Message spoofing detection via validation of originating switch

• US 20080026778A1
• Filed: 07/25/2006
• Published: 01/31/2008
• Est. Priority Date: 07/25/2006
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Cai, Yigang, Sharma, Alok
• Granted Patent: US 8,121,624 B2
• Time in Patent Office: Days
• US Class Current: 455/466
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Message spoofing is detected by an anti-spoofing application comparing a trusted switch address (i.e., corresponding to an originating switch having processed an incoming message) to an “affiliated” address (i.e., corresponding to a switch serving the location of the identified sender). Message spoofing is detected if the trusted address differs from the affiliated address.

Claims

1. In a communication network supporting an electronic messaging service, wherein an incoming message includes indicia of sender and is subject to possible message spoofing so as to appear to originate from a sender other than the true sender, a method of detecting instances of message spoofing comprising:

identifying a device address corresponding to an originating switch having processed the incoming message, defining a trusted address;

identifying a device address corresponding to a switch serving the identified sender, defining an affiliated address; and

determining whether the trusted address differs from the affiliated address, wherein message spoofing is detected if the trusted address differs from the affiliated address.

2. The method of claim 1, wherein the step of identifying the trusted address comprises inspecting a message header of the incoming message for indicia of the originating switch, the originating switch having inserted its address in the message header coincident to processing the message.

3. The method of claim 1, wherein the step of identifying the affiliated address comprises querying a location register associated with the identified sender for indicia of the switch serving the identified sender.

4. The method of claim 1, further comprising blocking the message if message spoofing is detected.

5. The method of claim 1, performed by an anti-spoofing application residing in a terminating message application server.

6. The method of claim 5, wherein the incoming message comprises an SMS message and the terminating message application server comprises a Short Message Service Center (SMSC).

7. The method of claim 6, wherein the step of identifying the trusted address comprises inspecting a message header of the incoming SMS message for indicia of an originating Mobile Switching Center (MSC), and wherein the step of identifying the affiliated address comprises querying a location register associated with the identified sender for indicia of an MSC serving the identified sender.

8. The method of claim 5, wherein the incoming message comprises a SIP message and the terminating message application server comprises a Short Message Service Center Application Server (SMSC-AS).

9. The method of claim 8, wherein the step of identifying the trusted address comprises inspecting a message header of the incoming SIP message for indicia of an originating Call Session Control Function (CSCF), and wherein the step of identifying the affiliated address comprises querying a location register associated with the identified sender for indicia of the CSCF serving the identified sender.

10. A method of providing an electronic messaging service, the method comprising:

receiving an electronic message having indicia of a sending terminal, a destination terminal and an originating switch having processed the electronic message;

identifying a location of the indicated sending terminal and a switch serving the location of the indicated sending terminal;

determining whether the originating switch having processed the electronic message is the same as the switch serving the location of the indicated sending terminal;

delivering the message to the indicated destination terminal if the originating switch having processed the electronic message is determined to be the same as the switch serving the location of the indicated sending terminal;

otherwise

blocking delivery of the message to the indicated destination terminal.