Systems and methods for protocol-based identification of rogue base stations

• US 9,525,994 B2
• Filed: 10/30/2014
• Issued: 12/20/2016
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Goldfarb, Eithan
• Primary Examiner(s): SAMS, MATTHEW C
• Application Number:
  US14/527,891
• Publication Number:
  US 20150140997A1
• Time in Patent Office: 782 Days
• US Class Current: 1/1
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 60/04 using triggered events
• CPC Class Codes: H04W 8/02 Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A rogue base station detection system that establishes a communication session with a suspected base station, and verifies whether the base station is rogue or innocent by testing which advanced communication features are supported by the base station. The detection system holds a definition of one or more communication features that are supported by innocent base stations and not by rogue base stations. During a communication session with a suspected base station, the detection system requests the base station to activate these communication features. If the base station does not support the features in question, it is likely to be rogue.

Claims

1. A method, comprising:

predefining at least one communication feature that, when supported by a base station indicates that the base station is innocent and when not supported by the base station indicates that the base station is suspected of being rogue;

establishing a communication session with a suspected base station;

during the communication session, requesting the base station to perform the predefined communication feature; and

classifying the suspected base station as innocent or rogue depending on whether the suspected base station performs the requested communication feature, wherein classifying the suspected base station comprises deciding that the suspected base station is rogue in response to detecting that the suspected base station is unable to perform the requested communication feature.

2. The method according to claim 1, wherein the at least one communication feature comprises a plurality of communication features, and comprising sequentially requesting the base station to perform the communication features in the plurality.

3. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to provide a data service.

4. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to activate frequency hopping.

5. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to carry out a call setup signaling process.

6. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to accept an incoming call.

7. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to perform a hand-over process.

8. The method according to claim 1, wherein requesting the base station to perform the communication feature comprises requesting the base station to activate an Unstructured Supplementary Service Data (USSD) feature.

9. The method according to claim 1, and comprising scanning a plurality of base stations so as to construct a list of suspected base stations, and establishing communication sessions and classifying each of the suspected base stations on the list.

10. Apparatus, comprising:

a transmitter and a receiver, which are configured to communicate with one or more base stations; and

a processor, which is configured to predefine at least one communication feature that, when supported by a base station indicates that the base station is innocent and when not supported by the base station indicates that the base station is suspected of being rogue, to establish a communication session with a suspected base station, to request the base station, during the communication session, to perform the predefined communication feature, and to classify the suspected base station as innocent or rogue depending on whether the suspected base station performs the requested communication feature, wherein the processor is configured to decide that the suspected base station is rogue in response to detecting that the suspected base station is unable to perform the requested communication feature.

11. The apparatus according to claim 10, wherein the at least one communication feature comprises a plurality of communication features, and wherein the processor is configured to sequentially request the base station to perform the communication features in the plurality.

12. The apparatus according to claim 10, wherein the processor is configured to request the base station to provide a data service.

13. The apparatus according to claim 10, wherein the processor is configured to request the base station to activate frequency hopping.

14. The apparatus according to claim 10, wherein the processor is configured to request the base station to carry out a call setup signaling process.

15. The apparatus according to claim 10, wherein the processor is configured to request the base station to accept an incoming call.

16. The apparatus according to claim 10, wherein the processor is configured to request the base station to perform a hand-over process.

17. The apparatus according to claim 10, wherein the processor is configured to request the base station to activate an Unstructured Supplementary Service Data (US SD) feature.

18. The apparatus according to claim 10, wherein the processor is configured to scan a plurality of base stations so as to construct a list of suspected base stations, and to establish communication sessions and classify each of the suspected base stations on the list.