Methods, devices, and systems for providing dynamic protection against amplification attacks
View Patent ↗Methods, devices, and systems for providing dynamic protection against amplification attacks are described herein. One communications method includes receiving, at a session border controller (SBC), a first request message from a peer device that does not have an assigned trust level, determining, based on a type of communication that is received from the peer device, whether the peer device should be classified as an untrusted level, semi-trusted level, or trusted level peer device, and assigning the classification to the peer device for use in subsequent communications with the peer device.
1 . A communications method, the communications method comprising:
receiving, at a session border controller (SBC), a first request message from a peer device that does not have an assigned trust level;
determining, based on a type of communication that is received from the peer device, whether to classify the peer device as an untrusted level, semi-trusted level, or trusted level peer device;
assigning the classification to the peer device for use in subsequent communications with the peer device;
processing a packet flow from the peer device using a policer corresponding to the assigned classification;
processing the packet flow from the policer and a number of packet flows from a number of policers using an aggregate policer, wherein a plurality of policers include the policer and the number of policers and a plurality of packet flows include the packet flow from the policer and the number of packet flows from the number of policers, wherein the policer admits the packet flow and the number of policers admit the number of packet flows, and wherein the aggregate policer adds a mark to a different number of packet flows of the plurality of packet flows which evaluates from which of the plurality of policers fill rate violations occur;
limiting an aggregate fill rate of the plurality of packet flows to a maximum rate of packet flows using the aggregate policer, wherein the maximum rate of packet flows is a maximum rate for downstream application processing; and
admitting the packet flow of the plurality of packet flows based on the packet flow from the policer using the aggregate policer.
2 . The method of claim 1 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) invite type message, determining to classify the peer device as trusted.
3 . The method of claim 1 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) subscribe type message, determining to classify the peer device as trusted.
4 . The method of claim 1 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) invite type message, determining to classify the peer device as semi-trusted until a subsequent SIP message having a context of the SIP invite type message is received from the peer device, then updating the assigned classification to trusted.
5 . The method of claim 1 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) subscribe type message, determining to classify the peer device as semi-trusted until a subsequent SIP message having a context of a Session Initiation Protocol (SIP) invite is received from the peer device, then updating the assigned classification to trusted.
6 . The method of claim 1 , wherein assigning a semi-trusted or untrusted classification to the peer device results in messages or packets received from the peer device by the SBC to be processed at a lower priority to those from trusted peer devices.
7 . A session border controller (SBC) comprising:
a processor and memory wherein the memory includes instructions that are executable by the processor to:
receive a first request message from a peer device that does not have an assigned trust level;
determine, based on a type of communication that is received from the peer device, whether to classify the peer device as an untrusted level, semi-trusted level, or trusted level peer device;
assign the classification to the peer device for use in subsequent communications with the peer device;
process a packet flow from the peer device using a policer corresponding to the assigned classification;
process the packet flow from the policer and a number of packet flows from a number of policers using an aggregate policer, wherein a plurality of policers include the policer and the number of policers and a plurality of packet flows include the packet flow from the policer and the number of packet flows from the number of policers, wherein the policer admits the packet flow and the number of policers admit the number of packet flows, and wherein the aggregate policer adds a mark to a different number of packet flows of the plurality of packet flows which evaluates from which of the plurality of policers fill rate violations occur;
limit an aggregate fill rate of the plurality of packet flows to a maximum rate of packet flows using the aggregate policer, wherein the maximum rate of packet flows is a maximum rate for downstream application processing; and
admit the packet flow of the plurality of packet flows based on the packet flow from the policer using the aggregate policer.
8 . The SBC of claim 7 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) type message referring to a topmost record-route peer device, determining to classify the peer device as trusted, based on a reference to the topmost record-route peer device.
9 . The SBC of claim 7 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) invite type message, determining to classify the peer device as semi-trusted until a subsequent SIP message being an in-dialog request matching a dialog of the first request message and sent from a topmost record-route peer device, then updating the assigned classification to the peer device to trusted.
10 . The SBC of claim 7 further comprising:
wherein when the first request message is a Session Initiation Protocol (SIP) subscribe type message, determining to classify the peer device as semi-trusted until a subsequent SIP message having a context of a Session Initiation Protocol (SIP) invite is received from the peer device, then updating the assigned classification to trusted.
11 . The SBC of claim 7 further comprising:
wherein the peer device is a first peer device and when the first request message is an invite message referencing a second peer device that is a topmost record-route peer device, determining to classify the first peer device as semi-trusted until a subsequent SIP message having a context of the invite message is received from the first peer device, then updating the assigned classification to the first peer device to trusted.
12 . The SBC of claim 7 further comprising:
wherein the peer device is a first peer device and when the first request message is a Session Initiation Protocol (SIP) subscribe type message, determining to classify the first peer device as semi-trusted until a subsequent SIP message having a context of a Session Initiation Protocol (SIP) invite is received from the first peer device, then updating the assigned classification to the first peer device to trusted and wherein there is a second peer device that is topmost record-route peer device and determining to classify the second peer device as semi-trusted until a different subsequent SIP message being an in-dialog request matching a dialog of the first request message and sent from the topmost record-route peer device, then updating the assigned classification to the second peer device to trusted.
13 . The SBC of claim 7 , wherein the policer is for untrusted packet flows, semi-trusted packet flows, or trusted packet flows.
14 . A non-transitory computer readable medium including processor executable instructions which when executed by a processor included in a session border controller control the session border controller to perform the following operations:
receive, at the session border controller, a first request message from a peer device that does not have an assigned trust level;
determine, based on a type of communication that is received from the peer device, whether to classify the peer device as an untrusted level, semi-trusted level, or trusted level peer device;
assign the classification to the peer device for use in subsequent communications with the peer device;
process a packet flow from the peer device using a policer corresponding to the assigned classification;
process the packet flow from the policer and a number of packet flows from a number of policers using an aggregate policer, wherein a plurality of policers include the policer and the number of policers and a plurality of packet flows include the packet flow from the policer and the number of packet flows from the number of policers, wherein the policer admits the packet flow and the number of policers admit the number of packet flows, and wherein the aggregate policer adds a mark to a different number of packet flows of the plurality of packet flows which evaluates from which of the plurality of policers fill rate violations occur;
limit an aggregate fill rate of the plurality of packet flows to a maximum rate of packet flows using the aggregate policer, wherein the maximum rate of packet flows is a maximum rate for downstream application processing; and
admit the packet flow of the plurality of packet flows based on the packet flow from the policer using the aggregate policer.
15 . The non-transitory computer readable medium of claim 14 , wherein the type of communication of the first request message that is received from the peer device is one criterion for determining whether to classify the peer device as the untrusted level, semi-trusted level, or trusted level peer device, and a type of communication of a second message from the peer device is a second criterion.
16 . The non-transitory computer readable medium of claim 14 , wherein the type of communication of the first request message that is received from the peer device is used for making a first determination as to whether to classify the peer device as the untrusted level, semi-trusted level, or trusted level peer device, and a type of communication of a second message from the peer device is used for making a second determination as to whether to classify the peer device as the untrusted level, semi-trusted level, or trusted level peer device.
17 . The non-transitory computer readable medium of claim 14 , wherein the type of communication of the first request message that is received from the peer device is one criterion for determining whether to classify the peer device as the untrusted level, semi-trusted level, or trusted level peer device, and a quantity of route transfer protocol (RTP) packets exchanged with the peer device is a second criterion.
18 . The non-transitory computer readable medium of claim 14 , wherein the type of communication of the first request message that is received from the peer device is one criterion for determining whether to classify the peer device as the untrusted level, semi-trusted level, or trusted level peer device, and a quantity of route transfer protocol (RTP) packets exchanged over a predetermined time period with the peer device is a second criterion.
19 . The non-transitory computer readable medium of claim 18 , wherein the quantity of RTP packets exchanged is greater than a threshold value in order for the peer device to be classified as the trusted level peer device.