Method and service gateway for hijack prevention

Abstract

The application provides a hijacking prevention method and a service gateway, and belongs to the technical field of core networks. The hijacking prevention method comprises the following steps: a service gateway (SGW) detects user data plane service traffic corresponding to an allocated tunnel endpoint identifier (TEID) within a preset time period; and the SGW judges whether the allocated TEID is at risk of being attacked by a man-in-the-middle according to the user data plane service traffic. The technical scheme of the application can effectively prevent and mitigate the risk of man-in-the-middle attacks on the data plane.

Description

Technical Field

[0001] This invention relates to the field of core network technology, and in particular to an anti-hijacking method and service gateway. Background Technology

[0002] Once a home (micro) base station (H(e)NB) is compromised and root access is gained, a man-in-the-middle attack can be carried out. The principle behind this is as follows: Figure 1 As shown.

[0003] Attackers first gain root access to the home (micro)cell H(e)NB through penetration, and then install a custom-developed SCTP (Flow Control Transmission Protocol) MITM (Man-in-the-Middle) tool on the rooted base station. This SCTP MITM tool can intercept control plane signaling between the terminal and the core network via the H(e)NB, especially the Initial Context Setup Request (TIM) instruction from the MME (Mobility Management Entity) to the H(e)NB. This TIM carries the SGW-side TEID (Tunnel Endpoint Identifier) ​​information assigned to the H(e)NB by the SGW when establishing user data plane bearer between the H(e)NB and the SGW (Serving Gateway). The H(e)NB uses this TEID information to encapsulate user plane data and sends it to the SGW, which uniquely identifies the terminal's user plane data using this TEID. After obtaining the TEID, the attacker, having root privileges, can use techniques such as modifying the destination route MAC information in the H(e)NB to redirect user plane data (line (2) in the diagram above) that should have been sent to the legitimate SGW to a fake SGW built by the attacker. The fake SGW then forwards the user data (line (1) in the diagram above) to the Internet. The attacker can then parse the user plane data through the fake SGW and tamper with the bidirectional transmission data, achieving a man-in-the-middle effect on the user plane. Here, PGW is the PDN (Public Data Network) gateway, AAA Server is the AAA server, HSS is the Home Subscriber Server, and insecurelink is the secure link. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide an anti-hijacking method and service gateway that can effectively prevent and mitigate the risk of man-in-the-middle attacks on the data plane.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide the following technical solutions:

[0006] On the one hand, a method for preventing hijacking is provided, including:

[0007] The Service Gateway (SGW) detects the user data plane service traffic corresponding to the assigned Tunnel Endpoint Identifier (TEID) within a preset time period.

[0008] SGW determines whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0009] In some embodiments, the SGW determines whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic, including:

[0010] The SGW determines whether a data tunnel uniquely identified by the TEID exists;

[0011] If it does not exist, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack; if it exists, it is detected whether there is user data plane service traffic in the data tunnel within a preset time period. If there is no user data plane service traffic, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack.

[0012] In some embodiments, after determining that the assigned TEID is at risk of being attacked by a man-in-the-middle, the method further includes:

[0013] Send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer, and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

[0014] In some embodiments, after determining that the assigned TEID is at risk of being attacked by a man-in-the-middle, the method further includes:

[0015] A second instruction is sent to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of a man-in-the-middle attack.

[0016] This invention also provides an SGW, including a processor and a transceiver.

[0017] The processor is used to detect the user data plane service traffic corresponding to the assigned tunnel endpoint identifier (TEID) within a preset time period; and to determine whether the assigned TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0018] In some embodiments, the processor is specifically used to determine whether a data tunnel uniquely identified by the TEID exists; if it does not exist, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle; if it exists, it detects whether the data tunnel has user data plane service traffic within a preset time period; if there is no user data plane service traffic, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle.

[0019] In some embodiments, the transceiver is further configured to send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer message and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

[0020] In some embodiments, the transceiver is also used to send a second instruction to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of a man-in-the-middle attack.

[0021] This invention also provides an SGW, including a memory, a processor, and a computer program stored in the memory and executable on the processor; when the processor executes the program, it implements the anti-hijacking method described above.

[0022] In some embodiments, the processor is used to detect the user data plane service traffic corresponding to the assigned tunnel endpoint identifier (TEID) within a preset time period; and to determine whether the assigned TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0023] In some embodiments, the processor is specifically used to determine whether a data tunnel uniquely identified by the TEID exists; if it does not exist, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle; if it exists, it detects whether the data tunnel has user data plane service traffic within a preset time period; if there is no user data plane service traffic, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle.

[0024] In some embodiments, the processor is configured to send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

[0025] In some embodiments, the processor is configured to send a second instruction to the MME, instructing the MME to send a risk warning message to the terminal, alerting it to the risk of a man-in-the-middle attack.

[0026] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the anti-hijacking method described above.

[0027] The embodiments of the present invention have the following beneficial effects:

[0028] In the above scheme, the SGW can determine whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack by detecting the user data plane service traffic corresponding to the allocated TEID within a preset time period. Then, it can notify the MME to take corresponding measures, such as reporting a message to delete the TEID bearer and instructing the terminal to delete the data plane bearer corresponding to the TEID. This can prevent data plane man-in-the-middle attacks and effectively alleviate continuous user data plane man-in-the-middle attacks. Attached Figure Description

[0029] Figure 1 A diagram illustrating the principle of a man-in-the-middle attack on a home (micro) base station;

[0030] Figure 2 This is a schematic diagram of the LTE network architecture;

[0031] Figure 3 and Figure 4 This is a flowchart illustrating the anti-hijacking method according to an embodiment of the present invention;

[0032] Figure 5 This is a schematic diagram of the structure of the SGW according to an embodiment of the present invention;

[0033] Figure 6 This is a schematic diagram of the composition of the SGW in an embodiment of the present invention. Detailed Implementation

[0034] To make the technical problems, technical solutions and advantages of the embodiments of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0035] In related technologies, after the legitimate SGW assigns local TEID information to the H(e)NB, the attacked H(e)NB encapsulates the information using the intercepted TEID. However, instead of sending user plane data to the legitimate SGW, it uses technical means to send the TEID-encapsulated information to a forged SGW controlled by the attacker. The legitimate SGW then waits to be assigned a TEID to the user. The user then uses the assigned TEID to create a user plane tunnel and exchanges user plane data with the Internet through this tunnel.

[0036] Based on the above principles, this application proposes a scheme to analyze whether there is a data plane man-in-the-middle attack by monitoring the data traffic in the TEID tunnel allocated on the SGW, and to interrupt the attack through control plane signaling after detecting the relevant attack. This scheme can effectively alleviate the security risks faced by the existing system.

[0037] like Figure 2As shown, the mobile terminal user data plane bearer path is that the UE (terminal) connects to the eNB (base station) in the E-UTRAN (evolved access network) through the LTE-Uu interface. The eNB connects to the SGW through the S1-U interface and to the data network through the PGW connected to the SGW. Here, the SGSN is the Serving GPRS Support Node and the PCRF is the Policy and Charging Rules Function Entity.

[0038] The S1-U bearer between the eNB and SGW is achieved through mutual allocation of TEIDs between the two ends, and through control plane signaling exchange between the S1-MME interface between the MME and the eNB, and between the S11 interface between the MME and the SGW. Specifically, to establish a data plane uplink path from the UE to the SGW, the SGW transmits the allocated TEID to the MME via GPT-C signaling between the S11 interface and the MME. The MME then notifies the eNB of the TEID in the Initial Context Setup Request instruction.

[0039] This invention provides an anti-hijacking method and service gateway, which can effectively prevent and mitigate the risk of man-in-the-middle attacks on the data plane.

[0040] Embodiments of the present invention provide an anti-hijacking method, such as... Figure 3 As shown, it includes:

[0041] Step 101: The Service Gateway (SGW) detects the user data plane service traffic corresponding to the assigned Tunnel Endpoint Identifier (TEID) within a preset time period;

[0042] Step 102: The SGW determines whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0043] In this embodiment, the SGW can determine whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack by detecting the user data plane service traffic corresponding to the allocated TEID within a preset time period. Then, it can notify the MME to take corresponding measures, such as reporting a message to delete the TEID bearer and instructing the terminal to delete the data plane bearer corresponding to the TEID. This can prevent data plane man-in-the-middle attacks and effectively alleviate continuous user data plane man-in-the-middle attacks.

[0044] In some embodiments, the SGW determines whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic, including:

[0045] The SGW determines whether a data tunnel uniquely identified by the TEID exists;

[0046] If it does not exist, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack; if it exists, it is detected whether there is user data plane service traffic in the data tunnel within a preset time period. If there is no user data plane service traffic, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack.

[0047] In some embodiments, after determining that the assigned TEID is at risk of being attacked by a man-in-the-middle, the method further includes:

[0048] Send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer, and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

[0049] In some embodiments, after determining that the assigned TEID is at risk of being attacked by a man-in-the-middle, the method further includes:

[0050] A second instruction is sent to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of a man-in-the-middle attack.

[0051] Based on the data plane man-in-the-middle attack prevention, after the legitimate SGW assigns legitimate SGW local TEID information to the home (micro) base station H(e)NB, the attacked H(e)NB intercepts the TEID encapsulation information and does not send the user plane data to the legitimate SGW. Instead, it uses technical means to send the information encapsulated by the TEID to a fake SGW controlled by the attacker.

[0052] Based on this principle, traffic monitoring functionality can be added to legitimate SGWs, such as... Figure 4As shown, the SGW monitors the allocated TEID endpoint information and determines whether there are tunnel establishment requests based on the TEID endpoint within a preset time period, and whether there is a data tunnel uniquely identified by the TEID created by the H(e)NB. If not, it triggers a Delete Bearer Request command to be sent to the MME. If it exists, it checks whether there is user data plane service traffic on the data tunnel within the preset time period. If there is, it processes it as normal service; otherwise, it triggers a Delete Bearer Request command to be sent to the MME. If no data tunnel is created using the TEID within a preset time period (e.g., a few seconds to tens of seconds, the preset time period is a configurable parameter), or if a data tunnel is created using the TEID but there is no user data plane service traffic, it can be determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack. After the SGW determines that the TEID is at risk of being attacked by a man-in-the-middle attack, the SGW reports the message of deleting the TEID identifier bearer to the MME through the Delete Bearer Request command between the SGW and the MME. The MME then instructs the terminal to delete the data plane bearer through the NAS (Non-Access Stratum) command between the MME and the terminal. The MME also sends a risk notification message to the terminal that there may be a man-in-the-middle attack, reminding the user to check whether the wireless access is normal.

[0053] This embodiment monitors whether a TEID tunnel is established on the SGW and whether there is service traffic in the tunnel. It also uses GTP-C commands between the SGW and the MME and NAS commands between the MME and the terminal to delete the data plane bearer. This method can prevent data plane man-in-the-middle attacks and effectively mitigate persistent user data plane man-in-the-middle attacks.

[0054] This invention also provides an SGW, such as... Figure 5 As shown, it includes a processor 12 and a transceiver 11.

[0055] The processor 12 is used to detect the user data plane service traffic corresponding to the assigned tunnel endpoint identifier (TEID) within a preset time period; and to determine whether the assigned TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0056] In some embodiments, the processor 12 is specifically used to determine whether a data tunnel uniquely identified by the TEID exists; if it does not exist, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle; if it exists, it detects whether the data tunnel has user data plane service traffic within a preset time period; if there is no user data plane service traffic, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle.

[0057] In some embodiments, the transceiver 11 is further configured to send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer message and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

[0058] In some embodiments, the transceiver 11 is also used to send a second instruction to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of being attacked by a man-in-the-middle.

[0059] This invention also provides an SGW, such as... Figure 6 As shown, it includes a memory 21, a processor 22, and a computer program stored on the memory 21 and executable on the processor 22; when the processor 22 executes the program, it implements the anti-hijacking method as described above.

[0060] In some embodiments, the processor 22 is used to detect the user data plane service traffic corresponding to the assigned tunnel endpoint identifier (TEID) within a preset time period; and to determine whether the assigned TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic.

[0061] In some embodiments, the processor 22 is specifically used to determine whether a data tunnel uniquely identified by the TEID exists; if it does not exist, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle; if it exists, it detects whether the data tunnel has user data plane service traffic within a preset time period; if there is no user data plane service traffic, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle.

[0062] In some embodiments, the processor 22 is configured to send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer and instructing the terminal to delete the data plane bearer corresponding to the TEID.

[0063] In some embodiments, the processor 22 is configured to send a second instruction to the MME, instructing the MME to send a risk warning message to the terminal, alerting it of the risk of a man-in-the-middle attack.

[0064] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the anti-hijacking method described above.

[0065] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage, or any other non-transferable medium that can be used to store information accessible to the computer-readable terminal device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0066] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for preventing hijacking, characterized in that, include: The Service Gateway (SGW) detects the user data plane service traffic corresponding to the assigned Tunnel Endpoint Identifier (TEID) within a preset time period. SGW determines whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic. The SGW's determination of whether the allocated TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic includes: The SGW determines whether a data tunnel uniquely identified by the TEID exists; If it does not exist, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack; if it exists, it is detected whether there is user data plane service traffic in the data tunnel within a preset time period. If there is no user data plane service traffic, it is determined that the allocated TEID is at risk of being attacked by a man-in-the-middle attack.

2. The anti-hijacking method according to claim 1, characterized in that, After determining that the assigned TEID is at risk of being attacked by a man-in-the-middle attack, the method further includes: Send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer, and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

3. The anti-hijacking method according to claim 1, characterized in that, After determining that the assigned TEID is at risk of being attacked by a man-in-the-middle attack, the method further includes: A second instruction is sent to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of a man-in-the-middle attack.

4. A Service Gateway (SGW), characterized in that, Including processor and transceiver, The processor is used to detect the user data plane service traffic corresponding to the assigned tunnel endpoint identifier (TEID) within a preset time period; and to determine whether the assigned TEID is at risk of being attacked by a man-in-the-middle attack based on the user data plane service traffic. Specifically, the processor is used to determine whether a data tunnel uniquely identified by the TEID exists; if it does not exist, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle; if it exists, it detects whether there is user data plane service traffic in the data tunnel within a preset time period; if there is no user data plane service traffic, it determines that the allocated TEID is at risk of being attacked by a man-in-the-middle.

5. The SGW according to claim 4, characterized in that, The transceiver is also used to send a first instruction to the Mobility Management Entity (MME), instructing the MME to delete the TEID bearer message and instructing the terminal by the MME to delete the data plane bearer corresponding to the TEID.

6. The SGW according to claim 4, characterized in that, The transceiver is also used to send a second instruction to the MME, instructing the MME to send a risk warning message to the terminal, reminding it of the risk of being attacked by a man-in-the-middle.

7. A Service Gateway (SGW), comprising a memory, a processor, and a computer program stored in the memory and executable on the processor; characterized in that, When the processor executes the program, it implements the anti-hijacking method as described in any one of claims 1-3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the anti-hijacking method as described in any one of claims 1-3.

Images