Preventing subscriber identification module spoofing in the mobile user plane

Abstract

The purpose is to prevent SIM spoofing within the mobile user plane. The method includes establishing a session for a user device that communicates with a Session Management Function (SMF) and a User Plane Function (UPF), then snooping messages between the SMF and the UPF to obtain one or more of the user device's address, a tunnel endpoint identifier, or the address of a node in the radio access network. The method also includes generating a route for transmitting one or more of the user device's address, the tunnel endpoint identifier, or the address of the node in the radio access network, and then providing the route to a router.

Claims

1. Establish a session for user devices that communicate with the Session Management Function (SMF) and User Plane Function (UPF), Snooping messages between the SMF and the UPF, obtaining one or more of the user device address, tunnel endpoint identifier, or node addresses within the wireless access network, A route is generated for transmitting one or more of the user device address, the tunnel endpoint identifier, or the address of the node in the wireless access network. Provide the aforementioned route to the router. A method characterized by including the following.

2. The method according to claim 1, characterized in that the user device is connected to the node in the wireless access network.

3. The method according to claim 1, further comprising causing the node in the wireless access network to transmit a signal to the Access and Mobility Management Function (AMF) in response to the node in the wireless access network receiving a packet from the user equipment.

4. The method according to 3, further comprising causing the AMF to transmit a signal to the SMF, wherein the AMF transmits a signal to the SMF before establishing the session for the user equipment to communicate with the SMF and the UPF.

5. The method according to claim 1, characterized in that snooping the messages between the SMF and the UPF includes a packet forwarding control protocol (PFCP) proxy snooping PFCP messages between the SMF and the UPF.

6. The method according to claim 1, wherein generating the route includes generating the route by a Border Gateway Protocol (BGP) control device, the control device is further configured to update the corresponding Type 1ST route by one or more of the address of the user device, the tunnel endpoint identifier, or the address of the node in the radio access network.

7. Furthermore, the system receives internal Internet Protocol (IP) packets from the user device to the node within the wireless access network, and then, The aforementioned internal IP packets are encapsulated within user datagram protocol packets, GPRS tunneling protocol (GTP) packets, and IP packets, respectively. The method according to claim 1, characterized by including the following:

8. The method according to 7, further comprising causing the router to verify the source address of the internal IP packet.

9. Furthermore, by determining whether the corresponding route for the user device has been announced by the BGP control device, it is determined whether the internal IP packet was generated by the user device, and then, In response to the BGP control device determining that the corresponding route for the user device has been announced, the GTP packet is forwarded to the mobile backhaul. The method according to 8, characterized in that it includes the following.

10. The method according to 9, characterized in that the mobile backhaul is a transport network configured to connect the core network to the wireless access network.

11. Furthermore, by determining whether the corresponding route for the user device has been announced by the BGP control device, it is determined whether the internal IP packet was generated by the user device, and then, In response to the BGP control device determining that the corresponding route for the user device has not been announced, the GTP packet is discarded. The method according to 8, characterized in that it includes the following.

12. The method according to 11, characterized in that the discarding of the GTP packets is performed to prevent subscriber identification module (SIM) spoofing.

13. The method according to claim 1, characterized in that the user device communicates with a 5G wireless access network.

14. The method according to claim 1, characterized in that the user device is a cellular device capable of communicating with the node in the wireless access network.

15. The method according to claim 1, characterized in that the node in the wireless access network is a gNodeB in a 5G wireless access network.

16. The method according to claim 1, characterized in that the user device is associated with a unique IMSI (International Mobile Subscriber Identification Number), and establishing the session for the user device includes establishing a session for receiving packets from the unique IMSI.

17. The method according to claim 1, characterized in that the aforementioned route is a type 1ST route.

18. The method according to claim 1, characterized in that the router is a provider edge router.

19. The method according to claim 1, characterized in that the router is a cell site router.

20. The method according to claim 1, further comprising instructing the router to store the route in the corresponding routing table.

Images