A terminal detection and defense method for a speed reduction attack of a mobile communication system

Abstract

The present application belongs to the field of network security technology of mobile communication system, and relates to a terminal detection and defense method for speed reduction attack of mobile communication system, which comprises the following steps: obtaining local real capability information and calculating expected performance index after terminal booting; listening to abnormal signaling events and recording suspicious cell identification information; periodically collecting performance index and screening effective samples in the service transmission stage; calculating actual performance index based on the effective samples and comparing with the expected performance index to determine whether sustained speed reduction occurs; comprehensively determining whether the terminal is subjected to speed reduction attack in combination with multi-dimensional information; and when the attack is confirmed, the terminal actively performs a defense process to restore normal wireless service. The present application enables the terminal to independently detect speed reduction attack caused by tampered capability and autonomously perform defense, thereby effectively ensuring wireless communication security.

Description

Technical Field

[0001] This invention belongs to the field of mobile communication system network security technology, and specifically relates to a terminal detection and defense method for mobile communication system speed-down attacks. Background Technology

[0002] In 4G systems, user equipment (UE) reports radio access capability information to the network via UE Capability Information, including terminal type, supported protocol versions, and carrier aggregation capabilities. This information directly affects the level of radio resources configured by the network for the terminal, thereby determining the actual transmission rate of the terminal's services.

[0003] According to the design of the 3GPP (3rd Generation Partnership Project) protocol, the capability information reporting process occurs before the terminal's security activation. During this time, air interface signaling is not protected by integrity or encrypted and can only be exchanged in plaintext. Therefore, attackers can exploit this protocol vulnerability to carry out speed-down attacks.

[0004] The attack method is as follows: Construct a fake base station to attract terminals to camp on the fake base station, and use the Tracking Area Update (TAU) rejection process to trigger the terminal to fall back to the initial registration process with a specific rejection reason value; then, use the capability reporting process in the initial registration process to intercept and tamper with the terminal's capability information, causing the network to receive downgraded capability information; then shut down the fake base station and release the terminal into the real network; in the real network, the terminal receives the resources allocated by the network corresponding to the downgraded capability information, resulting in limited service rates, which is the speed reduction attack.

[0005] This security threat persists in 5G / 4G hybrid network systems. Terminals may proactively fall back to the 4G system due to insufficient 5G signal coverage or normal service drop-off processes; alternatively, attackers can force terminals to passively fall back to the less secure 4G system by sending false denial signaling. Once a terminal falls back to the 4G system, a speed-down attack can be carried out.

[0006] Because rate-degradation attacks are highly covert, it is difficult for the network side to distinguish whether the capability degradation is due to genuine limitations in the terminal's capabilities or malicious tampering, as there are no obvious abnormal signaling on the terminal side. Existing defense solutions mostly rely on modifying protocol specifications or introducing auxiliary verification on the network side, which is difficult to deploy quickly in commercially available cellular networks. Summary of the Invention

[0007] This invention proposes a terminal detection and defense method for speed-down attacks on mobile communication systems, in order to solve the problem of the lack of effective terminal-side detection and defense methods for speed-down attacks caused by the tampering of terminal wireless capability information in 4G systems or 5G / 4G hybrid network system scenarios.

[0008] A terminal detection and defense method for speed-reduction attacks on mobile communication systems includes: after the terminal powers on, it acquires local real-time capability information and calculates expected performance indicators; the terminal listens for abnormal signaling events and records suspicious cell identification information; the terminal periodically collects performance indicators and filters valid samples during service transmission; the terminal calculates actual performance indicators based on valid samples and compares them with expected performance indicators to determine whether a sustained rate limitation has occurred; the terminal comprehensively determines whether it has been subjected to a speed-reduction attack by combining multi-dimensional information; and when the attack is confirmed, the terminal actively executes a defense process to restore normal wireless service.

[0009] Furthermore, the local real-world capability information includes: terminal category, supported protocol version, theoretical maximum uplink / downlink transmission rate corresponding to the terminal category, and theoretical maximum uplink / downlink modulation and coding scheme (MCS) level corresponding to the terminal category.

[0010] Furthermore, the expected performance indicators include a lower limit for transmission rate and a lower limit for MCS level; the lower limit for transmission rate is calculated by multiplying the theoretical maximum uplink / downlink transmission rate by a preset rate threshold percentage; the lower limit for MCS level is calculated by multiplying the theoretical highest uplink / downlink MCS level by a preset MCS level threshold percentage.

[0011] Furthermore, the process of the terminal monitoring abnormal signaling events and recording suspicious cell identification information includes: when the terminal initiates a TAU request, it records the identification information of the target cell; when the network side rejects the request and the rejection reason value is 0x09 (UE Identity cannot be derived by the network), the terminal stores the target cell identification information in the suspicious cell list; the rejection reason value 0x09 is a typical signaling feature of a rate-down attack, and this reason value will trigger the terminal to fall back to the initial registration process, which the attacker can then use to carry out a rate-down attack; therefore, by monitoring this rejection reason value, the terminal completes the recording of suspicious cells in the early stage of the attack, providing a basis for subsequent confirmation of the attack source.

[0012] Furthermore, the target cell is the cell where the current terminal is camped; the target cell identification information includes: Physical Cell Identifier (PCI), Tracking Area Code (TAC), and E-UTRA Absolute Radio Frequency Channel Number (EARFCN).

[0013] Furthermore, the process of periodically collecting performance indicators and screening valid samples includes: the terminal periodically collecting physical layer and media access control (MAC) layer performance indicators as samples, adding sampling timestamps and storing them in a sliding window; when the number and timeliness of samples in the sliding window meet the preset conditions of the sliding window, samples with signal quality that meet the preset excellent conditions are selected as valid samples, and the proportion of the number of valid samples to the total number of samples is not less than the preset proportion.

[0014] Furthermore, the performance metrics include: signal quality metrics, including Reference Signal Received Power (RSRP) and Signal to Interference plus Noise Ratio (SINR); scheduling metrics, including uplink / downlink MCS levels; transmission rate metrics, including uplink / downlink rates; and channel state metrics, including Carrier Frequency Offset (CFO) and Timing Advance (TA).

[0015] Furthermore, the preset conditions for the sliding window include: the number of samples is not less than the minimum preset value, and the timeliness does not exceed the maximum preset value; the timeliness refers to the difference between the current time and the sample sampling timestamp.

[0016] Furthermore, the preset favorable conditions include: RSRP is higher than a first threshold and SINR is higher than a second threshold.

[0017] Furthermore, the method for determining the continuous rate limitation is as follows: Based on valid samples, the terminal calculates four indicators: average uplink / downlink transmission rate and average uplink / downlink MCS level; each of the four indicators is compared with the expected lower limit; when each indicator is lower than its lower limit, the rate limitation counter is incremented; otherwise, the counter is set to zero; when the counter is continuously incremented to a preset number, the continuous rate limitation is determined.

[0018] Furthermore, the conditions for the terminal to comprehensively determine whether it has been subjected to a rate-reduction attack by combining multi-dimensional information include: simultaneously satisfying the existence of the continuous rate limitation, the current channel state being normal, and the list of suspicious cells being non-empty; the normal channel state means that the absolute value of CFO is lower than the third threshold, and the absolute value of TA is lower than the fourth threshold.

[0019] Furthermore, the defense process includes:

[0020] The terminal checks the list of suspicious cells, adds the suspicious cells to the list of prohibited cells for isolation, and sets the corresponding prohibition duration;

[0021] The terminal clears the list of suspicious cells and sets the rate-limited counter to zero.

[0022] The terminal automatically executes the deregistration process and then initiates a re-registration.

[0023] Furthermore, each record in the prohibited cell list includes the following fields: PCI, TAC, EARFCN, timestamp information, and prohibition duration; the prohibition duration is configured as a preset duration, or written into non-volatile memory (NV) to be permanently prohibited.

[0024] Furthermore, the specific method for the terminal to automatically execute the deregistration process and then initiate re-registration is as follows: the terminal performs local deregistration, clears registration-related information, and resets all functional modules; the terminal ignores cells within the validity period in the prohibited cell list, reselects a cell to camp on, and initiates the registration process; in the process of reselecting a cell to camp on and initiating registration, the terminal reports the locally stored real capability information to the network, and restores normal wireless service after completing registration; the validity period refers to the difference between the current time and the timestamp when the record was added, which does not exceed its corresponding prohibition duration.

[0025] The present invention has at least the following beneficial effects:

[0026] By monitoring the TAU process, the terminal records suspicious cell identification information in the early stages of an attack, effectively solving the problem of being unable to trace the source of the attack after the fake base station completes the attack and releases the terminal. Based on local real capability information, the terminal can accurately identify speed-down attacks by periodically collecting performance indicators and combining them with multi-dimensional information such as channel status. The terminal can independently complete the entire attack detection and defense process without network-side support or modification of protocol specifications, making it highly feasible and practical for deployment. Attached Figure Description

[0027] Figure 1 This is the overall flowchart of the present invention;

[0028] Figure 2This is a flowchart illustrating the process of monitoring abnormal signaling events and recording suspicious cell identification information according to the present invention.

[0029] Figure 3 This is a flowchart illustrating the process of comprehensively determining a speed-reduction attack based on multi-dimensional information, as described in this invention.

[0030] Figure 4 This is a flowchart of the active defense process of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0032] A specific implementation method for terminal detection and defense against speed-down attacks on mobile communication systems, as follows: Figure 1 As shown, the method includes: after the terminal powers on, it obtains local real-time capability information and calculates expected performance indicators; the terminal listens for abnormal signaling events and records suspicious cell identification information; the terminal periodically collects performance indicators and filters valid samples during the service transmission phase; the terminal calculates actual performance indicators based on valid samples and compares them with expected performance indicators to determine whether a continuous rate limitation has occurred; the terminal combines multi-dimensional information to comprehensively determine whether it has been subjected to a rate-reduction attack; when the attack is confirmed, the terminal actively executes a defense process to restore normal wireless service.

[0033] The local real-world capability information includes: terminal type, supported protocol version, theoretical maximum uplink / downlink transmission rate corresponding to the terminal type, and theoretical maximum uplink / downlink MCS level corresponding to the terminal type.

[0034] For specific details, please refer to Table 1 for the terminal's actual capabilities.

[0035] Table 1

[0036]

[0037] The expected performance indicators include a lower limit for transmission rate and a lower limit for MCS level. The lower limit for transmission rate is calculated by multiplying the theoretical maximum uplink / downlink transmission rate by a preset rate threshold percentage. The lower limit for MCS level is calculated by multiplying the theoretical highest MCS level for uplink / downlink by a preset MCS level threshold percentage.

[0038] Preferably, the preset rate threshold percentage is 40%, and the preset MCS level threshold percentage is 50%.

[0039] like Figure 2As shown, the process of the terminal monitoring abnormal signaling events and recording suspicious cell identification information includes: when the terminal initiates a TAU request, it records the identification information of the target cell; when the network side rejects the request and the rejection reason value is 0x09, it indicates that the network cannot deduce the identity of the terminal, and the terminal stores the target cell identification information in the suspicious cell list; the target cell is the cell where the terminal is currently camped; the target cell identification information includes: PCI, TAC, and EARFCN.

[0040] For specific details, please refer to the target community identification information in Table 2.

[0041] Table 2

[0042]

[0043] The process of periodically collecting performance indicators and screening valid samples includes: the terminal periodically collects physical layer and MAC layer performance indicators as samples, adds sampling timestamps and stores them in a sliding window; when the number and timeliness of the samples in the sliding window meet the preset conditions of the sliding window, samples whose signal quality meets the preset excellent conditions are selected as valid samples, and the proportion of the number of valid samples to the total number of samples is not less than the preset proportion.

[0044] Preferably, the preset ratio is 60%.

[0045] The performance metrics include: signal quality metrics, including RSRP and SINR; scheduling metrics, including uplink / downlink MCS levels; transmission rate metrics, including uplink / downlink rates; and channel state metrics, including CFO and TA.

[0046] For specific details, please refer to the performance indicators in Table 3.

[0047] Table 3

[0048]

[0049] The preset conditions for the sliding window include: the number of samples is not less than the minimum preset value, and the timeliness does not exceed the maximum preset value; the timeliness refers to the difference between the current time and the sample sampling timestamp.

[0050] Preferably, the minimum preset value for the number of samples is 10, and the maximum preset value for timeliness is 5 seconds.

[0051] The preset favorable conditions include: RSRP is higher than the first threshold and SINR is higher than the second threshold.

[0052] Preferably, the first threshold is -90dBm and the second threshold is 10dB.

[0053] The method for determining continuous rate limitation is as follows: Based on valid samples, the terminal calculates four indicators: average uplink / downlink transmission rate and average uplink / downlink MCS level; each of the four indicators is compared with the expected lower limit. When all indicators are lower than their lower limits, the rate limitation counter is incremented; otherwise, the counter is set to zero. When the counter is continuously incremented to a preset number of times, it is determined that the continuous rate limitation is determined.

[0054] Preferably, the counter is preset to run 10 times.

[0055] like Figure 3 As shown, the conditions for the terminal to comprehensively determine whether it has been subjected to a rate-reduction attack by combining multi-dimensional information include: simultaneously satisfying the existence of the continuous rate limitation, the current channel state being normal, and the list of suspicious cells being non-empty; the normal channel state means that the absolute value of CFO is lower than the third threshold, and the absolute value of TA is lower than the fourth threshold.

[0056] Preferably, the third threshold is 300Hz and the fourth threshold is 50µs.

[0057] like Figure 4 As shown, the defense process includes:

[0058] The terminal checks the list of suspicious cells, adds the suspicious cells to the list of prohibited cells for isolation, and sets the corresponding prohibition duration;

[0059] The terminal clears the list of suspicious cells and sets the rate-limited counter to zero.

[0060] The terminal automatically executes the deregistration process and then initiates a re-registration.

[0061] Each record in the prohibited cell list contains the following fields: PCI, TAC, EARFCN, timestamp information, and prohibition duration; the prohibition duration is configured as a preset duration, or written into NV to be permanently prohibited.

[0062] For details, please refer to the list of prohibited communities in Table 4.

[0063] Table 4

[0064]

[0065] Preferably, the preset duration is 30 minutes.

[0066] The specific method for the terminal to automatically execute the deregistration process and then initiate re-registration is as follows: the terminal performs local deregistration, clears registration-related information, and resets all functional modules; the terminal ignores cells in the prohibited cell list that are within the validity period, and reselects a cell to initiate the registration process; in the process of reselecting a cell to initiate registration, the terminal reports the local real capability information to the network, and restores normal wireless service after completing the registration; the validity period refers to the difference between the current time and the timestamp when the record was added, which does not exceed its corresponding prohibition duration.

[0067] Those skilled in the art will understand that all or part of the processes in the above method embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0068] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A terminal detection and defense method for speed-down attacks on mobile communication systems, characterized in that, The method includes: after the terminal is powered on, it obtains local real capability information and calculates expected performance indicators; the terminal listens for abnormal signaling events and records suspicious cell identification information; the terminal periodically collects performance indicators and filters valid samples during the service transmission phase; the terminal calculates actual performance indicators based on valid samples and compares them with expected performance indicators to determine whether there is a continuous rate limitation; the terminal combines multi-dimensional information to comprehensively determine whether it has been subjected to a rate-reduction attack; when the attack is confirmed, the terminal actively executes the defense process to restore normal wireless service.

2. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The local real-world capability information includes: terminal type, supported protocol version, theoretical maximum uplink / downlink transmission rate corresponding to the terminal type, and theoretical maximum uplink / downlink MCS level corresponding to the terminal type.

3. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The expected performance indicators include a lower limit for transmission rate and a lower limit for MCS level. The lower limit for transmission rate is calculated by multiplying the theoretical maximum uplink / downlink transmission rate by a preset rate threshold percentage. The lower limit for MCS level is calculated by multiplying the theoretical highest MCS level for uplink / downlink by a preset MCS level threshold percentage.

4. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The process of the terminal monitoring abnormal signaling events and recording suspicious cell identification information includes: when the terminal initiates a TAU request, it records the identification information of the target cell; when the network side rejects the request and the rejection reason value is 0x09, it indicates that the network cannot deduce the identity of the terminal, and the terminal stores the target cell identification information in the suspicious cell list; the target cell is the cell where the terminal is currently camped; the target cell identification information includes: PCI, TAC, and EARFCN.

5. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The process of periodically collecting performance indicators and screening valid samples includes: The terminal periodically collects physical layer and MAC layer performance indicators as samples, adds sampling timestamps, and stores them in a sliding window; When the number and timeliness of samples within the sliding window meet the preset conditions of the sliding window, samples whose signal quality meets the preset excellent conditions are selected as valid samples, and the proportion of the number of valid samples to the total number of samples is not less than the preset proportion. The performance metrics include: signal quality metrics, including RSRP and SINR; scheduling metrics, including uplink / downlink MCS levels; transmission rate metrics, including uplink / downlink rates; and channel state metrics, including CFO and TA. The preset conditions for the sliding window include: the number of samples is not less than the minimum preset value, and the timeliness does not exceed the maximum preset value; the timeliness refers to the difference between the current time and the sample sampling timestamp. The preset favorable conditions include: RSRP is higher than the first threshold and SINR is higher than the second threshold.

6. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The method for determining continuous rate limitation is as follows: Based on valid samples, the terminal calculates four indicators: average uplink / downlink transmission rate and average uplink / downlink MCS level; each of the four indicators is compared with the expected lower limit. When all indicators are lower than their lower limits, the rate limitation counter is incremented; otherwise, the counter is set to zero. When the counter is continuously incremented to a preset number of times, it is determined that the continuous rate limitation is determined.

7. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The conditions for the terminal to comprehensively determine whether it has been subjected to a rate-reduction attack by combining multi-dimensional information include: simultaneously satisfying the existence of the continuous rate limitation, the current channel state being normal, and the list of suspicious cells being non-empty; the normal channel state means that the absolute value of CFO is lower than the third threshold, and the absolute value of TA is lower than the fourth threshold.

8. The terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 1, characterized in that, The defense process includes: The terminal checks the list of suspicious cells, adds the suspicious cells to the list of prohibited cells for isolation, and sets the corresponding prohibition duration; The terminal clears the list of suspicious cells and sets the rate-limited counter to zero. The terminal automatically executes the deregistration process and then initiates a re-registration.

9. A terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 8, characterized in that, Each record in the prohibited cell list contains the following fields: PCI, TAC, EARFCN, timestamp information, and prohibition duration; the prohibition duration is configured as a preset duration, or written into NV to be permanently prohibited.

10. A terminal detection and defense method for speed-down attacks on mobile communication systems according to claim 8, characterized in that, The specific method for the terminal to automatically execute the deregistration process and then initiate re-registration is as follows: the terminal performs local deregistration, clears registration-related information, and resets all functional modules; the terminal ignores cells in the prohibited cell list that are within the validity period, and reselects a cell to initiate the registration process; in the process of reselecting a cell to initiate registration, the terminal reports the local real capability information to the network, and restores normal wireless service after completing the registration; the validity period refers to the difference between the current time and the timestamp when the record was added, which does not exceed its corresponding prohibition duration.

Images