Wireless communication network security method and system

• US 7,496,348 B2
• Filed: 06/07/2005
• Issued: 02/24/2009
• Est. Priority Date: 06/07/2005
• Status: Expired due to Fees

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Gonzalez, Jesus, Iskandar, Antoine S., Varghese, Jessy, Harris, John M., Srey, Lena
• Primary Examiner(s): Eisen; Alexander
• Assistant Examiner(s): LEE, JUSTIN YE
• Application Number:
  US11/146,822
• Publication Number:
  US 20060276173A1
• Time in Patent Office: 1,358 Days
• Field of Search: 455/410, 455/418, 455/419, 455/101, 455/92, 455/455
• US Class Current: 455/410
• CPC Class Codes: H04M 1/24 Arrangements for testing
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A security method (100) in a radio access network can include monitoring (102) (by either a base station controller or a mobile radio) for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names, notifying (104) of a specific abnormality detected, and receiving (108) access, conditional access or limited access based on the specific abnormality detected. The method can further include receiving updates (112) used for monitoring the abnormalities. The method can further include the optional step (106) of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected and suspending (110) one or more services based on the specific abnormality detected. The method can further include receiving (114) at the mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.

Claims

1. A radio access network security method, comprising the steps of:

monitoring for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names;

notifying of a specific abnormality detected via a wireless communication link;

receiving access, conditional access or limited access via the wireless communication link based on the specific abnormality detected; and

suspending packet data services at a mobile radio upon detection of a malicious software routine in the mobile radio while continuing to enable voice or circuit data calls.

2. The method of claim 1, wherein the method further comprises the step of receiving updates used for monitoring the one or more abnormalities.

3. The method of claim 1, wherein the method further comprises the step of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected.

4. The method of claim 3, wherein the method further comprises the step of suspending one or more services being provided to the mobile radio based on the specific abnormality detected.

5. The method of claim 1, wherein the method further comprises the step of issuing a notification from a mobile radio and receiving a response from a base station controller causing the mobile radio to perform one of the functions among suspending data services, suspending data services and voice services, canceling suspension of data services, and canceling suspension of data services and voice services.

6. The method of claim 1, wherein the method further comprises the step of receiving at a mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.

7. The method of claim 1, wherein a base station controller monitors for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names and initiates a suspension of service upon the detection of one or more abnormalities.

8. The method of claim 1, wherein the method further comprises the step of isolating a mobile radio operating system from an air interface layer.

9. The method of claim 1, wherein the method further comprises the step of preventing denial of service attacks by monitoring behavior of mobile radios in communication with the radio access network and flagging the specific abnormality detected.

10. The method of claim 1, wherein the method further comprises the step of alerting other mobile radios nearby the mobile radio with the abnormality and causing the other mobile radios to increase a security level or run virus software.

11. The method of claim 1, wherein the method further comprises the step of causing the mobile radio to enter an unslotted mode.

12. A radio access network security system, comprising:

a transceiver;

a processor coupled to the transceiver, wherein the processor is programmed to;

monitor for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names;

notify of a specific abnormality detected among the one or more abnormalities via a wireless communication link;

receive access, conditional access or limited access via the wireless communication link based on the specific abnormality detected; and

suspend packet data services at a mobile radio upon detection of a malicious software routine in the mobile radio while continuing to enable voice or circuit data calls.

13. The system of claim 12, wherein the processor is further programmed to receive updates used for monitoring the one or more abnormalities.

14. The system of claim 12, wherein the system comprises a mobile radio that is programmed to issue a notification from the mobile radio to a base station controller if the specific abnormality is detected and the system performs at least one among the functions of:

disabling an infected service for a predetermined amount of time,

refusing a resource assignment for a flagged application,

redirecting the mobile radio to an analog service, instructing other geographically nearby mobile radios to increase their security level,

instructing other geographically nearby mobile radios to run virus software,

preventing peer-to-peer communications,

preventing access to a mobile radio'"'"'s address book by other normally trustworthy appearing wireless devices,

increasing security levels at mobile radios in recent communication with the mobile radio or that are in the mobile radio'"'"'s address book, buddy list or recent call list,

instructing the mobile radio to enter into a battery draining mode, or

instructing the mobile radio to enter a location finding mode.

15. The system of claim 14, wherein the system is further programmed to suspend one or more services being provided to the mobile radio based on the specific abnormality detected.

16. The system of claim 12, wherein the system is further programmed to issue a notification from a mobile radio and receive a response from a base station controller causing the mobile radio to perform one of the functions among suspending data services, suspending data services and voice services, canceling suspension of data services, and canceling suspension of data services and voice services.

17. The system of claim 12, wherein the system is further programmed to receive at a mobile radio an over the air programming instruction to suspend a specific service and alert the mobile radio.

18. The system of claim 12, wherein one among a mobile radio and a base station controller monitors for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names and initiates a suspension of service upon the detection of one or more abnormalities.