System and Method for Faked Base Station Detection

• US 20160381545A1
• Filed: 06/21/2016
• Published: 12/29/2016
• Est. Priority Date: 06/26/2015
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: Qian, Jianying, Muhanna, Ahmad Shawky, Wang, Zhibi
• Granted Patent: US 9,867,039 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 60/04 using triggered events
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A system and method of detecting fake base stations. A first wireless device such as a user equipment (UE) or a base station (BS) may identify multiple parameters associated with a discovery signal transmitted by a second wireless device, the second wireless device advertising as a BS. The first wireless device may compare the multiple parameters with a set of parameters assigned to, or otherwise associated with, a cluster of neighboring BSs, and determine that the second wireless device is a fake BS when an inconsistency between the multiple parameters and the set of parameters associated with the cluster of neighboring BSs exceeds a threshold. The UE or the BS may also transmit the multiple parameters to a central controller, and the central controller may aggregate, correlate, and analyze the parameters, historical data, and other data from other sources associated with the second wireless device to determine whether the second wireless device is a fake BS.

Claims

1. A method for detecting fake base stations, the method comprising:

identifying, by a first wireless device, multiple parameters associated with a discovery signal transmitted by a second wireless device, the second wireless device advertising as a base station controller (BS);

comparing, by the first wireless device, the multiple parameters associated with the discovery signal transmitted by the second wireless device with a set of parameters assigned to, or otherwise associated with, a cluster of neighboring BSs; and

determining that the second wireless device is a fake BS when an inconsistency between the parameters associated with the discovery signal transmitted by the second wireless device and the set of parameters assigned to, or otherwise associated with, the cluster of neighboring BSs exceeds a threshold.

2. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

comparing a frequency band over which the discovery signal is transmitted with a set of frequency bands assigned to, or otherwise associated with, the cluster of neighboring BSs.

3. The method of claim 1, wherein the discovery signal identifies a location area code (LAC) or a cell identifier (CID) of the second wireless device, and wherein determining that the second wireless device is a fake BS comprises:

comparing the LAC or the CID of the second wireless devices with a set of LACs or a set of CIDs assigned to, or otherwise associated with, the cluster of neighboring BSs, respectively.

4. The method of claim 1, wherein the discovery signal identifies one or more BS capabilities of the second wireless device, and wherein determining that the second wireless device is a fake BS comprises:

comparing the one or more BS capabilities of the second wireless device with a set of BS capabilities associated with the cluster of neighboring BSs to determine whether or not the one or more BS capabilities of the second wireless device are inconsistent with BS capabilities of the cluster of neighboring BSs.

5. The method of claim 4, wherein the one or more BS capabilities of the second wireless device are inconsistent with the BS capabilities of the cluster of neighboring BSs when the second wireless device lacks a BS capability in the set of BS capabilities associated with the cluster of neighboring BSs.

6. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

comparing a network parameter identified in the discovery signal transmitted by the second wireless device with a set of network parameters associated with the cluster of neighboring BSs.

7. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

detecting a noise level of the discovery signal transmitted by the second wireless device; and

comparing the noise level of the discovery signal with a noise level of one or more signals transmitted by one or more BSs in the cluster of neighboring BSs in the absence of a fake BS.

8. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

scanning a neighborhood for a system information (SI) message broadcasted by the second wireless device and examining whether a valid neighboring cell list is included in the SI message.

9. The method of claim 1, wherein the first wireless device is a base station, a user equipment, or a network-side device configured to detect fake BSs.

10. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

detecting that a communications session between a mobile station and a base station controller (BS) in a wireless network is downgraded from a long-term evolution (LTE) or a Universal Mobile Telecommunications System (UMTS) connection to a Global System for Mobile Communications (GSM) connection.

11. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

detecting that an encrypted communications session between a mobile station and a base station is downgraded to an unencrypted communications session or a weak encryption algorithm that can be easily attacked.

12. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

comparing both a received power level of the discovery signal and a lifetime of the discovery signal with a signal power threshold and a signal duration threshold, respectively, the lifetime of the discovery signal corresponding to a period of time for which the discovery signal is capable of being detected by the first wireless device.

13. The method of claim 1, wherein determining that the second wireless device is a fake BS comprises:

comparing a number of customer complaints received at a customer service center during a predefined period of time with an average number of customer complaints.

14. A wireless communication device, comprising:

a processor; and

a non-transitory computer readable storage medium coupled to the processor and storing programming for execution by the processor, the programming including instructions to;

identify multiple parameters associated with a discovery signal transmitted by a second wireless device, the second wireless device advertising as a base station (BS);

compare the multiple parameters associated with the discovery signal transmitted by the second wireless device with a set of parameters assigned to, or otherwise associated with, a cluster of neighboring BSs; and

determine that the second wireless device is a fake BS when an inconsistency between the parameters associated with the discovery signal transmitted by the second wireless device and the set of parameters assigned to, or otherwise associated with, the cluster of neighboring BSs exceeds a threshold.

15. The wireless communication device of claim 14, wherein the instructions to determine that the second wireless device is a fake BS include instructions to:

compare a frequency band over which the discovery signal is transmitted with a set of frequency bands assigned to, or otherwise associated with, the cluster of neighboring BSs.

16. The wireless communication device of claim 14, wherein the discovery signal identifies a location area code (LAC) or a cell identifier (CID) of the second wireless device, and wherein the instructions to determine that the second wireless device is a fake BS include instructions to:

Compare the LAC or the CID of the second wireless devices with a set of LACs or a set of CIDs assigned to, or otherwise associated with, the cluster of neighboring BSs, respectively.

17. The wireless communication device of claim 14, wherein the discovery signal identifies one or more BS capabilities of the second wireless device, and wherein the instructions to determine that the second wireless device is a fake BS include instructions to:

compare the one or more BS capabilities of the second wireless device with a set of BS capabilities associated with the cluster of neighboring BSs to determine whether or not the one or more BS capabilities of the second wireless device are inconsistent with BS capabilities of the cluster of neighboring BSs.

18. The wireless communication device of claim 17, wherein the one or more BS capabilities of the second wireless device are inconsistent with the BS capabilities of the cluster of neighboring BSs when the second wireless device lacks a BS capability in the set of BS capabilities associated with the cluster of neighboring BSs.

19. The wireless communication device of claim 14, wherein the instructions to determine that the second wireless device is a fake BS include instructions to:

compare a network parameter identified in the discovery signal transmitted by the second wireless device with a set of network parameters associated with the cluster of neighboring BSs.

20. The wireless communication device of claim 14, and wherein the instructions to determine that the second wireless device is a fake BS include instructions to:

detect a noise level of the discovery signal transmitted by the second wireless device; and

compare the noise level of the discovery signal with a noise level of one or more signals transmitted by one or more BSs in the cluster of neighboring BSs in the absence of a fake BS.

21. A method for detecting fake base stations, the method comprising:

detecting, by a first wireless device, a discovery signal of a second wireless device, the second wireless device advertising as a base station controller (BSC);

determining, by the first wireless device, a power threshold and a minimum lifetime duration assigned to, or otherwise associated with, a cluster of neighboring BSCs; and

determining that the second wireless device is a faked base station when both a received power level of the discovery signal exceeds the power threshold and a lifetime of the discovery signal fails to exceed the minimum lifetime duration, the lifetime of the discovery signal corresponding to a period of time for which the discovery signal is capable of being detected by the first wireless device.

22. The method of claim 21, wherein determining the minimum lifetime duration the power threshold and the minimum lifetime duration assigned to, or otherwise associated with, the cluster of neighboring BSs comprises:

receiving a control signal from one of the BSCs, the control signal specifying the power threshold and the minimum lifetime duration.

23. The method of claim 21, wherein determining the minimum lifetime duration the power threshold and the minimum lifetime duration assigned to, or otherwise associated with, the cluster of neighboring BSs comprises:

detecting discovery signals of two or more BSCs in the cluster of BSCs;

determining the minimum lifetime duration according to lifetimes of the discovery signals; and

determining the power threshold according to received signal power levels of the discovery signals.

24. The method of claim 21, further comprising:

determining that the second wireless device is not a faked base station when either the received power level of the discovery signal fails to exceed the power threshold or the lifetime of the discovery signal exceeds the minimum lifetime duration.