Man-in-the-middle Detector for Rogue Base Station Signaling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods fail to effectively detect man-in-the-middle attacks by rogue base stations in both stationary and moving mobile terminals, as they rely on power and direction changes which can lead to false alerts due to network reselection and location area code manipulation.

Innovation Solution

A method and apparatus that analyze anomalies in signaling transmissions from base stations, such as LAC code discrepancies, high transmission power, and incorrect location update frequencies, using network measurement parameters stored in a database for comparison, and provide alerts with optional location visualization on a map.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing detection methods monitor receiving power and transmission direction changes, then they can detect man-in-the-middle attacks in stationary terminals, but they produce false alerts when terminals are moving

Engineering Contradiction:

Improvedetection accuracyVSAvoidapplicability to moving terminals

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent changes the detection parameters from physical signal characteristics (power, direction) to network protocol characteristics (LAC code, location update frequency, signaling transmission patterns). This allows the detection method to work reliably for both stationary and moving terminals, as protocol parameters remain consistent regardless of terminal motion state.

Inventive Principle:

Principle #35Parameter changes

2Object-generated harmful factors

If rogue base stations use high transmission power and modified network selection parameters to attract mobile terminals, then they can successfully initiate man-in-the-middle attacks, but they create detectable anomalies in network signaling

Engineering Contradiction:

Improveattack capabilityVSAvoiddetection ease

Core Design Contradiction:

Object-generated harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The patent converts the harmful behavior of rogue base stations (using high power, modified parameters to attract terminals) into beneficial detection signals. By monitoring for anomalies in LAC code consistency, location update frequency, and signaling patterns, the system transforms the attack mechanisms themselves into detectable indicators of compromise.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Ease of operation

If base stations transmit location area code in broadcast channels for network reselection, then mobile terminals can perform location updates, but rogue base stations can exploit this to initiate attacks

Engineering Contradiction:

Improvenetwork reselection functionalityVSAvoidvulnerability to attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent implements feedback by continuously monitoring network signaling parameters (LAC code consistency across cells, location update frequency, paging message patterns) and comparing them against expected legitimate network behavior. This feedback mechanism enables the system to detect when the normal location update and reselection procedures are being exploited by rogue base stations.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8351900B2Man-in-the-middle detector and a method using it

Publication Date: 2013.01.08 EXFO

AI summary

A method receives signaling messages by a mobile apparatus at least from one base station of a cellular network, interprets a received signaling message, searches for an anomaly with at least one signaling parameter of the received signaling message from a first base station to a known comparison signaling parameter, gives an alert if the comparison gives an unequal result concerning at least one signaling parameter.