WO2018001278A1

WO2018001278A1 - Base station redirection method and base station redirection device

Info

Publication number: WO2018001278A1
Application number: PCT/CN2017/090598
Authority: WO
Inventors: 黄琳; 张婉桥; 杨卿
Original assignee: 北京奇虎科技有限公司
Priority date: 2016-06-30
Filing date: 2017-06-28
Publication date: 2018-01-04

Abstract

The embodiments of the present invention relate to a base station redirection method and a base station redirection device. The base station redirection method comprises: searching a third base station excluding a second base station when a message redirected to the second base station is received; and establishing a communication connection with the third base station. According to the technical solution of the present invention, when the redirected message is received, the third base station excluding a first base station sending the redirected message and the second base station, to which the redirected message is directed, is searched. Therefore, under the condition that the first base station is a pseudo base station, the second base station, to which the redirected message is directed, is not connected, thereby guaranteeing access to a secure base station, preventing user equipment from receiving fraud or harassment information or avoiding leaking personal information.

Description

Base station redirection method and base station redirection device

Technical field

The present invention relates to the field of communication security technologies, and in particular, to a base station redirection method and a base station redirection device.

Background technique

The redirection means that the network side informs the user equipment (UE) of the base station by the redirection command, so that the UE searches the base station according to the information and accesses the base station.

Generally, when the UE is connected to a certain base station, if the base station load is too high, a redirection instruction is sent to the UE, so that the UE accesses the base station with a lower load. However, due to the defect of the communication protocol, the UE may also receive a redirection instruction from the pseudo base station. If the base station is connected to the base station to which the pseudo base station redirection command is directed, the UE may have a great security risk.

Summary of the invention

The technical problem to be solved by the present invention is how to timely and effectively control the program running by the script.

To this end, according to a first aspect of the present invention, a base station redirection method is provided, comprising:

Searching for the third base station other than the first base station and the second base station when receiving the message redirected by the first base station to the second base station;

Establishing a communication connection with the third base station.

Optionally, when receiving the packet, the base station redirection method further includes:

Generating a first prompt message for prompting the redirected base station information, and causing the user to select to reject the redirect instruction or accept the redirect instruction;

Searching for the third base station based on a user-selected refusal redirect instruction, or

Establishing a communication connection with the second base station based on the user-selected accept redirection command.

According to a second aspect of the present invention, a base station redirection apparatus is further provided, including:

a packet receiving module, configured to receive a packet redirected by the first base station to the second base station;

a search module, configured to search for a third base station other than the first base station and the second base station when the message receiving module receives a message redirected to the second base station;

A connection establishing module is configured to establish a communication connection with the third base station.

According to a third aspect of the present invention, a base station redirection method is provided, including:

Performing authentication on the first base station;

If the first base station fails to pass the authentication, when the packet redirected from the first base station to the second base station is received, searching for the third base station other than the first base station and the second base station;

Establishing a communication connection with the third base station.

According to a fourth aspect of the present invention, a base station redirection apparatus is further provided, including:

An authentication module configured to authenticate the first base station;

a search module, configured to: when the first base station fails to pass the authentication, search for the first base station and the first when receiving a message redirected from the first base station to the second base station a third base station other than the second base station;

And a connection module configured to establish a communication connection with the third base station. According to a fifth aspect of the invention there is provided computer program comprising computer readable code, when said computer readable code is run on a computer, causing said computer to perform said base station according to any one of the claims Redirect method.

According to still another aspect of the present invention, there is provided a computer readable medium storing the computer program as claimed in the claims.

According to the above technical solution, at least the following technical effects can be achieved:

1. When receiving the redirect message, searching for the first base station that sends the redirect message, and the third base station other than the second base station that the redirect message points to. Therefore, when the first base station is a pseudo base station, the second base station pointed to by the redirect message is not accessed, and the secure base station is ensured to prevent the user equipment from receiving fraud, harassment information or revealing personal information;

2. Before receiving the packet redirected to the second base station, it is determined based on whether the connection reject message is received, and whether the connection is attempted according to the redirect message, so that the risk is avoided even if there is no risk. Searching for the third base station, resulting in waste of power consumption of the user equipment;

3. The request packet can be upgraded to the tracking area of the base station, and whether the first base station is a pseudo base station is determined according to whether the first base station returns a request rejection message, and the first base station is not a pseudo base station. a base station, thereby establishing a communication connection with a base station having the highest signal strength in the area;

4. The base station attempting to access may be authenticated first, and then the redirect message sent by the base station may be received, so that it is first determined according to the authentication result whether the base station attempting to access is a pseudo base station, and in the case of being a pseudo base station. The access to the base station to which the redirect message is directed can be avoided, and the pseudo base station and its redirect message can be searched for other base stations other than the base station to ensure secure access to the base station;

5. It is possible to avoid attempting to access the first base station or the second base station again when entering the above area again, and ensuring that the base station attempting to access is a secure base station.

DRAWINGS

The features and advantages of the present invention are more clearly understood from the following description of the drawings.

FIG. 1 is a schematic flow chart showing a method for redirecting a base station according to an embodiment of the present invention; FIG.

2 is a schematic flow chart of a method for redirecting a base station according to another embodiment of the present invention;

FIG. 3 is a schematic flow chart showing a method for redirecting a base station according to still another embodiment of the present invention; FIG.

FIG. 4 is a schematic flow chart showing a method for redirecting a base station according to still another embodiment of the present invention; FIG.

FIG. 5 is a schematic flow chart showing a method for redirecting a base station according to still another embodiment of the present invention; FIG.

6 is a schematic flow chart showing a method for redirecting a base station according to still another embodiment of the present invention;

FIG. 7 is a schematic block diagram of a base station redirection apparatus according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention; FIG.

FIG. 9 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention; FIG.

FIG. 10 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention; FIG.

11 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention;

FIG. 12 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention; FIG.

FIG. 13 is a schematic flowchart of a method for redirecting a base station according to an embodiment of the present invention; FIG.

FIG. 14 is a schematic flowchart of a method for redirecting a base station according to another embodiment of the present invention; FIG.

FIG. 15 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention; FIG.

FIG. 16 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention; FIG.

FIG. 17 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention; FIG.

FIG. 18 is a schematic block diagram of a base station redirection apparatus according to an embodiment of the present invention; FIG.

FIG. 19 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention; FIG.

20 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention;

21 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention;

Figure 22 is a block diagram schematically showing the structure of a computer for performing a base station redirection method according to the present invention;

Figure 23 schematically illustrates a storage unit for holding or carrying program code that implements base station redirection in accordance with the present invention.

detailed description

The embodiments of the present invention are described in detail below, and the examples of the embodiments are illustrated in the drawings, wherein the same or similar reference numerals are used to refer to the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the drawings are illustrative and are merely illustrative of the invention and not It is to be construed as limiting the invention.

The singular forms "a", "an", "the" It is to be understood that the phrase "comprise" or "an" Integers, steps, operations, components, components, and/or groups thereof. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element. Further, "connected" or "coupled" as used herein may include either a wireless connection or a wireless coupling. The phrase "and/or" used herein includes all or any one and all combinations of one or more of the associated listed.

Those skilled in the art will appreciate that all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention belongs, unless otherwise defined. It should also be understood that terms such as those defined in a general dictionary should be understood to have meaning consistent with the meaning in the context of the prior art, and will not be idealized or excessive unless specifically defined as here. The formal meaning is explained.

Those skilled in the art can understand that the "terminal" and "terminal device" used herein include both a wireless signal receiver device, a device having only a wireless signal receiver without a transmitting capability, and a receiving and transmitting hardware. A device having a device capable of performing two-way communication receiving and transmitting hardware on a two-way communication link. Such devices may include cellular or other communication devices having a single line display or a multi-line display or a cellular or other communication device without a multi-line display; PCS (Personal Communications Service), which may combine voice, data Processing, fax, and/or data communication capabilities; PDA (Personal Digital Assistant), which can include radio frequency receivers, pagers, Internet/Intranet access, web browsers, notepads, calendars, and/or GPS (Global Positioning System (Global Positioning System) receiver; conventional laptop and/or palmtop computer or other device having a conventional laptop and/or palmtop computer or other device that includes and/or includes a radio frequency receiver. As used herein, "terminal", "terminal device" may be portable, transportable, installed in a vehicle (aviation, sea and/or land), or adapted and/or configured to operate locally, and/or Run in any other location on the Earth and/or space in a distributed form. The "terminal" and "terminal device" used herein may also be a communication terminal, an internet terminal, a music/video playing terminal, and may be, for example, a PDA, a MID (Mobile Internet Device), and/or have a music/video playback. Functional mobile phones can also be smart TVs, set-top boxes and other devices.

Those skilled in the art can understand that the concepts of servers, clouds, remote network devices, and the like used herein have equivalent effects, including but not limited to computers, network hosts, single network servers, multiple network server sets, or multiple servers. The cloud that makes up. Here, the cloud is based on cloud computing (Cloud Computing) A large number of computers or network servers, of which cloud computing is a kind of distributed computing, a super virtual computer composed of a group of loosely coupled computers. In the embodiment of the present invention, the communication between the remote network device, the terminal device and the WNS server can be implemented by any communication method, including but not limited to, mobile communication based on 3GPP, LTE, WIMAX, TCP/IP, UDP protocol. Computer network communication and short-range wireless transmission based on Bluetooth and infrared transmission standards.

Those skilled in the art should understand that the concepts of "application", "application", "application software" and similar expressions as used in the present invention are the same concepts well known to those skilled in the art, and are referred to by a series of computer instructions and related. Data software is an organically constructed computer software suitable for electronic operation. Unless otherwise specified, the naming itself is not limited by the type and level of programming language, nor by the operating system or platform on which it operates. Of course, such concepts are also not limited by any form of terminal.

In the prior art, the operation of the user equipment to receive the redirect message of the base station is performed before the authentication operation.

For example, after the user equipment enters a certain area, the signal strength of the base station in the area is generally detected, and the base station with the highest signal strength is selected to try to access. When the access is attempted, the user equipment initiates a Tracking Area Update Request message to the base station. If the base station needs to redirect the user equipment, the user rejects the message for the tracking area upgrade request. After receiving the reject message for the tracking area upgrade request, the user equipment transmits an connection request (Attach Request) message to the base station, where the connection request message carries the IMSI (International Mobile Subscriber Identity) of the user equipment, and the base station After the IMSI is collected, the device rejects the packet and sends a Radio Resource Control (RRC) redirection packet to the user equipment to notify the user to connect to other base stations.

If the base station that sends the redirection packet is a pseudo base station, the user equipment does not authenticate the pseudo base station when receiving the redirection packet in the prior art, and therefore attempts to access the falsified base station redirection packet. The base station pointed to by the base station, and the base station to which the pseudo base station redirection message is directed is still a pseudo base station or a normal base station with a lower security level. Therefore, once the redirection packet of the pseudo base station is accessed, the user equipment is secure. Causes great hidden dangers, such as easy to steal user information, call records, and receiving harassing text messages and scam messages.

FIG. 1 is a schematic flow chart of a method for redirecting a base station according to an embodiment of the present invention, which may be applied to a user equipment such as a mobile terminal. As shown in FIG. 1, the base station redirection method includes:

S1, searching for a third base station other than the first base station and the second base station when receiving a message that is redirected by the first base station to the second base station;

S2. Establish a communication connection with the third base station.

According to this embodiment, when receiving the redirect message, the user equipment may search for a redirect report. The first base station of the text, and the third base station other than the second base station to which the redirect message is directed. Therefore, when the first base station is a pseudo base station, the second base station pointed to by the redirect packet is not accessed, and the secure base station is ensured to prevent the user equipment from receiving fraud, harassment information or revealing personal information.

2 is a schematic flow chart of a method for redirecting a base station according to another embodiment of the present invention. As shown in FIG. 2, based on the embodiment shown in FIG. 1, when receiving the message, the base station is heavy. The orientation method also includes:

S3. The first prompt information is generated, used to prompt the redirected base station information, and the user selects to reject the redirect instruction or accept the redirect instruction.

S4. Search for the third base station based on a user-selected refusal redirection instruction, or

S5. Establish a communication connection with the second base station based on the user-selected redirection command.

According to the embodiment shown in FIG. 1, when the redirect message is received, the base station pointed to by the redirect message is not accessed. In the case that the first base station is a pseudo base station, the second base station pointed to by the redirect message can be avoided. However, when the first base station is a normal base station, the first base station redirects the packet to the first The second base station is a secure base station, and access to the second base station generally does not pose a security risk. In this case, if the third base station is still searched, the power consumption of the user equipment will be wasted.

According to this embodiment, when the message redirected to the second base station is received, the first prompt information is generated on the user equipment, for example, the first prompt information is “received from the first base station to the second base station. If the packet is attempted to access the second base station, the user may be informed that the current user equipment has received the redirected message, and then may select to attempt to access the second base station or refuse to access the second base station according to requirements.

For example, if the user considers that the repeated message is not trusted, then the refusal redirection instruction may be input for the first prompt information, so that the user equipment searches for the third base station other than the first base station and the second base station. If the user believes that the message is trusted to be repeated, the user may accept the redirect command for the first prompt information, thereby attempting to access the second base station pointed by the redirect command.

FIG. 3 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 3, on the basis of the embodiment shown in FIG. 2, a communication connection is established with the second base station. After that, the base station redirection method further includes:

S6. Determine whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet.

S7. If it is lower, the second prompt information is generated.

The operation of the user equipment to receive the redirection packet occurs before the authentication of the first base station is performed. Therefore, when the redirection packet of the first base station is received, the user cannot confirm whether the first base station and the second base station are pseudo. The base station, therefore, needs to further determine the security of the second base station when receiving the redirection packet of the first base station and connecting to the second base station pointed by the redirection packet.

According to this embodiment, after the user establishes a communication connection with the second base station based on the user inputting the redirection instruction for the first prompt information, the user equipment can record the security level of the connected base station before receiving the redirected message, and the current connection. The security level of the two base stations, so that the security level of the two base stations can be compared, so that the user can learn the security status of the network provided by the second base station, so as to select whether to continue to connect to the second base station.

If the security level of the second base station is lower than the security level of the base station connected before receiving the packet, it indicates that the security level of the network where the user equipment is located is reduced (for example, only 2G is dropped from 3G), and the network with lower security level is lower. It is more likely to be invaded by criminals, thereby sending fraudulent information or stealing user information to user equipment. In this case, although the first base station and the second base station are not necessarily pseudo base stations, the security level of the network where the user equipment is located is reduced. Therefore, the second prompt information, for example, the second prompt, may be generated based on the situation. The information may be “the current network security level is lowered, whether to continue to use the current network”, the user may choose to continue to use the current network, then the user equipment maintains a communication connection with the second base station, and if the user chooses not to use the current network, the user equipment is disconnected. A communication connection with the second base station and searching for the third base station.

FIG. 4 is a schematic flowchart of a base station redirection method according to another embodiment of the present invention. As shown in FIG. 4, the base station redirection method further includes:

S8. Determine whether the security level of the third base station is lower than a security level of the base station connected before receiving the packet.

S9. If it is lower, the third prompt information is generated.

According to this embodiment, after searching for the third base station and establishing a communication connection with the third base station, since the user equipment can record the security level of the connected base station before receiving the redirected message, and the security level of the currently connected third base station, The security level of the two can be compared, so that the user can learn the security status of the network provided by the third base station to select whether to continue to connect to the third base station.

If the security level of the third base station is lower than the security level of the base station connected before receiving the packet, it indicates that the security level of the network where the user equipment is located is reduced (for example, only 2G is dropped from 3G), and the network with lower security level is lower. It is more likely to be invaded by criminals, thereby sending fraudulent information or stealing user information to user equipment. In this case, although the second base station is a secure base station, the security level of the network where the user equipment is located is reduced. Therefore, the third prompt information may be generated based on the situation. For example, the third prompt information may be “current. If the network security level is lowered, whether the current network continues to be used, and the user can choose to continue using the current network, the user equipment maintains a communication connection with the third base station. If the user chooses not to use the current network, the user equipment disconnects from the third base station. The communication is connected, and searches for a fourth base station other than the first base station, the second base station, and the third base station.

Optionally, the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is Do not lower than the security level of the 4G base station.

For example, the authentication mode of the 2G base station is GSM (Global System for Mobile Communication) authentication, and the authentication mode of the 3G base station is WCDMA (Wideband Code Division Multiple Access) authentication, 4G base station. The authentication method is LTE (Long Term Evolution) authentication.

The GSM authentication is unidirectional. Only the base station (network) authenticates the user, and the user equipment does not authenticate the base station (network). The illegal base station can pretend to be a legitimate base station to spoof the user equipment and steal user information. And in the GSM network, the problem of data integrity protection is not considered, and it is difficult to find out if the data is tampered with in the process of transmission. The encryption of the GSM network is not end-to-end, it is only encrypted in the wireless channel part, and there is no encryption in the fixed network (using clear text transmission), which provides an opportunity for the attacker. The GSM encryption algorithm and the key have security risks. For example, the key is too short, only 64 bits. The encryption algorithm is not public and relatively fixed, and the encryption algorithm cannot be negotiated.

Although the WCDMA network can achieve two-way authentication, the security level is higher than that of the GSM network. However, the authentication in the authentication process only implements the authentication of the HLR (Home Location Register) by the user equipment, but does not implement the authentication of the VLR (Visitor Location Register) by the user equipment, so the attacker can Intercept the legitimate IMSI for attack. And without considering the authentication and secure communication on the network side, the attacker can obtain the CK and IK by intercepting the information between the VLR and the HLR to obtain an AV (Authentication Vector). The user equipment roams between different PLMNs (Public Land Mobile Network). Different PLMNs may be different networks in different countries. When the local HLR sends the AV to the VLR of the roaming network, it passes through different networks. It is easy to be intercepted by an attacker.

In an LTE network, the authentication process of the UE is:

C1, the UE transmits the information between the UE and the CN to the NAS layer (Non-Access Stratum, non-access stratum, NAS protocol, and the transmitted content may be user information or control information, such as service establishment, release, or mobility management. Information) MME (Mobility Management Entity, which is the key control node of the 3GPP protocol LTE access network, which is responsible for the positioning of the idle mode UE, the paging process, including the relay, simply saying that the MME is responsible for the signaling processing part) initiates the authentication. request;

The C2 and the MME request an authentication vector from the HSS (Home Subscriber Server).

C3, HSS returns one or more EPS (Evolved Packet System) authentication vectors (RAND, AUTN, XRES, KASME) to the MME;

C4, after receiving the MME, the XRES and the Kasme are saved, and the random number RAND and the authentication token AUTN are sent to the UE;

C5. The UE authenticates the first base station through the AUTN, calculates RES&CK/IK according to AUTN&RAND, and further calculates Kasme (the second layer key required for LTE authentication, which is calculated by a layer of keys CK and IK) ;

C6. The UE and the MME derive the encryption key and integrity protection key required by the NAS layer and the AS layer according to Kasme. These keys are deleted when the UE changes from active to idle.

On the one hand, since the authentication process of the LTE network is completed by the authentication vector quaternary, on the other hand, when the UE changes from the active state to the idle state, the key is deleted, so there is no problem existing in the GSM network and the WCDMA network. Therefore the level of security is higher.

FIG. 5 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 5, on the basis of the embodiment shown in FIG. 1, a base station redirection method searches for the third. Before the base station, it also includes:

S10: Determine whether a connection reject message is received before receiving the message redirected to the second base station, and if the connection reject message is received, perform step S2 to search for the third base station, otherwise, execute S11, and The second base station establishes a communication connection.

After the user equipment enters a certain area, the signal strength of the base station in the area is detected, and the first base station with the highest signal strength is selected to try to access, and the tracking area upgrade request message is sent to the first base station, if the first base station needs Redirect the user equipment and feedback the rejection message for the tracking area upgrade request. After receiving the refusal message for the tracking area upgrade request, the user equipment transmits a connection request message to the first base station, and the base station sends a redirection message to the user equipment, and notifies the user to connect to the user equipment. Second base station.

The above situation is a process in which the first base station rejects its access request and redirects it during the process of attempting to access the first base station after the user enters a certain area, in which case the pseudo base station exists as the first The risk that the base station transmits the redirect message to the user equipment.

However, in other cases, the source of the redirected packet is generally secure, and there is no risk in attempting to connect according to the redirected packet. For example, if the user equipment is connected to a certain base station, but the base station needs temporary maintenance or a sudden failure, the redirect message can be directly transmitted to the user equipment, and in this case, the user equipment directly receives the redirect. The message does not receive the connection rejection message for the tracking area upgrade request, and the connection rejection message for the transmission connection request feedback rejection message.

Therefore, according to the embodiment, before receiving the message redirected to the second base station, it may be determined based on whether the connection reject message is received, whether the connection is attempted according to the redirect message, thereby avoiding risk. In the case of the third base station, the power consumption of the user equipment is wasted.

6 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 6, on the basis of the embodiment shown in FIG. 1, a base station redirection method searches for the third. Base Before the station, it also includes:

S12. Transmit a preset number of tracking area upgrade request messages to the first base station.

S13, it is determined whether the request rejection message of the first base station is received after the tracking area upgrade request message is sent, and if yes, step S2 is performed to search for the third base station, otherwise, step S14 is performed, and The first base station establishes a communication connection.

After the user equipment enters a certain area, the signal strength of the base station in the area is detected, and the first base station with the highest signal strength is selected to try to access. In this case, the packet received by the first base station is redirected to the second base station. If the first base station is not a pseudo base station, the first base station sends the redirect message because the current load of the first base station is high, and temporarily cannot be For user equipment access.

It can be seen that, in the case that the first base station is a normal base station, if the first base station sends a redirection packet, it only indicates that the first base station is temporarily unavailable for the user equipment access, but the load of the normal base station generally does not continue to be maintained at a high level. The level, that is, the request to reject the request for the access request of the user equipment is not continued. In order to redirect the user equipment to the base station with a lower security level, the pseudo base station feeds back the request for all the access requests sent by the user equipment, and then sends a redirect message.

According to this embodiment, the tracking area upgrade request message of the preset number of times (more than one time, for example, may be 10 times) may be transmitted to the first base station. Preferably, the time interval of each time the tracking area upgrade request message is transmitted may be set to 1 minute. If the first base station returns a request rejection message for all the tracking area upgrade request messages, then the first base station has a larger probability of being a pseudo base station. After receiving the tracking area upgrade request message, the first base station does not receive the request rejection message (or receives the request permission message of the base station), so that the first base station has reduced the load at this time, and the user can be used for the user. The device is accessed, and the first base station is a normal base station. Therefore, the user equipment can access the first base station, thereby establishing a communication connection with the base station with the highest signal strength in the area.

FIG. 7 is a schematic block diagram of a base station redirection apparatus according to an embodiment of the present invention. As shown in FIG. 7, the base station redirection apparatus 70 includes:

The message receiving module 71 is configured to receive a message that is redirected by the first base station to the second base station;

The searching module 72 searches for a third base station other than the first base station and the second base station when the message receiving module receives the message redirected to the second base station;

The connection establishing module 73 is configured to establish a communication connection with the third base station.

FIG. 8 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 8, the base station redirection apparatus further includes:

The prompting module 74, when the packet receiving module receives the packet redirected to the second base station, generates the first prompt information, is configured to prompt the redirected base station information, and causes the user to select to reject the redirect instruction or accept the heavy Directional instruction

The search module 72 is further configured to search the third base station based on a refusal redirection instruction selected by the user.

Or the connection establishing module 73 is further configured to establish a communication connection with the second base station based on the user-selected accept redirection command.

FIG. 9 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 9, on the basis of the embodiment shown in FIG. 8, the base station redirection apparatus 70 further includes:

After the connection establishment module 73 establishes a communication connection with the second base station, the security determination module 75 determines whether the security level of the second base station is lower than the security level of the base station connected before receiving the message.

The prompting module 74 generates second prompt information when the security level of the second base station is lower than the security level of the base station connected before receiving the packet.

FIG. 10 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 10, on the basis of the embodiment shown in FIG. 7, the base station redirection apparatus 70 further includes:

The security judging module 75 is configured to determine whether the security level of the third base station is lower than a security level of the base station connected before receiving the packet;

The prompting module 74 generates third prompt information when the security level of the third base station is lower than the security level of the base station connected before receiving the message.

Optionally, the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is lower than the security level of the 4G base station.

FIG. 11 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 11, on the basis of the embodiment shown in FIG. 7, the base station redirection apparatus 70 further includes:

The message judging module 76 determines, before searching the third base station, whether the connection rejecting message is received before the packet receiving module receives the packet redirected to the second base station.

The search module 72 searches for the third base station when the message receiving module 71 receives the connection reject message before receiving the message redirected to the second base station, and the connection establishing module 73 is in the The message receiving module 71 establishes a communication connection with the second base station when receiving the connection reject message before receiving the message redirected to the second base station.

FIG. 12 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 12, on the basis of the embodiment shown in FIG. 7, the base station redirection apparatus 70 further includes:

The message transmission module 77 is configured to transmit a preset number of tracking area upgrade request messages to the first base station before searching the third base station;

After the search module 72 sends the tracking area upgrade request message, the message receiving module 71 searches for the third base station when receiving the request rejection message of the first base station. After the connection establishment module 73 sends the tracking area upgrade request message, the message receiving module 71 establishes a communication connection with the first base station when receiving the request permission message of the first base station.

In response to the above problems, the present invention also proposes a base station redirection method and a base station redirection apparatus as shown below.

FIG. 13 is a schematic flowchart of a method for redirecting a base station according to an embodiment of the present invention, which may be applied to a mobile terminal. As shown in FIG. 13, the base station redirection method includes:

Step 1: Perform authentication on the first base station;

Step 2: If the first base station fails to pass the authentication, when the packet redirected from the first base station to the second base station is received, the first base station and the second base station are searched for Three base stations;

Step 3: Establish a communication connection with the third base station.

According to this embodiment, the base station may be authenticated before receiving the redirect message. For example, after the user equipment enters an area, it is detected that the signal strength of the first base station is the highest, and then attempts to access the first base station, and directly initiates an authentication request to the first base station, requesting the first base station to feed back the authentication information; After the first base station feeds back the reject message for the tracking area upgrade request, or after receiving the feedback reject message for the transmission connection request, the first base station sends an authentication request to the first base station to request the first base station to feed back the authentication information.

For the first base station that fails the authentication (for example, the first base station feeds back the authentication information but does not match the authentication information stored by the terminal, or the first base station does not feed back the authentication information), it can generally be determined as a pseudo base station. If the redirection packet sent by the redirection packet is transmitted to the user equipment by the first base station, the second base station pointed to by the redirection packet is also a pseudo base station, or a base station with a lower security level, the user equipment may write the identifiers of the first base station and the second base station (for example, an identity identifier, an address identifier, and the like) to the blacklist, and search for the area other than the first base station and the second base station in the area. Three base stations and try to access. Certainly, for the third base station, the same authentication mode as the first base station may be adopted, and if the third base station passes the authentication, a communication connection is established with the third base station.

It can be seen that, according to the embodiment, the base station that attempts to access may be authenticated, and then the redirect message sent by the base station is received, so that it is first determined according to the authentication result whether the base station attempting to access is a pseudo base station, In the case of a pseudo base station, access to the base station to which the redirect message is directed can be avoided, and the pseudo base station and its redirect message can be searched for other base stations other than the base station to ensure secure access to the base station.

Optionally, the identifiers of the first base station and the second base station are recorded if the first base station fails to pass the authentication.

According to the present embodiment, it is possible to avoid again (in the present invention, "again" means any time after the first time), when attempting to access the above-mentioned area, attempting to access the first base station or the second base station again, and ensuring the base of the attempted access. The station is a secure base station.

Optionally, authenticating the first base station includes:

When an attempt is made to access the first base station, an authentication request is initiated to the first base station, or when the first base station receives the feedback rejection message for the tracking area upgrade request, an authentication request is initiated to the first base station, and the first base station is requested to provide feedback. Authentication information.

According to this embodiment, when the user equipment attempts to access the first base station, or when receiving the first base station feedback request rejection message for the tracking area upgrade request, the user equipment does not transmit the IMSI to the base station attempting to access, so In two cases, the base station is authenticated, which can reduce the probability that the pseudo base station acquires the user IMSI.

For example, if the user equipment UE is running in a 4G (fourth generation mobile communication technology) network, the authentication method of the user equipment to the first base station may be as follows:

First, the UE transmits the information between the UE and the CN to the NAS layer (Non-Access Stratum, non-access stratum, NAS protocol, and the transmitted content may be user information or control information, such as service establishment, release, or mobility management. Information) MME (Mobility Management Entity, which is the key control node of the 3GPP protocol LTE access network, which is responsible for the positioning of the idle mode UE, the paging process, including the relay, simply saying that the MME is responsible for the signaling processing part) initiates the authentication. request;

S2: The MME requests an authentication vector from the HSS (Home Subscriber Server).

S3, the HSS returns one or more sets of EPS (Evolved Packet System) authentication vectors (RAND, AUTN, XRES, KASME) to the MME;

S4, after receiving the MME, save the XRES, Kasme, and send the random number RAND and the authentication token AUTN to the UE;

S5. The UE authenticates the first base station by using the AUTN. If the first base station fails to pass the authentication, the UE ends. If the authentication is performed, the RES&CK/IK is calculated according to the AUTN&RAND, and the Kasme (which is required for LTE authentication) is further calculated. The second layer key is calculated by a layer of keys CK and IK);

S6. The UE and the MME derive the encryption key and the integrity protection key required by the NAS layer and the AS layer according to the Kasme.

FIG. 14 is a schematic flowchart of a method for redirecting a base station according to another embodiment of the present invention. As shown in FIG. 14, the method for redirecting a base station according to the embodiment shown in FIG. 13 further includes:

Step 4: If the first base station passes the authentication, when receiving the message redirected from the first base station to the second base station, establish a communication connection with the second base station.

According to the embodiment, in the case that the first base station passes the authentication, the first base station is not a pseudo base station, and therefore, a communication connection can be established with the second base station according to the redirect message.

FIG. 15 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 15, after establishing a communication connection with the second base station, based on the embodiment shown in FIG. The base station redirection method further includes:

Step 5: Determine whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet.

Step 6. If it is lower, the first prompt information is displayed.

According to the present embodiment, even in the case where the first base station is not a pseudo base station, it is possible for the first base station to redirect the user equipment to a base station having a lower security level.

For example, after the user equipment enters an area, the base station with the highest power in the area is detected as the first base station. In the process of attempting to connect to the first base station, the first base station passes the authentication, but the first base station has a higher load at this time. Therefore, the redirect instruction is fed back to the user device. If the 4G base station in the area is high in complexity, only the second base station has a lower load, but the second base station is a 2G base station, and the base station connected to the user equipment before receiving the redirect message is a 4G base station, then After the user equipment accesses the second base station, the security level of the mobile network where the user equipment is located is lowered.

According to the embodiment, the first prompt information may be displayed in the above case, so that the user can know in time that the security level of the connected base station is lowered, and then whether to maintain the connection with the second base station.

FIG. 16 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 16, when the first base station fails to pass authentication, on the basis of the embodiment shown in FIG. 13, the base station The redirect method also includes:

Step 7: Display second prompt information, where the second prompt information is used to prompt the user that the first base station fails to pass the authentication, and causes the user to select to reject the redirect instruction or accept the redirect instruction;

Step 8. Search for the third base station based on the selected reject redirect instruction, or

Step 9. Establish a communication connection with the second base station based on the selected accept redirection command.

In some cases, even if the first base station fails to pass the authentication, the user equipment is still required to connect to the second base station according to the redirect message of the first base station.

For example, in the process of detecting a case by a public security organ, it is necessary to obtain evidence that a criminal uses a pseudo base station to send a redirect message to the user. Then, according to the embodiment, in the case that the first base station fails to pass the authentication, the communication connection with the second base station is still established according to the redirect message of the first base station, so as to detect the pseudo in the process of connecting to the second base station. The base station sends fraudulent information or steals the message to the user terminal, thereby confirming the evidence of the crime.

FIG. 17 is a schematic flowchart of a method for redirecting a base station according to still another embodiment of the present invention. As shown in FIG. 17, after establishing a communication connection with the second base station, on the basis of the embodiment shown in FIG. The base station redirection method further includes:

Step 10: Determine whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet.

In step 11, if it is lower, the third prompt information is displayed.

According to this embodiment, when the first base station fails to pass the authentication and is connected to the second base station to which the first base station redirects the message, the first base station may be tested according to whether the security level of the second base station is lowered.

For example, when the operator sets up the base station, the parameter values used by some base stations for authentication may not be stored or omitted, and the base stations cannot pass the authentication. Then, according to the embodiment, the carrier test can be provided with conditions, and if the first base station fails to pass the authentication, the communication connection with the second base station is still established according to the redirect message of the first base station, and the second base station is further determined. Is the security level reduced?

If the security level of the second base station is not lowered, it may be determined that the first base station is a pseudo base station. If the security level of the second base station is not lowered, the first base station is a normal base station (because the redirection packet sent by the pseudo base station is generally used to redirect the user equipment to the base station with a lower security level to send fraud information or Stealing the message), but the parameters or parameter values required for authentication are missing, and the base station can be repaired accordingly.

Although the WCDMA network can achieve two-way authentication, the security level is higher than that of the GSM network. However, the authentication in the authentication process only implements the authentication of the HLR (Home Location Register) by the user equipment, but does not implement the authentication of the VLR (Visitor Location Register) by the user equipment, so the attacker can Intercept the legitimate IMSI for attack. And without considering the authentication and confidential communication on the network side, the attacker can intercept the letter between the VLR and the HLR. Get the AV (AuthenticationVector) to get CK and IK. The user equipment roams between different PLMNs (Public Land Mobile Network). Different PLMNs may be different networks in different countries. When the local HLR sends the AV to the VLR of the roaming network, it passes through different networks. It is easy to be intercepted by an attacker.

The LTE network does not have problems with the GSM network and the WCDMA network, so the security level is higher.

FIG. 18 is a schematic block diagram of a base station redirection apparatus according to an embodiment of the present invention. As shown in FIG. 18, the base station redirection apparatus 60 according to the second aspect of the present invention includes:

The authentication module 61 is configured to perform authentication on the first base station;

The searching module 62 searches for the first base station and the second when receiving the message redirected from the first base station to the second base station if the first base station fails to pass the authentication. a third base station other than the base station;

The connection module 63 establishes a communication connection with the third base station.

Optionally, the connection module 63 establishes with the second base station when receiving the packet redirected from the first base station to the second base station, when the first base station is authenticated. Communication connection.

FIG. 19 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 19, on the basis of the embodiment shown in FIG.

The determining module 64 is configured to determine whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet;

The display module 65 displays the first prompt information under the request that the security level of the second base station is lower than the security level of the base station connected before receiving the message.

FIG. 20 is a schematic block diagram of a base station redirection apparatus according to another embodiment of the present invention. As shown in FIG. 20, on the basis of the embodiment shown in FIG.

The display module 65 is configured to display the second prompt information when the first base station fails to pass the authentication, and the second prompt information is used to prompt the user that the first base station fails to pass the authentication, and the user selects to reject the redirect instruction or Accept the redirect instruction;

The searching module 62 is configured to search for the third base station based on the rejected redirecting instruction of the selected second prompt information.

Or the connection module 63 is configured to establish a communication connection with the second base station based on the selected accept redirection command.

21 is a schematic block diagram of a base station redirection apparatus according to still another embodiment of the present invention, as shown in FIG. 21. As shown in FIG. 20, the base station redirection device 60 further includes:

The determining module 66 is configured to determine, after the connection module 63 establishes a communication connection with the second base station, whether the security level of the second base station is lower than a security level of the base station connected before receiving the message;

The display module 65 displays the third prompt information when the security level of the second base station is lower than the security level of the base station connected before receiving the message.

In summary, when the redirection packet is received, the first base station that sends the redirection packet and the third base station other than the second base station that the redirection packet points are received. Therefore, when the first base station is a pseudo base station, the second base station pointed to by the redirect packet is not accessed, and the secure base station is ensured to prevent the user equipment from receiving fraud, harassment information or revealing personal information.

It should be noted that the algorithms and formulas provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the examples based herein. The structure required to construct such a system is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment in the above description of the exemplary embodiments of the present invention in order to the , diagram, or description of it. However, the method and apparatus disclosed are not to be interpreted as reflecting the invention that the claimed invention is claimed to have more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to the fact that at least some of such features and/or processes or units are mutually exclusive, any combination of the present description (including accompanying rights) may be employed. All the features disclosed in the claims, abstract and drawings are combined with all the processes or units of any method or device so disclosed. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the website security detection device in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 22 illustrates a computer in which a base station redirection method in accordance with the present invention can be implemented. The computer traditionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520. The memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above. For example, storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 520 in the mobile terminal of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 531', code that can be read by a processor, such as 510, which when executed by a computer causes the computer to perform various steps in the methods described above.

"an embodiment," or "an embodiment," or "an embodiment," In addition, it is noted that the phrase "in one embodiment" is not necessarily referring to the same embodiment.

The above is only a part of the embodiments of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

A base station redirection method includes:

Searching for the third base station other than the first base station and the second base station when receiving the message redirected by the first base station to the second base station;

Establishing a communication connection with the third base station.
The base station redirection method according to claim 1, wherein when the message is received, the method further includes:

Generating a first prompt message for prompting the redirected base station information, and causing the user to select to reject the redirect instruction or accept the redirect instruction;

Searching for the third base station based on a user-selected refusal redirect instruction,

Or establishing a communication connection with the second base station based on a user-selected accept redirection command.
The base station redirection method according to claim 2, further comprising: after establishing a communication connection with the second base station,

Determining whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet;

If it is lower, the second prompt information is generated.
The base station redirection method according to claim 1, further comprising:

Determining whether the security level of the third base station is lower than a security level of the base station connected before receiving the packet,

If it is lower, a third prompt information is generated.
The base station redirection method according to claim 3 or 4, wherein the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is lower than the security level of the 4G base station.
The base station redirection method according to any one of claims 1 to 5, further comprising: before searching the third base station, further comprising:

Determining whether a connection reject message is received before receiving the message redirected to the second base station, and if the connection reject message is received, searching for the third base station, otherwise establishing a communication connection with the second base station.
The base station redirection method according to any one of claims 1 to 6, further comprising: before searching the third base station, further comprising:

Transmitting, to the first base station, a preset number of tracking area upgrade request messages;

Determining whether the request rejection message of the first base station is received after each sending the tracking area upgrade request message;

If yes, searching for the third base station;

Otherwise, a communication connection is established with the first base station.
A base station redirection device includes:

a packet receiving module, configured to receive a packet redirected by the first base station to the second base station;

a search module, configured to search for a third base station other than the first base station and the second base station when the message receiving module receives a message redirected to the second base station;

A connection establishing module is configured to establish a communication connection with the third base station.
The base station redirection device of claim 8, further comprising:

The prompting module generates, when the packet receiving module receives the packet redirected to the second base station, the first prompt information, configured to prompt the redirected base station information, and causes the user to select to reject the redirect instruction or accept the redirect instruction;

The search module is further configured to search for the third base station based on a user-selected refusal redirection instruction.

Or the connection establishment module is further configured to establish a communication connection with the second base station based on a user-selected accept redirection command.
The base station redirection device of claim 9, further comprising:

a security judging module, configured to determine, after the connection establishing module establishes a communication connection with the second base station, whether a security level of the second base station is lower than a security level of a base station connected before receiving the packet,

The prompting module generates second prompt information when the security level of the second base station is lower than the security level of the base station connected before receiving the packet.
The base station redirection device of claim 8, further comprising:

The security judgment module is configured to determine whether the security level of the third base station is lower than a security level of the base station connected before receiving the packet;

The prompting module generates third prompt information when the security level of the third base station is lower than the security level of the base station connected before receiving the message.
The base station redirection device according to claim 10 or 11, wherein the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is lower than the security level of the 4G base station.
The base station redirection device according to any one of claims 8 to 12, further comprising:

The message judging module determines, before searching the third base station, whether the connection rejecting message is received before the packet receiving module receives the packet redirected to the second base station.

The search module searches for the third base station when the packet receiving module receives the connection reject message before receiving the message redirected to the second base station, and the connection establishment module is in the report The receiving module establishes a communication connection with the second base station when receiving the connection reject message before receiving the message redirected to the second base station.
The base station redirection device according to any one of claims 8 to 13, further comprising:

The message transmission module is configured to transmit a preset number of tracking area upgrade request messages to the first base station before searching the third base station;

The search module, after receiving the tracking area upgrade request message, searches for the third base station, when the message receiving module receives the request rejection message of the first base station, After the connection establishment module sends the tracking area upgrade request message, the message receiving module establishes a communication connection with the first base station when receiving the request permission message of the first base station.
A base station redirection method includes:

Performing authentication on the first base station;

If the first base station fails to pass the authentication, when the packet redirected from the first base station to the second base station is received, searching for the third base station other than the first base station and the second base station;

Establishing a communication connection with the third base station.
The base station redirection method according to claim 15, further comprising:

And if the first base station passes the authentication, when receiving the message redirected from the first base station to the second base station, establishing a communication connection with the second base station.
The base station redirection method according to claim 16, wherein after establishing a communication connection with the second base station, the method further includes:

Determining whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet,

If it is lower, the first prompt information is displayed.
The base station redirection method according to claim 15, wherein when the first base station fails to pass the authentication, the method further includes:

Displaying the second prompt information, where the second prompt information is used to prompt the user that the first base station fails to pass the authentication, and causes the user to select to reject the redirect instruction or accept the redirect instruction;

Searching for the third base station based on the selected reject redirect instruction, or

Establishing a communication connection with the second base station based on the selected accept redirection command.
The base station redirection method according to claim 18, further comprising: after establishing a communication connection with the second base station,

Determining whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet,

If it is lower, the third prompt information is displayed.
The base station redirection method according to claim 17 or 19, wherein the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is lower than the security level of the 4G base station.
A base station redirection device includes:

An authentication module configured to authenticate the first base station;

Searching, in the case that the first base station fails to authenticate, searching for the first base station and the second base station when receiving a message redirected from the first base station to the second base station a third base station other than the third base station;

The connection module establishes a communication connection with the third base station.
The base station redirection apparatus according to claim 21, wherein the connection module receives a message redirected from the first base station to a second base station when the first base station passes authentication And establishing a communication connection with the second base station.
The base station redirection device of claim 22, further comprising:

The determining module is configured to determine whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet;

The display module displays the first prompt information if the security level of the second base station is lower than the security level of the base station connected before receiving the message.
The base station redirection device of claim 21, further comprising:

The display module is configured to display the second prompt information when the first base station fails to pass the authentication, and the second prompt information is used to prompt the user that the first base station fails to pass the authentication, and causes the user to select to reject the redirect instruction or accept Redirect instruction

The search module is configured to search the third base station based on the selected reject redirect instruction.

Or the connection module is configured to establish a communication connection with the second base station based on the selected redirection instruction.
The base station redirection device of claim 24, further comprising:

The determining module is configured to determine, after the connection module establishes a communication connection with the second base station, whether the security level of the second base station is lower than a security level of the base station connected before receiving the packet,

The display module displays the third prompt information when the security level of the second base station is lower than the security level of the base station connected before receiving the message.
The base station redirection device according to claim 22 or 24, wherein the security level of the 2G base station is lower than the security level of the 3G base station, and the security level of the 3G base station is lower than the security level of the 4G base station.
A computer program comprising computer readable code when said computer readable code is When executed on a computer, the computer is caused to perform the base station redirection method according to any one of claims 1-7, 15-20.
A computer readable medium storing the computer program of claim 27.