ECOH, GOST, HAS-160, HAVAL, JH, MD2, MD4, MD5, MD6, RadioGatun, RIPEMD, RIPEMD-128, RIPEND-160, RIPEMD-320, SHA-1, SHA-3 SHA-224, SHA-256, SHA-512, Skein, SipHash, Snefru, Spectral Hash, SWIFFT, Tiger, or Whirlpool.
4. The method of claim 1 , wherein the first communication session is one of a Session Initiation Protocol (SIP) communication session, an H.323 communication session, or a Web Real-Time Communication (WebRTC) communication session.
5. The method of claim 1 , wherein the first invite message is a first Session Initiation Protocol (SIP) INVITE message, wherein the media message is a Real-time Transport Protocol (RTP) or a Secure RTP (SRTP) message, and wherein the first communication session is a SIP communication session.
6. The method of claim 5 , wherein the first hash is sent in a SIP header in the first SIP INVITE.
7. The method of claim 5 , further comprising:
receiving a second SIP INVITE to establish a second SIP communication session, wherein the second SIP INVITE comprises a second hash of a second fingerprint, wherein the second fingerprint is different from the first fingerprint.
8. The method of claim 5 , wherein the first fingerprint is sent in a payload of the RTP or SRTP message.
9. The method of claim 5 , wherein the first hash is sent in a Session Description Protocol (SDP) <fmt>header in the first SIP INVITE message.
10. The method of claim 9 , wherein the SDP <fmt>header has an additional header that indicates a presence of the first hash.
11. A session border controller comprising:
a microprocessor; and
a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that cause the microprocessor to:
receive a first invite message to establish a first communication session, wherein the first invite message comprises a first hash of a first fingerprint, receive a media message containing the first fingerprint to establish a media stream for the communication session, create a second hash using the first fingerprint in the media message, compare the first hash to the second hash, and latch to an address and/or a port in the media message in response to the first hash matching the second hash.
12. The session border controller of claim 11 , wherein the instructions further cause the microprocessor to not latch to the address or the port in the media message in response to the first hash not matching the second hash.
13. The session border controller of claim 11 , wherein the first communication session is one of a Session Initiation Protocol (SIP) communication session, an H.323 communication session, or a Web Real-Time Communication (WebRTC) communication session.
14. The session border controller of claim 11 , wherein the first invite message is a first Session Initiation Protocol (SIP) INVITE message, wherein the media message is a Real-time Transport Protocol (RTP) or a Secure RTP (SRTP) message, and wherein the first communication session is a SIP communication session.
15. The session border controller of claim 14 , wherein the first hash is sent in a SIP header in the first SIP INVITE.
16. The session border controller of claim 14 , wherein the instructions further cause the microprocessor to receive a second SIP INVITE to establish a second SIP communication session and wherein the second SIP INVITE comprises a second hash of a second fingerprint, wherein the second fingerprint is different from the first fingerprint.
17. The session border controller of claim 14 , wherein the first fingerprint is sent in a payload of the RTP or SRTP message.
18. The session border controller of claim 14 , wherein the first hash is sent in a Session Description Protocol (SDP) <fmt>header in the first SIP INVITE message.
19. The session border controller of claim 18 , wherein the SDP <fmt>header has an additional header that indicates a presence of the first hash.
20. A communication device comprising:
a microprocessor; and
a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that cause the microprocessor to:
generate a hash of a fingerprint; and
send an invite message that comprises the hash of a fingerprint to a Session Border Controller (SBC), wherein the invite message is to establish a communication session, and send a media message to the SBC that includes the fingerprint, wherein the SBC uses the hash of the fingerprint and the fingerprint to determine whether to latch to an address and/or a port in the media message.