SMS Fraud Detection

• US 20160174077A1
• Filed: 05/13/2014
• Published: 06/16/2016
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: Markport Limited (Mavenir Group Holdings Ltd.)
• Original Assignee: Markport Limited (Mavenir Group Holdings Ltd.)
• Inventors: ABRAMOV, Ilia, PETRILAK, Tomas, SCRIPCARU, Victor
• Granted Patent: US 9,661,502 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

A receiving network detects fraudulent messages received via a grey route. At a start of a session, a message delivery request is sent to a Short Message Service (SMS) node in the receiving network. This sends a request to a Home Location Register (HLR) of a supposedly originating network for routing information concerning an originator. Upon receiving a response from the HLR, it requests validation of retrieved information, to validate both the originator and the originating network. The SMS node also makes an HLR look-up for a recipient, before performing message delivery.

Claims

1. A method performed by a receiving home Public Land Mobile Network (PLMN) including a receiving node, the method comprising the steps of:

said receiving node receiving from a foreign source node in a foreign PLMN, a delivery request for a message having an originator and a recipient; and

said receiving node extracting from said delivery request, an extracted originator address of said originator and a foreign source node address of said foreign source node, and performing validation steps of;

(a) querying a foreign location register having a foreign location register address, to determine a register-provided originator address of said originator, and validating existence and availability of said extracted originator address by comparing said extracted originator address with said register-provided originator address; and

(b) verifying association of said foreign source node with said foreign location register by comparing said foreign location register address with said foreign source node address,

wherein said validation steps (a) and (b) are performed before attempting to perform tasks for delivery of the message.

5. The method of claim 1, wherein said validation step (b) includes identifying said foreign location register address according to SCCP CgPa GT address digits of said foreign location register.

6. The method of claim 5, wherein said validation step (b) uses said digits to compare said addresses of said foreign location register and said foreign source node.

7. The method of claim 6, wherein a configurable sub-set of said digits are used in said comparison of said addresses of said foreign location register and said foreign source node.

8. The method of claim 1, wherein said validation step (b) includes comparing SCCP CgPa GT address digits of said foreign location register address against SCCP CgPa GT address digits of said foreign source node address.

9. The method of claim 1, wherein said validation step (b) includes comparing SCCP CgPa GT address digits of said foreign location register address against GSM MAP Service Centre originating address digits of said foreign source node.

10. The method of claim 1, wherein said delivery request uses a protocol selected from the group consisting of SS7 ande SMPP.

11. The method of claim 1, wherein for said step (a) said delivery request is an MT message received by said receiving node over SMPP links, said extracted originator address is an originator MSISDN, and validity of said originator MSISDN and its association with a source network is checked by performing a SRI-for-SM operation for said originator MSISDN.

12. The method of claim 11, wherein said SRI-for-SM operation is performed towards a database, and upon completion of said SRI-for-SM operation a further validity check is performed.

2-4. -4. (canceled)

13. A group of mobile network nodes comprising digital data processors and ports for transmitting and receiving data, and being programmed to reside in a home network and perform steps of:

receiving from a foreign source node in a foreign PLMN, a delivery request for a message having an originator and a recipient;

extracting from said delivery request, an extracted originator address of said originator and a foreign source node address of said foreign source node; and

performing validation steps of;

(a) querying a foreign location register having a foreign location register address to determine a register-provided originator address of said originator, and validating existence and availability of said extracted originator address by comparing said extracted originator address with said register-provided originator address; and

(b) verifying association of said foreign source node with said foreign location register by comparing said foreign location register address with said foreign source node address,

wherein said validation steps (a) and (b) are performed before attempting to perform tasks for delivery of the message.