Data leakage detection in a cellular communication network

Abstract

There is provided techniques for enabling data leakage detection in a cellular communication network (100). A method is performed by a network node (200). The network node (200) resides in the cellular communication network (100). The method comprises processing (S204) a data item communicated in the cellular communication network (100). The method comprises associating the data item with metadata for data leakage detection as the data item is processed by the network node (200). The metadata at least identifies that the data item has been processed by the network node (200).

Description

[0001] DATA LEAKAGE DETECTION IN A CELLULAR COMMUNICATION NETWORK

[0002] TECHNICAL FIELD

[0003] Embodiments presented herein relate to a method, a network function node, a computer program, and a computer program product for enabling data leakage detection in a cellular communication network. Embodiments presented herein further relate to a method, a data leakage detection node, a computer program, and a computer program product for data leakage detection in the cellular communication network.

[0004] BACKGROUND

[0005] In communications networks, there may be a challenge to obtain good performance and capacity for a given communications protocol, its parameters and the physical environment in which the communications network is deployed.

[0006] For example, in communications networks, where data items are sent between different entities, or even monitored at a single entity, there is risk that the data item is leaked. This can be an issue if the data item contains private, or otherwise sensitive, information. Data leakage prevention technologies can be applied to prevent, or at least reduce the risk, of such data leakage.

[0007] In this respect, in Papadimitriou, Panagiotis, and Hector Garcia-Molina. "Data leakage detection," IEEE Transactions on knowledge and data engineering 23.1 (2010): 51-63 is provided techniques including perturbing a set of distributor objects by fake elements being added. In some applications, fake objects may cause fewer problems that perturbing real objects. For example, say the distributed data objects are medical records and the agents are hospitals. In this case, even small modifications to the records of actual patients may be undesirable. However, the addition of some fake medical records maybe acceptable, since no patient matches these records, and hence no one will ever be treated based on fake records.

[0008] However, current data leakage prevention technologies allow an attacker to remain undetected for a long time, allowing the attacker to exfiltrating potentially sensitive information. This is because an attacker might bypass authentication, which makes it difficult to, at least temporarily, notice if any data has been leaked. As a consequence, sensitive information may end up in the public domain without the awareness of the information owner since the attacker remains undetected.

[0009] Even if endpoint detection and response (EDR) technology is available and can be used for threat detection, it is from G. Karantzas and C. Patsakis: “An Empirical Assessment of Endpoint Detection and Response System against Advanced Persistent Threats Attacks Vectors” 2021 Journal of Cybersecurity and Privacy known that an attacker can have access to methods to avoid being detected by the EDR.

[0010] Hence, there is still a need for improved data leakage prevention technologies.

[0011] SUMMARY

[0012] An object of the invention herein is to facilitate data leakage prevention.

[0013] Current data leakage prevention technologies are either aimed at being generic and fitting any type of scenario, or are aimed specifically at hospital environments. There are no current data leakage prevention technologies specifically aimed at cellular communication networks. A particular object is therefore to provide efficient data leakage prevention in cellular communication networks.

[0014] Current data leakage prevention technologies are based on using generic fake elements that are added to genuine data. Such fake elements might be identified by an attacker that thus might filter out the fake elements before publishing any leaked data. This makes data leakage prevention difficult. A particular object is therefore to provide efficient data leakage prevention that uses data that mimics the genuine data.

[0015] These objects are met by the independent claims.

[0016] According to a first aspect there is presented a method for enabling data leakage detection in a cellular communication network. The method is performed by a network node. The network node resides in the cellular communication network. The method comprises processing a data item communicated in the cellular communication network. The method comprises associating the data item with metadata for data leakage detection as the data item is processed by the network node. The metadata at least identifies that the data item has been processed by the network node.

[0017] According to a second aspect there is presented A network node for enabling data leakage detection in a cellular communication network. The network node is configured to reside in the cellular communication network. The network node comprises processing circuitry. The processing circuitry is configured to cause the network node to process a data item communicated in the cellular communication network. The processing circuitry is configured to cause the network node to associate the data item with metadata for data leakage detection as the data item is processed by the network node. The metadata at least identifies that the data item has been processed by the network node.

[0018] According to a third aspect there is presented a computer program for enabling data leakage detection in a cellular communication network. The computer program comprises computer code which, when run on processing circuitry of A network node configured to reside in the cellular communication network, causes the network node to perform actions. One action comprises the network node to process a data item communicated in the cellular communication network. One action comprises the network node to associate the data item with metadata for data leakage detection as the data item is processed by the network node. The metadata at least identifies that the data item has been processed by the network node.

[0019] According to a fourth aspect there is presented a method for data leakage detection in a cellular communication network. The method is performed by a data leakage detection node. The method comprises performing data leakage detection by identifying metadata. The metadata is associated with a data item. The metadata at least identifies that the data item has been processed by A network node residing in the cellular communication network. The method comprises identifying the data item as leaked responsive to having identified the metadata associated with the data item.

[0020] According to a fifth aspect there is presented a data leakage detection node for data leakage detection in a cellular communication network. The data leakage detection node comprises processing circuitry. The processing circuitry is configured to cause the data leakage detection node to perform data leakage detection by identifying metadata. The metadata is associated with a data item. The metadata at least identifies that the data item has been processed by A network node residing in the cellular communication network. The processing circuitry is configured to cause the data leakage detection node to identify the data item as leaked responsive to having identified the metadata associated with the data item.

[0021] According to a sixth aspect there is presented a computer program for data leakage detection in a cellular communication network. The computer program comprises computer code which, when run on processing circuitry of a data leakage detection node, causes the data leakage detection node to perform actions. One action comprises the data leakage detection node to perform data leakage detection by identifying metadata. The metadata is associated with a data item. The metadata at least identifies that the data item has been processed by A network node residing in the cellular communication network. One action comprises the data leakage detection node to identify the data item as leaked responsive to having identified the metadata associated with the data item.

[0022] According to a seventh aspect there is presented a computer program product comprising a computer program according to at least one of the third aspect and the sixth aspect and a computer readable storage medium on which the computer program is stored. The computer readable storage medium could be a non-transitory computer readable storage medium.

[0023] Advantageously, these aspects overcome the issues noted above.

[0024] Advantageously, these aspects meet the objects formulated above.

[0025] Advantageously, these aspects provide a complement to existing threat detection technologies. Existing technologies focus on finding malicious or abnormal behavior with the help of EDRs. However, some attackers manage to remain undetected for a long time. Some attackers manage to infiltrate a network, exfiltrate a lot of information, leave the network and publish this data online without triggering the EDR. The herein disclosed embodiments can be used to aid a system owner (which is processing sensitive data) to detect the existence and origin of a data leakage with the help of metadata.

[0026] Advantageously, these aspects can be applied for different types of network nodes and different types of processing by the network nodes, such as over numerous interfaces and components that a network node and its related functionality can have, where appointed interfaces, hosts and components can be associated with unique metadata. This gives the advantage of enabling a data leakage detection node to backtrack the origin of the data leakage, at which component the leak occurred as well as over which interface a data item was likely intercepted. Further, if the host information was added, a suspected host can be identified.

[0027] Advantageously, these aspects can help in detecting and locating vulnerabilities in third-party software, malicious insiders, cloud misconfigurations and physical security compromise which are all common data attack vectors. Also, in the common case of stolen or misused credentials, the herein disclosed embodiments can be applied for detection, and potentially also location, of data leakage.

[0028] Other objectives, features and advantages of the enclosed embodiments will be apparent from the following detailed disclosure, from the attached dependent claims as well as from the drawings.

[0029] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the element, apparatus, component, means, module, step, etc." are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, module, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

[0030] BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The inventive concept is now described, by way of example, with reference to the accompanying drawings, in which: Fig. 1 is a schematic diagram illustrating a cellular communication network according to embodiments;

[0032] Figs. 2 and 3 are flowcharts of methods according to embodiments;

[0033] Figs. 4 to 7 are schematic illustrations of how metadata can be used for data leakage detection purposes according to embodiments;

[0034] Fig. 8 is a schematic illustration of database storage according to embodiments;

[0035] Fig. 9 is a schematic diagram showing functional units of a network node according to an embodiment;

[0036] Fig. 10 is a schematic diagram showing functional modules of a network node according to an embodiment;

[0037] Fig. 11 is a schematic diagram showing functional units of a data leakage detection node according to an embodiment;

[0038] Fig. 12 is a schematic diagram showing functional modules of a data leakage detection node according to an embodiment; and

[0039] Fig. 13 shows one example of a computer program product comprising computer readable means according to an embodiment.

[0040] DETAILED DESCRIPTION

[0041] The inventive concept will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the inventive concept are shown. This inventive concept may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the inventive concept to those skilled in the art. Like numbers refer to like elements throughout the description. Any step or feature illustrated by dashed lines should be regarded as optional. Fig. i is a schematic diagram illustrating a cellular communication network 100 where embodiments presented herein can be applied. The cellular communication network 100 represents a reference architecture of a fifth-generation telecommunication system (5GS). However, it is appreciated that similar, or corresponding, entities, are part of also other network architectures, and the herein disclosed embodiments are not limited to the specific network architecture illustrated in Fig. 1. In general terms, the cellular communication network 100 comprises a core network no, a (radio) access network 120, and a Data Network (DN) 140, e.g., providing operator services, Internet access or 3rd party services, vi a User Plane Function (UPF) 130. The (radio) access network 120 and the core network no are interconnected with each other. Further, the (radio) access network 120 and the core network 110 are interconnected with the data network 140 via a user plane function 130. The (radio) access network 120 provides network access to a user equipment (UE) 150. The core network 110 comprises the following entities: and Authentication Server Function (AUSF), an Access and Mobility Management Function (AMF), a Network Exposure Function (NEF), a Network Repository Function (NRF), a Network Slice Selection Function (NSSF), a Policy Control Function (PCF), a Session Management Function (SMF), a Unified Data Management (UDM), a Unified Data Repository (UDR), an Application Function (AF), a Network Data Analytics Function (NWDAF), a Binding Support Function (BSF), and a Charging Function (CHF). Service based interfaces are represented by the format Nxyz (e.g., Nnssf, NNef, etc.) and point to point interfaces are represented by the format Nx (e.g., Ni, N2, etc.).

[0042] The embodiments disclosed herein relate to techniques for enabling data leakage detection in a cellular communication network 100 and techniques for data leakage detection in the cellular communication network 100. In order to obtain such techniques, there is provided a network node 200, a method performed by the network node 200, a computer program product comprising code, for example in the form of a computer program, that when run on processing circuitry of the network node 200, causes the network node 200 to perform the method. In order to obtain such techniques, there is further provided a data leakage detection node 300, a method performed by the data leakage detection node 300, and a computer program product comprising code, for example in the form of a computer program, that when run on processing circuitry of the data leakage detection node 300, causes the data leakage detection node 300 to perform the method.

[0043] With continued reference to Fig. 1, the network node 200 could be a network function (NF) node that resides in the core network no of the cellular communication network 100. In other examples, the network node 200 is provided in the core network node no but not in any NF. In yet other examples, the network node 200 is provided in the UE 150. In yet other examples, the network node 200 is provided in a node of the (radio) access network 120. In yet other examples, the network node 200 is provided in a probing node. In yet further examples, the network node 200 is provided in a node of a cloud computation, or edge computation, environment. The same applies for the data leakage detection node 300. That is, the data leakage detection node 300 could be an NF node that resides in the core network no of the cellular communication network 100, be provided in the core network node no but not in any NF, be provided in a node of the (radio) access network 120, be provided in a probing node, or be provided in a node of a cloud computation, or edge computation, environment.

[0044] Reference is now made to Fig. 2 illustrating a method for enabling data leakage detection in a cellular communication network 100 as performed by the network node 200 according to an embodiment. The network node 200 is configured to reside in the cellular communication network 100.

[0045] S104: The network node 200 processes a data item communicated in the cellular communication network 100.

[0046] S106: The network node 200 associates the data item with metadata for data leakage detection as the data item is processed by the network node 200. The metadata at least identifies that the data item has been processed by the network node 200.

[0047] That the metadata at least identifies that the data item has been processed by the network node 200 does not necessarily imply that the metadata identifies the network node 200 itself. Rather, the purpose of the metadata is to enable a subsequent identification of where in the cellular communication network 100 the data item has been captured by an attacker. Thus, a message or sequence of messages, can provide information of where in the cellular communication network IOO a data leak has occurred and thus indicate where to start searching for the attacker. In this respect, just because the data item is associated with metadata by the network node 200, this does not imply that the data leak actually occurred at the network node 200. Rather, the data leakage might have occurred some time after the data item was processed by the network node 220. For example, in case the processing involves sending the data item at an outgoing network interface of the network node 200, an attacker might capture the data by probing the outgoing network interface of the network node 200 by using some monitoring tool, etc.

[0048] Embodiments relating to further details of enabling data leakage detection in a cellular communication network 100 as performed by the network node 200 will now be disclosed with continued reference to Fig. 2.

[0049] There maybe different types of network nodes 200. In some examples, as disclosed above, the network node 200 is an NF node that resides in a core network no of the cellular communication network 100. In other examples, the network node 200 is provided in the core network node but not in any network function. In yet other examples, the network node 200 is provided in a node of the (radio) access network. In yet other examples, the network node 200 is provided in a probing node. In yet further examples, the network node 200 is provided in a node of a cloud computation, or edge computation, environment.

[0050] As disclosed above, the network node 200 in S104 processes the data item communicated in the cellular communication network 100. There could be different ways in which the network node 200 processes the data item. In some embodiments, processing the data item comprises any of: receiving the data item at an incoming network interface of the network node 200, sending the data item at an outgoing network interface of the network node 200, internally processing the data item in the network node 200, storing the data item in a database.

[0051] As disclosed above, the network node 200 in S106 associates the data item with metadata, where the metadata at least identifies that the data item has been processed by the network node 200. Examples of different ways in which the data item can be processed have been given above. Further in this respect there could be different ways in which the metadata identifies that the data item has been processed by the network node 200. How to associate the metadata with the network node 200 to enable the metadata to at least identify that the data item has been processed by the network node 200 should be selected so as to enable efficient identification, as exact as possible, where data is leaked, even if the leakage does not occur directly at the network node 200. The spots associated with metadata can be placed directly on, or related to, interfaces of the network node 200. They can also be placed inside network node 200, related to communication between container based virtual network functions but also on certain spots inside of a container based virtual network function. The number of spots could be decided by a consideration between the accuracy the use of more spots can give against the increased cost in form of administrating the same. The spots can also be related to the physical hardware, the location of the physical hardware or the infrastructure provider so that they can be used to identify the location of the data leakage related to the host provider. In some embodiments, the metadata identifies any of: a network interface of the network node 200, an instance of the network node 200, hardware that the network node 200 is running on. The spots associated with metadata can be placed on a network interface of the network node 200, an instance of the network node 200, hardware that the network node 200 is running on. The metadata can thereby be used to identify the location of a breach in terms of software, physical location, etcetera.

[0052] In some aspects, the metadata not only identifies that the data item has been processed by the network node 200, but also the point in time the data item was processed by the network node 200. That is, in some embodiments, the metadata further identifies a point in time at which the data item was processed by the network node 200.

[0053] There can be different ways in which the data item is associated with the metadata. In some embodiments, the data item is associated with the metadata by the metadata being embedded in a message comprising the data item. As will be further disclosed below, the data item might be stored in a database and then be associated with the metadata when the data item is stored in the database.

[0054] Further in this respect, the message comprising the data item might either be a genuine message or a dummy message that is generated solely for data leakage detection purposes. In particular, in some embodiments, the data item comprises information of a subscriber, and the message either comprises genuine information of the subscriber or is a dummy message.

[0055] The metadata could thus be encoded into genuine data, e.g., be part of a phone number in a CDR, where the metadata actually encodes information about where the phone number was modified. That is, in some embodiments where the message comprises genuine information of the subscriber, the metadata is encoded into the genuine information of the subscriber.

[0056] In addition to adding associating metadata with genuine messages, also dummy messages generated for tracking purposes can be used. Dummy messages can be generated, sent through network, and finally removed from network, without affecting operation of genuine messages. Therefore, in other embodiments, the message is a dummy message, and the subscriber is a dummy subscriber. Dummy subscription can in this way be used for detecting active attacks based on leaked data (that is not known by the MNO to be leaked). In general terms, dummy subscriptions should not receive incoming calls or text messages. If there starts to be a lot of activity related to a dummy subscription, this is an indication that there has been a data leak and the dummy subscription’s telephone number has been added to the target pool of an attacker. An attacker would not get the number in any other way than via leaked data from the network (or maybe via randomly selecting phone numbers), as the number is not used or registered anywhere, but only used to enabling data leaks to be detected. For identifying database leaks, dummy data (e.g., related to dummy subscription) could be stored in the database. However, when replicating the database to other databases in the network, not all data related to the dummy subscription is replicated, but instead part of the data is modified so that it is different at each instance of the database. Further aspects relating to this will be disclosed below with reference to the example in Fig. 8. Further in this respect, there can be different ways in which the metadata is embedded in a message comprising the data item. In general terms, when a second network node 200 receives a message from a first network node, the message might already comprise some metadata. There can then be different ways in which the second network node 200 embeds its own metadata in the message. For example, the second network node 200 might embed its own metadata by modifying the metadata already embedded in the message, replace the metadata already embedded in the message with its own metadata, or concatenate the metadata already embedded in the message with its own metadata. That is, in some embodiments, the message already comprises further metadata for data leakage detection that at least identifies that the data item has been processed by a further NF node 200. The metadata could then be embedded in the message by either being concatenated with this further metadata, or by being added to this further metadata, or by replacing this further metadata. Thus, in a chain of network nodes 200 processing a data item, the network nodes 200 involved in processing the data item can therefore embed its own metadata in the message comprising the data item.

[0057] In general terms, the data item is of a certain type. The metadata might then be selected so that it is of the same type as the data item. That is, the data item comprises data in a certain format, and in some embodiments, the metadata is provided as data in this certain format. This could make the metadata appear inconspicuous and decrease the risk of an attacker identifying and, possibly, filtering out or otherwise removing, the metadata for avoiding data leakage to be detected.

[0058] In this respect, there could be different examples of metadata. In some non-limiting examples, the metadata is, or comprises, any, or any combination, of: an International Mobile Subscriber Identifier (IMSI), a tracking phone number, a Charging Data Record (CDR), call duration information, location data. These are all examples of data types which make the metadata appear inconspicuous. Taking a CDR for a dummy subscription as an example, the calling number, or IMSI, and / or the receiving number, or IMSI, can act as trigger that the CDR is used as metadata. Other fields of the CDR, such as call duration, etc., can encode various information about where and when the CDR has been generated, and / or been processed; which network node, which instance, running on which infrastructure, etc. that has processed the data item in which the metadata (i.e., the CDR) is embedded. Taking location data as an example, location data can encode information about where and / or when the information was generated / processed (as for CDR). Dummy subscription might be bound to a certain location, but when wanting to record specific information about where the location related message was processed, the location information can be used to identify that the data item associated with the location data has been processed by a certain network node 200. Part of location data, which can origin from a dummy subscription or potentially a genuine subscription, can therefore be modified differently at selected network nodes and thus define metadata. Further, a dummy identity of a (radio) access network node 120 could be used for the same purpose as the dummy subscription.

[0059] For example, so-called tracking phone numbers can be used as metadata and registered to a security management system. A tracking phone number is a number that should never receive any calls or text messages. The security management system (implementing a data leakage detection node 300 as will be described below) detects if one or some of the tracking phone numbers are used, i.e. if the number receives calls or text messages. Since the number is not actually in use nor allocated to any real subscription it should not have any activities other than what the MNO generates for data leakage detection purposes. Thus, if there are activities (incoming call, or text message), this is an indication that the number has leaked. A single activity, e.g. one incoming call, can still potentially be a misdial, but if the number gets frequent actions, then it is likely that the number has leaked and is being used e.g. as target for spamming attacks. As result, the operator knows that a leakage has occurred and the metadata will tell the operator about the associated information regarding the data leakage, e.g. by the phone number only being used in certain parts of the network and thus pinpointing the data leak to that part of the network.

[0060] In general terms, there might be two types of metadata; internal metadata and external metadata. Internal metadata is metadata that is carried with the data items themselves, while external metadata is metadata generated and stored by e.g. an entity processing or forwarding the data items, e.g. a log file recording that a certain data item passed through a specific network node. Internal metadata is carried with the data items themselves so if the data is part of a data leak, then the metadata will also be part of the data leak, and thus it is possible to pinpoint where the data was leaked from based on the (internal) metadata. External metadata could e.g. be implemented as a hash of a message being processed by a network node 200, as long as the message is unique. If unique messages cannot be guaranteed, then instead e.g. a hash of N, where N>1 is an integer, consecutive messages being processed could be used, which would increase the probability of uniqueness of the hashed data. In this case there needs to be clear rules with regards to what acts as the trigger for collecting N messages (following the trigger message), so that when checking the stored external metadata against leaked data one can pinpoint places in the leaked data from where one should hash N consecutive messages to get a hash to compare against the hash in the external metadata. As an alternative to hashing the complete message, the hash can be created by dedicated parts of that message. Since the leaked data can potentially only include parts of the original message, to connect the message to the hash, the hash can only include these parts of the message plus potential additions which can take a limited number of values.

[0061] One option for generating well-camouflaged metadata, i.e. such that the attacker cannot easily filter it out, is to assign a dummy subscription for this purpose. Then, each network node 200 processing a data item belonging to the dummy subscription can modify the messages associated with the dummy subscription without potentially disturbing the experience of a genuine subscriber. Using such a dummy subscription also provides e.g. an easy way to indicate from where N messages are hashed as discussed above; every time there is a message (or a certain type of message) related to the dummy subscription the network node 200 will record external metadata for N messages following the dummy message. Another benefit of using a dummy subscription is that data items related to it can be stored and handled in arbitrary ways without risk of violation local laws or regulations, etc.

[0062] In general terms, the metadata could be associated with data items that a possible attacker would, or at least might, be most interested in. A non-limiting example of such data items are data items that hold sensitive user data. In particular, in some embodiments, the data item comprises security-sensitive user data of the subscriber. In some non-limiting examples, the data item is, or comprises, any of: user plane data of the subscriber, a CDR of the subscriber, location data of the subscriber, contact information of the subscriber.

[0063] Further, in some aspects, the metadata is not embedded in any message in which the data item is sent. Rather, the metadata can be represented by a certain, possibly unique, sequence of messages that are sent. That is, in some embodiments, the data item is associated with the metadata by the network node 200 sending out a sequence of messages, where the metadata is defined by the sequence, and where at least one of the messages comprises, or relates to, the data item. This sequence of messages thus should be selected so that it is not likely to otherwise occur in the cellular communication network 100.

[0064] In some aspects, data items might be associated with metadata for data leakage detection purposes upon being triggered to do so. Here, the network node 200 could be triggered to associate data items with metadata for data leakage detection e.g., regularly or when a suspected data leakage has been detected at some other node. Therefore, in some embodiments, the network node 200 is configured to perform (optional) step S102.

[0065] S102: The network node 200 obtains an indication to associate the data item with the metadata. The data item is then associated with the metadata in S104 in response thereto (i.e., in response to the network node 200 having obtained the indication in S102).

[0066] Reference is now made to Fig. 3 illustrating a method for data leakage detection in a cellular communication network 100 as performed by the data leakage detection node 300 according to an embodiment.

[0067] S204: The data leakage detection node 300 performs data leakage detection by identifying metadata. The metadata is associated with a data item. The metadata at least identifies that the data item has been processed by a network node 200 residing in the cellular communication network 100. S206: The data leakage detection node 300 identifies the data item as leaked responsive to having identified the metadata associated with the data item.

[0068] Embodiments relating to further details of data leakage detection in a cellular communication network 100 as performed by the data leakage detection node 300 will now be disclosed with continued reference to Fig. 3.

[0069] In general terms, a data leakage can become known in different ways. One example is that the attacker claims ownership of the data by presenting parts of the leaked data. One example is that the attacker uses the thus stolen data to impersonate another user, authority, or operator representative, possible with an objective to gain access to further information or privileges. Other scenarios can be that the leaked data is found online. One example is that the leaked data is observed as used, for instance by messaging services. Yet another scenario can be that the data is found at criminal forensic analysis, for example if the police perform a raid at a suspected criminal site. The criminal can in this case be a rogue employee at an MNO, Hyperscale Cloud Provider (HCP), Operations Technology (OT) provider, or third-party supplier company, or a criminal hacker who has attacked a system to get the data. For this purpose, the data leakage detection node 300 might inspect, or otherwise monitor, CDRs or databases, etc., for metadata.

[0070] In general terms, the data leakage has an origin. As noted above, the network node 200 might in some cases be regarded as the origin of the data leakage, although generally the data leakage may have occurred some time after the data item was processed by the network node 200. In some embodiments, the leakage detection node 300 is further configured to perform (optional) step S208.

[0071] S208: The data leakage detection node 300 identifies that the network node 200 is the origin of the data leakage.

[0072] In some aspects, the data leakage detection node 300 performs the detection upon being triggered to do so. Here, the data leakage detection node 300 could be triggered to perform the data leakage detection e.g., regularly or when a suspected data leakage has been detected at some other node. Therefore, in some embodiments, the leakage detection node 300 is further configured to perform (optional) step S202.

[0073] S202: The data leakage detection node 300 obtains an indication to perform the data leakage detection, and wherein the data leakage detection is performed in response thereto.

[0074] Examples of how metadata can be used for data leakage detection purposes according to at least some of the above disclosed embodiments will be disclosed next with reference to the examples in Figs. 4, 5, 6, 7, and 8.

[0075] In Fig. 4 is illustrated an example with three network nodes 200 in terms of network functions (denoted “Network Function 1”, “Network Function 2”, and “Network Function 3”) and a UE. Each network function has an incoming network interface (SBI), an outgoing network interface (SBI), a probing interface (eBPF) and an administration interface (Admin). For illustrative purposes, the metadata is represented by a single integer number, displayed at each interface. That is, the values, symbolized with “1”, “2”, “3”, “4” and so on, form the metadata. Further, the metadata is assumed to have some initial value. The initial value can either be additional data added to a genuine or dummy message or act / be encoded as / into part of the actual payload of a message (i.e., not be something on-top of the payload), e.g. using a well-known value for identifier, a special request type etc. The initial value is either generated by the UE or sent to the UE by an entity with the intention of being used as initial value, where the entity maybe the Mobile Network Operator or a third- party entity. The initial value can also be generated inside of the Mobile Network. The initial value can also be inserted by one of the network nodes. Such a network nodes can generate a request with the initial value or insert the initial value into a request sent by another network node. The initial value can be communicated / shared with the data leakage detection node 300 that will use it to search for data breaches later. This might either be explicitly sharing the initial value, or the initial value is easy to derive by the data leakage detection node 300. In one alternative of the system 400, the UE is virtual and exists only for the purpose of generating initial values. It is not known to an external observer, or attacker, which UEs are virtual and the data from the virtual UE mixes with the data from regular UEs. Fig. 4 illustrates three examples (denoted “Ex 1”, “Ex 2”, “Ex 3”) of how metadata is associated with a data item, where the data item is represented by the initial value, and where the metadata is associated with the data item by means of concatenation. In the first example Ex 1, a message comprising the data item is sent from the UE to Network Function 1 and then to the probing interface of Network Function 1. The metadata is thus a concatenation of the initial value, “1” and “2”. If a data leakage is detected and the metadata “2” can be recovered, this indicates that the data leakage occurred at the probing interface of Network Function 1 or some time after the message was probed at the probing interface of Network Function 1. In the second example Ex 2, a message comprising the data item is sent from the UE to Network Function 1, then from Network Function 1 to Network Function 2 and then output at the administration interface of Network Function 2. The metadata is thus a concatenation of the initial value, “1”, “4”, “6”, and “10”. If a data leakage is detected and the metadata “4” can be recovered, this indicates that the data leakage occurred either at the outgoing network interface of Network Function 1 or at the incoming network interface of Network Function 2 or somewhere between these two network interfaces. In the third example Ex 3, a message comprising the data item is sent from the UE to Network Function 1, then from Network Function 1 to Network Function 2 and then from Network Function 2 to Network Function 3. The metadata is thus a concatenation of the initial value, “1”, 4 , 6 , 5 , and 8 .

[0076] In Fig. 5 is illustrated an example with network nodes 200 in terms of network functions (denoted “NFci”, and “NFc2”) that are hosted (by hosts 500 denoted “Hosti”, “Host2”, and “Hosts”) according to four different configurations (a) (b), (c), (d). Each host could be a group of servers, a server, part of a server, a piece of hardware, or the like. In a first example (a), NFci and NFc2 are both hosted by one and the same host “Hosti”. In a second example (b), NFci is hosted by Host2 and NFC2 is hosted by Hosts. In a third example (c), NFci and NFc2 are both hosted by one and the same host “Host2”. In a fourth example (d), NFci is hosted by Hosts and NFC2 is hosted by Hosti. In Fig. 5 the metadata is represented by three CDRs (denoted “CDR-a”, “CDR-b”, and “CDR-c”), as illustrated in Fig. 5(e). Each CDR specifies a calling number (“From”), a receiving number (“To”), and a call duration value (“Duration”). In this way, the origin of a leaked CDR, or even a leakage of the calling or receiving number only, can be tracked to a unique host. If, for instance any of the two numbers (assuming both leaked numbers are used as metadata) in CDR-b is found leaked, it can be concluded that data leakage related to Host2 has occurred. An alternative is that the calling number alone acts as metadata, whilst the receiving number could be used for encoding information about the location where the CDR has been processed.

[0077] In Fig. 6 is illustrated configurations of four examples (a), (b), (c), (d) of network nodes 200 corresponding to the same examples in Fig. 5 but with different metadata, in terms of CDRs (denoted “CDR-a” to “CDR-i”), as illustrated in Fig. 6(e). In the example of Fig. 6 is illustrated how location tracking can be combined with interface tracking. In Fig. 6, the calling number 0703249712 and the receiving number 07080924183 define a static part of the metadata and are used as CDR identifier. The duration is different for each CDR and is used to identify the location. In this example, if CDR-f is found leaked, it can be concluded based on the duration in the leaked CDR that a data leakage has occurred at Host2 and that the information is fetched from NFc2. If instead CDR-b is found leaked, it can be concluded that a data leakage has occurred related to the communication between NFci and NFc2 on Hosti.

[0078] In Fig. 7 is illustrated an example (a) with network nodes 200 in terms of network functions (denoted “NFci”, “NFc2”, and “NFc3”) residing on a respective host 500 (denoted “Hosti”, “Host2”, and “Hosts”) and with metadata, in terms of CDRs (denoted “CDR-a” to “CDR-g”) as illustrated in Fig. 7(b). The hosts are operatively connected to an external EDR unit 700 via EDR agents 710. Here the investigation concerns whether a leakage occur related to the EDR unit or not and from which host the data leakage origins. If any of the numbers in the CDRs a-g are found leaked this indicates a data leakage. If the leaked number corresponds to CDR-a, this indicates that the data leakage can be unrelated to the external EDR unit. But if the leaked number instead corresponds to any of the other CDRs, the data leakage seems related to the EDR. Depending on which CDR b-g the leaked number corresponds to, the origin of the data leakage can further be narrowed down. In some examples, the metadata is not directly inserted by the network node 200 but rather by a relaying node (such as a Service Communication Proxy, SCP) on behalf of the network node 200. Thus, metadata could be inserted by the SCP in messages sent to the network node 200 so that the network node 200 is not itself aware about metadata being inserted. Therefore, the SCP might be regarded as representing another network node 200.

[0079] In Fig. 8 is illustrated an example the data item as associated with the metadata is stored in a database. For the purpose of detecting database leakage, metadata is defined with one or more type of elements, which maybe 3GPP specific data like mobile phone number, email addresses etc. that is ideally in interest of an attacker, as an illustrative example, the property of the elements in the metadata could be of such type that it is expect that those will be part of leaked data when made public or presented by an attacker as proof of ownership to an extorted company. Database replication could then be implemented in such a way that each replica of the original database will only contain metadata comprising its own subset of the elements of the metadata in the master database, where thus some of the elements of the metadata are uniquely replicated to only one replica of the database. This is illustrated in Fig. 8 where elements of a master database 800 “Master DB” is replicated into database replicas 810 “DB Replica 1”, “DB Replica 2”, and “DB Replica 3”. With the unique replication of elements, it would be possible to identify data leakage from which database replica the metadata has been leaked. As a complement to unique replication of elements of the metadata these elements could be common but be changed by applications that reads out the data from the databases, i.e., the data items themselves can be used as metadata. The application will in this case set to the data items that are read a value which can be related to for instance the requester or the location of the request. In that way, the metadata will give indications on who has read the data item or from where the request came. A benefit of storing elements of the metadata in the replicated database is that those elements will be included if data items are retrieved through e.g., memory dumps, raw database dumps, stolen storage drives and backups etc. Another benefit is that the elements can be updated when applications are used to retrieve data items from the database. This could be the case if user credentials are used by unauthorized persons, obtained illegally, or misused by authorized persons.

[0080] Fig. 9 schematically illustrates, in terms of a number of functional units, the components of a network node 200 according to an embodiment. Processing circuitry 210 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 1310a (as in Fig. 13), e.g., in the form of a storage medium 230. The processing circuitry 210 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA).

[0081] Particularly, the processing circuitry 210 is configured to cause the network node 200 to perform a set of operations, or steps, as disclosed above. For example, the storage medium 230 may store the set of operations, and the processing circuitry 210 maybe configured to retrieve the set of operations from the storage medium 230 to cause the network node 200 to perform the set of operations. The set of operations maybe provided as a set of executable instructions. Thus, the processing circuitry 210 is thereby arranged to execute methods as herein disclosed.

[0082] The storage medium 230 may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory.

[0083] The network node 200 may further comprise a communications (comm.) interface 220 for communications with other entities, functions, nodes, and devices in the cellular communication network 100. As such the communications interface 220 may comprise one or more transmitters and receivers, comprising analogue and digital components.

[0084] The processing circuitry 210 controls the general operation of the network node 200 e.g., by sending data and control signals to the communications interface 220 and the storage medium 230, by receiving data and reports from the communications interface 220, and by retrieving data and instructions from the storage medium 230. Other components, as well as the related functionality, of the network node 200 are omitted in order not to obscure the concepts presented herein.

[0085] Fig. 10 schematically illustrates, in terms of a number of functional modules, the components of a network node 200 according to an embodiment. The network node 200 of Fig. 10 comprises a number of functional modules; a process module 210b configured to perform step S104, and an associate module 210c configured to perform step S106. The network node 200 of Fig. 10 may further comprise a number of optional functional modules, such as an obtain module 210a configured to perform step S102. In general terms, each functional module 2ioa:2ioc maybe implemented in hardware or in software. Preferably, one or more or all functional modules 210a: 210c may be implemented by the processing circuitry 210, possibly in cooperation with the communications interface 220 and / or the storage medium 230. The processing circuitry 210 may thus be arranged to from the storage medium 230 fetch instructions as provided by a functional module 210a: 210c and to execute these instructions, thereby performing any steps of the network node 200 as disclosed herein.

[0086] Fig. 11 schematically illustrates, in terms of a number of functional units, the components of a data leakage detection node 300 according to an embodiment. Processing circuitry 310 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 1310b (as in Fig. 13), e.g., in the form of a storage medium 330. The processing circuitry 310 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA).

[0087] Particularly, the processing circuitry 310 is configured to cause the data leakage detection node 300 to perform a set of operations, or steps, as disclosed above. For example, the storage medium 330 may store the set of operations, and the processing circuitry 310 maybe configured to retrieve the set of operations from the storage medium 330 to cause the data leakage detection node 300 to perform the set of operations. The set of operations may be provided as a set of executable instructions. Thus, the processing circuitry 310 is thereby arranged to execute methods as herein disclosed.

[0088] The storage medium 330 may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory.

[0089] The data leakage detection node 300 may further comprise a communications interface 320 for communications with other entities, functions, nodes, and devices in the cellular communication network 100. As such the communications interface 320 may comprise one or more transmitters and receivers, comprising analogue and digital components.

[0090] The processing circuitry 310 controls the general operation of the data leakage detection node 300 e.g., by sending data and control signals to the communications interface 320 and the storage medium 330, by receiving data and reports from the communications interface 320, and by retrieving data and instructions from the storage medium 330. Other components, as well as the related functionality, of the data leakage detection node 300 are omitted in order not to obscure the concepts presented herein.

[0091] Fig. 12 schematically illustrates, in terms of a number of functional modules, the components of a data leakage detection node 300 according to an embodiment. The data leakage detection node 300 of Fig. 12 comprises a number of functional modules; a detect module 310a configured to perform step S204, and an identify module 310c configured to perform step S206. The data leakage detection node 300 of Fig. 12 may further comprise a number of optional functional modules, such as any of an obtain module 310a configured to perform step S202, and an identify module 3iod configured to perform step S208. In general terms, each functional module 3ioa:3iod maybe implemented in hardware or in software. Preferably, one or more or all functional modules 3ioa:3iod may be implemented by the processing circuitry 310, possibly in cooperation with the communications interface 320 and / or the storage medium 330. The processing circuitry 310 may thus be arranged to from the storage medium 330 fetch instructions as provided by a functional module 3ioa:3iod and to execute these instructions, thereby performing any steps of the data leakage detection node 300 as disclosed herein.

[0092] The network node 200 and / or the data leakage detection node 300 maybe provided as a standalone device or as a part of at least one further device. For example, the network node 200 and / or the data leakage detection node 300 maybe provided in a node of the radio access network or in a node of the core network, as disclosed above. Alternatively, functionality of the network node 200 and / or the data leakage detection node 300 maybe distributed between at least two devices, or nodes. These at least two nodes, or devices, may either be part of the same network part (such as the radio access network or the core network) or may be spread between at least two such network parts. Thus, a first portion of the instructions performed by each of the network node 200 and / or the data leakage detection node 300 maybe executed in a respective first device, and a second portion of the instructions performed by each of the network node 200 and / or the data leakage detection node 300 maybe executed in a respective second device; the herein disclosed embodiments are not limited to any particular number of devices on which the instructions performed by the network node 200 and / or the data leakage detection node 300 maybe executed. Hence, the methods according to the herein disclosed embodiments are suitable to be performed by a network node 200 and / or a data leakage detection node 300 residing in a cloud computational environment. Therefore, although a single processing circuitry 210, 310 is illustrated in Figs. 9 and 11 the processing circuitry 210, 310 maybe distributed among a plurality of devices, or nodes. The same applies to the functional modules 2ioa:2ioc, 3ioa:3iod of Figs. 10 and 12 and the computer programs 1320a, 1320b of Fig. 13.

[0093] Fig. 13 shows one example of a computer program product 1310a, 1310b comprising computer readable means 1330. On this computer readable means 1330, a computer program 1320a can be stored, which computer program 1320a can cause the processing circuitry 210 and thereto operatively coupled entities and devices, such as the communications interface 220 and the storage medium 230, to execute methods according to embodiments described herein. The computer program 1320a and / or computer program product 1310a may thus provide means for performing any steps of the network node 200 as herein disclosed. On this computer readable means 1330, a computer program 1320b can be stored, which computer program 1320b can cause the processing circuitry 310 and thereto operatively coupled entities and devices, such as the communications interface 320 and the storage medium 330, to execute methods according to embodiments described herein. The computer program 1320b and / or computer program product 1310b may thus provide means for performing any steps of the data leakage detection node 300 as herein disclosed.

[0094] In the example of Fig. 13, the computer program product 1310a, 1310b is illustrated as an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu-Ray disc. The computer program product 1310a, 1310b could also be embodied as a memory, such as a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), or an electrically erasable programmable read-only memory (EEPROM) and more particularly as a non-volatile storage medium of a device in an external memory such as a USB (Universal Serial Bus) memory or a Flash memory, such as a compact Flash memory. Thus, while the computer program 1320a, 1320b is here schematically shown as a track on the depicted optical disk, the computer program 1320a, 1320b can be stored in anyway which is suitable for the computer program product 1310a, 1310b.

[0095] The inventive concept has mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the inventive concept, as defined by the appended patent claims.

Claims

CLAIMS1. A method for enabling data leakage detection in a cellular communication network (100), wherein the method is performed by a network node (200), wherein the network node (200) resides in the cellular communication network (100), and wherein the method comprises: processing (S104) a data item communicated in the cellular communication network (100); and associating (S106) the data item with metadata for data leakage detection as the data item is processed by the network node (200), wherein the metadata at least identifies that the data item has been processed by the network node (200).

2. The method according to claim 1, wherein processing the data item comprises any of: receiving the data item at an incoming network interface of the network node (200), sending the data item at an outgoing network interface of the network node (200), internally processing the data item in the network node (200), storing the data item in a database.

3. The method according to claim 1 or 2, wherein the metadata identifies any of: a network interface of the network node (200), an instance of the network node (200), hardware that the network node (200) is running on.

4. The method according to any preceding claim, wherein the metadata further identifies a point in time at which the data item was processed by the network node (200).

5. The method according to any preceding claim, wherein the data item is associated with the metadata by the metadata being embedded in a message comprising the data item.

6. The method according to claim 5, wherein the data item comprises information of a subscriber, and wherein the message either comprises genuine information of the subscriber or is a dummy message.

7. The method according to claim 6, wherein, when the message comprises genuine information of the subscriber, the metadata is encoded into said genuine information of the subscriber.

8. The method according to claim 6, wherein, when the message is the dummy message, the subscriber is a dummy subscriber.

9. The method according to any of claims 5 to 8, wherein the message already comprises further metadata for data leakage detection that at least identifies that the data item has been processed by a further NF node (200), and wherein the metadata is embedded in the message by either being concatenated with said further metadata or by being added to said further metadata or by replacing said further metadata.

10. The method according to any of claims 1 to 4, wherein the data item is associated with the metadata by the network node (200) sending out a sequence of messages, wherein the metadata is defined by the sequence, and wherein at least one of the messages comprises, or relates to, the data item.

11. The method according to any preceding claim, wherein the data item comprises data in a certain format, and wherein the metadata is provided as data in said certain format.

12. The method according to any preceding claim, wherein the metadata is, or comprises, any, or any combination, of: an International Mobile Subscriber Identifier, IMSI, a tracking phone number, a Charging Data Record, CDR, call duration information, location data.

13. The method according to any preceding claim, wherein the data item comprises information of a subscriber, and wherein the data item comprises security-sensitive user data of the subscriber.

14. The method according to any preceding claim, wherein the data item comprises information of a subscriber, and wherein the data item is, or comprises, any of: user plane data of the subscriber, a Charging Data Record, CDR, of the subscriber, location data of the subscriber, contact information of the subscriber.15- The method according to any preceding claim, wherein the method further comprises: obtaining (S102) an indication to associate the data item with the metadata, and wherein the data item is associated with the metadata in response thereto.

16. A method for data leakage detection in a cellular communication network (100), wherein the method is performed by a data leakage detection node (300), and wherein the method comprises: performing (S204) data leakage detection by identifying metadata, wherein the metadata is associated with a data item, and wherein the metadata at least identifies that the data item has been processed by a network node (200) residing in the cellular communication network (100); and identifying (S206) the data item as leaked responsive to having identified the metadata associated with the data item.

17. The method according to claim 16, wherein the data leakage has an origin, and wherein the method further comprises: identifying (S208) the network node (200) as the origin of the data leakage.

18. The method according to claim 16 or 17, wherein the method further comprises: obtaining (S202) an indication to perform the data leakage detection, and wherein the data leakage detection is performed in response thereto.

19. A network node (200) for enabling data leakage detection in a cellular communication network (100), the network node (200) being configured to reside in the cellular communication network (100), the network node (200) comprising processing circuitry (210), the processing circuitry being configured to cause the network node (200) to: process a data item communicated in the cellular communication network (100); andassociate the data item with metadata for data leakage detection as the data item is processed by the network node (200), wherein the metadata at least identifies that the data item has been processed by the network node (200).

20. A data leakage detection node (300) for data leakage detection in a cellular communication network (100), the data leakage detection node (300) comprising processing circuitry (310), the processing circuitry being configured to cause the data leakage detection node (300) to: perform data leakage detection by identifying metadata, wherein the metadata is associated with a data item, and wherein the metadata at least identifies that the data item has been processed by a network node (200) residing in the cellular communication network (100); and identify the data item as leaked responsive to having identified the metadata associated with the data item.

21. A computer program (1320a) for enabling data leakage detection in a cellular communication network (100), the computer program comprising computer code which, when run on processing circuitry (210) of a network node (200) configured to reside in the cellular communication network (100), causes the network node (200) to: process (S104) a data item communicated in the cellular communication network (100); and associate (S106) the data item with metadata for data leakage detection as the data item is processed by the network node (200), wherein the metadata at least identifies that the data item has been processed by the network node (200).

22. A computer program (1320b) for data leakage detection in a cellular communication network (100), the computer program comprising computer code which, when run on processing circuitry (310) of a data leakage detection node (300), causes the data leakage detection node (300) to:perform (S204) data leakage detection by identifying metadata, wherein the metadata is associated with a data item, and wherein the metadata at least identifies that the data item has been processed by a network node (200) residing in the cellular communication network (100); and identify (S206) the data item as leaked responsive to having identified the metadata associated with the data item.

23. A computer program product (1310a, 1310b) comprising a computer program (1320a, 1320b) according to at least one of claims 21 and 22, and a computer readable storage medium (1330) on which the computer program is stored.

Images