METHODS, SYSTEMS, AND COMPUTER READABLE MEDIA FOR DETECTION OF AN UNAUTHORIZED SERVICE MESSAGE IN A NETWORK

• US 20100105355A1
• Filed: 10/19/2009
• Published: 04/29/2010
• Est. Priority Date: 10/17/2008
• Status: Active Grant

• Current Assignee: ZephyrTel, Inc.
• Original Assignee: Newnet Communication Technologies B.V.
• Inventors: Nooren, Eloy Johan Lambertus
• Granted Patent: US 8,326,265 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

A method is described for detecting an unauthorized service message in a communications network. The method comprising the steps of: receiving a signaling message associated with a supplementary service (SS) message and/or a unstructured supplementary service data (USSD) message from a first network node, the signaling message comprising identification information of the sender of the SS message and/or USSD message and first location information of the first network node; requesting second location information of the first network node from the a second network node serving the sender of the SS message and/or USSD message; and, comparing the first location information with the second location information in order to determine whether the SS message and/or USSD message is authorized or not.

Claims

1. A method for detecting an unauthorized service message in a communications network, the method comprising the steps of:

at a supplementary services network routing node, at least a portion of which is implemented in hardware;

receiving a signaling message associated with a supplementary service (SS) message or a unstructured supplementary service data (USSD) message identifying a first network node as a node serving a sender of the SS or USSD message, the signaling message comprising identification information of the sender of the SS or USSD message and first identification information of the first network node;

requesting, from a second network node, identification information identifying a network node serving the sender of the SS or USSD message; and

comparing the first identification information with the second identification information in order to determine whether the SS or USSD message is authorized or not.

2. The method of claim 1 wherein requesting from a second network node, identification information of the sender of the SS or USSD message comprises sending a MAP message comprising a subscriber identity as a request parameter to the second network node.

3. The method of claim 2 wherein the MAP message comprises a MAP AnyTimeInterrogation and wherein an address is received from the second network node in response to the AnyTimeInterrogation message.

4. The method of claim 3 comprising sending the signaling message to the second network node if an address associated with the first network node in the first identification information is equal to the address of the first network node received from the second network node.

5. The method of claim 1 wherein requesting, from the second network node, identification of the sender of the SS or USSD message comprises sending a MAP SendRoutingInfoForSM message to the second network node and receiving from the second network node an address associated with the first network node.

6. The method of claim 5 comprising sending the signaling message to the second network node if the first N digits of an address associated with the first network node in the first identification information is equal to the first N digits of the address received from the second network node.

7. The method of claim 1 wherein the first network node comprises a Visitor Location Register (VLR) and the second network node comprises a Home Location Register (HLR).

8. A network node comprising a router for routing supplementary service (SS) messages or unstructured supplementary service data (USSD) messages, the network node comprising:

a receiver for receiving a signaling message associated with an SS message or USSD message, the signaling message comprising identification information of the sender of the SS or USSD message and first identification information identifying a first network node as a node serving the sender of the SS or USSD message;

a serving node request unit for requesting, from a second network node, second identification information identifying a network node serving the sender of the SS or USSD message;

a comparator for comparing the first identification information with the second identification information in order to determine whether the SS or USSD message is authorized or not.

9. The network node of claim 8 comprising means for sending the signaling message to the second network node if the SS or USSD message is an authorized message.

10. The network node of claim 8 wherein the serving node request unit is configured to send an AnyTimeInterrogation message to the second network node to obtain the second identification information.

11. The network node of claim 8 wherein the serving node request unit is configured to send a MAP SendRoutingInfoForSM message to the second network node to determine the second identification information.

12. The network node of claim 8 wherein the first network node comprises a visitor location register (VLR) and the second network node comprises a home location register (HLR).

13. The network node of claim 8 wherein the comparator is configured to identify the signaling message as being a spoofed message in response to determining that the first and second location information identifies different nodes.

14. The network of claim 8 wherein, in response to identifying the signaling message as a spoofed message, the comparator is configured to instruct the receiver to discard the signaling message.

15. A network node for detecting spoofing of service messages, the network node comprising:

a receiver for receiving a signaling message associated with a service message, the signaling message including identification information of a sender of the service message and first identification information identifying a first network node as a node serving the sender of the service message;

a serving node request unit for requesting, from a second network node, second identification information identifying a network node serving the sender of the service message; and

a comparator for comparing the first identification information with a second identification information in order to determine whether the service message is authorized or not.

16. The network node of claim 15 wherein the receiver receives signaling message after it has been intercepted and diverted by a proxy.

17. The network node of claim 16 wherein the proxy comprises a signal transfer point configured to screen mobile application part (MAP) signaling messages.

18. The network node of claim 15 wherein the service message comprises a supplementary service (SS) or unstructured supplementary service data (USSD) message.

19. The network node of claim 15 wherein the service message comprises a session initiation protocol (SIP) message.

20. A computer readable medium having stored thereon executable instructions that when executed by the processor of a computer control the computer to perform the steps comprising:

receiving a signaling message associated with a supplementary service (SS) message or a unstructured supplementary service data (USSD) message identifying a first network node as a node serving a sender of the SS or USSD message, the signaling message comprising identification information of the sender of the SS or USSD message and first identification information of the first network node;

requesting, from a second network node, identification information identifying a network node serving the sender of the SS or USSD message; and

comparing the first identification information with the second identification information in order to determine whether the SS or USSD message is authorized or not.