Abstract:
Disclosed is a device for dropping an attack multimedia packet. An object of the invention is to provide a device, a system and a method for dropping an attack multimedia packet, capable of filtering RTP packets received to selectively drop an attack multimedia packet, thereby providing a stable multimedia service. According to the invention, the received RTP packet is filtered to selectively drop an attack multimedia packet, so that it is possible to provide a stable multimedia service.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims all benefits of Korean Patent Application No. 10-2007-0119850 filed on Nov. 22, 2007 in the Korean Intellectual Property Office, the disclosures of which are incorporated herein by reference. 
       BACKGROUND 
       [0002]    1. Technical Field 
         [0003]    The present invention relates to a device, a system and a method for dropping an attack multimedia packet, and more particularly, to a device, a system and a method for dropping an attack multimedia packet, capable of effectively dropping an attack multimedia packet so as to normally provide a multimedia service using the RTP. 
         [0004]    2. Description of the prior art 
         [0005]    The RTP (Real-time Transport Protocol) is a transport layer protocol for transmitting/receiving voice data in real time and is performed between terminals. The RTP is typically used as an upper protocol of the UDP (User Datagram Program). 
         [0006]    The multimedia packets for internet telephone, video communication and the like are generally transported through the RTP. While a session is set up and the RTP packets are transmitted through the SIP or H.323 protocol, an attacker may insert any RTP packet into a data stream to cause a failure in the terminal or to have an influence on a service quality. 
         [0007]      FIG. 1  shows a RTP message format that is used to transmit multimedia contents. 
         [0008]    The following describes each field of a RTP message format with reference to  FIG. 1 . V (version) indicates a version of the RTP protocol and P (padding) indicates whether the message includes a padding. X (extension) indicates whether a header is extended or not and CC (CSRC counter) indicates the number of CSRC. 
         [0009]    M (marker) indicates a marking bit for allowing an event in a packet stream such as frame boundary and PT (payload type) indicates a RTP payload format (audio, video and the like) and can be changed at the middle of the session. 
         [0010]    The sequence number is a number that is increased by one (1) for each RTP packet transmitted, is used to detect a packet loss and to recover a packet sequence and has any initial value. 
         [0011]    The time stamp indicates a first octet instance sampling in the RTP data packet, is induced from the clock that is sequentially increased for the purpose of synchronization and Jitter calculation, and has any initial value. 
         [0012]    The SSRC is a value for identifying a synchronization source, is selected as any value and is an inherent value that is used to identify the RTP stream session. The CSRC list is a list of identified values (SSRC) for a corresponding source when performing the communication with many persons (it is processed in a mixer for processing many call contents) and maximum 15 lists can be provided. 
         [0013]    Among the RTP message field values, the SSRC is a unique value for identifying the RTP session. The time stamp and the sequence number are the important fields indicating that the transmission is made in the normal sequence and time. Hence, the above values are importantly used to determine whether the packet is arbitrarily generated by an attacker on the data stream of the RTP packets. 
         [0014]    When an attacker transmits an attack multimedia packet for attack threat, damage is caused in the RTP packet processing system, in the form of failure of service or denial of service, for example. 
         [0015]    When an attacker generates and transmits any RTP packet to a service using/via system, thereby giving rise to excessive traffic, the failure of service is caused. Many attack packets may be discarded in the level of the protocol or application program. However, due to the processing of many packets, the service quality may be deteriorated or the failure of service may be caused. 
         [0016]    In the RTP insertion attack as an alternative attack type, an attacker monitors a RTP signal through the sniffing and checks the UDP port number and the SSRC (Synchronization Source), which are used by an object for which the attack is made, thereby supposing the increased value thereof. When a next session is generated, both a normal packet and a spoofed packet are generated/transmitted, during the call, to process the media traffics of the attacker, thereby interrupting the call. As the application processes the spoofed packet, the unwanted contents are reproduced or the normal packet is discarded, so that the reproduction may not be made for a predetermined period. 
       SUMMARY OF THE DISCLOSURE 
       [0017]    Accordingly, the present invention has been made to solve the above problems. An object of the invention is to provide a device, a system and a method for dropping an attack multimedia packet, capable of filtering RTP packets received to selectively drop an attack multimedia packet, thereby providing a stable multimedia service. 
         [0018]    In order to achieve the above object, there is provided a device for dropping an attack multimedia packet. The device comprises an IP/Port blacklist that registers and manages IP/Port information that is an object for dropping; a blacklist filter that refers to the IP/Port blacklist for the IP/Port information registered therein and drops a received RTP packet when the IP/Port information conforms to an IP/Port of the received RTP packet; a non-registration session RTP packet filter that compares the IP/Port and SSRC of the RTP packet filtered in the blacklist filter with IP/Port information and SSRC information of a normal user registered, thereby selectively dropping the RTP packet; a registration session memory that provides IP/Port information and SSRC information of a normal user registered of a RTP packet having a call set normally to the non-registration session RTP packet filter; and a spoofed RTP packet filter that calculates differences between a time stamp and a sequence number of the received RTP packet and a time stamp and a sequence number of a RTP packet received just previously, thereby selectively dropping the received RTP packet, based on the calculated values. 
         [0019]    According to an embodiment of the invention, there is provided a system for dropping an attack multimedia packet. The system comprises a transmit terminal; a receive terminal that receives a RTP packet transmitted from the transmit terminal to receive a multimedia service; a call setup device that exchanges a call initiating signal and call information between the transmit terminal and the receive terminal; and a device for dropping an attack multimedia packet that examines the RTP packet transmitted from the transmit terminal to drop a malicious RTP packet. The device for dropping an attack multimedia packet comprises an IP/Port blacklist that registers and manages IP/Port information that is an object for dropping; a blacklist filter that refers to the IP/Port blacklist for the IP/Port information registered therein and drops a received RTP packet when the IP/Port information conforms to an IP/Port of the received RTP packet; a non-registration session RTP packet filter that compares the IP/Port and SSRC of the RTP packet filtered in the blacklist filter with IP/Port information and SSRC information of a normal user registered, thereby selectively dropping the RTP packet; a registration session memory that provides IP/Port information and SSRC information of a normal user registered of a RTP packet having a call set normally to the non-registration session RTP packet filter; and a spoofed RTP packet filter that calculates differences between a time stamp and a sequence number of the received RTP packet and a time stamp and a sequence number of a RTP packet received just previously, thereby selectively dropping the received RTP packet, based on the calculated values. 
         [0020]    According to an embodiment of the invention, there is provided a method for dropping an attack multimedia packet. The method comprises the steps of: (a) comparing an IP/Port of RTP packet received through a call setup route with IP/Port information of an attacker registered, thereby selectively dropping the received RTP packet; (b) comparing IP/Port and SSRC of the received RTP packet having passed to the step of (a), based on IP/Port and SSRC information of a normal user registered of a RTP packet received through a normal call setup route, thereby selectively dropping the RTP packet; and (c) calculating differences between a time stamp and a sequence number of the received RTP packet and a time stamp and a sequence number of a RTP packet received just previously, thereby selectively dropping the received RTP packet, based on the calculated values. 
         [0021]    According to the invention, the received RTP packets are filtered, so that an attack multimedia packet is selectively dropped. As a result, it is possible to provide a stable multimedia service. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]    The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: 
           [0023]      FIG. 1  shows a RTP message format that is used to transmit multimedia contents; 
           [0024]      FIG. 2  is a block diagram showing a structure of a system for dropping an attack multimedia packet according to an embodiment; 
           [0025]      FIG. 3  is a block diagram showing a structure of a device for dropping an attack multimedia packet according to an embodiment; and 
           [0026]      FIGS. 4   a  to  4   c  are flow charts showing method for dropping an attack multimedia packet according to an embodiment. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0027]    Hereinafter, a preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. 
         [0028]      FIG. 2  is a block diagram showing a structure of a system for dropping an attack multimedia packet according to an embodiment. 
         [0029]    Referring to  FIG. 2 , a system for dropping an attack multimedia packet comprises a transmit terminal  210 , a receive terminal  220 , a call setup device  230  and a device  240  for dropping an attack multimedia packet. 
         [0030]    The transmit terminal  210  transmits a call request message to the call setup device  230  so as to provide a multimedia service to the receive terminal  220 . 
         [0031]    The call setup device  230  comprises a proxy server (not shown) that forwards the call request message to the receive terminal  220  that is an object for call. 
         [0032]    The receive terminal  220  receives the call request message and transmits a call accepting message to the proxy server when it wants to receive the multimedia service. 
         [0033]    The proxy server forwards the call accepting message to the transmit terminal  210 . As a result, a call setup is completed, so that a route is set up which enables an actual call through RTP packets between the transmit terminal  210  and the receive terminal  220 . 
         [0034]    The device  240  for dropping an attack multimedia packet is disposed between the transmit terminal  210  and the receive terminal  220 , examines RTP packets transmitted from the transmit terminal  210  to drop a malicious RTP packet. The device  240  for dropping an attack multimedia packet should have a function of proxying all the RTP packets on the transmit/receive route of the RTP packets. 
         [0035]    Here, since the call setup route and the transmit route of the RTP packets are independent each other, the call setup device  230  goes via a specific point of the device  240  for dropping an attack multimedia packet during the call setup process so as to receive all the RTP packets. Since the device  240  for dropping an attack multimedia packet is connected with the call setup device  230  through an interface, it can receive call setup information that is set normally through the corresponding interface. 
         [0036]    In general, since the SBC (Session Border Controller) “proxies” the RTP packets, it is possible to apply the device  240  for dropping an attack multimedia packet to front and rear ends of the SBC, or to mount the function of the device  240  for dropping an attack multimedia packet to the SBC system. 
         [0037]      FIG. 3  is a block diagram showing a structure of a device for dropping an attack multimedia packet according to an embodiment. 
         [0038]    Referring to  FIG. 3 , the device  240  for dropping an attack multimedia packet comprises a blacklist filter  241 , an IP/Port blacklist  242 , a non-registration session RTP packet filter  243 , a registration session memory  244  and a spoofed RTP packet filter  245 . 
         [0039]    A security manager considers specific IP/Port information as an attacker and registers it in the IP/Port blacklist  242  so as to drop a malicious attack multimedia packet, based on the IP/Port information of the RTP packet. 
         [0040]    The blacklist filter  241  compares the IP/Port information registered in the IP/Port blacklist  242  with an IP/Port of the RTP packet received and drops a RTP packet having IP/Port information conforming to the IP/Port information registered as an attacker. 
         [0041]    The RTP packet filtered through the blacklist filter  241  passes through the non-registration session RTP packet  243 . When the received RTP packet is a non-registration session RTP packet whose call is not set normally and that is arbitrarily generated by an attacker, based on the IP/Port information registered as a normal user and the SSRC information of the RTP packet, the non-registration session RTP packet filter  243  drops the corresponding packet. 
         [0042]    Here, the non-registration session RTP packet filter  243  shares the call setup information with an equipment such as soft switch for session setup, IMS, gate keeper, SIP proxy, SBC and the like. 
         [0043]    The registration session memory  244  receives and stores/manages the information about the call set normally from the equipment such as soft switch for session setup, IMS, gate keeper, SIP proxy, SBC and the like. The device  240  for dropping an attack multimedia packet updates and stores the sequence number and time stamp values in the registration session memory  244  whenever processing the RTP packet. 
         [0044]    The registration session memory  244  and the non-registration session RTP packet filter  243  are connected with each other through an interface. When there is no SSRC value, as a result of referring to the registration session memory for the registration session, this may correspond to a case where a RTP session is generated and a first RTP packet is received. Accordingly, when there is no SSRC value, the non-registration session packet filter  243  does not drop the RTP packet, stores the SSRC of the RTP packet in the registration session memory  244  and forwards the RTP packet to a next process. 
         [0045]    The spoofed RTP packet filter  245  drops a spoofed RTP packet. An attacker has acquired the RTP stream session information through the sniffing, and has generated the spoofed RTP packet to process the corresponding RTP packet in the receive terminal  220 . The spoofed RTP packet filter  245  filters the spoofed RTP packet, based on the field values of the time stamp and the sequence number of the RTP packet received. 
         [0046]    The time stamp indicates a first octet instance sampling in a RTP packet, is induced from the clock that is sequentially increased for the purpose of synchronization and Jitter calculation, and has any initial value. For example, if several continuous packets are generated at the same time in the same video frame information, these packets may have the same time stamp. 
         [0047]    The spoofed RTP packet filter  245  refers to the registration session memory  244  for the session information registered therein so as to refer to the sequence numbers and the time stamps of the RTP packets received up to the just previous time. 
         [0048]    Then, when a difference between the stored time stamp and the time stamp of the received RTP packet is larger than a previous increase unit, the spoofed RTP packet filter  245  drops the received RTP packet. Since the packet may be a packet that exceeds a sampling unit first step and is likely to be arbitrarily generated by an attacker, the transmission thereof is delayed for a long time, so that it may be discarded in the application layer or may be reproduced in the application program. 
         [0049]    In the meantime, the sequence number is a number that is increased by one (1) for each RTP packet transmitted. When the sequence number deviates from a range of indicated thresholds, as compared to the stored sequence number value, or is same the sequence number of the RTP packet already received, the packet is dropped. 
         [0050]    Although the sequence numbers may not arrive sequentially on a packet transmit route, the packet having the high extent thereof is considered as a packet that is arbitrarily generated by an attacker, so that the corresponding packet is dropped. 
         [0051]    Among the RTP packets having passed the dropping process by the time stamp and the sequence number, a packet whose sequence number is increased but time stamp is decreased or a packet whose sequence number is decreased but time stamp is increased is considered as a packet that is arbitrarily generated by an attacker, so that the corresponding RTP packet is dropped. 
         [0052]    As described above, the device  240  for dropping an attack multimedia packet filters the RTP packets through the blacklist filter  241 , the non-registration session RTP packet filter  243  and the spoofed RTP packet filter  245 , so that it can drop the RTP packet that is maliciously generated by an attacker. 
         [0053]    The following specifically describes a method for dropping an attack multimedia packet according to the invention. 
         [0054]      FIGS. 4   a  to  4   c  are flow charts showing method for dropping an attack multimedia packet according to an embodiment of the invention. 
         [0055]    Referring to  FIG. 4   a,  a RTP packet is received in the blacklist filter  241  through a call setup route (S 402 ). The blacklist filter  241  refers to the IP/Port blacklist  242  for the IP/Port information registered as an attacker therein (S 404 ) and compares it with the IP/Port information of the RTP packet received (S 406 ). The specific IP/Port information may be set as a blacklist manually by a security manager or automatically by a security device such as IPS (Intrusion Prevention System). 
         [0056]    As a result of the comparison, when the IP/Port information registered as an attacker conforms to the IP/Port information of the RTP packet received, the corresponding RTP packet is dropped (S 408 ). The comparison is carried out for all the IP/Port information registered as an attacker in the IP/Port blacklist  242  (S 410 ). When the IP/Port of the RTP packet received does not conform to the IP/Port information registered in the IP/Port blacklist  242 , a next process continues (S 412 ). 
         [0057]    Referring to  FIG. 4   b,  when the RTP packet is received in the non-registration session RTP packet filter  243  (S 414 ), the non-registration session RTP packet filter  243  refers to the registration session memory  244  for the IP/Port registered as a normal user therein and the SSRC of the RTP packet (S 416 ). Here, the non-registration session RTP packet filter  243  shares the call setup information that is set normally from the call setup device  230  or a call setup attack detection/drop dedicated security equipment. 
         [0058]    Then, the non-registration session RTP packet filter checks whether the IP/Port of the RTP packet conforms to the IP/Port registered as a normal user in the registration session memory  244  (S 418 ). When they conform to each other, a next process continues. The process of checking whether the IP/Port of the RTP packet is registered is carried out for all the IP/Port registered in the registration session memory  244  (S 420 ). 
         [0059]    Then, the non-registration session RTP packet filter  243  compares the SSRC information of the received RTP packet with the SSRC registered in the registration session memory  244  to check whether they conform to each other (S 424 ). When the SSRC information of the received RTP packet conforms to the registered SSRC, a next process continues. When the SSRC information of the received RTP packet does not conform to the SSRC registered, then it is checked whether the packet is a RTP first received after a RTP session is generated (S 426 ). When the packet is a RTP packet first received after a RTP session is generated, it is newly registered in the registration session memory  244  (S 428 ). When the packet is not a RTP packet first received, it is dropped (S 422 ). 
         [0060]    Referring to  FIG. 4   c,  when the spoofed RTP packet filter  245  receives the RTP packet (S 432 ), the spoofed RTP packet filter  245  refers to the registration session memory  244  for the values of the sequence number and time stamp (S 434 ). Here, the registration session memory  244  stores the values of the sequence numbers and the time stamps of the RTP packets received up to the just previous time. 
         [0061]    Continuously, the spoofed RTP packet filter  245  calculates a difference between the stored time stamp and the time stamp of the received RTP packet (S 436 ). When the calculated difference is larger than the previous increase unit, the spoofed RTP packet filter  245  drops the corresponding packet (S 438 ). This is because the packet may be a packet that exceeds a sampling unit first step and is likely to be arbitrarily generated by an attacker, so that it may be partially reproduced, as described above. When the calculated difference is smaller than the previous increase unit, a next step continues, so that it is determined whether a difference between the stored sequence number and the sequence number of the received RTP packet is within a range of thresholds (S 440 ). Although the sequence numbers may not arrive sequentially on a packet transmit route, the packet having the high extent thereof is considered as a packet that is arbitrarily generated by an attacker. Hence, when the difference deviates from the range of thresholds, the packet is considered as a spoofed RTP packet, so that the corresponding packet is dropped. When the difference is within the range of thresholds, a next step continues. 
         [0062]    As described above, the difference values of the sequence numbers and the time stamps are calculated to filter the RTP packet. Then, among the RTP packets having passed the filtering process, it is determined whether the sequence number of the packet is increased but the time stamp thereof is decreased or whether the sequence number of the packet is decreased but the time stamp thereof is increased (S 442 ). If so, since the packet is likely to be arbitrarily generated by an attacker, the corresponding RTP packet is dropped (S 438 ). 
         [0063]    When both the sequence number and the time stamp are sequentially increased or decreased together, a next step continues (S 444 ), so that a process of transmitting the RTP packet to the receive terminal  220  is continued. 
         [0064]    While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made thereto without departing from the spirit and scope of the invention as defined by the appended claims.