MAN-IN-THE-MIDDLE DETECTOR AND A METHOD USING IT

• US 20090104889A1
• Filed: 05/21/2008
• Published: 04/23/2009
• Est. Priority Date: 06/13/2007
• Status: Active Grant

• Current Assignee: Exfo Oy (11172239 Canada, Inc.)
• Original Assignee: Nethawk Oyj (11172239 Canada, Inc.)
• Inventors: Pauna, Janne, Kumpula, Juha, Ahokangas, Markus, Lotvonen, Jukka
• Granted Patent: US 8,351,900 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 52/04 TPC
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method receives signaling messages by a mobile apparatus at least from one base station of a cellular network, interprets a received signaling message, searches for an anomaly with at least one signaling parameter of the received signaling message from a first base station to a known comparison signaling parameter, gives an alert if the comparison gives an unequal result concerning at least one signaling parameter.

Claims

1. A method for detecting a rogue base station, the method comprising:

receiving signaling messages by a mobile apparatus at least from one base station of a cellular network;

interpreting a received signaling message;

searching for an anomaly by comparing at least one signaling parameter of the received signaling message from a first base station to a known comparison signaling parameter; and

giving an alert if the comparison gives an unequal result concerning at least one signaling parameter.

2. The method according to claim 1, wherein the comparison signaling parameter has been saved in a memory of the mobile apparatus in advance.

3. The method according to claim 1, wherein the comparison signaling parameter is included in a signaling message received from a second base station.

4. The method according to claim 2, wherein a signaling parameter utilized in the comparison is included in a broadcast control channel message.

5. The method according to claim 2, wherein a signaling parameter utilized in the comparison is included in a paging message.

6. The method according to claim 2, wherein a parameter utilized in the comparison is included in a location update rejection message.

7. The method according to claims 1, wherein a parameter utilized in the comparison is one of the following:

a location area code, C1 value, C2 value, cell id, network time, transmission power, periodic location update frequency, cause code in location update termination and international mobile subscriber identity.

8. The method according to claim 1, wherein after a given alert a bearing is taken to the rogue base station for locating its geographical position.

9. The method according to claim 1, wherein the cellular network is a GSM network.

20. A computer readable medium encoded with instructions to perform any of the steps of claim 1, when executed by a computer

10. A mobile detecting apparatus comprising:

a receiver configured to receive a signaling message at least from one base station of a cellular network;

a processor configured to interpret the received signaling message;

a memory configured to save interpreted signaling parameters;

wherein the processor is configured to execute steps of a software program comprising computer readable code for searching for an anomaly in a received signaling message by comparing at least one signaling parameter of the received signaling message from a first base station to a known comparison parameter; and

an alarm unit configured to give an alert about a rogue base station if the comparison gives an unequal result concerning at least one signaling parameter.

11. The mobile detecting apparatus according to claim 10, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a broadcast control channel message against a comparison signaling parameter.

12. The mobile detecting apparatus according to claim 10, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a paging message against a comparison signaling parameter.

13. The mobile detecting apparatus according to claim 10, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a location update rejection message against a comparison signaling parameter.

14. The mobile detecting apparatus according to claim 10, wherein a signaling parameter utilized in the comparison is one of the following:

a location area code, C1 value, C2 value, cell id, network time, transmission power, periodic location update frequency, cause code in location update termination and international mobile subscriber identity.

15. The mobile detecting apparatus according to claim 10, wherein the apparatus further comprises a locating receiver for making location measurements the results of which are configured to be utilized as a further comparison parameter in the anomaly search.

16. The mobile detecting apparatus according to claim 15, wherein the apparatus further comprises a means for retrieving and showing a location of the mobile apparatus and base stations of the serving cellular network on a map display.

17. The mobile detecting apparatus according to any of the claim 10, wherein the apparatus is further configured to take a bearing towards a detected rogue base station.

18. The mobile detecting apparatus according to claim 17, wherein the apparatus is further configured to estimate a distance to the detected rogue base station either by utilizing a timing advance or transmission power of the rogue base station.

19. The mobile detecting apparatus according to claim 18, wherein the mobile apparatus is a mobile terminal of a GSM network.