KR20070104633A - Methods and devices for protecting core networks - Google Patents

Abstract

The present invention drops message 302, 402 by receiving 202, 402, 402 the message including the mobile identity of MS 104, and whenever the received mobile identity does not match the stored mobile identity with respect to MS 104. And 210 to provide a method and apparatus for protecting core network 102. Messages 302 and 402 are processed whenever the received mobile identity matches the stored mobile identity with respect to MS 104 (208). The mobile identity can be IMSI, TMSI or P-TMSI. The messages 302 and 402 are uplinks such as mobility management (MM) messages, universal packet radio service (GPRS) mobility management (GMM) messages, or UMA or unauthenticated radio resource (URR) messages (used only between MS and UNC). Message or downlink message. The invention can be implemented as a computer program for use on a computer readable medium, where several method steps are implemented by one or more code segments.

Description

METHOD AND APPARATUS FOR PROTECTING A CORE NETWORK}

TECHNICAL FIELD The present invention generally relates to the field of mobile communications, and more particularly, to a method and apparatus for protecting a core network by verifying the mobile identity of a mobile station within an unauthorized mobile access network.

Unlicensed network controller (UNC) and unauthenticated network controller security gateway (UNC-SGW) when the mobile station (MS) establishes an IPsec secured connection to the UNC-SGW, and when the MS is registered with the UNC. The Unlicensed Mobile Access (UMA) specification suggests that the same International Mobile Subscriber Identity (IMSI) must ensure that an Unlicensed network controller secure gateway is used. In two such examples, the MS provides IMSI to UNC-SGW and UNC respectively. However, the implementation of this presentation also exposes the core network to attack.

This is also the case for what is known as "general access to A and Gb-interfaces" in the 3rd Generation Partnership Project (3GPP) standard, or otherwise general access network (GAN). See 3GPP Technical Specifications 43.318 (Step-2) and 44.319 (Step-3). Note that the generic access network controller (GANC) in the 3GPP specification is the same as the UNC in the UMA specification. Similarly, the generic access network controller security gateway (GANC-SEGW) in the 3GPP specification is identical to the UNC-SGW in the UMA specification.

For example, MS uses Temporary Mobile Subscriber Identities (TMSI) or Packet Temporary Mobile Subscriber Identities (P-TMSI) to provide personal computers with SIM-card readers and UMA clients. Emulate multiple mobile stations, such as PC). In addition, an inappropriate MS may send a location update or IMSI detach message to the core network causing a type of denial of service (DoS) attack (such as failing to terminate a call) on the MS-level. Accordingly, there is a need for a method and apparatus for protecting a core network by identifying the mobile identities (IMSI, TMSI and / or P-TMSI) used by the mobile stations when they communicate with the core network.

The present invention relates to mobile identities used by mobile stations (international mobile subscriber identity (IMSI), temporary mobile subscriber identity (TMSI) and / or packet temporary mobile subscriber identity (P-TMSI)) when mobile stations communicate with the core network. It provides a method and apparatus for protecting a core network by identifying. In short, messages containing a mobile identity that do not correspond to the stored mobile identity with respect to the MS (after registration) are dropped. Once this message is dropped, various preventive reporting actions can be taken. Therefore, the MS is allowed to use only one IMSI, one TMSI and / or one P-TMSI. As a result, the present invention protects the core network from deliberate and faulty implementations. The present invention is applicable to unauthorized mobile access network (UMAN) and GANs.

In particular, the present invention provides a method of protecting a core network by receiving a message that includes a mobile identity of an MS and dropping the message whenever the received mobile identities do not match the stored mobile identities with respect to the MS. The message is processed whenever the received mobile identity does not match the stored mobile identity with respect to the MS. The mobile identity can be IMSI, TMSI and / or P-TMSI. The message is either an uplink message or a downlink, such as a mobility management (MM) message, a universal packet radio service (GPRS) mobility management (GMM) message, or a UMA or unauthenticated radio resource (URR) message (used only between MS and UNC). It may be a link message. The invention can be implemented as a computer program for use on a computer readable medium, where several method steps are implemented by one or more code segments.

In addition, the present invention provides an apparatus including a data storage device coupled to be in communication with a processor. The data storage device stores the collection of mobile identities in the MSs. The processor receives a message that includes the MS's mobile identity and drops the message whenever the received mobile identity does not match the stored mobile identity with respect to the MS. The device is typically an unauthenticated network controller (UNC) in an unauthenticated access network (UMAN) or a general access network controller (GANC) in a general access network (GAN) that communicates with a core net.

Additional benefits and advantages of the present invention will become more apparent from the following description of various embodiments provided by way of example with reference to the accompanying drawings.

1 is an exemplary signaling sequence illustrating the use of mobile identities between a UMA network and a core network;

2 is a flow chart illustrating a method of protecting a core network in accordance with the present invention;

3 is a signaling sequence illustrating the use of one embodiment of the present invention for uplink messages;

4 is a signaling sequence illustrating the use of one embodiment of the present invention for downlink messages;

5 is a flowchart illustrating a method according to an embodiment of the present invention for an uplink message;

6 is a flowchart illustrating a method according to an embodiment of the present invention for a downlink message; And

7 is a flowchart illustrating a method according to another embodiment of the present invention for a downlink message.

While the implementation and use of various embodiments of the present invention are described below, it should be appreciated that the present invention provides a variety of acceptable inventive concepts that can be used in a wide variety of specific content. The specific embodiments discussed herein are not intended to limit the scope of the present invention but to primarily describe specific methods of making and using the invention.

In order to facilitate understanding of this invention, a number of vocabulary words are described below. The vocabulary defined herein means commonly recognized by those skilled in the art within the scope related to the present invention. Vocabulary such as "a", "an" and "the" are not intended to be merely related to a single entity but include generic classes in which specific examples may be used in the description. The terminology is used herein to describe specific embodiments of the invention, but their use is not intended to limit the invention, except as outlined in the claims.

The present invention relates to a mobile identity used by a mobile station (MSSI) when mobile stations communicate with a core network (International Mobile Subscriber Identity (IMSI), Temporary Mobile Subscriber Identity (TMSI) and / or Packet Temporary Mobile Subscriber Identity (P-TMSI). It provides a method and apparatus for protecting a core network by identifying)). Briefly, a message containing a mobile identifier that does not correspond to the stored mobile identifier for the MS (after registration) is dropped. Once this message is dropped, various preventive reporting actions can be taken. Therefore, the MS is allowed to use only one IMSI, one TMSI, and one P-TMSI. As a result, the present invention protects the core network from intentional and faulty MS implementations. Note that the present invention can be applied to both Unauthorized Mobile Access Networks (UMAN) and GANs.

Referring now to FIG. 1, an exemplary signaling sequence is shown illustrating the use of mobile identities between an unauthorized mobile access (UMA) network (UMAN) or a general access network (GAN) 100 and a core network 102. When the MS 104 sets up the IPsec secure connection 108 to face the UNC-SGW or GANC-SEGW 106, the MS 104 uses an EAP-SIM or EAP-AKA to authenticate the unauthenticated network controller (UNC). -SGW) or IMSI to the security gateway of the generic access network controller (GANC-SEGW) 106. UNC-SGW or GANC-SEGW 106 utilizes well-known signaling and authentication protocols (Authentication, Authorization and accounting (AAA) infrastructure 114) to HLR 110 Authenticate this IMSI (110). When MS 104 is registered with UNC or GANC 116 (118), MS 104 also provides IMSI to unauthorized network controller (UNC) or generic access network controller (GANC) 116. . In addition, the MS 104 uses IMSI, TMSI, or P-TMSI to identify itself when the MS 104 communicates with the core network 102 (eg, the MSC 112).

Note that TMSI and P-TMSI are not registered with UNC or GANC 116 at registration 118. TMSI and P-TMSI are only weighted within the location area. Outside the location area, TMSI and P-TMSI must be combined with location area identifiers (LAIs) to provide explicit identities. TMSI or P-TMSI reallocation is always performed at least on each change in location area. These choices are left to the network operator.

The mobile identity is used in the following mobility management (MM) message between the MS 104 and the MSC / Visitor Location Register (VLR) 112.

From MS 104 to MSC / VLR 112 (uplink message):

LOCATION UPDATING REQUEST

IDENTITY RESPONSE

CM SERVICE REQUEST

IMSI DETACH INDICATION

CM RE-ESTABLISHMENT REQUEST

From MSC / VLR 112 to MS 14 (downlink message):

TMI REALLOCATION COMMAND

LOCATION UPDATING ACCEPT

The mobile identity is also used in the PAGING RESPONSE message from the MS 104 to the MSC / VLR 112. Hence, UNC or GANC 116 may perform verification on MM-messages sent between MS 104 and MSC / VLR 112.

Reference is now made to FIG. 2, which is a flowchart illustrating a method 200 of protecting the core network 102 related to the present invention. At block 202 UNC and GANC 116 receive a message that includes the mobile identity of MS 104. The UNC or GANC 116 then determines whether the received mobile identity is correct by comparing the received mobile identity with the stored mobile identity with respect to the MS 104 at block 204. If the mobile identity received at decision block 206 is determined to be correct, then the received message is processed (eg, delivered, etc.) at block 208. However, if it is determined that the received mobile identity at the decision block 206 is not correct, then the received mobile identity is dropped at the block 210. The mobile identity can be IMSI, TMSI or P-TMSI. The received message is used for mobility management (MM) messages, universal packet radio service (GPRS) mobility management (GMM) messages, or UMA or unauthenticated radio resource (URR) messages (only between MS 104 and UNC 116). May be an uplink message or a downlink message.

By performing a layer violation, that is, whether the MS 104 uses an IMSI such as that used to register with UNC or GANC 116, the core network ( Sneak into the upper layer message sent by MS 104 towards 102 to determine if it is correct. Because TMSI values are assigned by MSC / VLR 112 and P-TMSI is assigned by SGSN, UNC or GANC 116 indicates that MS 104 is using the value assigned by MSC 112. You can see that. This is again by checking the upper layer downlink message sent by the core network 102 to know that the TMSI value or P-TMSI value has been assigned to the MS 104 and the TMSI value or P actually assigned by the MS 104. This can be done by confirming an upper layer uplink message that it is using TMSI.

The invention may be implemented as an apparatus such as UNC or GANC 116 including a data storage device coupled to communicate with a processor. The data storage device stores the collection of mobile identities in the MS 104. The processor receives 202 a message that includes the mobile identity of the MS 104 and drops 210 the message whenever the received mobile identity does not match the stored mobile identity with respect to the MS 104. The processor may be a pre-processor, filter or other processing device in the apparatus. The data storage device can be a memory, disk drive, hard drive, or the like.

Reference is now made to FIG. 3, which shows a signaling sequence 300 illustrating the use of one embodiment of the present invention related to uplink message 302. As shown in FIG. When UNC or GANC 116 receives an uplink message 302 that includes a mobile identity, UNC or GANC 116 confirms 304 the mobile identity. If the uplink message 302 is a registration request (ie, a new MS 104), the UNC or GANC 116 stores the received mobile identity and associates it with the MS 104, and processes the received message (ie, , Will register). If the verification 304 fails, i.e., the received mobile identity does not match the stored mobile identity with respect to the MS 104, the message 302 is dropped. However, if acknowledgment 304 passes, that is, the received mobile identity matches the stored mobile identity with respect to MS 104, or if the mobile identity cannot be detected, UNC or GANC 116 returns message 302. Process (i.e., forward message 306). The mobile identity may not be detectable in some of the GMM-message and GPRS mobility management (GMM) messages between the MS 104 and SGSN, which may be computed and transmitted on the LLC-layer, UNC or GANC 116 Can't easily sneak into these messages. For example, a ROUTING AREA UPDATE REQUEST message is typically computed and sent, and the UNC or GANC 116 can perform an acknowledgment on this message.

In particular, if uplink message 302 includes an IMSI, UNC or GANC 116 confirms that this IMSI is the same as that provided by MS 104 during registration. If so, the message 306 is delivered to the core network. If different, the message is dropped. UNC or GANC 116 may also unregister MS 104 and temporarily blacklist the IP address used by MS 104. Other actions may include notifying the operator with an alarm and recording the event.

If uplink message 302 includes TMSI or P-TMSI, and UNC or GANC 116 does not store TMSI or P-TMSI for such MS 104, then TMSI or P-TMSI is determined by MS 104. Stored in the context. However, if UNC or GANC 116 has already been stored in TMSI or P-TMSI for this MS, then UNC or GANC 116 confirms that these TMSI or P-TMSI values are identical. If they are the same, the message 306 is forwarded to the core network. If they are different, the message is dropped. UNC or GANC 116 may also unregister MS 104 and temporarily blacklist the IP address used by MS 104. Other actions include using an alarm to notify the operator and record the event.

Reference is now made to Figure 4, where a signaling sequence 400 is shown illustrating the use of one embodiment of the present invention related to downlink message 402. When UNC or GANC 116 receives a downlink message 402 that includes a mobile identity, UNC or GANC 116 confirms 404 the mobile identity. If downlink message 402 includes a new mobile identity (newly assigned or replaced) for MS 104, UNC or GANC 116 stores the received mobile identity and associates it with MS 104, It will process the received message (ie, forward the message 406 to the MS 104). If the mobile identity is confirmed as being already stored (eg, already exists) for the MS 104 (404), then the received message is processed (ie, the message is passed to the MS 104). Alternatively, the mobile identity may be maintained and not stored until an uplink message is received that accepts, confirms, or completes the downlink message 402.

For example, if the downlink message is a TMSI REALLOCATION COMMAND, UNC or GANC 116 stores the TMSI value assigned to the MS 104 context. The downlink message is received upon signaling connection related to the MS 104 context. Storing TMSI in the MS 104 context is also delayed until a TMSI REALLOCATION COMPLETE message is received from the MS 104. Similarly, if downlink message 402 is LOCATION UPDATING ACCEPT and a new TMSI is assigned to MS 104, UNC or GANC 116 stores the assigned TMSI value in MS 104 context. Storing TMSI in the MS 104 context is also delayed until a TMSI REALLOCATION COMPLETE message is received from the MS 104. The process for P-TMSI REALLOCATION COMMAND is handled in the same way.

Reference is now made to Figure 5, which is a flowchart illustrating a method 500 in accordance with one embodiment of the present invention related to an uplink message. The uplink message is received at block 502. If it is determined that the received message does not include (or cannot be detected) the MS's mobile identity at decision block 504, the uplink message is processed (eg, delivered, executed, etc.) at block 506. . However, if the uplink message is determined to include the mobile identity of the MS at decision block 504, and the mobile identity is determined to be IMSI at decision block 508, the IMSI is stored with respect to the MS at block 512, and the MS Is registered. However, if it is determined that the uplink message is not a registration request at decision block 510 and the received IMSI is determined to conform to the IMSI stored for the MS at decision block 514, the message is generally processed at block 506. . However, if it is determined that the received IMSI does not match the IMSI stored for the MS at decision block 514, the message is dropped at block 516. UNC or GANC 116 may also perform the following actions: unregister the MS at block 518; Blacklisting the IP addresses associated with the MS for a period of time in block 520; In block 522, notifying the system operator of the dropped message and the deregistration of the mobile station; Or record the dropped message at block 524 and information about deregistration of the mobile station.

However, if the mobile identity is determined to be TMSI or P-TMSI at decision block 508, and it is determined that TMSI or P-TMSI is not already stored for the MS at decision block 526, then TMSI or P-TMSI is determined at block 528. ), And the message is generally processed at block 506. However, if it is determined that TMSI or P-TMSI has already been stored for the MS in decision block 526 and the received TMSI or P-TMSI matches the TMSI or P-TMSI stored for the MS in decision block 530, the message Is generally processed at block 506. However, if it is determined that the received TMSI or P-TMSI does not conform to the TMSI or P-TMSI stored for the MS at decision block 530, the message is dropped at block 516. UNC or GANC 116 may also perform the following actions: unregister the MS at block 518; Blacklisting the IP addresses associated with the MS for a period of time in block 520; In block 522, notifying the system operator of the dropped message and the deregistration of the mobile station; Or record the dropped message at block 524 and information about deregistration of the mobile station.

Reference is now made to Figure 6, which is a flowchart illustrating a method 600 according to one embodiment of the present invention for downlink messages. The downlink message is received at block 602. If it is determined that the downlink message does not include a TMSI or P-TMSI for the MS at decision block 604, the downlink message is processed (eg, delivered, executed, etc.) at block 606. However, it is determined that the downlink message includes TMSI or P-TMSI for the MS in decision block 604, and that TMSI or P-TMSI is not new in decision block 608 (ie, UNC or GANC 116). Is already stored and associated with the MS), the downlink message is generally processed at block 606. However, if TMSI or P-TMSI is determined to be new at decision block 608, then TMSI or P-TMSI is stored with respect to the MS at block 610, and the message is generally processed at block 606.

Reference is now made to FIG. 7, which is a flowchart illustrating a method 700 according to another embodiment of the present invention on downlink. The downlink message is received at block 702. If it is determined that the downlink message does not include a TMSI or P-TMSI for the MS at decision block 704, the downlink message is processed (eg, delivered, executed, etc.) at block 706. However, it is determined that the downlink message includes TMSI or P-TMSI for the MS in decision block 704, and that TMSI or P-TMSI is not new in decision block 708 (i.e., UNC or GANC already stored). And associate it with the MS), the downlink message is generally processed at block 706. However, if the TMSI or P-TMSI is determined to be new at decision block 708, the TMSI or P-TMSI is maintained at block 710 and the message is generally processed at block 712. The TMSI or P-TMSI is an uplink message until the TMSI or P-TMSI receives an uplink message that accepts, acknowledges, or completes a received downlink message comprising the TMSI or P-TMSI maintained at block 714. Is maintained. Thereafter, the retained TMSI or P-TMSI is stored with respect to the MS at block 716 and the uplink message is generally processed at block 718.

Any of the above-described methods may be implemented as a computer program used on a computer readable medium, wherein the various method steps are implemented by one or more code segments.

Although the invention and its advantages have been described in detail, it should be appreciated that various changes, substitutions and alterations can be made without departing from the spirit and scope of the invention as defined by the appended claims. In addition, the scope of the present application is not limited to the specific embodiments of the processes, machines, manufacture, components of matter, means, methods and steps described in the specification, but only by the claims.

Claims (22)

In the method of protecting the core network 102, Receiving (202) a message (302, 402) containing a mobile identity of the mobile station (104); And Dropping (210) the message (302,402) whenever the received mobile identity does not match a stored mobile identity with respect to the mobile station (102). The method of claim 1, And processing (208) a message (302,402) whenever the received mobile identity matches a stored mobile identity with respect to a mobile station (104). The method of claim 1, And wherein said mobile identity is an international mobile subscriber identity (IMSI), a temporary mobile subscriber identity (TMSI), or a packet temporary mobile subscriber identity (P-TMSI). The method of claim 1, And the message (302, 402) is an uplink message (302) or a downlink message (402). The method of claim 4, wherein And the uplink message (302) is received from a mobile switching center (MSC) (116) or a universal packet radio service (GPRS) supporting node (SGSN). The method of claim 1, Storing the received mobile identity (512) and processing the received message (302, 402) whenever the received message (302, 402) is a registration request. Way. The method of claim 1, Storing (610) the received mobile identity and the received messages (302, 402) are downlink messages (402), each time the received mobile identity assigns or replaces a mobile identity of the mobile station (104). Processing the received message (302, 402). The method of claim 7, wherein Protect the core network, characterized in that the received mobile identity is not stored (716) until an uplink message is received (714) that accepts, confirms, or completes the downlink message (402). How to. The method of claim 1, Dropping the received message (210,516) includes: Deregistering (518) the mobile station; Blacklisting (520) an Internet Protocol (IP) address associated with the mobile station (104) for a period of time; Notifying (522) a system operator of the dropped message and deregistration of the mobile station; And Recording (524) the dropped message and information about deregistration of the mobile station. The method of claim 1, And wherein said received message is a mobility management (MM) message, a universal packet radio service (GPRS) mobility management (GMM) message, or a UMA or unauthorized radio resource (URR) message. The method of claim 1, The message 302, 402 is in an unauthenticated network controller (UNC) 116 in an unauthenticated mobile access network (UMAN) 100 or in a general access network (GAN) 100 in communication with the core network 102. Received by a general access network controller (GANC) 116. In a computer program used on a computer-readable medium for protecting the core network 102, Code segment for receiving (202) a message (302, 402) containing a mobile identity of a mobile station (104); And And a code segment to drop (210) the message (302, 402) whenever the received mobile identity does not match the stored mobile identity with respect to the mobile station (104). A computer program used on a readable medium. The method of claim 12, The computer further comprises a code segment for processing (208) the message (302, 402) whenever the received mobile identity matches a stored mobile identity with respect to the mobile station (104). A computer program used on a readable medium. The method of claim 12, And a code segment for storing the received mobile identity and processing the received message 302,402 whenever the received message 302,402 is a registration request. A computer program used on a removable medium. The method of claim 12, Store the received mobile identity (610) and the received message (302,402) is a downlink message (402) and each time the received mobile identity allocates or replaces the mobile identity of the mobile station (104) And (608) a code segment for processing (302, 402). The method of claim 15, A computer for protecting a core network, characterized in that the received mobile identity is not stored (716) until an uplink message is received (714) that accepts, confirms, or completes the downlink message (402). A computer program used on a medium that can be read by a computer. In the device, A data storage device for storing a collection of mobile identities in a mobile station; And The data receiving a message 302,402 containing the mobile identity of the mobile station 104 and dropping the message 302,402 whenever the received mobile identity does not conform to the stored mobile identity with respect to the mobile station 104; And a processor coupled to communicate with the storage device. The method of claim 17, Wherein the device is an unauthorized network controller (UNC) or a general access network controller (GANC). The method of claim 17, The processor processes (208) the message (302,402) whenever the received mobile identity matches a stored mobile identity with respect to the mobile station (104). The method of claim 17, And the processor stores (610, 402) the received message (302, 402) and processes the received message (302, 402) whenever the received message (302, 402) is a registration request. The method of claim 17, The processor stores the received mobile identity (610), the received message is a downlink message 402 and whenever the mobile identity assigns or replaces the mobile identity of the mobile station 104, the received message ( And processing (608) 302,402. The method of claim 21, Wherein the received mobile identity is not stored (716) until an uplink message is received (714) that accepts, confirms or completes the downlink message (402).

Images