Mechanism for identifying malicious content, DoS attacks, and illegal IPTV services

#1. Technical Field of the Invention

#The invention relates generally to network security; and, more particularly, it relates to providing security within networks whose content includes Internet protocol television (IPTV) streams.

#2. Description of Related Art

#FIG. 1 is a diagram illustrating an embodiment of a network that services Internet Protocol Television (IPTV) content.

#FIG. 2 is a diagram illustrating an alternative embodiment of a network that services IPTV content and includes protection from external attacks.

#FIG. 3 is a diagram illustrating an alternative embodiment of a network that services IPTV content and includes protection from internal attacks.

#A novel security mechanism is presented herein that protects a network servicing Internet Protocol Television (IPTV) streams from internal as well as external attacks. Whereas prior art approaches are incapable of dealing with insider attacks such as denial of service (DoS) attacks and illegal IPTV services (e.g., service stealing, etc.), the security mechanisms presented herein allow protection of an IPTV network's infrastructure (e.g., keeping devices therein from being infected with malicious programs such as worms, trojans, viruses, malware, spyware, BOTs (or botnets), etc.). In addition, the security mechanisms presented herein can protect an IPTV service provider's investment by preventing theft of IPTV services by insiders (e.g., legitimate subscribers of IPTV content who may steal and/or re-sell their legitimately acquired IPTV content to non-subscribers). Not only do the security mechanisms presented herein provide for protection of an IPTV network from both internal and external attack, but they also provide for stemming the promulgation of malicious programs outside of the network.

#Pro-active security mechanisms for the monitoring of IP multicast groups carrying broadcast TV channels (e.g., IPTV services) is employed, and when suspicious activity is detected, then appropriate actions may be taken. For example, when an intrusion prevention system (IPS) (e.g., which may be implemented, at least in part, using a security appliance (SA) in accordance with an embodiment as described herein) encounters suspicious behavior, then appropriate actions may be taken pro-actively to perform any of a number of desired security actions such as blocking control messages to and/or from a suspected infected device, blocking an IPTV stream from being broadcast, continuing to monitor an IPTV stream, continuing to monitor control messages, and/or some other security action, etc.

#One mechanism by which security functions may be effectuated is for the IPS to subscribe to the same multicast groups that are being subscribed by users. This way, the IPS has access to and can monitor the content within the very same IPTV streams to which users as exposed. To perform accurate inspection of the individual packets within an IPTV stream, deep packet inspection (DPI) can be employed by the IPS. Currently, DPI has the ability to perform packet inspection up to Layer-7 at near line speed using various techniques (e.g., signature-based worm detection, anomaly-based worm detection, a hybrid thereof, or some other technique). In addition, anti-virus, anti-spyware, and other functions can also be performed within such an IPS.