A system for detection of signaling anomalies in LTE roaming

Abstract

The present invention relates to a system (1) for respectively controlling the authentication information requests and location verification information requests received in order to prevent possible attack and / or fraud transactions by monitoring the sequence in which authentication and location verification messages are sent received while performing LTE roaming.

Description

[0001] A SYSTEM FOR DETECTION OF SIGNALING ANOMALIES IN LTE ROAMING

[0002] Technical Field

[0003] The present invention relates to a system for respectively controlling the authentication information requests and location verification information requests received in order to prevent possible attack and / or fraud transactions by monitoring the sequence in which authentication and location verification messages are sent received while performing LTE roaming.

[0004] Background of the Invention

[0005] In LTE roaming signaling, an AIR (Authentication Information Request) message is used for subscriber authentication and a ULR (Update Location Request) message is used to inform the MME (Mobility Management Entity) where the subscriber is registered. The AIR and ULR messages must be sent for the subscriber respectively.

[0006] In the state of the art, the firewalls used in the S6a interface do not check the sequence of AIR and ULR messages sent for the subscriber. In this case, an attacker can send ULR messages directly to change the subscriber’s location or to perform a denial of service (DoS) attack on the subscriber. Without AIR-ULR control in firewalls, attacks such as denial of service attacks and fake location update attacks may also succeed.

[0007] Therefore, there is need for a system which enables to prevent possible attacks and fraud by monitoring the sequence of AIR and ULR messages sent for the subscriber on the S6a interface, based on the requirement that the subscriber must first receive an AIR and then a ULR before the same MME.

[0008] The Chinese patent document no. CN106304064, an application included in the state of the art, discloses a roaming method. In the roaming method, an authentication information request instruction sent from mobile terminals included in a server and a roaming network is received at first. The authentication information request instruction received includes the current location information of the mobile terminal. It is ensured that an authentication request is created by means of an authentication terminal previously associated with the location information. Through the authentication request created, it is ensured that the previously set instructions are received and saved to the current network at the current location. The control instruction sends the authentication information and the identity information obtained to the roaming server and transmits it to the mobile terminal. According to the authentication information, the mobile terminal uses the network by registering to the pre-set current network. In the said invention, it is ensured that connection is realized between the roaming server and the mobile terminal.

[0009] Summary of the Invention

[0010] An objective of the present invention is to realize a system for respectively controlling the authentication information requests and location verification information requests received in order to prevent possible attack and / or fraud transactions by monitoring the sequence in which authentication and location verification messages are sent received while performing LTE roaming.

[0011] Detailed Description of the Invention

[0012] “A System for Detection of Signaling Anomalies in LTE Roaming” realized to fulfil the objective of the present invention is shown in the figure attached, in which: Figure l is a schematic view of the inventive system.

[0013] The components illustrated in the figure are individually numbered, where the numbers refer to the following:

[0014] 1. System

[0015] 2. Electronic device

[0016] 3. Database

[0017] 4. Server

[0018] The inventive system (1) for respectively controlling the authentication information requests and location verification information requests received in order to prevent possible attack and / or fraud transactions by monitoring the sequence in which authentication and location verification messages are sent received while performing LTE roaming; comprises at least one electronic device (2) which can establish communication with remote servers using any remote communication protocol; at least one database (3) wherein the data of authentication information request and location authentication information request generated while the electronic device (2) receives communication services, are kept under record; and at least one server (4) which is in communication with the database (3) and compares the username AVP (Attribute Value Pair) data, that is included on the ULR data when the ULR data is received, with the AIR data previously received on the database (3) and blocks the message if the comparison does not result in a match.

[0019] The electronic device (2) included in the inventive system (1) is a device such as smartphone, tablet computer or portable computer that is used to perform data monitoring regarding the communication services received by subscribers and has a key or touch screen for allowing data entry. The said electronic device (2) is configured to establish connection with the server (4) by using any remote communication protocol included in the state of the art and to realize data exchange with the server (4) over this connection established. In one preferred embodiment of the invention, the electronic device (2) is configured to exchange data with the server (4) by using Internet as a databus.

[0020] The database (3) included in the inventive system (1) is in communication with the server (4) and configured to be managed by the server (4). In one preferred embodiment of the invention, the database (3) is configured to keep record of the data of authentication information request (AIR) and update location request (ULR) generated via the mobility management entity (MME) while the electronic device (2) receives communication service, as well as the information on the arrival sequence of these data, therein.

[0021] The server (4) included in the inventive system (1) is configured to establish communication with the electronic device (2) by using any remote communication protocol and to exchange data with the electronic device (2) through this communication established. The server (4) is configured to ensure that the subscriber -who is a user of electronic device (2)- and the MME information sent by the subscriber are kept in the database (3) via SCFW, since the messages sent for the same subscriber do not always arrive at the same SCFW (Sequence Control Firewall) machine. The server (4) is configured to store the IMSI (International Mobile Subscriber Identity) in the username AVP (Attribute Value Pair) and the MME information in the Origin-Host AVP (Attribute Value Pair) in the incoming AIR message in the database (3). The server (4) is configured to receive the IMSI in the username AVP (Attribute Value Pair) and the MME in the Origin-Host AVP (Attribute Value Pair) in the incoming ULR message and to check whether these data are included in the database (3). The server (4) is configured to block the message if there is no match as a result of the check. The server (4) is configured to receive PUR (Purge UE Request) and CLR (Cancel Location Request) messages on the S6a interface to SCFW machines. The server (4) is configured to delete the IMSI data included in the received messages, if they are registered in the database (3) with the Origin-Host in the PUR message, since the incoming subscriber in these messages has left the place of registration. The server (4) is configured to delete the data from the database (3) if the IMSI data included in the received messages is registered in the database (3) with the Destination-Host in the CLR message, since the incoming subscriber included in these messages has left the place where s / he was registered. Thus, the subscriber is not kept in the database (3) and the database (3) is prevented from becoming overcrowded.

[0022] Industrial Applicability of the Invention

[0023] With the inventive system (1), it is ensured that possible attacks and frauds are prevented by monitoring the sequence of AIR and ULR messages sent for the subscriber on the S6a interface, based on the requirement that the subscriber must receive AIR at first and then ULR from the same MME.

[0024] Within these basic concepts; it is possible to develop various embodiments of the inventive “System (1) for Detection of Signaling Anomalies in LTE Roaming”; the invention cannot be limited to examples disclosed herein and it is essentially according to claims.

Claims

CLAIMS1. A system (1) for respectively controlling the authentication information requests and location verification information requests received in order to prevent possible attack and / or fraud transactions by monitoring the sequence in which authentication and location verification messages are sent received while performing LTE roaming; characterized in that it comprises at least one electronic device (2) which can establish communication with remote servers using any remote communication protocol; at least one database (3) wherein the data of authentication information request and location authentication information request generated while the electronic device (2) receives communication services, are kept under record; and at least one server (4) which is in communication with the database (3) and compares the username AVP (Attribute Value Pair) data, that is included on the ULR data when the ULR data is received, with the AIR data previously received on the database (3) and blocks the message if the comparison does not result in a match.

2. A system (1) according to Claim 1; characterized by the electronic device (2) which is a device such as smartphone, tablet computer or portable computer that is used to perform data monitoring regarding the communication services received by subscribers and has a key or touch screen for allowing data entry.

3. A system (1) according to Claim 1 or 2; characterized by the electronic device (2) which is configured to establish connection with the server (4) by using any remote communication protocol and to realize data exchange with the server (4) over this connection established.

4. A system (1) according to Claim 3; characterized by the electronic device (2) which is configured to exchange data with the server (4) by using Internet as a databus.

5. A system (1) according to any of the preceding claims; characterized by the database (3) which is in communication with the server (4) and configured to be managed by the server (4).

6. A system (1) according to any of the preceding claims; characterized by the database (3) which is configured to keep record of the data of authentication information request and update location request generated via the mobility management entity while the electronic device (2) receives communication service, as well as the information on the arrival sequence of these data, therein.

7. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to establish communication with the electronic device (2) by using any remote communication protocol and to exchange data with the electronic device (2) through this communication established.

8. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to ensure that the subscriber -who is a user of electronic device (2)- and the MME information sent by the subscriber are kept in the database (3) via SCFW, since the messages sent for the same subscriber do not always arrive at the same SCFW machine.

9. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to store the IMSI in the username AVP and the MME information in the Origin-Host AVP in the incoming AIR message in the database (3).

10. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to receive the IMSI in the username AVP and the MME in the Origin-Host AVP in the incoming ULR message and to check whether these data are included in the database (3).

11. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to block the message if there is no match as a result of the check and to receive PUR and CLR messages on the S6a interface to SCFW machines.

12. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to delete the IMSI data included in the received messages, if they are registered in the database (3) with the Origin- Host in the PUR message, since the incoming subscriber in these messages has left the place of registration.

13. A system (1) according to any of the preceding claims; characterized by the server (4) which is configured to delete the data from the database (3) if the IMSI data included in the received messages is registered in the database (3) with the Destination-Host in the CLR message, since the incoming subscriber included in these messages has left the place where s / he was registered.

Images