SMS SIGNALING FRAUD DETECTION AND PREVENTION SYSTEM

Abstract

This invention relates to a system (1) developed to detect and prevent attacks aimed at obtaining subscriber identity and the address of the exchange from which they receive service using the SS7 network and SMS signaling flows.

Description

1 TARIFF DETECTING AND PREVENTING FRAUD IN SMS SIGNALING SYSTEM Technical Area 5 This invention enables subscriber identification using SS7 network and SMS signaling flows. Detecting and preventing attacks aimed at hijacking the IMSI (Internal Security and Interception System) and the central office address it receives services from. It relates to a system developed to prevent this. Previous Technique In the communications sector: SS7 (Signal System 7) network and SMS (short message). Using signal flows, the subscriber identity (IMSI) and the exchange receiving the service are determined. Attacks aimed at taking over the address are taking place. These attacks have been successful. 15 If this happens, it can pave the way for more sophisticated signaling attacks, and The attackers also got their hands on information about the subscriber's actual country / operator from which they receive service. This is possible. To prevent such attacks, SMS main redirection should be implemented. In homerouting or SOIP (SMS over IP) configurations, IPSMGW (IP Short Message) Gateway (IP - short message gateway) addresses can be protected by turning them around, while the new 20 In next-generation attacks, the attacker impersonates IPSMGW and steals user information. from the base (HSS) subscriber's actual identity (IMSI) and exchange address (VLR) It appears that they are trying to obtain information. Among the studies involved in the technology... It can detect and prevent attacks that are capable of developing new generation sophisticated attacks. No application developed for this purpose has been found. 25 US2015141003 is the result of research within the known state of the art. a routing information in mobile networks in a United States patent document numbered [number]. a system for sending and regenerating (sri) messages It is mentioned. 30 2 The invention in question, which is the subject of the United States patent document, originates from the network of inventions. The SMSC broadcasts an SRI-SM to a receiver's HLR (User B on Network B). A series of One of the N Platform or Message Controllers ("MCOs") intercepts the SRI-SM. The MCO, Instead of passing the SRI-SM, it terminates it and fully decodes all fields. Specifically, the buyer removes the MSISDN from this. MCO then introduces a new 5 for the same MSISDN. It creates an SRI-SM, but the new request includes the visited MSC address, SGSN address, and All available data, including but not limited to IP-SM-GW addresses. It forces a request. Once a response is received, the MCO acts solely on the basis of the response it received. Instead of performing a redirect, it generates a new query response for the source SMSC. If the MCO is programmed to provide incorrect addresses for smart services, 10 It includes the wrong address in the query response it generates. Brief Description of the Invention The aim of this invention is to enable subscriber 15 using the SS7 network and SMS signaling flows. attacks aimed at obtaining the IMSI (Internal Security Institution) and the address of the exchange it receives service from The goal is to create a system designed to detect and prevent such incidents. Detailed Description of the Invention The "SMS Signaling" project was carried out to achieve the purpose of this invention. The "Fraud Detection and Prevention System" is shown in the attached document; Figure 1 shows a schematic view of the system that is the subject of the invention. The parts shown in the figure are individually numbered, and the corresponding numbers correspond to these numbers. given below: 1. System 2. Database 30 3. Server 3 Subscriber Identity (IMSI) is determined using the SS7 network and SMS signaling flows. detecting and preventing attacks aimed at hijacking the telephone exchange address from which it receives service a system developed for (1); - Exceptional data in the form of SMS transit carrier (SMS Hub), through itself 5 an operator (Roaming Hub) that allows international roaming and a different network operator that carries its own signaling (Roaming extension network) to store information and switchboard addresses TADIG (Transferred Account Data) Recording the Interchange Group (Transferred Account Data Exchange Group) codes at least one database configured to receive (2), 10 -communicate with the database (2) using any remote communication protocol managing roaming and interconnection signaling, SS7 Monitoring SMS signaling, processing SRI-SM messages, and storing them in the database. (2) Registered SMS transit carrier, which allows international roaming through it. operator and operator carrying a different network signal through itself 15 Exception data settings like this are disabled to prevent false alarms. leaving, which TADIG code corresponds to the subscriber's central office address to record information in the database (2), all that is blocked or not dropped at least one configured to keep records in the database (2) The server includes (3). 20 Which global title (GT) is included in the database (2) in the system (1) that is the subject of the invention? When the addresses arrive, the server (3) is disabled so that it does not generate false alarms. It is configured to record exception data indicating that it will remain in effect. 25 database (3) detected by server (3) blocked or dropped It is configured to record all the data that is processed. The server (3) in the system (1) which is the subject of the invention, the data on the database (2) It is configured to access and save data onto the database (2). Server (3) sends an SRI-SM message from a foreign network to the main network subscribers 30 If it arrives, the incoming message will be blocked by the SS7 firewall or SMS security. 4 It is configured to direct messages to the server (3). SCCP (Signalling Connection) includes the transmitting network among its parameters. Obtaining the central office address information in the Control Part (Global Title) layer and In the MAP (Mobile Application Part Mobile Application) (Global Title) layer It is configured to obtain the central office address information. Server (3) 5 The central office address information at the SCCP layer and the central office address at the MAP layer. To ensure that (2) TADIG codes are found in the database for information purposes. is being configured. Server (3) by taking the first three digits of the TADIG codes Finding international ISO3 notified country codes and country codes It is configured to enable comparison of the server (3) codes 10 If it determines that they are equal, it will transmit the message without blocking it. is being configured. The server (3) detects that the codes are different from each other. In this case, check whether there are any exceptional data registered in the database (2). to reject the message with the appropriate error code if it is an exception. 15 to record in the database (2) so that the operation teams can be notified is being configured. Server (3) records with cybersecurity centers. It is configured to enable sharing. Server (3) incoming message After checks, messages that appear to be healthy are sent to the subscriber number database. (Home Location Register - HLR) or SMS Homerouter It is configured to be sent to the box. 20 Industrial application of the invention In the system in question (1), messages from foreign networks are processed via SCCP the central office address information in the layer and the central office address information in the MAP layer 25 When TADIG codes are compared, the country codes do not match. In such a case, the message in question is determined to be a potential attack. If it is an exceptional circumstance... If it's not data, the attack is prevented by directly blocking the message. The system subject to the invention (1) uses the SS7 network and SMS signaling flows aiming to obtain the subscriber identity (IMSI) and the address of the exchange from which they receive service. It was developed to detect and prevent attacks. Around these fundamental concepts, the subject of this invention is "Fraud in SMS Signaling 5". Development of a wide variety of applications related to the Detection and Prevention System (1)” It is possible, and the invention is not limited to the examples described here, but is essentially As stated in the requests.

Claims

6 REQUESTS 1. Subscriber ID and SMS signaling flows are used to determine the subscriber identity. detecting attacks aimed at hijacking the address of the central office from which it receives services and Developed to prevent; 5 - SMS transit carrier in the form of exceptional data, through itself internationally the operator that allows roaming and a different network signaling system to store operator information and switchboard addresses transmitted over it At least one data entry point configured to register TADIG codes. containing base (2) and 10 -communicate with the database (2) using any remote communication protocol managing routing and interconnection signaling, SS7 Monitoring SMS signaling, processing SRI-SM messages, data. SMS transit carrier registered on the base (2) through itself international the operator allowing roaming and a different network signaling with its own 15 The settings of the exception data in the form of an operator carrying it through are fake. To disable it so that it doesn't generate an alarm, which is the subscriber's switchboard address? To record the information that corresponds to the TADIG code in the database (2), all records that are blocked or advanced without being dropped are in the database (2) 20 characterized by at least one server (3) configured to keep records. a system (1).

2. Which global header addresses arrive when the server (3) false alarm It records exception data indicating that it will be disabled to prevent production. Claim 1, characterized by the database (3) configured to receive 25 such a system (1).

3. The server (3) detected that the blocked or dropped progressed with the database (3) which is structured to record all data A system like the one in Claim 1 or 2, as characterized (1). 30 7 4. To access data on database (2) and to add data to database (2) the above characterized by the server (3) configured to record a system like any of the requests (1).

5. An SRI-SM message from a foreign network arriving for main network subscribers. In this case, the incoming message bypasses the SS7 firewall or SMS security. characterized by the server (3) to ensure that it is directed to the wall a system like any of the above requests (1).

6. SCCP 10 includes the sender network within the message parameters. obtaining the central office address information in the layer and in the MAP layer. Characterized by the server (3) to enable the acquisition of the central office address information. a system like any of the above-mentioned requests (1).

7. The central office address information at the SCCP layer and the central office information at the MAP layer. (2) Finding TADIG codes from the database for address information to provide the above requests characterized by the server (3) a system like any other (1).

8. Taking the first three digits of the TADIG codes and applying the international ISO3 20 Finding the country codes with notifications and the country codes to enable comparison characterized by server (3) a system like any of the above requests (1).

9. If it detects that the codes are identical, it will send the message 25 The above is characterized by the server (3) to transmit without blocking. a system like any of the requests (1).

10. Data if it detects that the codes are different from each other. Checking whether there are any exceptional data registered in the database (2), 30 If it is not an exception, the message will be rejected with the appropriate error code. 8 to register in the database (2) so that the operation teams can be notified any of the above requests characterized by the server (3) a system like one of them (1).

11. After checking incoming messages, subscriber 5 will receive messages that appear to be healthy. sending the numbers to the database or SMS main router box any of the above requests characterized by the server (3) a system like one of them (1). 15 25