METHOD, APPARATUS AND RELATED COMPUTER PROGRAM FOR DETECTING CHANGES TO A NETWORK CONNECTION

• US 20120250658A1
• Filed: 12/15/2009
• Published: 10/04/2012
• Est. Priority Date: 12/15/2009
• Status: Abandoned Application

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Eisl, Jochen, Abendroth, Joerg, Mustajarvi, Jari Pekka
• Application Number:
  US13/515,335
• Publication Number:
  US 20120250658A1
• Time in Patent Office: Days
• US Class Current: 370/331
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 24/04 Arrangements for maintaining operational condition

Abstract

A method, a device, and a computer program product detect changes to the connection of a device, such as a mobile device to a network, and initiate at least one measure when changes are detected. Changes might be caused by malicious users or malicious mobile phone SW in order to perform Denial of Service (DoS) attacks to the network. Those changes could be, for example, frequent handover actions, frequent attach/detach actions or frequent Packet Data Protocol context activation, deactivation or modification actions initiated by a mobile device or a group of mobile devices. The changes to the connection are detected by checking if parameters related to the mobile device, or related to network elements, violate defined policy rules. The detection itself is done in a network element, such as a core network element.

Claims

1. A method for detecting changes to a connection of a mobile device to a network, whereby the detecting comprises determining if at least one-parameter related to the mobile device or related to the network is violating a policy rule related to the changes, and,

if it is determined that a policy rule is violated,. initiating at least one measure, wherein the changes to the connection are frequent handover actions.

6. The method of claim 1, wherein the at least one parameter related to the mobile device contains

number of completed handover actions of the mobile device, or

duration of the last connection of the mobile device to the network, or

number of connection changes to a network of the mobile device.

7. The method of claim 1, wherein the at least one parameter related to the network contains

number of completed handover actions in the network, or

number of completed handover actions in a part of the network, or

number of completed handover actions originated in at least one specific cell of the network, or

number of completed handover actions originated in the network, or

number of completed handover actions targeted to at least one specific cell of the network, or

number of completed handover actions targeted to the network.

12. The method of claim 1, wherein the policy rule is configurable and specific for the at least one parameter.

13. The method of claim 1, wherein different policy rules can be configured for different mobile devices, or different groups of mobile devices, or different groups of mobile users, or different parts of the network.

14. The method of claim 1, wherein the policy rule is violated if a threshold for the at least one parameter is passed within a defined period of time.

18. The method of claim 1, wherein the detecting comprises correlating at least one of the determination results and the selected parameters of at least two mobile devices.

19. The method of claim 1, wherein the at least one measure is one of

blocking access to the network of the mobile device, or

rejecting further attach or detach or handover requests of the mobile device, or

rejecting further Packet Data Protocol context activation, deactivation or modification requests of the mobile device, or

rejecting further changes requested to at least one parameter of the connection of the mobile device, or

constraining a list of available access networks to the mobile device, or

modifying at least one policy rule used to detect the changes to the connection of the mobile device, or

blocking network access for at least one application running on the mobile device.

20. The method of claim 19, wherein the at least one measure is only taken for a specific time.

21. The method of claim 1, wherein the at least one measure is one of

sending a message to the mobile device and inform a user about the detected frequent changes to the connection, or

sending a message to the mobile device asking for re-configuration of an access selection policy of the mobile device, or

informing a network management system.

44. A computer program embodied on a non-transitory computer-readable medium, comprising code for controlling a processor to perform the method according to claim 1.

2-5. -5. (canceled)

8-11. -11. (canceled)

15-17. -17. (canceled)

22. An apparatus for detecting changes to a connection of a mobile device to a network, the apparatus comprising:

a determining block configured to determine if at least one parameter related to the mobile device or related to the network is violating a policy rule related to the changes, and

a measure block configured to initiate at least one measure if a policy rule is violated wherein the changes to the connection are frequent handover actions.

27. The apparatus of claim 22, wherein the at least one parameter related to the mobile device contains

number of completed handover actions of the mobile device, or

duration of the last connection of the mobile device to the network, or

number of connection changes to a network of the mobile device.

28. The apparatus of claim 22, wherein the at least one parameter related to the network contains

number of completed handover actions in the network, or

number of completed handover actions in a part of the network, or

number of completed handover actions originated in at least one specific cell of the network, or

number of completed handover actions originated in the network, or

number of completed handover actions targeted to at least one specific cell of the network, or

number of completed handover actions targeted to the network.

34. The apparatus of claim 22, wherein the policy rule is configurable and specific for the at least one parameter.

35. The apparatus of claim 22, wherein different policy rules can be configured for different mobile devices, different groups of mobile devices, different groups of mobile users, or different parts of the network.

36. The apparatus of claim 22, wherein the detecting block determines that the policy rule is violated if a threshold for the at least one parameter is passed within a defined period of time.

37. The apparatus of claim 22, further comprising correlating at least one of determination results and selected parameters of at least two mobile devices.

38. The apparatus of claim 22, wherein the at least one measure is one of

blocking access to the network of the mobile device, or

rejecting further attach or detach or handover requests of the mobile device, or

rejecting further Packet Data Protocol context activation, deactivation or modification requests of the mobile device, or

rejecting further changes requested to at least one parameter of the connection of the mobile device, or

constraining a list of available access networks to the mobile device, or

modifying at least one policy rule used to detect the changes to the connection of the mobile device, or

blocking network access for at least one application running on the mobile device.

39. The apparatus of claim 38, wherein the at least one measure is only taken for a specific time.

40. The apparatus of claim 22, wherein the at least one measure is one of

sending a message to the mobile device and inform a user about the detected changes to the connection, or

sending a message to the mobile device asking for re-configuration of an access selection policy of the mobile device, or

informing a network management system.

42. The apparatus of claim 22, wherein the changes to the connection are performed between at least two heterogeneous access networks.

43. The apparatus of claim 22, wherein the apparatus comprises one of a Policy and Charging Rules Function or a Packet Data Network Gateway or a Serving GPRS Support Node or a Mobility Management Entity or an evolved Packet Data Gateway.

23-26. -26. (canceled)

29-33. -33. (canceled)

41. (canceled)

45. (canceled)