Wireless communication network security method and system

• US 20060276173A1
• Filed: 06/07/2005
• Published: 12/07/2006
• Est. Priority Date: 06/07/2005
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Harris, John M., Gonzalez, Jesus, Srey, Lena, Iskandar, Antoine S., Varghese, Jessy
• Granted Patent: US 7,496,348 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04M 1/24 Arrangements for testing
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A security method (100) in a radio access network can include monitoring (102) (by either a base station controller or a mobile radio) for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names, notifying (104) of a specific abnormality detected, and receiving (108) access, conditional access or limited access based on the specific abnormality detected. The method can further include receiving updates (112) used for monitoring the abnormalities. The method can further include the optional step (106) of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected and suspending (110) one or more services based on the specific abnormality detected. The method can further include receiving (114) at the mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.

Claims

1. A radio access network security method, comprising the steps of:

monitoring for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names;

notifying of a specific abnormality detected via a wireless communication link; and

receiving access, conditional access or limited access via the wireless communication link based on the specific abnormality detected.

2. The method of claim 1, wherein the method further comprises the step of receiving updates used for monitoring the one or more abnormalities.

3. The method of claim 1, wherein the method further comprises the step of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected.

4. The method of claim 3, wherein the method further comprises the step of suspending one or more services being provided to the mobile radio based on the specific abnormality detected.

5. The method of claim 1, wherein the method further comprises the step of issuing a notification from a mobile radio and receiving a response from a base station controller causing the mobile radio to perform one of the functions among suspending data services, suspending data services and voice services, canceling suspension of data services, and canceling suspension of data services and voice services.

6. The method of claim 1, wherein the method further comprises the step of receiving at a mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.

7. The method of claim 1, wherein a base station controller monitors for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names and initiates a suspension of service upon the detection of one or more abnormalities.

8. The method of claim 1, wherein the method further comprises the step of isolating a mobile radio operating system from an air interface layer.

9. The method of claim 1, wherein the method further comprises the step of preventing denial of service attacks by monitoring behavior of mobile radios in communication with the radio access network and flagging the specific abnormality detected.

10. The method of claim 1, wherein the method further comprises the step of suspending packet data services at a mobile radio upon detection of a malicious software routine in the mobile radio while continuing to enable voice or circuit data calls.

11. A radio access network security system, comprising:

a transceiver;

a processor coupled to the transceiver, wherein the processor is programmed to;

monitor for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names;

notify of a specific abnormality detected among the one or more abnormalities via a wireless communication link; and

receive access, conditional access or limited access via the wireless communication link based on the specific abnormality detected.

12. The system of claim 11, wherein the processor is further programmed to receive updates used for monitoring the one or more abnormalities.

13. The system of claim 11, wherein the system comprises a mobile radio that is programmed to issue a notification from the mobile radio to a base station controller if the specific abnormality is detected and the system performs at least one among the functions of:

disabling an infected service for a predetermined amount of time,

refusing a resource assignment for a flagged application,

redirecting the mobile radio to an analog service, instructing other geographically nearby mobile radios to increase their security level,

instructing other geographically nearby mobile radios to run virus software,

preventing peer-to-peer communications,

preventing access to a mobile radio'"'"'s address book by other normally trustworthy appearing wireless devices,

increasing security levels at mobile radios in recent communication with the mobile radio or that are in the mobile radio'"'"'s address book, buddy list or recent call list,

instructing the mobile radio to enter into a battery draining mode, or

instructing the mobile radio to enter a location finding mode.

14. The system of claim 13, wherein the system is further programmed to suspend one or more services being provided to the mobile radio based on the specific abnormality detected.

15. The system of claim 11, wherein the system is further programmed to issue a notification from a mobile radio and receive a response from a base station controller causing the mobile radio to perform one of the functions among suspending data services, suspending data services and voice services, canceling suspension of data services, and canceling suspension of data services and voice services.

16. The system of claim 11, wherein the system is further programmed to receive at a mobile radio an over the air programming instruction to suspend a specific service and alert the mobile radio.

17. The system of claim 11, wherein one among a mobile radio and a base station controller monitors for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names and initiates a suspension of service upon the detection of one or more abnormalities.

18. The system of claim 11, wherein the system is programmed to suspending packet data services at a mobile radio upon detection of a malicious software routine in the mobile radio while continuing to enable voice or circuit data calls.

19. A radio access network system, comprising:

a transceiver; and

a processor coupled to the transceiver, wherein the processor is programmed to;

detect an abnormality in an application within a mobile radio in communication with the radio access network system; and

responsive to detecting the abnormality, perform at least one function among;

controlling access by the mobile radio to resources on the radio access network system selectively, while enabling access for the mobile radio to other resources on the radio access network system, and

running one or more mitigation functions that mitigate the effects of the abnormality on the radio access network system.

20. The radio access network system of claim 19, wherein the processor controls access to resources by performing one or more of the functions selected from:

restricting access to a mobile radio'"'"'s address book by other normally trustworthy appearing wireless devices,

increasing security levels at mobile radios in recent communication with the mobile radio or that are in the mobile radio'"'"'s address book, buddy list or recent call list,

restricting access to a particular service application, or

redirecting service to a less attack-susceptible service;

and wherein the one or more mitigation functions are selected among the functions of at least;

alerting other mobile radios nearby the mobile radio with the abnormality and causing them to increase their security level or run virus software,

instructing the mobile radio to drain its power source by waking up more often to check for pages, or

instructing the mobile radio to drain its power source more rapidly by instructing the mobile to perform more precise location tracking.