Man-in-the-middle detector and a method using it

• US 8,351,900 B2
• Filed: 05/21/2008
• Issued: 01/08/2013
• Est. Priority Date: 06/13/2007
• Status: Active Grant

• Current Assignee: Exfo Oy (11172239 Canada, Inc.)
• Original Assignee: Exfo Oy (11172239 Canada, Inc.)
• Inventors: Lotvonen, Jukka, Kumpula, Juha, Ahokangas, Markus, Pauna, Janne
• Primary Examiner(s): Nguyen, Duc M
• Application Number:
  US12/124,607
• Publication Number:
  US 20090104889A1
• Time in Patent Office: 1,693 Days
• Field of Search: 455/410, 455/411, 455/456.1, 455/456.4
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 52/04 TPC
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method receives signaling messages by a mobile apparatus at least from one base station of a cellular network, interprets a received signaling message, searches for an anomaly with at least one signaling parameter of the received signaling message from a first base station to a known comparison signaling parameter, gives an alert if the comparison gives an unequal result concerning at least one signaling parameter.

Claims

1. A method comprising:

a mobile terminal of a cellular telephone network receiving signaling messages at least from a first base station and a second base station of the cellular telephone network;

the mobile terminal interpreting both last received signaling messages;

the mobile terminal searching for an anomaly by comparing at least one signaling parameter included in the message received from the first base station to the same signaling parameter included in the message received from the second base station; and

the mobile terminal giving an alert about a rogue base station when the comparison gives an anomaly concerning at least one signaling parameter of the message of the first base station or the second base station.

2. The method according to claim 1, wherein the signaling parameter utilized in the comparison is included in a signaling message.

3. The method according to claim 1, wherein a signaling parameter utilized in the comparison is included in a broadcast control channel message.

4. The method according to claim 1, wherein a signaling parameter utilized in the comparison is included in a paging message.

5. The method according to claim 1, wherein a signaling parameter utilized in the comparison is included in a location update rejection message.

6. The method according to claim 1, wherein a parameter utilized in the comparison is one of the following:

a location area code, C1 value, C2 value, network time, transmission power, periodic location update frequency, cause code in location update termination and international mobile subscriber identity.

7. The method according to claim 1, wherein after a given alert a bearing is taken to the rogue base station for locating its geographical position.

8. The method according to claim 1, wherein the cellular network is a GSM network.

10. A non-transitory computer readable medium storing a set of instructions for execution by one or more processors to detect a rogue base station, the set of instructions comprising the steps of claim 1 or claim 6.

9. A mobile terminal of a cellular telephone network comprising:

a receiver configured to receive signaling messages at least from a first base station and a second base station of the cellular telephone network;

a processor configured to interpret both last received signaling messages;

a memory configured to save interpreted signaling parameters;

wherein the processor is configured to execute steps of a software program comprising computer readable code for searching for an anomaly in a received signaling message by comparing at least one signaling parameter of the message received from the first base station to a signaling parameter of the message received from the second base station; and

an alarm unit configured to give an alert about a rogue base station when the comparison gives an anomaly concerning at least one signaling parameter of the message of the first base station or the second base station.

11. The mobile terminal according to claim 9, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a broadcast control channel message of the first base station against a signaling parameter included in a broadcast control channel message of the second base station.

12. The mobile terminal according to claim 9, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a paging message of the first base station against a signaling parameter included in a broadcast control channel message of the second base station.

13. The mobile terminal according to claim 9, wherein the software program for searching an anomaly comprises computer readable code to interpret a signaling parameter included in a location update rejection message of the first base station against a signaling parameter included in a broadcast control channel message of the second base station.

14. The mobile terminal according to claim 9, wherein a signaling parameter utilized in the comparison is one of the following:

a location area code, C1 value, C2 value, network time, transmission power, periodic location update frequency, cause code in location update termination and international mobile subscriber identity.

15. The mobile terminal according to claim 9, wherein the mobile terminal further comprises a locating receiver for making location measurements the results of which are configured to be utilized as a further comparison parameter in the anomaly search.

16. The mobile terminal according to claim 15, wherein the mobile terminal further comprises a means for retrieving and showing a location of the mobile the mobile terminal and base stations of the serving cellular network on a map display.

17. The mobile according to claim 9, wherein the mobile terminal is further configured to take a bearing towards a detected rogue base station.

18. The mobile terminal according to claim 17, wherein the mobile terminal is further configured to estimate a distance to the detected rogue base station either by utilizing a timing advance or transmission power of the rogue base station.

19. The mobile terminal according to claim 18, wherein the mobile the mobile terminal is a mobile terminal of a GSM network.