Method of checking amount of transmitted data

• US 7,366,496 B2
• Filed: 02/20/2001
• Issued: 04/29/2008
• Est. Priority Date: 02/22/2000
• Status: Expired due to Term

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Niemi, Valtteri, Vialen, Jukka
• Primary Examiner(s): LY, ANH VU H
• Application Number:
  US09/958,301
• Publication Number:
  US 20020159444A1
• Time in Patent Office: 2,625 Days
• Field of Search: 370/231, 370/232, 370/235, 370/236, 370/252, 370/278, 370/310.2, 370/328, 370/338, 370/389, 370/394, 455/405, 455/406, 455/410, 455/411
• US Class Current: 455/410
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

During a connection between a network infrastructure and user equipment a first indication of the amount of data transmitted over the connection is maintained in the network infrastructure and a second indication of the amount data transmitted is maintained in the user equipment. A checking procedure is triggered in response to encountering a predetermined checking value. The checking procedure utilizes integrity protected signalling. During the checking procedure the first indication is compared with the second indication.

Claims

1. A method, comprising:

maintaining in a network infrastructure a first indication of an amount of data transmitted over a connection in a communication system;

maintaining in an apparatus a second indication of the amount of data transmitted over the connection;

triggering, in response to encountering a predetermined checking value, a checking procedure to find out whether or not the connection is used by an intruder, the checking procedure utilizing integrity protected signalling messages and the first and second indications;

transmitting at least one of the first and second indications in an integrity protected signalling message during the checking procedure between the apparatus and the network infrastructure;

verifying the integrity of the integrity protected signalling message; and

comparing, in response to the integrity being verified, the first indication with the second indication during the checking procedure.

2. A method according to claim 1, the method further comprising:

continuing the connection and the maintenance of the first indication and the second indication if the first indication and the second indication are the same.

3. A method according to claim 2, the method further comprising:

triggering the checking procedure in the network infrastructure;

sending the first indication to the apparatus;

comparing the first indication with the second indication in the apparatus; and

if the first indication and the second indication are not the same;

sending the second indication from the apparatus to the network infrastructure;

rechecking the first indication;

comparing the rechecked first indication with the received second indication; and

releasing the connection if the rechecked first indication and the received second indication are not the same.

4. A method according to claim 2, the method further comprising:

triggering the checking procedure in the network infrastructure;

sending the first indication to the apparatus;

comparing the first indication with the second indication in the apparatus; and

if the first indication and the second indication are not the same;

sending the second indication from the apparatus to the network infrastructure;

rechecking the first indication;

comparing the rechecked first indication with the received second indication; and

if the rechecked first indication and the received second indication are not the same;

checking if a difference between the rechecked first indication and the received second indication is acceptable; and

releasing the connection only if the difference is not acceptable.

5. A method according to claim 4, the method further comprising:

decreasing the checking value if the difference between the rechecked first indication and the received second indication is acceptable.

6. A method according to claim 2, the method further comprising:

triggering the checking procedure in the apparatus;

sending the second indication to the network infrastructure;

comparing the first indication with the second indication in the network infrastructure; and

if the first indication and the second indication are not the same;

sending the first indication from the network infrastructure to the apparatus;

rechecking the second indication;

comparing the rechecked second indication with the received first indication; and

releasing the connection if the rechecked second indication and the received first indication are not the same.

7. A method according to claim 2, the method further comprising:

triggering the checking procedure in the apparatus;

sending the second indication to the network infrastructure;

comparing the first indication with the second indication in the network infrastructure; and

if the first indication and the second indication are not the same;

sending the first indication from the network infrastructure to the apparatus;

rechecking the second indication;

comparing the rechecked second indication with the received first indication; and

if the rechecked second indication and the received first indication are not the same, the method further comprises;

checking if a difference between the rechecked second indication and the received first indication is acceptable; and

releasing the connection only if the difference is not acceptable.

8. A method according to claim 6, the method further comprising:

waiting, in the apparatus, a predetermined time for a message from the network infrastructure, the message containing the first indication; and

triggering the checking procedure in apparatus only if the message is not received within the predetermined time.

9. A method according to claim 1, wherein the predetermined checking value determines the amount of data transmitted between two checking procedures in succession.

10. A method according to claim 1, wherein the predetermined checking value determines the number of data packets transmitted between two checking procedures in succession.

11. A method according to claim 1, wherein the predetermined checking value determines a time interval between two checking procedures in succession.

12. A method according to claim 1, wherein the apparatus is one of the group of user equipment and a network node.

13. A communication system comprising:

a network infrastructure;

at least one apparatus; and

a connection established between the apparatus and the network infrastructure;

wherein

the network infrastructure is configured to maintain a first indication of the amount of data transmitted over the connection;

the apparatus is configured to maintain a second indication of the amount of data transmitted over the connection; and

the network infrastructure is configured to trigger, in response to encountering a predetermined checking value, a checking procedure to find out whether or not the connection is used by an intruder, the checking procedure utilizing integrity protected signalling messages and the first and second indications, to transmit during the checking procedure at least one of the indications in an integrity protected signalling message between the apparatus and the network infrastructure;

to verify the integrity of integrity protected signalling message; and

in response to the integrity being verified to compare the first indication with the second indication during the checking procedure.

14. A system according to claim 13, wherein the network infrastructure is configured, on the basis of the comparison, to deduce whether or not to release the connection.

15. A system according to claim 13, wherein

the network infrastructure is configured to trigger the checking procedure by sending the first indication to the apparatus in response to encountering the predetermined checking value;

and to deduce on the basis of a response received from the apparatus whether or not to release the connection; and

the apparatus is configured in response to receiving the first indication to compare the first indication with the second indication; and

send a response indicating a comparison result to the network infrastructure.

16. A system according to claim 13, wherein

the apparatus is configured to trigger the checking procedure by sending the second indication to the network infrastructure in response to encountering the predetermined checking value;

and to deduce on the basis of a response received from the network infrastructure whether or not to release the connection; and

the network infrastructure is configured in response to receiving the second indication to compare the first indication with the second indication; and

send a response indicating a comparison result to the apparatus.

17. A system according to claim 16, wherein the apparatus is configured to wait a predefined time for a message from the network infrastructure, the message containing the first indication in response to encountering the predetermined checking value;

and to send the second indication to the network infrastructure only if no message is received during the predefined time.

18. A system according to claim 13, wherein if the first indication and the second indication are not the same, the system is configured to recompare the indications and on the basis of the recomparison to deduce whether or not to release the connection.

19. A system according to claim 13, wherein:

the network infrastructure is configured to maintain a first counter value indicating the amount of data transmitted and the first indication indicates the first counter value indirectly;

the apparatus is configured to maintain a second counter value indicating the amount of data transmitted and the second indication indicates the second counter value indirectly; and

if the first indication and the second indication are not the same, the network infrastructure is configured to compare the first counter value with the second counter value and on the basis of this comparison to deduce whether or not to release the connection.

20. A system according to claim 13, wherein the apparatus is one of the group of user equipment and a network node.