DETECTION AND SUPPRESSION OF SHORT MESSAGE SERVICE DENIAL OF SERVICE ATTACKS

• US 20100050255A1
• Filed: 08/20/2008
• Published: 02/25/2010
• Est. Priority Date: 08/20/2008
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: WILSON, PATRICK DAVID, HALDAR, DEBASHIS, ROUTT, WILLIAM JAMES, UPADHYAY, PIYUSH, WITZGALL, JOHN CHANDLER
• Granted Patent: US 8,255,994 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A method, system, and medium are provided for suppressing a Short Message Service (SMS) induced Denial of Service (DoS) attack on a telecommunications network. A register is updated to include information relevant to SMS messages that are requested to be communicated by way of a wireless telecommunications network. The register includes information of the location where the target devices of SMS messages are located. The register is utilized to detect an SMS induced DoS attack. A trigger is communicated to an SMS router to enable a DoS mode that restricts the communication of SMS messages. In an exemplary embodiment, only those SMS messages identified as part of the DoS attack are restricted.

Claims

1. A method for suppressing a Short Message Service (SMS) induced Denial of Service (DoS) attack on a telecommunications network, the method comprising:

receiving at a register a target device identifier and an originating source identifier associated with an SMS message;

requesting, from the register, a location of a target device associated with the target device identifier;

receiving at the register, the location of the target device;

updating the register to include the location of the target device;

determining a quantity of SMS message requests within a predefined time frame; and

communicating a trigger to an SMS router to enter into a DoS mode, wherein the trigger is communicated because the determined quantity of SMS message requests exceeds a predefined SMS request threshold.

2. The method of claim 1, wherein the telecommunications network is compatible with a wireless technology wherein the wireless technology is selected from a group including wireless technologies in the Third Generation Partnership Project (3GPP), Third Generation Partnership Project 2 (3GPP2), IEEE 802.16, and IEEE 802.11.

3. The method of claim 1, wherein the target device is a mobile communications device.

4. The method of claim 1, wherein the originating source identifier or the target device identifier is compatible with one from the following list:

(1) International Mobile Equipment Identity (IMEI);

(2) Mobile Subscriber Integrated Services Digital Network Number (MSISDNN);

(3) International Mobile Subscriber Identity (IMSI);

(4) Electronic Serial Number (ESN);

(5) Internet Protocol (IP) address;

(6) Media Access Control (MAC) address; and

(7) Phone Number.

5. The method of claim 1, wherein the target device location is received from either a Home Location Register (HLR) or a Visitor Location Register (VLR).

6. The method of claim 1, wherein the location is described by at least one from the following:

(1) Sector;

(2) Base Station;

(3) Node B;

(4) Transceiver; and

(5) Geographic Coordinates.

7. The method of claim 1 further comprising communicating a second trigger to the SMS router because the determined quantity of SMS message requests exceeds a predefined SMS request threshold for a predefined time period.

8. The method of claim 1 further comprising communicating a release trigger to the SMS router because the determined quantity of SMS message requests is below a predefined SMS request threshold.

9. One or more computer-storage media having computer-executable instructions embodied thereon for performing a method for suppressing a Short Message Service (SMS) induced Denial of Service (DoS) attack on a telecommunications network, the method comprising:

receiving at an SMS router an SMS message from an originating source, wherein the SMS message includes delivery information;

communicating, from the SMS router, the delivery information to a register;

receiving from the register a DoS mode trigger; and

enabling a DoS mode, wherein the DoS mode allows the SMS router to restrict communication of SMS messages by way of the SMS router.

10. The media of claim 9, wherein the telecommunications network is compatible with a wireless technology wherein the wireless technology is selected from a group including wireless technologies in the Third Generation Partnership Project (3GPP), Third Generation Partnership Project 2 (3GPP2), IEEE 802.16, and IEEE 802.11.

11. The media of claim 9, wherein the originating source is at least one from the following:

(1) Mobile Communications Device;

(2) Computing Device;

(3) Alert Service; and

(4) User Interface for Communicating SMS Messages.

12. The media of claim 9, wherein the delivery information includes at least one from the following:

(1) Time of the request;

(2) Target Device Identifier;

(3) Originating Source Identifier; and

(4) Priority Level.

13. The media of claim 9, wherein the register is a data table that is accessible by way of the telecommunications network.

14. The media of claim 13, wherein the register is associated with the SMS router by way of a communications pathway.

15. The media of claim 9, wherein the DoS mode trigger is received because a predefined quantity of SMS message requests were received by the SMS router within a predefined time frame.

16. The media of claim 15, wherein the predefined quantity of SMS message requests are from a common originating source.

17. The media of claim 9 wherein the DoS mode limits the communication from the SMS router of SMS message requests associated with one or more specified originating source identifiers.

18. The media of claim 17, wherein the DoS mode limits the communication includes preventing the communication of the SMS message request.

19. The media of claim 17, wherein the DoS mode limits the communication includes queuing the SMS message request to be communicated over a predefined time frame.

20. A system for suppressing a Short Message Service (SMS) induced Denial of Service (DoS) attack on a telecommunications network, the system comprising:

an SMS router that operates in a DoS mode upon receiving a trigger;

at least one computing device that operates with at least one processor and at least one computer-storage media, wherein the at least one computing device communicates with a register that maintains delivery data associated with one or more SMS messages communicated by way of the SMS router, wherein the at least one computing device communicates the trigger upon determining the SMS router is to operate in the DoS mode; and

a Home Location Register (HLR) that provides mobile device information of one or more mobile devices to the at least one computing device, wherein the mobile device information is utilized by the at least one computing device to populate at least a portion of the data maintained in the register.