Diameter IDR Spoofing Detection in Mobile Networks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The Diameter protocol in 4G and 5G mobile communication networks is vulnerable to location information stealing attacks using Insert Subscriber Data Request (IDR) messages, where attackers disguise as a Home Subscriber Server (HSS) to obtain subscriber location information, and existing security measures are inadequate to prevent such attacks without modifying the core network or receiving subscriber information from providers.

Innovation Solution

A method and apparatus that detect abnormal IDR messages by obtaining a normal International Mobile Subscriber Identity (IMSI) from Diameter S6a protocol packets, adding records to session tables, and determining message categories based on IMSI presence, bit flags, and origin-host attributes, allowing for the identification of spoofing attacks without modifying the 5G mobile communication core network or receiving subscriber information from providers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Diameter protocol is used for AAA process in 4G and 5G mobile communication networks, then authentication and authorization functionality is provided, but the system becomes vulnerable to location information stealing attacks using IDR messages

Engineering Contradiction:

Improveauthentication and authorization functionalityVSAvoidlocation information stealing attack

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

A detection system is introduced as an intermediary component that monitors Diameter signaling messages between MME and HSS without modifying the core network architecture. The system captures and analyzes IDR messages to detect spoofing attacks, acting as a mediator that adds security functionality while preserving the existing Diameter protocol operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The detection system performs preliminary analysis of IDR messages by extracting and verifying key parameters (MSISDN, IMSI, MSIN) before the attack can succeed. By checking these parameters in advance against stored subscriber data, the system prevents location information stealing attacks before they can compromise the network.

Inventive Principle:

Principle #10Preliminary action

2Object-affected harmful factors

If network concealment and access blocking are implemented to prevent IDR attacks, then some attack prevention is achieved, but attackers can still obtain HSS and MME information to disguise as HSS and steal location information

Engineering Contradiction:

Improveattack preventionVSAvoidsecurity against disguise attacks

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The detection system implements feedback mechanisms by continuously monitoring Diameter messages and comparing observed parameters against expected values. When an IDR message contains inconsistent or unauthorized parameters, the system generates alerts and can trigger countermeasures, creating a closed-loop security system that adapts to detected threats.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system applies preliminary anti-action by pre-configuring security rules and parameter validation criteria that prevent spoofing attempts before they succeed. By establishing expected parameter ranges and relationships in advance, the system can immediately reject messages that deviate from normal patterns, countering disguise attacks before they can extract location information.

Inventive Principle:

Principle #9Preliminary anti-action

3Device complexity

If the detection system analyzes IDR message parameters without modifying the 5G core network, then the system maintains original infrastructure, but must process and validate multiple message parameters to identify spoofing attacks

Engineering Contradiction:

Improvecore network modificationVSAvoidIDR message parameter validation

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The detection system extracts only the critical parameters (MSISDN, IMSI, MSIN) from the complex Diameter message stream for analysis, separating these key security-relevant elements from the rest of the message data. This extraction approach simplifies the detection process by focusing only on the parameters that indicate spoofing attempts, rather than analyzing the entire message structure.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The detection process is segmented into distinct stages: message capture, parameter extraction, validation against stored data, and decision-making. This segmentation allows each function to be implemented independently and simplifies the overall complexity of detecting spoofing attacks in the Diameter protocol without requiring comprehensive modification of the core network.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS10945117B1Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

Publication Date: 2021.03.09 KOREA INTERNET & SECURITY AGENCY

AI summary

Provided are methods of detecting a Diameter spoofing attack. According to an embodiment, the method comprises, obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of a Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network, adding a record comprising the normal IMSI to a session table, obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol and determining a category of the IDR message.