A system that detects and stops service interruptions in diameter signaling using position control.

Abstract

This invention relates to a system (1) that enables the detection of subscriber signaling anomalies in 4G and 5G (NSA) networks and the determination of whether the subscriber is on the networks where he / she last selected the network for checking specific messages.

Description

1 TARIFF POSITION CONTROL AND DIAMETER SIGNALING A SYSTEM THAT DETECTS AND STOPS DISCONTINUATION ATTACKS SYSTEM Technical Area This invention enables the detection of subscriber signaling anomalies in 4G and 5G (NSA) networks. The subscriber's last network selection for identification and control of specific messages. with a system that enables the detection of whether or not it is in the networks it operates in 10 It is related. Previous Technique Today, by sending fake PUR (Purge User Request) messages, a subscriber's data can be stolen. This will disrupt the situation and a denial-of-service (DoS) attack on the subscriber side. This can be done by sending a fake NOR (Notification Request) message to the subscriber. An SMS DoS attack can be launched in relation to this. In the current structure, such as PUR or NOR. When messages arrive, it is checked whether the subscriber is roaming or not. Additionally, some solutions that store location in the database allow active network queries. 20 The inspection is carried out without prior notification. Therefore, considering the studies and shortcomings in the current technique... when present, the subscriber's signaling on 4G and 5G (NSA) networks To detect anomalies and check specific messages, the subscriber's last 25 hours... a network selection that allows the system to determine whether the network is on any of the networks it has selected. It is understood that the system is needed. Chinese patent CN107800664A, which is included in the known state of the art. The document discusses methods and systems for preventing signal attacks. 30 2 The invention described in the patent document is a signaling attack. It describes the prevention method and a device for it. The method is mobile management. from the node (MME) or service general packet radio service technology (GPRS) Receiving diameter request information transmitted from the supported node (SGSN); diameter request Determining whether the information was obtained from a mobile interface; if yes, 5 whether a characteristic parameter of the diameter demand information is valid determination; and if the characteristic parameter of the diameter requirement information is invalid, the diameter abandonment of request information or diameter response information carrying an error code It is sent back to the MME or SGSN. Therefore, the signaling attack. The prevention method and its device, each attack path of a hacker 10 effectively attacking an HSS or an edge node through It can prevent and improve communication security. Brief Description of the Invention The purpose of this invention is to improve subscriber signaling in 4G and 5G (NSA) networks. to detect anomalies and to check the subscriber's last message. To determine whether the network selection is made on any of the networks it is located in. The goal is to implement a system developed for this purpose. Another purpose of this invention is to prevent subscribers from experiencing potential service interruptions on 4G / 5G networks. a system developed to ensure protection against attacks to accomplish. Another purpose of this invention is to provide Diameter error codes 25 when discrepancies are detected. The goal is to implement a system designed to ensure its rejection. Detailed Description of the Invention 3 The purpose of this invention was achieved through "Position Control with Diameter". A system that detects and stops denial-of-service attacks in signaling. The "System" is shown in the attached figure; Figure 1; Schematic view of the system that is the subject of the invention. 5 The parts shown in the figure are individually numbered, and these numbers correspond to... The corresponding answers are given below. 1. System 10 2. Server H. Memory Database Detecting subscriber signaling anomalies in 4G and 5G (NSA) networks. 15 for the subscriber's last network selection to be made and for specific messages to be checked. The invention was developed to enable the detection of whether or not it is present in the networks. subject system (1); - Accessing data on the memory database (H) and memory database (H) saving data onto a memory database (H) of the previous location the collection and prioritization of this memory data when PUR / NOR messages arrive. In the database (H), the operator information (H) is PUR / NOR compare the information from the operator from which the messages were received and identify any discrepancies. To ensure rejection, activate when no data is found in the memory database (H). It holds subscriber data for both 4G / 5G networks and 2G / 3G networks. and by querying through the controlling switchboard, the network where the last movement occurred can be identified. 25 to transmit messages via this identified network (where the subscriber is currently located). to check the network it comes from, the memory database (H) is active and to check that it is accessible, the MMEs are the exchanges from which the subscriber receives service. Check if the name and VLR number are in the memory database (H). to do, if this information is available, primarily the 30 in the message that came with the name MME. Check the MME name in the Origin Host; if both names match... 4 To ensure the message successfully passes this check, if it is named MME If a mismatch occurs, reject the incoming message without passing it to the primary network. If the memory database does not have the MME name (H) but has a VLR address, then this VLR Determine which operator the address belongs to in the memory database (H) and the relevant To find the operator's MCC-MNC values, use the 5 that come with these MCC-MNC values. By checking the MCC-MNC values ​​in the Origin Realm mentioned in the message, the message... Check if the network is coming from the previously selected operator, match. If there is a message, ensure it passes this check successfully; if there is no match... To ensure that it is reduced, if neither MME nor VLR is in the memory database (H). If the address is not found, use PS (Packet Switched) and CS (Circuit Switched) respectively. MME and VLR addresses in domains are associated with the relevant HSS (Home Subscriber System). This is detected by sending a Diameter UDR (User Data Request) to the platform. By adjusting the settings so that the correct paging is applied to the subscriber in the deliveries, the best Obtaining current location data, UDR messages are ultimately used for MME or VLR. If one can be obtained from the address, perform checks, if 15 of the UDR messages If neither the MME nor the VLR addresses can be obtained, then no further action is taken. At least one server configured to enable switching to other controls (2) It includes. The server (2) in the system (1) which is the subject of the invention, has 20 on the memory database (H). to access data and record data onto the memory database (H) It is configured. The server (2) has a memory database (H) of the previous location. this memory data is collected and prioritized when PUR / NOR messages arrive. In the database (H), the operator information (H) is PUR / NOR compare the information from the operator from which the messages were received and identify any discrepancies. It is configured to ensure that it is rejected. Server (2), memory data When no data is found in the base (H), it actively supports both 4G / 5G networks and 2G / 3G networks via the central office that holds and manages subscriber data. by interrogating, in order to identify the network from which the last action was taken is being configured. Server (2), this detected (subscriber already 30 to mutually check the network (where it is located) and the network from which the messages are received It is configured. The server (2) has active and accessible memory database (H). to check that the subscriber's service is received by the exchanges, namely the MMEs, and To check if the VLR number (H) exists in the memory database. is configured. The server (2), if this information is available, prioritizes MME The message received with the name "Origin Host" contains MME 5. Checking the name; if both names match, the message passes this check successfully. It is configured to allow passage. The server (2), if with the MME name If a mismatch occurs, the incoming message will be rejected without being passed to the primary network. It is configured accordingly. The server (2), if the memory database (H) has the MME name Otherwise, but if there is a VLR address, which operator does this VLR address belong to? 10 detecting the MCC-MNC values ​​of the relevant operator in the memory database (H) To find this, locate the Origin Realm in the message that comes with these MCC-MNC values. By checking the MCC-MNC values, the message confirms that the network was previously selected. Checking if it came from the operator; if there's a match, the message is checked. 15 to ensure it passes successfully, and to ensure it is dropped if there is no match. It is configured. Server (2), if memory database (H) has neither MME nor If the VLR address is not found, then PS (Packet Switched) and MME and VLR in CS (Circuit Switched) domains their addresses to the relevant HSS (Home Subscriber System) Detecting this by sending a Diameter UDR (User Data Request) to the platform, these 20 An adjustment to ensure that the correct paging (call) is delivered to the subscriber. The server is configured to obtain the most up-to-date location data by doing so. (2), if UDR messages can be received from either MME or VLR address at the end The server (2) is configured to implement controls if UDR If neither the MME nor the VLR addresses can be retrieved from the messages, then in this case 25 to allow proceeding to other checks without completing the current check It is being structured. Industrial application of the invention 6 In the system subject to the invention, (1) the server (2) provides data on the memory database (H) to access and save data onto the memory database (H), a previous location Collection of memory database (H) and when PUR / NOR messages arrive primarily in this memory database (H) then in this database (H) operator Comparing the information with the operator information from which the PUR / NOR messages are received and 5 to ensure the rejection of inconsistencies, data in memory database (H) When not found, it actively supports both 4G / 5G networks and 2G / 3G networks. By querying the central office that holds and manages subscriber data, you can find out the last activity. to identify the network it is being used on, and to identify this (the subscriber's current) (Located on the network) and the network from which the messages are received, check each other, memory 10 To verify that the database (H) is active and accessible, the subscriber's service The MME name and VLR number of the power plants it received are in the memory database (H) to check if it exists, and if so, primarily the MME name. Check the MME name in the Origin Host in the message received; if there are two... If the name also matches, the message will successfully pass this check, if 15 If there is a mismatch with the MME name, the incoming message is sent to the main network. reject without passing if the memory database (H) does not contain the MME name. If a VLR address exists, the memory data indicates which operator that VLR address belongs to. Detecting the base (H) and finding the MCC-MNC values ​​of the relevant operator, this The message received with the MCC-MNC values ​​indicates MCC-MNC 20 within the Origin Realm. By checking the values, the message is coming from the previously selected network operator. Checking if it hasn't arrived, and if there's a match, the message passes this check successfully. to allow it to pass, to drop it if there is no match, if memory data If neither MME nor VLR address is found in the base (H), then PS (Packet MME and VLR addresses in Switched and CS (Circuit Switched) domains 25 Diameter UDR (User Data) for the relevant HSS (Home Subscriber System) platform (Request) is sent to identify the subscriber and ensure that the correct paging is provided in these transmissions. By making adjustments accordingly, we can obtain the most up-to-date location data. If UDR messages can eventually be received from either the MME or VLR address To perform checks, if both the MME and VLR addresses in the UDR messages are 30 7 If this cannot be obtained, then proceed to other checks without performing this check. It provides. Based on these fundamental concepts, the invention focuses on "Position Control with Diameter". A System That Detects and Stops Disruption Attacks in Signaling 5 It is possible to develop a wide variety of applications related to (1)”, and the invention is here It cannot be limited to the examples given; it is essentially as stated in the claims.

Claims

8 REQUESTS 1. Detection of subscriber signaling anomalies in 4G and 5G (NSA) networks. the subscriber's last network selection for checking and verifying specific messages. 5 to ensure that it is determined whether or not it is in the networks it operates developed; - Accessing data on the memory database (H) and the memory database Saving data onto (H) is a memory database of the previous location (H) the collection and prioritization of these when PUR / NOR messages arrive. In the memory database (H), the operator information (H) is 10. Comparing the PUR / NOR messages with the operator information from which they originate. to ensure the rejection of inconsistencies, data in memory database (H) When not found, it actively uses both 4G / 5G networks and 2G / 3G their networks through the central office that holds and manages subscriber data By questioning, we can identify the network from which the last action was taken, and these 15 identified... (the network the subscriber is currently on) and the network from which the messages are received mutually verify that the memory database (H) is active and accessible. to check that the subscriber receives service from the MMEs (Ministry of Exchanges of Industry). whether its name and VLR number are in the memory database (H) to check, if this information exists, primarily the 20 that come with the MME name. Check the MME name in the Origin Host in the message; if there are two... If the name also matches, this ensures the message successfully passes this verification process. If there is a mismatch with the MME name, the incoming message is sent to the main network. reject without passing if the memory database (H) does not contain the MME name However, if a VLR address exists, you need to find out which operator that VLR address belongs to. 25 detecting (H) in the memory database and the relevant operator MCC-MNC Finding the values, and then comparing these MCC-MNC values ​​with the Origin message. By checking the MCC-MNC values ​​within the Realm, you can verify that the message was sent previously. Check if the network is coming from the selected operator, and if there is a match. Ensure the message passes this check successfully; if there is no match, then 30 to ensure that it is reduced, if neither MME nor (H) is in the memory database 9 If the VLR address is not found, use PS (Packet Switched) and CS (Circuit Switched) respectively. Switched) domains MME and VLR addresses to the relevant HSS (Home) Diameter UDR (User Data Request) to Subscriber System) platform to identify by sending, and in these transmissions to the subscriber, to ensure correct paging By making an adjustment in this way, you can obtain the most up-to-date location data. 5 to do, UDR messages eventually arrive at either the MME or VLR address. If possible, apply checks if MME and UDR messages are received. If neither VLR address can be obtained, then no further action is taken. at least one configured to allow switching to other controls a system characterized by server (2) (1). 10 2. To access the data in the memory database (H) and the memory database (H) characterized by the server (2) configured to record data on it. A system like the one in Request 1 (1).

3. Collecting the previous location in a memory database (H) and PUR / When NOR messages arrive, they are prioritized in this memory database (H). In this database, operator information (H) is where the PUR / NOR messages are received. comparison with operator information and rejection of discrepancies Claim 1 20 characterized by the server (2) configured to provide or a system like in 2 (1).

4. When no data is found in the memory database (H), both 4G / 5G are actively used. both their networks and 2G / 3G networks that hold and manage subscriber data. By querying through the central office, the network where the last activity took place can be identified. 25 In Claim 3, characterized by the server (2) configured to do so. such a system (1).

5. Messages are transmitted via this identified network (the network the subscriber is currently on). Server configured to mutually check the network from which it came (2) 30 as in any of the above claims characterized by system (1).

6. Check that the memory database (H) is active and accessible, The MME name and VLR number of the exchanges from which the subscriber receives service are 5 to check if memory exists in the database (H) from the above requests characterized by the configured server (2) a system like any other (1).

7. If this information is available, prioritize the message that arrived with the name MME, number 10. Check the MME name on the Origin Host. to successfully pass this check if both names match. characterized by the server (2) configured to allow passage a system like any of the above requests (1).

8. If there is a mismatch with the MME name, the incoming message is sent to the main network. Characterized by the server (2) configured to reject without passing through. a system like any of the above-mentioned requests (1).

9. If the memory database does not contain the MME name (H) but contains the VLR address, 20 Which operator does this VLR address belong to in the memory database (H)? to identify and find the MCC-MNC values ​​of the relevant operator, these MCC- The MCC values ​​in the message indicate MCC-MNC within the Origin Realm. by checking the values, the message was previously sent from the network-selected operator. Checking if it arrived, and if there's a match, the message confirms this check is successful. 25 to ensure it passes, and if there is no match, to ensure it is dropped from the above requests characterized by the configured server (2) a system like any other (1). 11 10. If neither the MME nor the VLR address is found in the memory database (H) PS (Packet Switched) and CS (Circuit Switched) respectively Switched domains (MME and VLR addresses) related HSS (Home Subscriber System) Diameter UDR (User Data Request) is sent to the platform to detect 5 to ensure that these mailings include proper paging (calls to action) for the subscriber. by making an adjustment to obtain the most up-to-date location data. from the above requests characterized by the configured server (2) a system like any other (1).

11. If UDR messages can be received from either the MME or VLR address at the end characterized by the server (2) configured to implement controls a system like any of the above requests (1).

12. If neither the MME nor the VLR addresses can be retrieved from the UDR messages, then 15 This allows you to proceed to other checks without performing the current check. The above is characterized by the server (2) configured to do so. a system like any of the requests (1). 25

Images