METHOD OF CHECKING AMOUNT OF TRANSMITTED DATA

• US 20080090549A1
• Filed: 12/12/2007
• Published: 04/17/2008
• Est. Priority Date: 02/22/2000
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: NIEMI, Valtteri, VIALEN, Jukka
• Granted Patent: US 7,962,121 B2
• Time in Patent Office: Days
• US Class Current: 455/405
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

During a connection between a network infrastructure and user equipment a first indication of the amount of data transmitted over the connection is maintained in the network infrastructure and a second indication of the amount data transmitted is maintained in the user equipment. A checking procedure is triggered in response to encountering a predetermined checking value. The checking procedure utilizes integrity protected signalling. During the checking procedure the first indication is compared with the second indication. This checking procedure enables easy discovery of an intruder who either sends and/or receives data on an authorized connection between a network infrastructure and a mobile station, the data transmission being charged from the mobile station.

Claims

1. An apparatus comprising a processor and a memory operatively connected to the processor,

wherein the processor is configured to:

store and update a first indication in the memory of an amount of data transmitted over a connection with another apparatus,

compare the first indication with a second indication of an amount of data transmitted over the connection, said second indication being provided by an integrity protected signalling message received from the other apparatus, and

cause an integrity-protected signalling message indicating the comparison result to be sent to the other apparatus.

2. The apparatus of claim 1, wherein the processor is configured to verify integrity of the integrity protected signalling message received from the other apparatus before performing the comparison.

3. The apparatus of claim 1, wherein the processor is configured to wait for said second indication a predetermined time in response to encountering a predefined checking value, and to trigger an intruder checking procedure by sending the first indication to the other apparatus in an integrity-protected signalling message if said second indication is not received within the predetermined time.

4. The apparatus of claim 1, wherein the processor is configured to store and update the first indication separately for uplink and downlink directions of the connection.

5. The apparatus of claim 1, wherein the apparatus is one of the following group comprising user equipment and a network node.

18. The apparatus of claim 1, wherein the processor is configured to store and update the first indication separately for uplink and downlink directions of the connection.

6. An apparatus, comprising:

means for maintaining a first indication of an amount of data transmitted over a connection with another apparatus,

means for receiving a second indication of an amount of data transmitted over the connection, said second indication being provided by an integrity protected signalling message received from the other apparatus

means for comparing the first indication with the second indication, and

means for sending an integrity-protected signalling message indicating the comparison result to the other apparatus.

7. The apparatus of claim 6, wherein the apparatus is one of the following group comprising user equipment and a network node.

8. The apparatus comprising a processor and a memory operatively connected to the processor,

wherein the processor is configured to:

store and update a first indication in the memory of an amount of data transmitted over a connection with another apparatus, and

trigger an intruder checking procedure in response to encountering a predefined checking value by sending the first indication to the other apparatus in an integrity-protected signalling message,

wherein, upon completion of the checking procedure, a determination may be made regarding whether or not the connection is being used by an intruder.

9. The apparatus of claim 8, wherein the processor is configured to trigger the intruder checking procedure after a predetermined amount of data has been transmitted between two checking procedures in succession.

10. The apparatus of claim 8, wherein the processor is configured to trigger the intruder checking procedure after a predetermined number of data has been transmitted between two checking procedures in succession.

11. The apparatus of claim 8, wherein the processor is configured to periodically trigger the intruder checking procedure.

12. The apparatus of claim 8, wherein the processor is further configured to receive a comparison result during the checking procedure, said comparison result being provided by an integrity protected signalling message received from the other apparatus.

13. The apparatus of claim 12, wherein the processor is further configured to deduce, based on the comparison result, whether or not to release the connection.

14. The apparatus of claim 12, wherein the processor is configured to release the connection in response to a comparison result that indicates that a difference between the first and second indications is an unacceptable difference.

15. The apparatus of claim 12, wherein the processor is configured to verify integrity of the integrity protected signalling message received from the other apparatus before and if the integrity is verified, to deduce, based on the comparison result, whether or not to release the connection.

16. The apparatus of claim 12, wherein the processor is configured to decrease the checking value in response to a comparison result that indicates that there is an acceptable difference between the first and second indications.

17. The apparatus of claim 8, wherein the processor is further configured to deduce during the checking procedure whether or not to release the connection.

19. The apparatus of claim 8, wherein the apparatus is one of the following group comprising user equipment and a network node.

20. An apparatus, comprising:

means for maintaining a first indication in the memory of an amount of data transmitted over a connection with another apparatus, and

means for trigger an intruder checking procedure in response to encountering a predefined checking value by sending the first indication to the other apparatus in an integrity-protected signalling message,

wherein, upon completion of the checking procedure, a determination may be made regarding whether or not the connection is being used by an intruder.

21. The apparatus of claim 20, wherein the apparatus is one of the following group comprising user equipment and a network node.

22. A computer-readable medium containing computer instructions thereon which, when executed by a processor, causes the processor:

to compare a first indication of an amount of data transmitted over a connection in a communication system with a second indication of an amount of data transmitted over the same connection, said second indication being provided by an integrity protected signalling message received over the connection; and

to cause an integrity-protected signalling message indicating the comparison result to be sent over the connection.

23. The computer-readable medium of claim 22, wherein the first indication represents an amount of data transmitted over the connection calculated by a first apparatus on a connection path of the connection, and wherein the second indication represents an amount of data transmitted over the connection calculated by a second apparatus on the connection path of the connection.

24. The computer-readable medium of claim 22, wherein the first indication represents an amount of data transmitted over the connection calculated by user equipment, and wherein the second indication represents an amount of data transmitted over the connection calculated by a network node in a radio network subsystem.

25. A computer-readable medium containing computer instructions thereon which, when executed by a processor, causes the processor:

to trigger an intruder checking procedure in response to encountering a predefined checking value by sending a first indication of an amount of data transmitted over a connection in an integrity-protected signalling message, and

to deduce, on the basis of a comparison result received as a response to the first indication, whether or not the connection is being used only by legal users.

26. The computer-readable medium of claim 25, wherein the processor releases the connection responsive to the comparison result.