Denial of service protection for IP telephony systems
A system and method for protecting components of an IP telephony network whereby a protection scheme is enabled upon detection of resource exhaustion within the network that prevents delivery of incoming messages. Resource exhaustion may result from denial of service attacks and/or malfunctions in automated dialing systems. Once a protection scheme is enabled, the system activates mechanisms for identifying calling parties that are suspected of contributing to the resource exhaustion condition. These suspected calling parties may be placed in a blocked sender list, either manually or automatically. Calling parties may be presented with a challenge function in order to determine whether the call is being made by an automated dialing system. The system blocks incoming calls from calling parties identified in the blocked sender list either permanently or for a specified time duration. The protection scheme remains enabled for a specified duration or until the resource exhaustion condition has subsided.
1. A method for protecting one or more components of an IP (Internet Protocol) telephony network, comprising:
monitoring incoming calls directed towards an enterprise calling system that is provided IP telephony calling by the IP telephony network wherein each incoming call originates from a caller, wherein the enterprise calling system is assigned a call capacity comprising a plurality of communication channels;
monitoring resource exhaustion within the enterprise calling system by monitoring a number of available communication channels from the plurality of communication channels assigned for use by the enterprise calling system within the IP telephony network; and
enabling a protection scheme when the resource exhaustion monitoring indicates the available call capacity has dropped below a first threshold; wherein the enabled protection scheme further comprises:
identifying a suspect caller that has attempted to complete multiple incoming calls to the enterprise calling system;
determining whether the suspect caller is identified in a suspect caller list, wherein each suspect in the suspect caller list is associated with a duration;
adding the suspect caller to a suspect caller list when the suspect caller is not identified in the suspect caller list, wherein the duration associated with the suspect caller is set to a first duration;
extending the duration associated with the suspect caller when the suspect caller is identified in the suspect caller list; and
blocking incoming calls from suspect callers in the suspected caller list until the expiration of the duration associated with the suspect caller.
2. The method of claim 1 , wherein the enabled protection scheme further comprises:
presenting a first challenge action to a caller identified in the suspected caller list, wherein the first challenge action determines whether the caller is an automated calling system;
evaluating a response provided to the first challenge action by the identified suspect caller; and
moving the identified suspect caller from the suspected caller list to a blocked caller list, when the evaluation determines that the identified suspect caller has not provided a correct response to the first challenge action.
3. The method of claim 2 , wherein the enabled protection scheme further comprises:
blocking incoming calls from suspect callers identified in the blocked caller list.
4. The method of claim 1 , wherein the enabled protection scheme further comprises:
providing information regarding callers placed on the suspected caller list to a user; and
receiving input from the user, wherein the input directs movement of a caller from the suspected caller to a blocked caller list.
5. The method of claim 3 , wherein the protection scheme is enabled for the enterprise calling system for a second time duration and is disabled when the second time duration expires.
6. The method of claim 1 , wherein the protection scheme remains enabled for the enterprise calling system until it is determined that the number of available communication channels assigned for use by the enterprise calling system exceeds the first threshold.
7. The method of claim 2 , the method further comprising:
presenting a second challenge action to a caller identified in the suspected caller list, wherein the second challenge action requires a manual input by the caller; and wherein the first challenge action requires a verbal response from the caller.
8. A tangible computer-readable storage device having program instructions stored thereon that, upon execution by a computer system for protecting a plurality of enterprise calling systems served by an IP telephony network, cause the computer system to:
monitor incoming calls directed towards an enterprise calling system of the plurality of enterprise calling systems that is provided IP telephony calling by the IP (Internet Protocol) telephony network wherein each incoming call originates from a sender, wherein the enterprise calling system is assigned a call capacity comprising a plurality of communication channels;
monitor resource exhaustion within the enterprise calling system by monitoring a number of available communication channels from the plurality of communication channels assigned for use by the enterprise calling system within the IP telephony network; and
enable a protection scheme when the resource exhaustion monitoring indicates the available call capacity has dropped below a first threshold, wherein the executed program instructions of the enabled protection scheme further cause the computer system to:
identify a suspect sender that has attempted to complete multiple incoming calls to the enterprise calling system;
determine whether the suspect caller is identified in a suspect caller list, wherein each suspect in the suspect caller list is associated with a duration;
add the suspect caller to a suspect caller list when the suspect caller is not identified in the suspect caller list, wherein the duration associated with the suspect caller is set to a first duration;
extending the duration associated with the suspect caller when the suspect caller is already identified in the suspect caller list; and
block incoming calls from suspect callers in the suspected caller list until the expiration of the duration associated with the suspect caller.
9. The tangible computer-readable storage device of claim 8 , wherein the program instructions, upon execution by the computer system, further cause the computer system to:
present a first challenge action to a sender identified in the suspected sender list, wherein the first challenge action determines whether the sender is an automated calling system;
evaluate a response provided to the first challenge action by the identified suspect sender; and
move the identified suspect sender from the suspected sender list to a blocked sender list, when the evaluation determines that the identified suspect sender has not provided a correct response to the first challenge action.
10. The tangible computer-readable storage device of claim 9 , wherein the program instructions, upon execution by the computer system, further cause the computer system to:
block incoming calls from suspect callers identified in the blocked caller list.
11. The tangible computer-readable storage device of claim 8 , wherein the program instructions, upon execution by the computer system, further cause the computer system to:
provide information regarding senders placed on the suspected sender list to a user; and
receive input from the user, wherein the input directs movement of a sender from the suspected sender list to a blocked sender list.
12. The tangible computer-readable storage device of claim 10 , wherein the protection scheme is enabled for the enterprise calling system for a second time duration and is disabled when the second time duration expires.
13. The tangible computer-readable storage device of claim 8 , wherein the protection scheme remains enabled for the enterprise calling system until it is determined that the number of available communication channels assigned for use by the enterprise calling system exceeds the first threshold.
14. The tangible computer-readable storage device of claim 9 , wherein the program instructions, upon execution by the computer system, further cause the computer system to:
present a second challenge action to a sender identified in the suspected sender list, wherein the second challenge action requires a manual input by the caller; and wherein the first challenge action requires a verbal response from the sender.
15. A system, comprising:
one or more processors; and
a memory device coupled to the one or more processors, the memory device storing computer-readable instructions that, upon execution by the one or more processors, cause the system to:
monitor incoming calls directed towards an enterprise calling system that is provided IP telephony calling by the IP telephony network wherein each incoming message originates from a sender, wherein the enterprise calling system is assigned a call capacity comprising a plurality of communication channels;
monitor resource exhaustion within the enterprise calling system by monitoring a number of available communication channels from the plurality of communication channels assigned for use by the enterprise calling system within the IP telephony network; and
enable a protection scheme when the resource exhaustion monitoring indicates the available call capacity has dropped below a first threshold, wherein the executed program instruction of the enabled protection scheme further cause the system to:
identify a sender that has attempted to complete multiple incoming calls to the enterprise calling system;
determine whether the sender is identified in a suspect caller list, wherein each suspect in the suspect caller list is associated with a duration;
add the sender caller to a suspect caller list when the sender is not identified in the suspect caller list, wherein the duration associated with the sender is set to a first duration;
extend the duration associated with the sender when the sender is already identified in the suspect caller list; and
block incoming calls from suspect callers in the suspected caller list until the expiration of the duration associated with the sender.
16. The system of claim 15 , wherein the system is further configured to:
present a first challenge action to a sender identified in the suspected sender list, wherein the first challenge action determines whether the sender is an automated calling system;
evaluate a response provided to the first challenge action by the identified suspect sender; and
move the identified suspect sender from the suspected sender list to a blocked sender list, when the evaluation determines that the identified suspect sender has not provided a correct response to the first challenge action.
17. The system of claim 16 , wherein the system is further configured to:
block incoming calls from suspect callers identified in the blocked caller list.
18. The system of claim 15 , wherein the system is further configured to:
provide information regarding senders placed on the suspected sender list to a user; and
receive input from the user, wherein the input directs movement of a sender from the suspected sender list to a blocked sender list.
19. The system of claim 17 , wherein the protection scheme is enabled for the enterprise calling system for a second time duration and is disabled when the second time duration expires.
20. The system of claim 15 , wherein the protection scheme remains enabled for the enterprise calling system until it is determined that the number of available communication channels assigned for use by the enterprise calling system exceeds the first threshold.