KR20160045411A - Apparatus and method for preventing error traffic on a international phone call - Google Patents

Abstract

A method for preventing damage to the abnormal call traffic due to the international call according to an embodiment of the present invention includes a flow entry for performing a basic filtering policy for the SIP protocol in order to reduce the load of the controller and the abnormal traffic damage prevention system according to the unnecessary packet processing Setting in the switch; The packet received by the switch is checked for the existence of a flow entry set in the switch, the packet is processed according to the action determined when the flow satisfying the matching condition of the flow entry occurs, and the packet is transmitted to the traffic damage prevention system step; When traffic satisfying the matching field is generated, the flow is delivered to the international call abnormal traffic damage prevention system, and the system first determines whether it is a SIP protocol for packet processing; If abnormal traffic existing in the black list is generated, it is checked whether abnormal traffic generated in the black list exists in the black list. Setting idle_timeout of the flow entry unset; And setting the idle_timeout in the flow entry of the abnormal traffic considering that the abnormal traffic is generated for the first time if it is not present in the black list.

Description

TECHNICAL FIELD [0001] The present invention relates to a system and a method for preventing traffic damage caused by an international call,

[0001] The present invention relates to a system and method for preventing traffic disruption caused by an international telephone call, and more particularly, to a SIP (Session Initiation Protocol) used in Voice over Internet Protocol (VoIP) in a Software Defined Network (SDN) ) Protocol packet detection and a packet processing method in case of abnormal traffic of an international call.

In recent years, the standardization of technology for efficiently operating the communication system by separating the traffic forwarding function of the switch and the control function of the switch has been carried out by the ONF (Open Networking Foundation), IETF (Internet Engineering Task Force), ETSI ISG NFV ) And International Telecommunications Union Telecommunication (ITU-T).

In particular, Software Defined Network (SDN) refers to a user-centered network in which a user has control authority regardless of basic network equipment such as a router or a switch, and a separate software controller controls traffic flow.

One of the technologies of software defined networks, Openflow, is a method in which an Openflow controller in a network is controlled by a procedure such as creating / changing / deleting a flow table of an openflow switch And controls the operation of the switch. In other words, it is a protocol for interacting with the data transfer function (Data Plane) by separating the control plane from the physical network to control how the data packet is transferred through the network.

Here, the flow table is a table in which a flow entry defining a processing action (action) for a packet conforming to a predetermined matching field is registered. The action of the flow entry is a processing operation for processing a packet according to a preset breakdown, and various settings such as dropping as well as routing (routing) the packet to the setting area can be specified.

In addition, with the spread of broadband Internet, Internet telephone users are increasing. Accordingly, Internet telephony via various types of systems such as IP-PBX, CALL BOX, or Softphone has become popular. In particular, telephone systems of such systems are widely used not only in large enterprises but also in SMEs.

However, since the access medium is used by the Internet, it provides an environment that can be easily accessed by anyone, and is becoming a target of hackers all over the world. Especially, system hacking cases due to inattention of equipment management due to lack of security consciousness are increasing .

This is a reality that the examples and scale of the damages are getting more and more easily to be able to get access to billing cases ranging from millions of won to tens of thousands of won through media.

If the telecommunication carrier identifies illegal calls by hacking, etc. in accordance with the amendment of the terms of use of Internet telephony service in 2013, the provision of the "international call interception blocking" clause has been newly established, In addition, the future creation science division plans to launch "corporate security rating disclosure" in the second half of 2014.

However, even in this environment, many enterprises and service providers have limitations in controlling and managing abnormal traffic due to various hacking attempts and hacking.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide a method and apparatus for detecting a Session Initiation Protocol (SIP) packet used for Internet telephony in a software defined network environment and for controlling packets for abnormal traffic when abnormal traffic is detected among detected SIP packets And how to apply system and control policies.

A method for preventing damage to the abnormal call traffic due to the international call according to an embodiment of the present invention includes a flow entry for performing a basic filtering policy for the SIP protocol in order to reduce the load of the controller and the abnormal traffic damage prevention system according to the unnecessary packet processing Setting in the switch; The packet received by the switch is checked for the existence of a flow entry set in the switch, the packet is processed according to the action determined when the flow satisfying the matching condition of the flow entry occurs, and the packet is transmitted to the traffic damage prevention system step; When traffic satisfying the matching field is generated, the flow is delivered to the international call abnormal traffic damage prevention system, and the system first determines whether it is a SIP protocol for packet processing; If abnormal traffic existing in the black list is generated, it is checked whether abnormal traffic generated in the black list exists in the black list. Setting idle_timeout of the flow entry unset; And setting idle_timeout in the flow entry of the abnormal traffic considering that the abnormal traffic is generated for the first time when it is not present in the black list.

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the problems of the related art. The present invention classifies SIP protocol of incoming traffic in an open flow based software defined network environment and processes abnormal traffic detected through an abnormal traffic detection system of classified SIP packets can do.

1 is a block diagram schematically illustrating a configuration of a system for a SIP protocol filtering based on a software defined network and a generated abnormal traffic processing according to an embodiment of the present invention.
2 is a flowchart illustrating an abnormal traffic management method for preventing abnormal traffic damage based on a software defined network according to an exemplary embodiment of the present invention.
3 is a block diagram illustrating a flow of a control policy for flow control according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Hereinafter, a system and a method for preventing traffic damage to an international call of an Internet telephone according to an embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram schematically illustrating a configuration of a system for filtering SIP (Session Initiation Protocol) based on a software defined network according to an embodiment of the present invention and processing the generated international call abnormal traffic.

Referring to FIG. 1, the switch 100 is not limited to the type, position, and role of a switch, and refers to a plurality of switches 100 located in all networks.

 The plurality of switches 100 are connected to the controller 200, and the controller 200 is connected to the international call abnormal traffic damage prevention system 300 for detecting and controlling traffic of the international internet call abnormal traffic.

 The plurality of switches 100 have a flow table, and the flow table defines how the switch 100 handles a flow corresponding to a matching condition by a flow entry have.

At this time, when the switch 100 transmits a plurality of packets determined to be the Internet telephony protocol to the international call abnormal traffic damage prevention system 300, the SIP detection unit 310 filters the accurate SIP protocol. The thus filtered SIP packet detects whether or not the traffic is abnormal in the international Internet call through the abnormal traffic detection unit 320. The abnormal traffic detected in the SIP packet is generated through the flow control unit 330 by the controller 200 ).

Upon receiving the flow control policy, the controller 200 causes the plurality of switches 100 or the individual switches 100 to set flow entries for flow control. At this time, the flow of the abnormal traffic can be controlled by the flow entry set in the plurality of or the switches 100.

Here, the flow entry includes timeouts, a priority, a matching field, and an action field value, and each field has a plurality of items. Explain it.

FIG. 2 is a flow chart illustrating a method of transmitting a packet from a software-defined network-based switch to an international internet telephone anomaly detection system 300 and detecting whether an abnormal traffic occurs in the SIP protocol by filtering the SIP protocol among received packets. And a flow of a policy requesting blocking of the detected abnormal traffic.

2, a flow entry for performing a basic filtering policy for the SIP protocol is set in the switch 100 in order to reduce the load incidence of the controller 200 and the abnormal traffic damage prevention system 300 according to the unnecessary packet processing .

The packet entering the switch confirms whether the flow entry exists in the switch (S101) and processes the packet according to the action determined when the flow satisfying the matching condition of the flow entry occurs. In particular, (300).

At this time, the flow entry is divided into timeouts, a priority, a matching field, and actions. The timeout consists of idle timeout and hard timeout. The matching fields are input port, ethernet type, source mac address (src mac) ), The destination MAC address (dst mac), the source ip address (src ip), the destination ip address (dst ip), the source port (src port), and the destination port (dst port) . In addition, actions to be performed include setting various information such as a flow drop, a transfer to a specific port, a destination change (modify dst ip), etc., and process the packet. Are shown in Table 1.

Table 1 shows one embodiment in which a flow entry for confirming whether or not a SIP protocol is established. In this embodiment, most Internet telephone protocols use the "50xx" port as the destination port when accessing the call processing server. Using this point, Table 1 shows that when the ethernet type is IP, the destination port (dst port) is 5060, and the protocol is udp, among the traffic that is input to the input port 1, And delivers the packet to a specific output port 2. Here, the output port is transmitted to the port 300 when the traffic satisfying the matching field is generated, and then transmitted to the system 300 for preventing damage to the abnormal traffic due to the international call.

When traffic satisfying the matching field is generated, the flow is transmitted to the international call abnormal traffic damage prevention system 300, and the system first determines whether it is a SIP protocol for packet processing (S103).

An example for judging the SIP protocol at this time is shown in Table 2 below.

In Table 2, based on the details defined in the Request For Comments (RFC), a working document of the Internet Engineering Task Force (IETF), the Internet protocol uses the IP protocol, the Request-Line and the Status There is always a CRLF (Carriage-Return Line-Feed) between the end of the line or between the message-header and the message-body.

The SIP version information exists at a specific location of the Request-Line and the Status-Line, and the SIP protocol can be filtered by checking whether the main method exists in the Request-Line.

This can be easily implemented by programming as shown in Table 3 below, which is an example for confirming Table 2 above.

If abnormal traffic is present, it is checked whether the generated abnormal traffic exists in the black list (S107). If abnormal traffic exists in the black list, The idle_timeout of the flow entry is not yet set in consideration of the abnormal traffic that has occurred even before (S109).

If it is not present in the black list, idle_timeout is set in the flow entry of the abnormal traffic in consideration of the occurrence of the abnormal traffic for the first time (S111).

Here, idle_timeout is the time that the flow entry can be kept unmatched. By setting idle_timeout in this manner, the result detected by the first abnormal traffic can be utilized as a method for compensating the false rate of blocking normal traffic for a long time due to a false alarm.

If the same traffic is continuously generated, the setting flow entry is likely to be abnormal traffic. If the normal traffic is low, the probability of re-occurrence is low. Therefore, the setting flow entry is maintained without matching during the idle_timeout setting time, and the corresponding flow entry is automatically deleted after the idle_timeout setting time The traffic block can be released.

This can be used as a safety device for enhancing the detection reliability of the international call abnormal traffic detection unit 320. The set value of idle_timeout used at this time is used by setting the optimal value by analyzing the occurrence pattern.

When the idle_timeout setting is completed, the international call abnormal traffic damage prevention system 300 generates a flow control policy for controlling the generated abnormal traffic (S113).

Table 4 is an embodiment for setting a flow entry as a policy for abnormal traffic control. (When idle_timeout is set)

Table 4 shows that when the abnormal traffic does not exist in the black list after abnormal traffic detection, the idle_timeout value is set (S111) and the corresponding flow entry is a flow entry for control, so that the priority of the other flow entry is higher than the priority , And a matching field value for identifying the abnormal traffic is set.

A variety of information such as an ethernet type, a source / destination MAC address, a source / destination ip address, and a source / destination port can be set as a matching field for checking abnormal traffic from a higher level. 4], the input port is 1, the ethernet type is 0x0800, the source ip address (src ip) is 10.10.1.1, the destination port (dst port) is 5060, and the protocol is udp If the matching condition is satisfied, an action is performed to drop the packet. At this time, if idle_timeout is 300 seconds and there is no flow matching for the matching condition for 5 minutes, the corresponding flow control entry is automatically deleted, and the processing priority for matching is the highest priority than other flow entries. The priority is a settable highest value when the priority variable is set to uint16_t.

In addition, as a method for processing the generated abnormal traffic, a packet is processed by various actions as shown in [Table 4], such as dropping the corresponding flow as the action setting details of the segment created in [Table 4] .

At this time, the international call abnormal traffic damage prevention system 300 transfers the flow control policy for abnormal traffic control to the controller managing the switch in which the traffic is generated (S115 or S117). However, considering that abnormal traffic may be generated in a plurality of peripheral switches even in the case of the same abnormal traffic, the flow control policy for abnormal traffic control may be sent only to the controller (controller A) (Controller B, controller C) or specific controllers (S117).

The flow control policy received from the abnormal traffic detection system may set a control policy flow entry only in the switch in which abnormal traffic is generated in each controller (S119), or may be set to a plurality of switches (S121).

This can increase the reliability of the abnormal traffic control because the abnormal traffic can be generated in a plurality of switches. In addition, the control policies are applied to a plurality of switches collectively to load the abnormal traffic damage prevention system 300 or the controller detection and control management Can be reduced. Further, by setting a control policy on an unnecessary switch, it is possible to effectively manage degradation of processing performance of the switch.

As a result, the abnormal flow is controlled by the control flow entry set in the switch (S123).

Table 5 is a method of selecting a controller or a switch object that has transmitted a flow control policy as a description of the flow control request (S115, S117) method after the flow control policy creation (S113). This is because a group of switches or controllers can be grouped and a flow control policy can be easily transferred to (1: 1), (1: n) and (1: all) It is possible to effectively and at the same time prevent the transmission of the signal.

In Table 5, it is assumed that the control target to receive the flow control policy is a switch-aware controller, a variety of groups set in advance by service type (Seoul, Busan, Daejeon ...) and subscriber type (enterprise, home, It can be applied collectively by type. The group set as described above may be applied to various types of groups according to requirements of an operator or a business operator as an embodiment.

Table 6 is an example of setting up a group for implementing Table 5, and it is assumed that a plurality of switches or controllers are simultaneously controlled with abnormal traffic generated in a single network according to types of control objects, service providers and operators, Can be inherently blocked from the network.

Table 7 is an example of a message to apply a flow control policy to switches (control objects) classified into a home subscriber (subscriber type) located in Busan area (service area).

This policy not only reduces the load on the controller and switch, but also reduces the overflow problem of many flow entries set in the future.

FIG. 3 is a diagram showing a flow of a flow control policy according to an embodiment as shown in Table 7, which is an embodiment in which a flow control policy can be applied only to a home subscriber located in Busan.

At this time, the controller periodically checks the count field value of the switch, and if the matching condition exceeds the threshold value within a predetermined time period (S125), the controller transmits the flow information to the abnormality of the international Internet telephone abnormal traffic damage prevention system 300 Traffic blacklist.

Field values that can distinguish the corresponding flow information of the upper layer can be set to a unique value that can distinguish the abnormal traffic by various field values such as a source ip address, a destination ip address, a source port, a destination port, and a protocol.

100: Switch 200: Controller
300: International call abnormal traffic damage prevention system 310: SIP detection unit
320: abnormal traffic detection unit 330: flow control unit

Claims (1)

Setting a flow entry in a switch for performing a basic filtering policy for a SIP protocol in order to reduce a load of a controller and an abnormal traffic damage prevention system in response to an unnecessary packet processing;
The packet received by the switch is checked for the existence of a flow entry set in the switch, the packet is processed according to the action determined when the flow satisfying the matching condition of the flow entry occurs, and the packet is transmitted to the traffic damage prevention system step;
When the traffic satisfying the matching field is generated, the flow is transmitted to the international call abnormal traffic damage prevention system 300, and the system first determines whether it is a SIP protocol for packet processing.
If abnormal traffic existing in the black list is generated, it is checked whether abnormal traffic generated in the black list exists in the black list. Setting idle_timeout of the flow entry unset;
Setting idle_timeout in a flow entry of the abnormal traffic considering that the abnormal traffic is generated for the first time when it is not present in the black list;
Upon completion of the idle_timeout setting, the international traffic abnormal traffic damage prevention system generates a flow control policy for controlling the generated abnormal traffic.
The flow control policy for the abnormal traffic control is transmitted to the controller for managing the switch in which the corresponding traffic is generated. Considering that abnormal traffic may be generated in a plurality of peripheral switches even in the same abnormal traffic, The control policy may be sent only to a controller that is in charge of the switch, or to a plurality of controllers or specific controllers in the vicinity;
The flow control policy received from the abnormal traffic detection system sets the flow control entry for the control policy only to the switch in which abnormal traffic is generated in each controller or sets the flow control entry to a plurality of switches. Controlling the corresponding flow by:
The controller periodically checks the count field value of the switch. If the matching condition matches the threshold value within a predetermined time, the controller adds the flow information to the abnormal traffic black list of the international internet telephone abnormal traffic damage prevention system A method for preventing traffic damage over an international call, including steps.

Images