Diameter Edge Agent MME Authentication for Roaming Fraud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile communications networks are vulnerable to Diameter security attacks, such as subscriber denial of service and fraud, due to spoofing of MME and HSS identifiers in interconnect signaling traffic, which can lead to 'man in the middle' scenarios, necessitating effective MME authentication for outbound roaming subscribers.
Innovation Solution
Implementing a Diameter edge agent (DEA) that maintains an AIR/ULR mapping database to validate the authenticity of visited public land mobile network identifiers (VPLMN ID) in Diameter authentication information request (AIR) and update location request (ULR) messages, ensuring that only valid messages are forwarded to the home subscriber server (HSS), thereby preventing fraudulent activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If home network elements are not directly connected to foreign networks and use interconnect networks to forward signaling, then network security is improved, but the home networks become susceptible to Diameter security attacks through compromised remote foreign networks
Solution Approach 1:
The patent introduces a Diameter Edge Agent (DEA) as an intermediary component deployed at the edge of the home network. The DEA intercepts and validates Diameter signaling messages (AIR and ULR) before they reach internal home network elements like the HSS. This intermediary validates MME identifiers and ensures message authenticity, blocking fraudulent attacks while maintaining legitimate roaming operations.
Solution Approach 2:
The patent implements preliminary validation of Diameter signaling messages at the DEA before they enter the home network. The DEA maintains mapping databases that store expected MME identifiers and validates incoming AIR/ULR messages against these stored values in advance, preventing fraudulent messages from reaching vulnerable internal elements like the HSS.
2Reliability
If MME authentication is implemented using DEA with AIR/ULR mapping database, then fraud prevention is improved, but device complexity increases
Solution Approach 1:
The patent extracts the authentication and validation functions from the core home network elements (HSS, MME) and concentrates them in a dedicated DEA component. The DEA handles all complex validation logic, database maintenance, and message filtering, simplifying the overall system architecture by centralizing security functions in a specialized element rather than distributing complexity across multiple network elements.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A method for authenticating a mobility management entity (MME) for outbound roaming subscribers includes maintaining a Diameter authentication information request (AIR)/update location request (ULR) mapping database at a Diameter edge agent (DEA). A Diameter AIR message is received at the DEA. The DEA determines that the AIR message includes a visited public land mobile network identifier (VPLMN ID) not of record in the database. The DEA records the VPLMN ID in the database. A Diameter ULR message is received at the DEA, and a VPLMN ID is read from the ULR message. The DEA determines that the VPLMN ID read from the ULR message does not match the VPLMN ID recorded for the subscriber in the database. In response to determining that the VPLMN ID does not match the VPLMN ID recorded for the subscriber in the database, the DEA rejects the ULR message.