Methods, systems, and computer readable media for providing diameter signaling router with firewall functionality

• US 9,647,986 B2
• Filed: 12/16/2013
• Issued: 05/09/2017
• Est. Priority Date: 10/16/2009
• Status: Active Grant

• Current Assignee: Tekelec
• Original Assignee: Tekelec
• Inventors: McCann, Thomas Matthew, Marsico, Peter Joseph
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US14/107,818
• Publication Number:
  US 20140181952A1
• Time in Patent Office: 1,240 Days
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

According to one aspect, the subject matter described herein includes a system for Diameter routing and firewall filtering. The system includes a Diameter signaling router comprising a network interface for receiving, from a first Diameter node, a first Diameter message having Diameter information. The Diameter signaling router also includes a firewall module for determining whether the first Diameter message satisfies a firewall policy. The firewall policy is based on at least a portion of the Diameter information in the first Diameter message. The Diameter signaling router further includes a routing module for forwarding at least a portion of the first Diameter message towards a second Diameter node in response to the first Diameter message satisfying the firewall policy.

Claims

1. A system for Diameter routing and firewall filtering, the system comprising:

a Diameter signaling router, comprising;

a network interface for receiving a plurality of Diameter messages, wherein receiving the plurality of Diameter messages includes receiving, from a first Diameter node, a first Diameter message having Diameter information;

a firewall module implemented using computing hardware within the Diameter signaling router, wherein the firewall module is configured to determine whether the first Diameter message satisfies a firewall policy, wherein the firewall policy includes a rule for examining a Diameter level parameter in the first Diameter message, wherein the rule specifies a whitelist or blacklist associated with the Diameter level parameter usable by the firewall module of the Diameter signaling router to determine whether the first Diameter message should be allowed to be forwarded; and

a routing module implemented using the computing hardware, wherein the routing module is configured to forward at least a portion of the first Diameter message towards a second Diameter node in response to the determination by the firewall module of the Diameter signaling router that the first Diameter message should be allowed to be forwarded.

2. The system of claim 1 wherein the Diameter signaling router includes a mitigation module implemented using the computing hardware, wherein the mitigation module is configured to perform a mitigating action in response to the first Diameter message failing to satisfy the firewall policy.

3. The system of claim 2 wherein the mitigating action includes at least one of:

discarding the first Diameter message, generating an error code, generating an error message, communicating an error message to the first Diameter node, generating an event record, generating a log entry, modifying the first Diameter message, generating a second Diameter message based on the first Diameter message;

modifying the Diameter information in the first Diameter message, modifying the first Diameter message to satisfy the firewall policy, triggering network address translation (NAT) processing for a Diameter message, triggering the routing module to handle the modified first Diameter message, triggering the routing module to handle the second Diameter message, and notifying an entity.

4. The system of claim 1 wherein the firewall module includes a network address translation (NAT) module configured to perform network address translation (NAT) processing on the first Diameter message.

5. The system of claim 4 wherein the NAT module is configured to perform NAT processing on a response message destined for the first Diameter node that corresponds to the first Diameter message.

6. The system of claim 1 wherein the firewall policy includes at least one of:

a rule for determining whether the first Diameter message is associated with one or more desired characteristics, a rule for determining whether the first Diameter message is associated with one or more undesired characteristics, and information for accessing a data structure for determining whether the first Diameter message satisfies a firewall policy.

7. The system of claim 6 wherein the undesired or desired characteristics include at least one of:

one or portions of Diameter information in a Diameter message, an attribute value pair (AVP), a message parameter, a value, a parameter length, a message length, a destination, an origination, a session, a network address in a Diameter message processed by a network address translation (NAT) module, a network address in a Diameter message not processed by a network address translation (NAT) module, exclusion of a message parameter, inclusion of a message parameter, a message type, manner in which a message is received, time of day, and time of week.

8. The system of claim 1 wherein the first Diameter message includes one of:

an UpdateLocation Request (ULR) message, an UpdateLocation Answer (ULA) message, an AuthenticationInformation Request (AIR) message, an AuthenticationInformation Answer (AIA) message, a CancelLocation Request (CLR) message, a CancelLocation Answer (CLA) message, an InsertSubscriberData Request (IDR) message, an InsertSubscriberData Answer (IDA) message, a DeleteSubscriberData Request (DSR) message, a DeleteSubscriberData Answer (DSA) message, a PurgeUE Request (PUR) message, a PurgeUE Answer (PUA) message, a Reset Request (RSR) message, a Reset Answer (RSA) message, a Notify Request (NOR) message, a Notify Answer (NOA) message, an MEIdentityCheck Request (ECR) message, and an MEIdentityCheck Answer (ECA) message.

9. The system of claim 1 wherein the Diameter information in the first Diameter message includes at least one of:

Diameter header portion information, a Diameter version, a Diameter message length, a Diameter flag, a command code (CC), a Diameter application identifier (ID), a hop by hop ID, an end to end ID, Diameter data portion information, a Diameter attribute value pair (AVP), an AVP parameter, an AVP code, an AVP flag, an AVP length, a vendor ID, AVP data, a parameter, a subscriber identifier, a device identifier, an international mobile subscriber identifier (IMSI), a mobile subscriber integrated services digital network (MSISDN) number, a short code, a uniform resource identifier (URI), an international mobile equipment identifier (IMEI), a mobile identification number (MIN), an Auth-Session-State parameter, a Origin-Host parameter, a Origin-Realm parameter, a Destination-Host parameter, a Destination-Realm parameter, a User-Name parameter, a Supported-Features parameter, a Terminal-Information parameter, a RAT-Type parameter, a ULR-Flags parameter, a Visited-PLMN-Id parameter, a SGSN-Number parameter, a Proxy-Info parameter, and a Route-Record parameter.

10. A method for Diameter routing and firewall filtering, the method comprising:

at a Diameter signaling router;

receiving a plurality of Diameter messages, wherein receiving the plurality of Diameter messages includes receiving, from a first Diameter node, a first Diameter message having Diameter information;

determining whether the first Diameter message satisfies a firewall policy, wherein the firewall policy includes a rule for examining a Diameter level parameter in the first Diameter message, wherein the rule specifies a whitelist or blacklist associated with the Diameter level parameter usable by the Diameter signaling router to determine whether the first Diameter message should be allowed to be forwarded; and

forwarding at least a portion of the first Diameter message towards a second Diameter node in response to the determination by the Diameter signaling router that the first Diameter message should be allowed to be forwarded.

11. The method of claim 10 comprising performing a mitigating action in response to the first Diameter message failing to satisfy the firewall policy.

12. The method of claim 11 wherein the mitigation action includes at least one of:

discarding the first Diameter message, generating an error code, generating an error message, communicating an error message to a Diameter node, generating an event record, generating a log entry, modifying the first Diameter message, generating a second Diameter message based on the first Diameter message;

modifying the Diameter information in the first Diameter message, modifying the first Diameter message to satisfy the firewall policy, triggering NAT processing for a Diameter message, triggering a routing module to handle the modified first Diameter message, triggering the routing module to handle the second Diameter message, and notifying an entity.

13. The method of claim 10 wherein the Diameter level parameter of the first Diameter message includes a Diameter attribute value pair (AVP).

14. The method of claim 10 wherein determining whether the first Diameter message satisfies a firewall policy includes determining whether to perform network address translation (NAT) processing on the first Diameter message.

15. The method of claim 14 wherein in response to determining that NAT processing is to be performed, performing NAT processing on the first message and performing NAT processing on a corresponding response message destined to the first Diameter node.

16. The method of claim 10 wherein the firewall policy includes at least one of:

a rule for determining whether the first Diameter message is associated with one or more desired characteristics, a rule for determining whether the first Diameter message is associated with one or more undesired characteristics, and information for accessing a data structure for determining whether the first Diameter message satisfies a firewall policy.

17. The method of claim 16 wherein the undesired or the desired characteristics include at least one of:

one or portions of Diameter information in a Diameter message, a message parameter, attribute value pair (AVP), a value, a parameter length, a message length, a destination, an origination, a session, a network address in a Diameter message processed by a network address translation (NAT) module, a network address in a Diameter message not processed by a network address translation (NAT) module, exclusion of a message parameter, inclusion of a message parameter, a message type, manner in which a message is received, time of day, and time of week.

18. The method of claim 10 wherein the first Diameter message includes one of:

an UpdateLocation Request (ULR) message, an UpdateLocation Answer (ULA) message, an AuthenticationInformation Request (AIR) message, an AuthenticationInformation Answer (AIA) message, a CancelLocation Request (CLR) message, a CancelLocation Answer (CLA) message, an InsertSubscriberData Request (IDR) message, an InsertSubscriberData Answer (IDA) message, a DeleteSubscriberData Request (DSR) message, a DeleteSubscriberData Answer (DSA) message, a PurgeUE Request (PUR) message, a PurgeUE Answer (PUA) message, a Reset Request (RSR) message, a Reset Answer (RSA) message, a Notify Request (NOR) message, a Notify Answer (NOA) message, an MEIdentityCheck Request (ECR) message, and an MEIdentityCheck Answer (ECA) message.

19. The method of claim 10 wherein the Diameter information in the first Diameter message includes at least one of:

Diameter header portion information, a Diameter version, a Diameter message length, a Diameter flag, a command code (CC), a Diameter application identifier (ID), a hop by hop ID, an end to end ID, Diameter data portion information, a Diameter attribute value pair (AVP), an AVP parameter, an AVP code, an AVP flag, an AVP length, a vendor ID, AVP data, a parameter, a subscriber identifier, a device identifier, an international mobile subscriber identifier (IMSI), a mobile subscriber integrated services digital network (MSISDN) number, a short code, a uniform resource identifier (URI), an international mobile equipment identifier (IMEI), a mobile identification number (MIN), an Auth-Session-State parameter, a Origin-Host parameter, a Origin-Realm parameter, a Destination-Host parameter, a Destination-Realm parameter, a User-Name parameter, a Supported-Features parameter, a Terminal-Information parameter, a RAT-Type parameter, a ULR-Flags parameter, a Visited-PLMN-Id parameter, a SGSN-Number parameter, a Proxy-Info parameter, and a Route-Record parameter.

20. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

at a Diameter signaling router;

receiving a plurality of Diameter messages, wherein receiving the plurality of Diameter messages includes receiving, from a first Diameter node a first Diameter message having Diameter information;

determining whether the first Diameter message satisfies a firewall policy, wherein the firewall policy includes a rule for examining a Diameter level parameter in the first Diameter message, wherein the rule specifies a whitelist or blacklist associated with the Diameter level parameter usable by the Diameter signaling router to determine whether the first Diameter message should be allowed to be forwarded; and

forwarding at least a portion of the first Diameter message towards a second Diameter node in response to the determination by the Diameter signaling router that the first Diameter message should be allowed to be forwarded.