False roaming judgment method and device, equipment, storage medium and product

Abstract

The invention discloses a false roaming judgment method and device, equipment, a storage medium and a product. The method comprises the following steps: receiving a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message at least carries a national and regional identifier of the visited network and the sending time of the roaming signaling message; acquiring an access signaling message that the user accesses the home network last time; the access signaling message at least carries an access position and access time; the access position is a base station position or a user position; obtaining the access position of the user in the visited network according to the national and regional identifier, and calculating the distance between the access position and the access position; calculating the speed of the user within the distance according to the distance, the sending time and the access time; and judging whether the roaming signaling message is a false roaming signaling message or not according to the speed. By adopting the embodiment of the invention, the accuracy of judgment can be greatly improved, and further the conditions of misplacement, mistaken interception, missing interception and missing placement of the roaming signaling message are reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a false roaming judgment method, device, equipment, storage medium and product. Background Art

[0002] Among the security attack methods for international roaming intercommunication signaling, there is a common attack method: attacking by forging false roaming signaling messages. Specifically, by accessing the network elements in the international intercommunication signaling network, forging users who have not actually roamed out of the home network to perform related operations (such as location update, authentication, etc.), and then attacking. For example, after successfully forging the user's departure, triggering the receiving user's SMS, and using the SMS verification code to log in to a fake account and other illegal behaviors. Therefore, how to judge false roaming signaling messages has become a new security research direction.

[0003] Currently, false roaming is judged only based on the time consumed by the user to roam out of the home network, and the judgment accuracy is low. Summary of the invention

[0004] The present application provides a false roaming judgment method, device, equipment, storage medium and product to solve the problem in the prior art that the judgment is only made based on the time consumed by the user roaming out of the home network, resulting in low judgment accuracy.

[0005] To achieve the above object, an embodiment of the present application provides a false roaming determination method, including:

[0006] Receiving a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message;

[0007] Acquire an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location;

[0008] According to the country and region identifier, obtaining the access location of the user in the visited network, and calculating the distance between the access location and the access location;

[0009] Calculate the speed of the user within the distance according to the distance, the sending time and the access time;

[0010] Whether the roaming signaling message is a false roaming signaling message is determined according to the speed.

[0011] As an improvement of the above solution, the determining, according to the speed, whether the roaming signaling message is a false roaming signaling message includes:

[0012] determining whether the speed is greater than a preset speed, and if so, determining that the roaming signaling message is a false roaming signaling message, and if not, determining that the roaming signaling message is not a false roaming signaling message;

[0013] In which, the preset speed is determined based on at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance and the port type of the target port; the target port is the initial target port closest to the access location, the initial target port is a port of the country / region of the visited network, or a port of a preset port type of the country / region of the visited network, and the preset port type is determined by the location relationship.

[0014] As an improvement of the above solution, the preset speed is determined according to at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance, and the port type of the target port, including at least one of the following situations:

[0015] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the first preset port type, the first preset speed is determined;

[0016] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the second preset port type, the second preset speed is determined;

[0017] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the third preset port type, the third preset speed is determined;

[0018] If the position relationship is adjacent to each other by land, and the distance is greater than or equal to the preset distance, a fourth preset speed is determined;

[0019] If the position relationship is not adjacent to a land road, the fifth preset speed is determined.

[0020] As an improvement of the above solution, obtaining the access location of the user in the visited network according to the country and region identifier, and calculating the distance between the access location and the access location includes:

[0021] According to the country / region identifier, the port locations of all ports of the country / region of the visited network are obtained; or, according to the country / region identifier, the port locations of all ports of a preset port type of the country / region of the visited network are obtained; wherein the preset port type is determined by the positional relationship between the country / region of the visited network and the country / region of the home network;

[0022] Taking the port location as an ideal access location, and obtaining the access location of the user in the visited network according to all the ideal access locations;

[0023] A distance between the access location and the access location is calculated.

[0024] As an improvement of the above solution, the access location is the ideal access location closest to the access location, or an average value of all the ideal access locations.

[0025] As an improvement of the above solution, after judging whether the roaming signaling message is a false roaming signaling message according to the speed, the false roaming judgment method further includes:

[0026] If the judgment result is that the roaming signaling message is a false roaming signaling message, intercepting the roaming signaling message;

[0027] If the judgment result is that the roaming signaling message is not a false roaming signaling message, the roaming signaling message is released.

[0028] As an improvement of the above solution, calculating the speed of the user within the distance according to the distance, the sending time and the access time includes:

[0029] Calculate the time difference between the sending time and the access time;

[0030] The speed of the user within the distance is calculated according to the distance and the time difference.

[0031] To achieve the above object, the embodiment of the present application further provides a false roaming determination device, including:

[0032] A first acquisition module is used to receive a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message;

[0033] A second acquisition module is used to acquire an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location;

[0034] A first calculation module, configured to obtain, according to the country and region identifier, an access location of the user in the visited network, and calculate a distance between the access location and the access location;

[0035] A second calculation module, configured to calculate a speed of the user within the distance according to the distance, the sending time and the access time;

[0036] The judging module is used to judge whether the roaming signaling message is a false roaming signaling message according to the speed.

[0037] To achieve the above-mentioned purpose, an embodiment of the present application also provides a false roaming judgment device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the false roaming judgment method as described above when executing the computer program.

[0038] To achieve the above-mentioned purpose, an embodiment of the present application further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the false roaming judgment method as described above.

[0039] To achieve the above-mentioned purpose, an embodiment of the present application further provides a computer program product, including a computer program / instruction, which implements the above-mentioned false roaming determination method when executed by a processor.

[0040] Compared with the prior art, the embodiments of the present application provide a false roaming judgment method, device, equipment, storage medium and product, which receives a roaming signaling message sent by a visited network to a user's home network; the roaming signaling message carries at least: the country and region identifier of the visited network and the sending time of the roaming signaling message; obtains an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location; based on the country and region identifier, obtains the access location of the user in the visited network, and calculates the distance between the access location and the access location; based on the distance, the sending time and the access time, calculates the speed of the user within the distance; and judges whether the roaming signaling message is a false roaming signaling message based on the speed. It can be seen that the embodiment of the present application uses the country and region identifier of the visited network carried in the roaming signaling message and the sending time of the roaming signaling message, and the access signaling message of the latest access to the home network to determine whether it is a false counterfeit roaming, which can reduce the time consumption for location and time query after receiving the roaming signaling message and reduce the processing delay; at the same time, according to the speed obtained by combining the distance between the user's access location in the visited network and the user's access location in the home network and the time consumed, the accuracy of the judgment can be greatly improved, thereby reducing the misplacement, misblocking, missed blocking and missed placement of roaming signaling messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1is a flow chart of a false roaming determination method provided by an embodiment of the present application;

[0042] Figure 2 is another flow chart of a false roaming determination method provided by an embodiment of the present application;

[0043] Figure 3 It is a structural block diagram of a false roaming determination device provided in an embodiment of the present application;

[0044] Figure 4 It is a structural block diagram of a false roaming judgment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] See also Figure 1 , Figure 1 : is a flow chart of a false roaming determination method provided in an embodiment of the present application, the false roaming determination method comprising:

[0047] S1. Receive a roaming signaling message sent by a visited network to a user's home network; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message;

[0048] S2. Acquire the access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location;

[0049] S3. Obtaining, according to the country or region identifier, an access location of the user in the visited network, and calculating a distance between the access location and the access location;

[0050] S4. Calculate the speed of the user within the distance according to the distance, the sending time, and the access time;

[0051] S5. Determine whether the roaming signaling message is a false roaming signaling message according to the speed.

[0052] In an embodiment of the present application, a roaming signaling message sent by a visited network to a home network of a user is received to obtain a country / region identifier of the visited network and a sending time of the roaming signaling message carried in the roaming signaling message. The country / region identifier is a country code MCC (Mobile Country Code), and the country / region of the visited network can be queried according to the country code MCC of the visited network.

[0053] Exemplarily, an embodiment of the present application is applied to a signaling security protection system, and the signaling security protection system receives a roaming signaling message sent by a visited network to a user's home network; specifically, the MSC network element (Mobile Switching Center) / MME (Mobility Management Entity) network element / AMF (Access and Mobility Management Function) network element of the visited network sends a roaming signaling message to the HLR (Home Location Register) network element / HSS (Home Subscriber Server) network element / UDM (Unified Data Management) network element of the user's home network, and the signaling security protection system receives the roaming signaling message, and the roaming signaling message can be a LTE (Long Term Evolution) system Diameter message / GSM (Global System for Mobile Communications, Chinese for Global Mobile Communications System) system SS7 (Signaling System #7, Signaling System #7) message / 5G (5th Generation Mobile Communication Technology, the fifth generation mobile communication technology) system HTTP (Hypertext Transfer Protocol, Hypertext Transfer Protocol) message, the LTE system Diameter message can specifically be an AIR (318) / ULR (316) / NOR (323) / PUR (321) message, AIR is an authentication information request (Authentication-Information Request), ULR is an update location request (Update-Location Request), NOR is a notification request (Notify Request), and PUR is a clear request (Purge-UE Request).

[0054] The access signaling message of the user's most recent access to the home network is obtained to obtain the access location and access time carried in the access signaling message, wherein the access location is a base station location or a user location; that is, the base station location is the base station location of the base station of the user's most recent access to the home network, and the user location is the user location when the user last accessed the base station of the home network. The two locations are not much different, so they can be replaced separately. The access time is the time when the user last accessed the base station of the home network.

[0055] Optionally, the roaming signaling message also carries a user identifier, and the access signaling message also carries a user identifier; then, based on the user identifier in the roaming signaling message, the access signaling message of the user corresponding to the user identifier who last accessed the home network is obtained.

[0056] Exemplarily, the signaling security protection system is configured with a roaming status database, which records in real time the user's most recent (and latest) access information in the home network, wherein the database can be obtained by collecting the location area and cell information carried in the location update message between the base station and the core network access network element (MSC / MME / AMF), and the base station location of each base station recorded when the network was built. The database is the real-time and latest location information data of the user in the country / region of the home network, and the database contains: user identification (IMSI / MSISDN), access time, base station location, location area / cell information. The access signaling message of the user's most recent access to the home network is obtained through the database.

[0057] Then, according to the country and region identifier, the access location of the user in the visited network is obtained, and the distance between the access location and the access location is calculated. Then, in combination with the sending time and the access time, the speed of the user within the distance is calculated, that is, the speed of the user from the access location to the access location, or the speed of the user from the access location to the access location. Finally, according to the speed, it is determined whether the roaming signaling message is a false roaming signaling message.

[0058] It is worth noting that in the prior art, after receiving a roaming signaling message, it is necessary to simulate the GMLC (Gateway Mobile Location Center) network element and the HSS network element respectively to perform two related queries before it can be determined whether the roaming signaling message is a forged false roaming signaling message. The time for the two queries is estimated to consume several hundred milliseconds. The roaming signaling message of the present application directly carries the country and region identifier of the visited network and the sending time of the roaming signaling message, which can reduce the number of queries, thereby reducing the time consumption for location and time queries after receiving the roaming signaling message, and reducing processing delays.

[0059] Moreover, the present application is particularly aimed at the scenario of roaming out of a special home network, which refers to a country / region with a large land area and many land borders. In the prior art, the time consumed by the user to roam out of the home network will be inaccurate due to its large land area. The present application makes a judgment based on the speed obtained by combining the distance between the user's access location in the visited network and the user's access location in the home network and the time consumed, which can greatly improve the accuracy of the judgment, thereby reducing the misplacement, misblocking, missed blocking and missed placement of roaming signaling messages. In addition, the present application is applicable to various international roaming scenarios, such as SS7 international roaming scenarios, Diameter international roaming scenarios and HTTP international roaming scenarios.

[0060] The embodiments of the present application are applicable to various international roaming scenarios. The country and region identifier of the visited network carried in the roaming signaling message and the sending time of the roaming signaling message are used together with the access signaling message of the user's most recent and latest access to the home network to determine whether it is false and counterfeit roaming. This can reduce the time consumption for location query after receiving the roaming signaling message and reduce the processing delay. At the same time, the judgment is made based on the speed obtained by combining the distance between the user's access location in the visited network and the user's access location in the home network and the time consumed, which can greatly improve the accuracy of the judgment and thereby reduce the situations of misplacement, misblocking, missed blocking and missed placement of roaming signaling messages.

[0061] In an optional implementation manner, the determining, according to the speed, whether the roaming signaling message is a false roaming signaling message includes:

[0062] determining whether the speed is greater than a preset speed, and if so, determining that the roaming signaling message is a false roaming signaling message, and if not, determining that the roaming signaling message is not a false roaming signaling message;

[0063] In which, the preset speed is determined based on at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance and the port type of the target port; the target port is the initial target port closest to the access location, the initial target port is a port of the country / region of the visited network, or a port of a preset port type of the country / region of the visited network, and the preset port type is determined by the location relationship.

[0064] It is understandable that the location relationship between the country / region of the visited network and the country / region of the home network can be divided into adjacent and non-adjacent, wherein adjacent includes land adjacent and ocean adjacent, and non-adjacent includes non-land adjacent and non-ocean adjacent, and there are overlapping situations in the above location relationships. For example, if the location relationship between country A and country B is land adjacent, it means that country A and country B are bordered by land, and the location relationship between country A and country C is non-land adjacent, it means that country A and country C are not bordered by land, that is, country A and country C are not adjacent by land, or country A and country C have other adjacent relationships except land adjacent, such as ocean adjacent relationship.

[0065] Port types can be divided according to the mode of transportation of the country / region entering the visited network, such as land port type, water port type and air port type. Land port type can be further divided into highway port type and railway port type.

[0066] The target port is the initial target port closest to the access location, and the initial target port is a port of the country / region of the visited network, or a port of the preset port type of the country / region of the visited network; that is, the target port can be a port of the country / region of the visited network and closest to the access location, and the port is not limited to a specific port type, and does not only refer to a port of a certain port type; the target port can be a port of the preset port type of the country / region of the visited network and closest to the access location, then the preset port type and the target port are the same.

[0067] Optionally, the preset port type is determined by the location relationship. For example, if the location relationship is land proximity, the preset port type is a land port type, and the initial target port is preferably a port of the land port type of the country / region of the visited network. Only the ports of the land port type that are closest to the access location and belong to the country / region of the visited network are screened. This can further improve the judgment criteria and further reduce the situations of misplacement, misblocking, missed blocking and missed placement of roaming signaling messages.

[0068] In an embodiment of the present application, a preset speed is determined based on the positional relationship between the country / region of the visited network and the country / region of the home network, the distance, and at least one of the port types of the target port. By automatically determining a suitable preset speed, different overflow scenarios can be adapted to provide different and reasonable judgment criteria for different overflow scenarios, thereby improving judgment accuracy and stability.

[0069] For example, the preset speed is confirmed according to the distance; specifically, if the distance is far, for example, greater than or equal to 2000 kilometers, it can be considered that air travel is adopted, and the preset speed corresponding to the air travel mode is determined; if the distance is short, it can be considered that land transportation is adopted, and the preset speed corresponding to the land transportation mode is determined; other situations are similar and can be set according to actual needs, which will not be elaborated here.

[0070] The preset speed is confirmed according to the port type of the target port; specifically, if the target port is a road port, it can be considered that road travel is adopted, and the preset speed corresponding to the road travel mode is determined; if the target port is a railway port, it can be considered that railway travel is adopted, and the preset speed corresponding to the railway travel mode is determined. The remaining situations are similar and can be set according to actual needs, which will not be repeated here.

[0071] The preset speed is confirmed according to the position relationship; specifically, if the position relationship is adjacent to land, it can be considered that land transportation is adopted, and the preset speed corresponding to the land transportation mode is determined; if the position relationship is adjacent to the ocean, it can be considered that water transportation is adopted, and the preset speed corresponding to the water transportation mode can be configured; other situations are similar and can be set according to actual needs, which will not be repeated here.

[0072] Of course, the confirmation can also be performed in combination with at least two of the position relationship, the distance and the port type of the target port, and can be set according to actual needs, which will not be repeated here.

[0073] In an optional implementation manner, the preset speed is determined according to at least one of a location relationship between the country / region of the visited network and the country / region of the home network, the distance, and a port type of a target port, including at least one of the following situations:

[0074] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the first preset port type, the first preset speed is determined;

[0075] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the second preset port type, the second preset speed is determined;

[0076] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the third preset port type, the third preset speed is determined;

[0077] If the position relationship is adjacent to each other by land, and the distance is greater than or equal to the preset distance, a fourth preset speed is determined;

[0078] If the position relationship is not adjacent to a land road, the fifth preset speed is determined.

[0079] Exemplarily, the signaling safety protection system is also configured with a land adjacent database, a non-land adjacent database and a travel speed limit database.

[0080] The land adjacent database includes: country / region name, land adjacent country / region name, port name, port type and port location of land adjacent country / region, and these data have corresponding relationship. For example, the land adjacent database includes country A, country B adjacent to country A by land, port name of country B, port type of port of country B, and port location of port of country B.

[0081] Through this database, the location relationship can be confirmed. For example, the country / region of the home network can be obtained based on the country / region identifier of the home network, and the land adjacent country / region name corresponding to the country / region of the home network can be searched from the land adjacent database. If it can be found, it means that it is land adjacent, otherwise, it is not land adjacent.

[0082] Through this database, the names, port types and port locations of various countries / regions adjacent to the country / region of the home network by land and the ports of each country / region can be obtained, and then the port of the country / region of the visited network that is closest to the access location can be obtained; the port type here is preferably a land port type, and the names, land port types and land port locations of various countries / regions adjacent to the country / region of the home network by land and the land ports of each country / region can be obtained, and then the land port of the country / region of the visited network that is closest to the access location can be obtained, which can improve the judgment standard and further reduce the situations of misplacement, misblocking, missed blocking and missed placement of roaming signaling messages.

[0083] The non-land adjacent database includes: country / region name, non-land adjacent country / region name, port name, port type and port location of non-land adjacent country / region, and these data have a corresponding relationship. For example, the non-land adjacent database includes country A, country C which is non-land adjacent to country A, port name of country C, port type of port of country C, and port location of port of country C.

[0084] Through this database, the location relationship can be confirmed. For example, the country / region of the visited network can be obtained based on the country / region identifier of the home network, and the non-land adjacent country / region name corresponding to the country / region of the home network can be searched from the non-land adjacent database. If it can be found, it means that it is non-land adjacent, otherwise, it is land adjacent.

[0085] Through the database, the names, types and locations of ports of various countries / regions adjacent to the country / region of the home network and the ports of various countries / regions can be obtained, and then the port of the country / region of the visited network closest to the access location can be obtained; the port type is preferably an air port type, and the names, types and locations of air ports of various countries / regions adjacent to the country / region of the home network and the ports of various countries / regions can be obtained, and then the air port of the country / region of the visited network closest to the access location can be obtained, which can improve the judgment standard and further reduce the misplacement, misblocking, missed blocking and missed placement of roaming signaling messages. Among them, the name of the air port can be named after the name of the air port airport that provides international inbound flights in the country / region of the air port.

[0086] The travel speed limit database provides the speed limit values ​​(i.e., preset speeds) for each travel mode. For example, the speed limit value for water travel mode can be configured to be 50 km / h, the speed limit value for road travel mode can be 250 km / h, the speed limit value for railway travel mode can be 400 km / h, and the speed limit value for air travel mode can be 900 km / h. The preset speed that needs to be judged is determined through the travel speed limit database.

[0087] Among the above databases, the roaming status database is a dynamic database, which can update the user's latest location information in the country / region of the home network in real time; other databases are static databases, which can be initially configured when the signaling security protection system implements the false roaming judgment method; in addition, the travel speed limit database can dynamically modify and implement its parameters based on subsequent signaling audit and review results after the false roaming judgment method takes effect.

[0088] For example, the preset distance is 2000 kilometers; the first preset port type is a port, the second preset port type is a road port, and the third preset port type is a railway port; the first preset speed is 50 kilometers per hour, the second preset speed is 250 kilometers per hour, and the third preset speed is 400 kilometers per hour; the fourth preset speed is 900 kilometers per hour; the fifth preset speed is 50 kilometers per hour, and the sixth preset speed is 900 kilometers per hour. These preset speeds may be the same or different.

[0089] like Figure 2 ,First, determine whether the country / region of the visited network and the country / region of the home network are adjacent to each other by land;

[0090] If they are adjacent by land, determine whether the distance between the access location and the access location is less than 2000 km;

[0091] If it is less than 2000 kilometers, the port type of the port closest to the access location in the country / region of the visited network is determined; if it is a port, it can be considered that water travel is adopted. At this time, it is determined whether the user's speed within the distance is greater than 50 kilometers / hour. If it is greater than 50 kilometers / hour, it is determined that the roaming signaling message is a false roaming signaling message. If it is less than or equal to 50 kilometers / hour, it is determined that the roaming signaling message is not a false roaming signaling message; if it is a road port, it can be considered that road travel is adopted. At this time, it is determined whether the user's speed within the distance is If the speed is greater than 250 km / h, the roaming signaling message is judged to be a false roaming signaling message; if the speed is less than or equal to 250 km / h, the roaming signaling message is not a false roaming signaling message; if it is a railway port, it can be considered that the railway travel is adopted. At this time, it is judged whether the user's speed within the distance is greater than 400 km / h; if the speed is greater than 400 km / h, the roaming signaling message is judged to be a false roaming signaling message; if the speed is less than or equal to 400 km / h, the roaming signaling message is not a false roaming signaling message.

[0092] If it is greater than or equal to 2000 kilometers, it can be considered as air travel. At this time, it is determined whether the user's speed within the distance is greater than 900 kilometers / hour. If it is greater than 900 kilometers / hour, the roaming signaling message is determined to be a false roaming signaling message. If it is less than or equal to 900 kilometers / hour, the roaming signaling message is determined not to be a false roaming signaling message.

[0093] If the two places are not adjacent to each other by land, it can be considered that air travel is adopted. At this time, it is determined whether the user's speed within the distance is greater than 900 kilometers / hour. If it is greater than 900 kilometers / hour, the roaming signaling message is determined to be a false roaming signaling message. If it is less than or equal to 900 kilometers / hour, the roaming signaling message is determined not to be a false roaming signaling message.

[0094] In an optional implementation manner, obtaining the access location of the user in the visited network according to the country or region identifier, and calculating the distance between the access location and the access location includes:

[0095] According to the country / region identifier, the port locations of all ports of the country / region of the visited network are obtained; or, according to the country / region identifier, the port locations of all ports of a preset port type of the country / region of the visited network are obtained; wherein the preset port type is determined by the positional relationship between the country / region of the visited network and the country / region of the home network;

[0096] Taking the port location as an ideal access location, and obtaining the access location of the user in the visited network according to all the ideal access locations;

[0097] A distance between the access location and the access location is calculated.

[0098] In an embodiment of the present application, based on the country and region identification, the port locations of all ports in the country / region of the visited network are obtained; preferably, the preset port type is determined by the positional relationship between the country / region of the visited network and the country / region of the home network, and based on the country and region identification, the port locations of all ports of the preset port type in the country and region of the visited network are obtained, so that the distance obtained according to these port positions can be adapted to the port type of the target port, which makes it more accurate to judge the size relationship between the distance and the preset distance, thereby further improving the accuracy of judgment.

[0099] In order to further reduce the time consumption of location query after receiving the roaming signaling message and reduce the processing delay, the port location is used as the ideal access location, and the access location of the user in the visited network is obtained based on all the ideal access locations; finally, the distance between the access location and the access location is calculated.

[0100] In an optional implementation, the access location is the ideal access location closest to the access location, or an average value of all the ideal access locations.

[0101] In the embodiment of the present application, in order to further reduce the possibility of misjudgment, the access location is preferably the ideal access location that is closest to the access location.

[0102] In an optional implementation, after determining whether the roaming signaling message is a false roaming signaling message according to the speed, the false roaming determination method further includes:

[0103] If the judgment result is that the roaming signaling message is a false roaming signaling message, intercepting the roaming signaling message;

[0104] If the judgment result is that the roaming signaling message is not a false roaming signaling message, the roaming signaling message is released.

[0105] In the embodiment of the present application, in order to avoid attacks caused by false roaming, after determining whether the roaming signaling message is a false roaming signaling message, further operations are performed on the roaming signaling message according to the determination result, including interception and release. Specifically, if the determination result is that the roaming signaling message is a false roaming signaling message, the roaming signaling message is intercepted, which can avoid attacks caused by the roaming signaling message; if the determination result is that the roaming signaling message is not a false roaming signaling message, the roaming signaling message is released.

[0106] In an optional implementation manner, calculating the speed of the user within the distance according to the distance, the sending time, and the access time includes:

[0107] Calculate the time difference between the sending time and the access time;

[0108] The speed of the user within the distance is calculated according to the distance and the time difference.

[0109] In an embodiment of the present application, the time difference between the sending time and the access time is calculated, and the time difference is the time consumed by the user from the access location to the access location, or the time consumed by the user from the access location to the access location; and then according to the distance and the time difference, the speed of the user within the distance is calculated. Specifically, the distance is divided by the time difference to obtain the speed, so as to confirm whether the user can reasonably arrive by existing transportation through the speed, so as to determine whether the received roaming signaling message is a false roaming signaling message.

[0110] A false roaming judgment method provided in an embodiment of the present application comprises receiving a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message; obtaining an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location; according to the country or region identifier, obtaining an access location of the user in the visited network, and calculating a distance between the access location and the access location; according to the distance, the sending time and the access time, calculating a speed of the user within the distance; and judging whether the roaming signaling message is a false roaming signaling message according to the speed. It can be seen that the embodiment of the present application uses the country and region identifier of the visited network carried in the roaming signaling message and the sending time of the roaming signaling message, and the access signaling message of the latest access to the home network to determine whether it is a false counterfeit roaming, which can reduce the time consumption for location and time query after receiving the roaming signaling message and reduce the processing delay; at the same time, according to the speed obtained by combining the distance between the user's access location in the visited network and the user's access location in the home network and the time consumed, the accuracy of the judgment can be greatly improved, thereby reducing the misplacement, misblocking, missed blocking and missed placement of roaming signaling messages.

[0111] See also Figure 3 , Figure 3 : is a structural block diagram of a false roaming determination device 10 provided in an embodiment of the present application, wherein the false roaming determination device 10 comprises:

[0112] The first acquisition module 11 is used to receive a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message;

[0113] The second acquisition module 12 is used to obtain the access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location;

[0114] A first calculation module 13, configured to obtain a visited location of the user in the visited network according to the country and region identifier, and calculate a distance between the visited location and the access location;

[0115] A second calculation module 14 is used to calculate the speed of the user within the distance according to the distance, the sending time and the access time;

[0116] The judging module 15 is configured to judge whether the roaming signaling message is a false roaming signaling message according to the speed.

[0117] Optionally, the judging module 15 is further configured to:

[0118] determining whether the speed is greater than a preset speed, and if so, determining that the roaming signaling message is a false roaming signaling message, and if not, determining that the roaming signaling message is not a false roaming signaling message;

[0119] In which, the preset speed is determined based on at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance and the port type of the target port; the target port is the initial target port closest to the access location, the initial target port is a port of the country / region of the visited network, or a port of a preset port type of the country / region of the visited network, and the preset port type is determined by the location relationship.

[0120] Optionally, the preset speed is determined according to at least one of a location relationship between the country / region of the visited network and the country / region of the home network, the distance, and a port type of a target port, including at least one of the following situations:

[0121] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the first preset port type, the first preset speed is determined;

[0122] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the second preset port type, the second preset speed is determined;

[0123] If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the third preset port type, the third preset speed is determined;

[0124] If the position relationship is adjacent to each other by land, and the distance is greater than or equal to the preset distance, a fourth preset speed is determined;

[0125] If the position relationship is not adjacent to a land road, the fifth preset speed is determined.

[0126] Optionally, the first calculation module 13 is further used for:

[0127] According to the country / region identifier, the port locations of all ports of the country / region of the visited network are obtained; or, according to the country / region identifier, the port locations of all ports of a preset port type of the country / region of the visited network are obtained; wherein the preset port type is determined by the positional relationship between the country / region of the visited network and the country / region of the home network;

[0128] Taking the port location as an ideal access location, and obtaining the access location of the user in the visited network according to all the ideal access locations;

[0129] A distance between the access location and the access location is calculated.

[0130] Optionally, the access location is the ideal access location closest to the access location, or an average value of all the ideal access locations.

[0131] Optionally, the false roaming determination device 10 further includes:

[0132] an interception module, configured to intercept the roaming signaling message if a judgment result shows that the roaming signaling message is a false roaming signaling message;

[0133] The release module is used to release the roaming signaling message if the judgment result is that the roaming signaling message is not a false roaming signaling message.

[0134] Optionally, the second calculation module 14 is further used for:

[0135] Calculate the time difference between the sending time and the access time;

[0136] The speed of the user within the distance is calculated according to the distance and the time difference.

[0137] It is worth noting that the working process of each module in the false roaming determination device 10 described in the embodiment of the present application can refer to the working process of the false roaming determination method described in the above embodiment, which will not be repeated here.

[0138] A false roaming determination device 10 provided in an embodiment of the present application receives a roaming signaling message sent by a visited network to a home network of a user; the roaming signaling message carries at least: a country or region identifier of the visited network and a sending time of the roaming signaling message; obtains an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location; based on the country or region identifier, obtains an access location of the user in the visited network, and calculates a distance between the access location and the access location; based on the distance, the sending time and the access time, calculates a speed of the user within the distance; and determines whether the roaming signaling message is a false roaming signaling message based on the speed. It can be seen that the embodiment of the present application uses the country and region identifier of the visited network carried in the roaming signaling message and the sending time of the roaming signaling message, and the access signaling message of the latest access to the home network to determine whether it is a false counterfeit roaming, which can reduce the time consumption for location and time query after receiving the roaming signaling message and reduce the processing delay; at the same time, according to the speed obtained by combining the distance between the user's access location in the visited network and the user's access location in the home network and the time consumed, the accuracy of the judgment can be greatly improved, thereby reducing the misplacement, misblocking, missed blocking and missed placement of roaming signaling messages.

[0139] In addition, an embodiment of the present application further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the false roaming judgment method as described in any of the above embodiments.

[0140] In addition, an embodiment of the present application further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the false roaming determination method as described in any of the above embodiments.

[0141] See also Figure 4 , Figure 4: is a structural block diagram of a false roaming judgment device 20 provided in an embodiment of the present application, and the false roaming judgment device 20 includes: a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, the steps in the false roaming judgment method embodiment are implemented. Alternatively, when the processor 21 executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0142] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the false roaming determination device 20.

[0143] The false roaming determination device 20 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art may understand that the schematic diagram is merely an example of the false roaming determination device 20 and does not constitute a limitation on the false roaming determination device 20. The false roaming determination device 20 may include more or fewer components than shown in the figure, or may combine certain components, or different components. For example, the false roaming determination device 20 may also include an input / output device, a network access device, a bus, etc.

[0144] The processor 21 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 21 is the control center of the false roaming determination device 20, and uses various interfaces and lines to connect various parts of the entire false roaming determination device 20.

[0145] The memory 22 can be used to store the computer program and / or module. The processor 21 implements various functions of the false roaming judgment device 20 by running or executing the computer program and / or module stored in the memory 22 and calling the data stored in the memory 22. The memory 22 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0146] Wherein, if the module / unit integrated in the false roaming judgment device 20 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor 21, the steps of the above-mentioned method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium.

[0147] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0148] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A false roaming judgment method, characterized in that: include: receiving a roaming signaling message sent by a visited network to a user's home network; The roaming signaling message carries at least: the country and region identifier of the visited network and the sending time of the roaming signaling message; Acquire an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location; According to the country and region identifier, obtaining the access location of the user in the visited network, and calculating the distance between the access location and the access location; Calculate the speed of the user within the distance according to the distance, the sending time and the access time; Whether the roaming signaling message is a false roaming signaling message is determined according to the speed.

2. The false roaming determination method according to claim 1, characterized in that: The determining, according to the speed, whether the roaming signaling message is a false roaming signaling message includes: determining whether the speed is greater than a preset speed, and if so, determining that the roaming signaling message is a false roaming signaling message, and if not, determining that the roaming signaling message is not a false roaming signaling message; In which, the preset speed is determined based on at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance and the port type of the target port; the target port is the initial target port closest to the access location, the initial target port is a port of the country / region of the visited network, or a port of a preset port type of the country / region of the visited network, and the preset port type is determined by the location relationship.

3. The false roaming determination method according to claim 2, characterized in that: The preset speed is determined according to at least one of the location relationship between the country / region of the visited network and the country / region of the home network, the distance, and the port type of the target port, including at least one of the following situations: If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the first preset port type, the first preset speed is determined; If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the second preset port type, the second preset speed is determined; If the position relationship is adjacent to each other by land, the distance is less than the preset distance, and the target port is of the third preset port type, the third preset speed is determined; If the position relationship is adjacent to each other by land, and the distance is greater than or equal to the preset distance, a fourth preset speed is determined; If the position relationship is not adjacent to a land road, the fifth preset speed is determined.

4. The false roaming determination method according to claim 1, characterized in that: The obtaining, according to the country or region identifier, an access location of the user in the visited network, and calculating a distance between the access location and the access location includes: According to the country / region identifier, the port locations of all ports of the country / region of the visited network are obtained; or, according to the country / region identifier, the port locations of all ports of a preset port type of the country / region of the visited network are obtained; wherein the preset port type is determined by the positional relationship between the country / region of the visited network and the country / region of the home network; Taking the port location as an ideal access location, and obtaining the access location of the user in the visited network according to all the ideal access locations; A distance between the access location and the access location is calculated.

5. The false roaming determination method according to claim 4, characterized in that: The access position is the ideal access position closest to the access position, or an average value of all the ideal access positions.

6. The false roaming determination method according to claim 1, characterized in that: After determining whether the roaming signaling message is a false roaming signaling message according to the speed, the false roaming determination method further includes: If the judgment result is that the roaming signaling message is a false roaming signaling message, intercepting the roaming signaling message; If the judgment result is that the roaming signaling message is not a false roaming signaling message, the roaming signaling message is released.

7. A false roaming judgment device, characterized in that: include: A first acquisition module, configured to receive a roaming signaling message sent by a visited network to a home network of a user; The roaming signaling message carries at least: the country and region identifier of the visited network and the sending time of the roaming signaling message; A second acquisition module is used to acquire an access signaling message of the user's most recent access to the home network; the access signaling message carries at least: an access location and an access time; the access location is a base station location or a user location; A first calculation module, configured to obtain, according to the country and region identifier, an access location of the user in the visited network, and calculate a distance between the access location and the access location; A second calculation module, configured to calculate a speed of the user within the distance according to the distance, the sending time and the access time; The judging module is used to judge whether the roaming signaling message is a false roaming signaling message according to the speed.

8. A false roaming judgment device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the false roaming determination method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program; wherein, when the computer program is run, it controls the device where the computer-readable storage medium is located to execute the false roaming determination method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the false roaming determination method according to any one of claims 1 to 6.

Images