System and method for combined network-side and off-air monitoring of wireless networks

• US 10,560,842 B2
• Filed: 01/27/2016
• Issued: 02/11/2020
• Est. Priority Date: 01/28/2015
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Goldfarb, Eithan
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Nguy, Chi D
• Application Number:
  US15/008,375
• Publication Number:
  US 20160269900A1
• Time in Patent Office: 1,476 Days
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

A monitoring system monitors authentication sessions both on the air interface between the terminals and the network, and on at least one wired network-side interface between network-side elements of the network. The monitoring system constructs a database of sets of network-side authentication parameters using network-side monitoring. Each set of network-side authentication parameters originates from a respective authentication session and is associated with the International Mobile Station Identity (IMSI) of the terminal involved in the session. In order to start decrypting the traffic of a given terminal, the system obtains the off-air authentication parameters of that terminal using off-air monitoring, and finds an entry in the database that matches the air-interface authentication parameters. From the combination of correlated network-side and off-air authentication parameters, the processor is able to extract the parameters needed for decryption.

Claims

1. A method for network monitoring, comprising:

obtaining, by a monitoring system, first sets of authentication parameters exchanged between wireless communication terminals and a wireless network, by monitoring an air interface between the terminals and the wireless network using a radio network interface, wherein the first sets of authentication parameters comprise Temporary Mobile Station Identities (TMSIs) of the wireless communication terminals that are active at a given geographic area;

obtaining, by the monitoring system, second sets of authentication parameters exchanged between the terminals and the network, by monitoring at least one wired interface between network-side elements of the wireless network using a core network interface, wherein the radio network interface and the core network interface are geographically separate, wherein the second sets of authentication parameters comprise International Mobile Station Identities (IMSIs);

establishing, by the monitoring system, one or more correlations between the first sets and the second sets, wherein the one or more correlations comprise the TMSIs of the wireless communication terminals correspond with given ones of the IMSIs;

determining, by the monitoring system, a type of application associated with a wireless terminal of the wireless terminals based on the established one or more correlations between the first sets and the second sets; and

providing a quality of service to the wireless terminal of the wireless terminals according to the determined type of application.

2. The method according to claim 1, wherein obtaining the first and second sets comprises monitoring authentication sessions conducted between the terminals and a Home Location Register (HLR) of a wireless network.

3. The method according to claim 1, wherein establishing the correlations comprises identifying one or more authentication parameters that appear in one of the first sets and in one of the second sets.

4. The method according to claim 1, wherein establishing the correlations comprises identifying a first set of authentication parameters obtained from the air interface and a second set of authentication parameters obtained from the wired interface that both pertain to a given terminal.

5. The method according to claim 4, wherein establishing the correlation comprises concluding that a Temporary Mobile Station Identity (TMSI) in the first set and an International Mobile Station Identity (IMSI) in the second set both pertain to the given terminal.

6. The method according to claim 5, wherein acting upon the correlations comprises monitoring the given terminal using the TMSI.

7. The method according to claim 1, wherein obtaining the first sets comprises storing the first sets in a database, and wherein establishing the correlations comprises, for a given second set obtained from the air interface, querying the database for a first set that matches the given second set.

8. The method according to claim 1, further comprising:

storing traffic received over the air interface to create a first replica of the traffic and a second replica of the traffic, wherein the first replica of the traffic and the second replica of the traffic both include user traffic;

obtaining parameters needed for decryption of the user traffic from the first replica of the traffic; and

using the obtained parameters from the first replica of the traffic to decrypt the user traffic from the second replica of the traffic.

9. A system for network monitoring, comprising:

a radio network interface, which is configured to monitor an air interface between wireless communication terminals and a wireless network;

a core network interface, which is configured to monitor at least one wired interface between network-side elements of the wireless network, wherein the radio network interface and the core network interface are geographically separate; and

a processor, which is configured to obtain using the first interface first sets of authentication parameters exchanged between the terminals and the network, the first sets of authentication parameters comprise Temporary Mobile Station Identities (TMSIs) of the wireless communication terminals that are active at a given geographic area, to obtain using the second interface second sets of authentication parameters exchanged between the terminals and the network, wherein the second sets of authentication parameters comprise International Mobile Station Identities (IMSIs), to establish one or more correlations between the first sets and the second sets, wherein the one or more correlations comprise the TMSIs of the wireless communication terminals correspond with given ones of the IMSIs, and to use the one or more correlations between the first sets and the second sets to recognize a type of application associated with a wireless terminal of the wireless terminals to provide a quality of service to the wireless terminal of the wireless terminals according to the type.

10. The system according to claim 9, wherein the processor is configured to obtain the first and second sets by monitoring authentication sessions conducted between the terminals and a Home Location Register (HLR) of a wireless network.

11. The system according to claim 9, wherein the processor is configured to establish the correlations by identifying one or more authentication parameters that appear in one of the first sets and in one of the second sets.

12. The system according to claim 9, wherein the processor is configured to establish the correlations by identifying a first set of authentication parameters obtained from the air interface and a second set of authentication parameters obtained from the wired interface that both pertain to a given terminal.

13. The system according to claim 12, wherein, by establishing the correlation, the processor is configured to conclude that a Temporary Mobile Station Identity (TMSI) in the first set and an International Mobile Station Identity (IMSI) in the second set both pertain to the given terminal.

14. The system according to claim 9, wherein the processor is configured to store the first sets in a database, and to establish a correlation for a given second set obtained from the air interface, by querying the database for a first set that matches the given second set.

15. A system for network monitoring, comprising:

a radio network interface, which is configured to monitor an air interface between wireless communication terminals and a wireless network;

a core network interface, which is configured to monitor at least one wired interface between network-side elements of the wireless network, wherein the radio network interface and the core network interface are geographically separate; and

a processor, which is configured to obtain using the air interface first sets of authentication parameters exchanged between the terminals and the network, the first sets of authentication parameters comprise Temporary Mobile Station Identities (TMSIs) of the wireless communication terminals that are active at a given geographic area, to obtain using the at least one wired interface second sets of authentication parameters exchanged between the terminals and the network, wherein the second sets of authentication parameters comprise International Mobile Station Identities (IMSIs), to establish one or more correlations between the first sets and the second sets, wherein the one or more correlations comprise the TMSIs of the wireless communication terminals correspond with given ones of the IMSIs, to determine a type of application associated with a wireless terminal of the wireless terminals based on the established one or more correlations between the first sets and the second sets, and to provide a quality of service to the wireless terminal of the wireless terminals according to the determined type of application.