JP6158750B2 - Communications system - Google Patents

Description

  The present invention relates to a technique for dealing with an attack on a communication system.

  Conventionally, in communication using SIP, a SIP server and a subscriber have a one-to-one correspondence, and information on subscribers accommodated in each SIP server is stored.

  In addition, when a subscriber (malicious attacker) launches a DoS attack against a SIP server, the SIP server individually copes with the attack by determining the attack / blocking the attack / locking out the subscriber. .

  On the other hand, in a form in which User Profile Server Function (UPSF) is introduced and subscriber information is collectively managed, and the SIP server sequentially inquires the subscriber information from the UPSF, the SIP server and the subscriber are N-to-1 correspondence. A person can be accommodated in any SIP server.

  Therefore, an attacker who performs a DoS attack can continuously attack the SIP servers by changing the accommodated SIP servers one after another. Even in this case, it is possible for each SIP server to cope with the attack by individually performing an attack determination / blocking attack / subscriber lockout.

JP 2007-060379 A

  However, when an attacker attacks a SIP server continuously, each SIP server independently performs a series of attack countermeasures such as attack determination / attack block / subscriber lockout, which is inefficient. .

  The present invention has been made in view of the above, and an object of the present invention is to more efficiently deal with attacks in a communication system that collectively manages subscriber information.

  A communication system according to the present invention includes a plurality of call connection devices and a subscriber information management device, and the call connection device acquires subscriber information from the subscriber information management device and accommodates subscribers. The call connection device comprises: a registration means for inquiring subscriber information from the subscriber information management device when the registration request is received from the subscriber terminal and accommodating the subscriber terminal; and the call connection device. Determination means for determining an attack against itself, and notification means for transmitting a notification including information on an attacker to the subscriber information management device when it is determined that the determination means is attacked, and The subscriber information management device receives an inquiry including information on the attacker from the call connection device and manages the attacker information, and receives an inquiry about the subscriber information from the call connection device. When If the subscriber is not managed as an attacker in the attacker information management means, the subscriber information is returned to the call connection device, and if the subscriber is managed as an attacker, the subscriber Subscriber information return means that does not return the information of the subscriber.

  ADVANTAGE OF THE INVENTION According to this invention, it can respond to an attack more efficiently in the communication system which manages subscriber information collectively.

It is a figure which shows the structure of the communication system in this Embodiment, and the flow of a process of a DoS attack countermeasure.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of a communication system and a flow of DoS attack countermeasure processing in the present embodiment. The communication system shown in the figure includes a subscriber information management device 1 and a plurality of call connection devices 2A to 2C. The call connection devices 2A to 2C inquire and acquire the subscriber information from the subscriber information management device 1. A subscriber terminal is connected to each of the call connection devices 2A to 2C. The call connection devices 2A to 2C and the subscriber terminals have an N-to-1 correspondence, and the subscriber terminals can be accommodated in any of the call connection devices 2A to 2C. In FIG. 1, subscribers A, B, and C are shown, and it is assumed that subscriber C is a malicious attacker and subscribes to a plurality of telephone numbers. Hereinafter, each device will be described.

  The subscriber information management device 1 is installed in the IP network and includes a subscriber information storage unit 13 to store subscriber information. The subscriber information reply unit 11 responds to inquiries from the call connection devices 2A to 2C. Subscriber information is provided to the call connection devices 2A to 2C. The subscriber information storage unit 13 stores other information (for example, a contract telephone number) in association with information that uniquely identifies the subscriber.

  In addition, the subscriber information management device 1 includes an attacker information management unit 12, and upon receiving an attack occurrence notification including information on the attacker from any of the call connection devices 2A to 2C, the attacker information management unit 12 Manage attacker information. The subscriber information return unit 11 calls the call connection when the inquiry target subscriber is managed as an attacker by the attacker information management unit 12 when the subscriber information is inquired from the call connection devices 2A to 2C. The subscriber information is not returned to the devices 2A to 2C.

  The call connection devices 2A to 2C are installed in the IP network, and when the registration unit 23 receives the location information registration request (Register) from the subscriber terminal, the subscriber information of the subscriber included in the location information registration request is added to the subscriber information. The management device 1 is inquired to accommodate the subscriber terminal. When the answer to the inquiry cannot be obtained from the subscriber information management device 1, the subscriber terminal is not accommodated. In addition, when the call connection devices 2A to 2C receive the call connection request signal from the accommodated subscriber terminal, the call connection devices 2A to 2C transmit the call connection request signal to the address information corresponding to the incoming number included in the call connection request signal, and perform communication. Establish.

  The call connection devices 2A to 2C include a determination unit 21 and a notification unit 22. When an attack is received, the call connection devices 2A to 2C deal with the attack and notify the subscriber information management device 1 that the attack has been received.

  The determination unit 21 determines whether or not an attack has been received. For example, a subscriber of a subscriber terminal that transmits a large amount of signals in a short time is determined as an attacker. The determination method may be the same as that performed by a conventional call connection device. When attacked, block against attacks and lock out attackers. The block is a process of discarding further signals without processing when the allowable number of the same signal per second exceeds a threshold value. Lockout is a process that does not accept any signal from a subscriber who is an attacker for a certain period of time. The lockout release trigger may be the same as that of a conventional call connection device.

  When the determination unit 21 determines that the attack is under attack, the notification unit 22 transmits an attack occurrence notification including the attacker information to the subscriber information management apparatus 1, and transmits the attacker information throughout the communication system. Share.

  Next, the operation of the communication system in the present embodiment will be described.

  When the subscriber C, who is a malicious attacker, performs a DoS attack on the call connection device 2A (step S11), the determination unit 21 determines that the subscriber C is under attack (step S12), and the notification unit 22 Transmits a notification of the occurrence of an attack by the subscriber C to the subscriber information management apparatus 1 (step S13).

  When the subscriber information management device 1 receives a notification of the occurrence of an attack by the subscriber C from the call connection device 2A, the attacker information management unit 12 manages the subscriber C as an attacker (step S14).

  After attacking the call connection device 2A, the subscriber C moves to the call connection device 2B, transmits a location information registration request to the call connection device 2B, and tries to register the location information (steps S15 and S16).

  The registration unit 23 of the call connection device 2B inquires the subscriber information management device 1 about the subscriber information of the subscriber C in response to the location information registration request from the subscriber terminal of the subscriber C (step S17).

  The subscriber information reply unit 11 receives an inquiry about the subscriber information of the subscriber C from the call connection device 2B, but does not reply because the subscriber C is managed as an attacker (step S18).

  The registration unit 23 of the call connection device 2B does not accommodate the subscriber terminal of the subscriber C because the subscriber information of the subscriber C cannot be obtained from the subscriber information management device 1 (step S19). Since the subscriber terminal of the subscriber C is not accommodated in the call connection device 2B, an attack on the call connection device 2B cannot be executed.

  The subscriber C further moves to another call connection device 2C and transmits a location information registration request to the call connection device 2C to attempt registration of the location information (steps S20 and S21), but the subscriber information management device 1 joins. Since the subscriber information of the subscriber C is not answered, the subscriber terminal of the subscriber C is not accommodated in the call connection device 2C (steps S22 to S24), and an attack on the call connection device 2C cannot be executed.

  As described above, according to the present embodiment, when the call connection devices 2A to 2C are attacked, the call connection devices 2A to 2C transmit an attack occurrence notification including information on the attacker to the subscriber information management device 1 to manage the subscriber information. When the attacker information management unit 12 of the device 1 receives the notification of the occurrence of the attack, it manages the attacked subscriber as an attacker, and when the subscriber information reply unit 11 receives an inquiry of subscriber information from the call connection devices 2A to 2C. If the inquired subscriber is an attacker, the subscriber information is not answered, so that the subscriber who attacked one of the call connection devices 2A to 2C is shared by the entire communication system as an attacker. Since the subscriber terminals are not accommodated in the call connection devices 2A to 2C, the attacker cannot continuously attack the call connection devices 2A to 2C, and more efficient countermeasures are possible.

DESCRIPTION OF SYMBOLS 1 ... Subscriber information management apparatus 11 ... Subscriber information reply part 12 ... Attacker information management part 13 ... Subscriber information storage part 2A-2C ... Call connection apparatus 21 ... Determination part 22 ... Notification part 23 ... Registration part

Claims (1)

A plurality of call connection devices and a subscriber information management device, wherein the call connection device is a communication system that acquires subscriber information from the subscriber information management device and accommodates subscribers;
The call connection device includes:
Registration means for receiving information about a subscriber from the subscriber information management device when receiving a registration request from a subscriber terminal and accommodating the subscriber terminal;
Determining means for determining an attack on the call connection device itself;
A notification means for transmitting a notification including information on an attacker to the subscriber information management device when it is determined that the determination means is being attacked,
The subscriber information management device includes:
Attacker information management means for receiving information including attacker information from the call connection device and managing attacker information;
When there is an inquiry about subscriber information from the call connection device, if the subscriber is not managed as an attacker in the attacker information management means, the subscriber information is returned to the call connection device. And a subscriber information return means which does not return the subscriber information when the subscriber is managed as an attacker.