CA2645313A1 - Method and device for identifying a mobile terminal in a digital cellular mobile radio network - Google Patents
Method and device for identifying a mobile terminal in a digital cellular mobile radio network Download PDFInfo
- Publication number
- CA2645313A1 CA2645313A1 CA2645313A CA2645313A CA2645313A1 CA 2645313 A1 CA2645313 A1 CA 2645313A1 CA 2645313 A CA2645313 A CA 2645313A CA 2645313 A CA2645313 A CA 2645313A CA 2645313 A1 CA2645313 A1 CA 2645313A1
- Authority
- CA
- Canada
- Prior art keywords
- end device
- user end
- simulator
- protocol
- identification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/60—Context-dependent security
- H04W12/63—Location-dependent; Proximity-dependent
Abstract
The invention relates to a method and a simulator (1) for identifying and/or tapping a mobile terminal (7) in a digital cellular mobile radio network, in which data is transmitted according to a code multiplex method. The aim of the invention is to enable a terminal (7) to be identified in a mobile radio network, in which data is transmitted according to a code multiplex method and if required to enable the tapping of conversations that are conducted via the mobile telephone. To achieve this: a simulator (1) is positioned in close proximity to the terminal (7) to be identified; the parameters that are relevant to the data transmission of base stations (6) in the mobile radio network that are in close proximity to the simulator (1) are determined by a measuring system (3; 11) and are transferred to the simulator (1); the simulator (1) is operated as a new base station (2), taking into consideration the determined parameters, but having another location area code; the terminal to be identified (7) recognizes the simulator (1) as a new base station (2) and logs on to said station using its identification parameters; the terminal (7) is identified by means of the transmitted identification parameters; after identification, the terminal (7) is redirected to a GSM mobile radio network.
Description
1=
Title: Method and device for identifying a mobile terminal in a digital cellular mobile radio network Description Field of the Invention The present invention describes a process for the identification of a mobile user end device in a digital cellular mobile radio network through which data are transmitted according to a CDMA (Code Divisional Multiple Access) process. In addition, the invention describes a simulator for the identification of a mobile end device in a digital cellular mobile radio network through which data are transmitted in a CDMA (Code Divisional Multiple Access) process.
Related Art Security forces have among other matters the assignment to solve crimes that have already been committed and/or to prevent crimes from occurring. An important factor in fulfillment of these assignments is the ability in specific situations to identify a suspect on the basis of mobile telephone use and to listen in on, record, and evaluate conversations that the person holds over the mobile telephone. The security forces are empowered to do this through relevant legal ordinances and regulations. The goal is to gather the communication traces of a suspect in order to identify the person and / or the mobile telephone that was used and to record and evaluate the conversations that were held.
In the state of the art various mobile radio networks for the transmittal of data are known. Very widespread in use, both in terms of network coverage as also in terms of the number of mobile user end devices, are GSM (Global System for Mobile Communications) mobile radio networks. For the past few years UMTS (Universal Mobile Telecommunications System) mobile radio networks have been available and are becoming increasingly widespread.
These two standards differ from each other for example in authentication,
Title: Method and device for identifying a mobile terminal in a digital cellular mobile radio network Description Field of the Invention The present invention describes a process for the identification of a mobile user end device in a digital cellular mobile radio network through which data are transmitted according to a CDMA (Code Divisional Multiple Access) process. In addition, the invention describes a simulator for the identification of a mobile end device in a digital cellular mobile radio network through which data are transmitted in a CDMA (Code Divisional Multiple Access) process.
Related Art Security forces have among other matters the assignment to solve crimes that have already been committed and/or to prevent crimes from occurring. An important factor in fulfillment of these assignments is the ability in specific situations to identify a suspect on the basis of mobile telephone use and to listen in on, record, and evaluate conversations that the person holds over the mobile telephone. The security forces are empowered to do this through relevant legal ordinances and regulations. The goal is to gather the communication traces of a suspect in order to identify the person and / or the mobile telephone that was used and to record and evaluate the conversations that were held.
In the state of the art various mobile radio networks for the transmittal of data are known. Very widespread in use, both in terms of network coverage as also in terms of the number of mobile user end devices, are GSM (Global System for Mobile Communications) mobile radio networks. For the past few years UMTS (Universal Mobile Telecommunications System) mobile radio networks have been available and are becoming increasingly widespread.
These two standards differ from each other for example in authentication,
2 protection of integrity, and encrypting. While in GSM only the mobile user end device is required to authenticate itself over a base station, UMTS also requires that the base station authenticate itself with the mobile user end device. In the context of the protection of integrity in UMTS, the directing data that need to be transmitted over the mobile radio network are for example protected by signatures against tampering. In order to encrypt the data that are to be carried over the mobile radio network, special encrypting processes are implemented for UMTS, such as for example the Kazumi process. The UMTS encryption relates both to the user data as well as the direction data.
While a GSM mobile radio network implements a combination of frequency multiplex processes (FDMA - Frequency Divisional Multiple Access) and time multiplex processes (TDMA - Time Divisional Multiple Access) for the transmittal of data, a UMTS mobile radio network utilizes a code multipiex process (CDMA - Code Divisional Multiple Access) in which the data (signals) are transmitted to several sources or senders at the same time. In this case the data are assigned specific code patterns (so called Scrambling Code).
In addition there is for example a process, that is known according to DE 199 222 Al, for identification and listening in on a mobile user end device in a 20 digital cellular GSM mobile radio network. On the basis of the above noted examples and not complete listing of differences between a GSM mobile radio network and a mobile radio network, in which the data are transmitted according to the code multiplex process, as for example in a UMTS mobile radio network, the processes known for GSM networks cannot be easily transferred to UMTS networks.
The technical specification ETSI TS 133 108 V6.8.2 (3GPP TS 33.108 version 6.8.2 Release 6) from January 2005 describes very broadly the general technical requirements for UMTS handover interfaces, which allow "lawful interception" a feature defined for UMTS networks. This feature must be realized in all technical equipment of public communication networks. It gives public institutions the possibility to dial up on existing UMTS connections and
While a GSM mobile radio network implements a combination of frequency multiplex processes (FDMA - Frequency Divisional Multiple Access) and time multiplex processes (TDMA - Time Divisional Multiple Access) for the transmittal of data, a UMTS mobile radio network utilizes a code multipiex process (CDMA - Code Divisional Multiple Access) in which the data (signals) are transmitted to several sources or senders at the same time. In this case the data are assigned specific code patterns (so called Scrambling Code).
In addition there is for example a process, that is known according to DE 199 222 Al, for identification and listening in on a mobile user end device in a 20 digital cellular GSM mobile radio network. On the basis of the above noted examples and not complete listing of differences between a GSM mobile radio network and a mobile radio network, in which the data are transmitted according to the code multiplex process, as for example in a UMTS mobile radio network, the processes known for GSM networks cannot be easily transferred to UMTS networks.
The technical specification ETSI TS 133 108 V6.8.2 (3GPP TS 33.108 version 6.8.2 Release 6) from January 2005 describes very broadly the general technical requirements for UMTS handover interfaces, which allow "lawful interception" a feature defined for UMTS networks. This feature must be realized in all technical equipment of public communication networks. It gives public institutions the possibility to dial up on existing UMTS connections and
3, to listen in on conversations held over these connections. If the provisions described in this document were not fulfilled in UMTS networks, the identification and the listening in on user end devices would not be possible right from the start due to missing technical requirements.
WO 2005/011 318 Al describes how a simulator introduced into a GSM radio cell for listening in on conversations held over a mobile teiephone and operated as a virtual base station only accepts registration of the to be listened on user end device and rejects the registration of other user end devices. The objective is to reduce the load of the virtual base station caused by other user end devices during the listening in on the to be listened on user end device. For achieving this objective the virtual base station can transmit rejection signals to user end devices, which try to register with the virtual base station.
Summary of the Invention The present invention creates an opportunity for identifying a mobile telephone in a mobile radio network through which data are transmitted according to a code divisional multiple access (CDMA) process, especially in a UMTS mobile radio network, and - where desired - to also listen to conversations being held on the mobile telephone.
The solution of this task comprises a process for the identification of a mobile user end device in a digital cellular mobile radio network through which data are transmitted according to a first protocol, comprising the following steps all carried out in the realm of the first protocol:
- in proximity to a user end device to be identified a simulator is arranged;
- a measurement system determines in proximity to the simulator parameters of the base stations relevant for the transmission of data and transfers the relevant parameters to the simulator;
WO 2005/011 318 Al describes how a simulator introduced into a GSM radio cell for listening in on conversations held over a mobile teiephone and operated as a virtual base station only accepts registration of the to be listened on user end device and rejects the registration of other user end devices. The objective is to reduce the load of the virtual base station caused by other user end devices during the listening in on the to be listened on user end device. For achieving this objective the virtual base station can transmit rejection signals to user end devices, which try to register with the virtual base station.
Summary of the Invention The present invention creates an opportunity for identifying a mobile telephone in a mobile radio network through which data are transmitted according to a code divisional multiple access (CDMA) process, especially in a UMTS mobile radio network, and - where desired - to also listen to conversations being held on the mobile telephone.
The solution of this task comprises a process for the identification of a mobile user end device in a digital cellular mobile radio network through which data are transmitted according to a first protocol, comprising the following steps all carried out in the realm of the first protocol:
- in proximity to a user end device to be identified a simulator is arranged;
- a measurement system determines in proximity to the simulator parameters of the base stations relevant for the transmission of data and transfers the relevant parameters to the simulator;
4 - the simulator is operated as a new base station taking into consideration the obtained parameters;
- the to be identified user end device recognizes the simulator as a new base station and registers itself there;
- an authentication procedure is commenced, the to be identified user end device rejects the authentication procedure as erroneous, the simulator begins an identification procedure in the course of which the simulator asks the to be identified user end device for its identification parameters, the simulator receives the identification parameters of the to be identified user end device, and - the user end device is identified in the realm of the first protocol on the basis of the transmitted identification parameters.
Processes based on the invention are suggested through which relevant mobile radio network base station parameters for data transmission can be determined in spatial proximity to the simulator and can be utilized for the identification of the user end device. The simulator is thus arranged in spatial proximity to the to be identified user end device; that is, in the radio cell in which the user end device is registered. The located parameters include in particular the scrambling codes and / or the transmission strengths of the base stations that are used by the base stations that are arranged in proximity to the simulator. The scrambling code is a code pattern, with which the various transmitters are coded within the frame of a code multiplex process for the transmission of data. At that point the simulator is operated as a new base station selectively with a different Location Area Code than the original base station in which the identified user end device was originally registered.
For this purpose, the simulator has access to necessary means, for example a base station which enables the operation of a simulator as a base station in a mobile radio network.
In addition the simulator sends system information in fact within the same frequency band as the original base station, though at a higher transmission
- the to be identified user end device recognizes the simulator as a new base station and registers itself there;
- an authentication procedure is commenced, the to be identified user end device rejects the authentication procedure as erroneous, the simulator begins an identification procedure in the course of which the simulator asks the to be identified user end device for its identification parameters, the simulator receives the identification parameters of the to be identified user end device, and - the user end device is identified in the realm of the first protocol on the basis of the transmitted identification parameters.
Processes based on the invention are suggested through which relevant mobile radio network base station parameters for data transmission can be determined in spatial proximity to the simulator and can be utilized for the identification of the user end device. The simulator is thus arranged in spatial proximity to the to be identified user end device; that is, in the radio cell in which the user end device is registered. The located parameters include in particular the scrambling codes and / or the transmission strengths of the base stations that are used by the base stations that are arranged in proximity to the simulator. The scrambling code is a code pattern, with which the various transmitters are coded within the frame of a code multiplex process for the transmission of data. At that point the simulator is operated as a new base station selectively with a different Location Area Code than the original base station in which the identified user end device was originally registered.
For this purpose, the simulator has access to necessary means, for example a base station which enables the operation of a simulator as a base station in a mobile radio network.
In addition the simulator sends system information in fact within the same frequency band as the original base station, though at a higher transmission
5=
power than the original base station. The emission of another Location Area Code (LAC) simulates to the to be identified user end device a movement of the user end device in a new spatial area to which the other LAC is assigned.
However, the same objective can also be achieved if the simulator sends data with the same LAC as the original base station but with a higher power than the original base station, or at least with a power which makes the to be identified user end device to receive the data from the simulator with a higher power than the data received from the original base station. In this way the user end device is compelled to make an automatic registration with the simulator. For this purpose the user end device performs a so called Location Update.
On the basis of the identification parameters, the identification of the user end device can take place. The identification parameters include for example an IMSI (International Mobile Subscriber Identity), a TMSI (Temporary Mobile Subscriber Identity), P-TMSI (Packet TMSI) and / or an IMEI (International Mobile Equipment Identity). These identification parameters are sufficient to adequately develop a connection between the simulator and the to be identified user end device for the purpose of listening to the conversation being held over the user end device. For this purpose the simulator has available sufficient means, for example a user end device which permits the operation of the simulator as a user end device for the development of a connection to the to be identified user end device and for monitoring the connection and / or the conversation.
According to a preferred method of the invention, the measurement system is designed as a monitor-user end device which can be a part of the simulator.
Because user end devices transmit regardless of the relevant parameters of base stations in the mobile radio network in close proximity to the user end device needed for data transmissions, measurement systems based on the ideas of the invention can be employed.
power than the original base station. The emission of another Location Area Code (LAC) simulates to the to be identified user end device a movement of the user end device in a new spatial area to which the other LAC is assigned.
However, the same objective can also be achieved if the simulator sends data with the same LAC as the original base station but with a higher power than the original base station, or at least with a power which makes the to be identified user end device to receive the data from the simulator with a higher power than the data received from the original base station. In this way the user end device is compelled to make an automatic registration with the simulator. For this purpose the user end device performs a so called Location Update.
On the basis of the identification parameters, the identification of the user end device can take place. The identification parameters include for example an IMSI (International Mobile Subscriber Identity), a TMSI (Temporary Mobile Subscriber Identity), P-TMSI (Packet TMSI) and / or an IMEI (International Mobile Equipment Identity). These identification parameters are sufficient to adequately develop a connection between the simulator and the to be identified user end device for the purpose of listening to the conversation being held over the user end device. For this purpose the simulator has available sufficient means, for example a user end device which permits the operation of the simulator as a user end device for the development of a connection to the to be identified user end device and for monitoring the connection and / or the conversation.
According to a preferred method of the invention, the measurement system is designed as a monitor-user end device which can be a part of the simulator.
Because user end devices transmit regardless of the relevant parameters of base stations in the mobile radio network in close proximity to the user end device needed for data transmissions, measurement systems based on the ideas of the invention can be employed.
6 The actual name and the personal data of the user of the user end device are registered with the operator (known as a provider) of the mobile radio network and can be requested from it in the context of an official inquiry. Only the provider has access to cross-reference lists that enable the attribution of the IMSI to a user and / or of the IMSI to a call number. The TMSI is - as the name itself points out - only of a temporary nature and does not permit a clear attribution to a particular user or to a particular call number. For this reason, it is important that not only the TMSI but also the IMSI be available,, If the to be identified user end device transmits, at identification to the simulator, only the TMSI (Temporary Mobile Subscriber Identity) as the identification parameter, then the authentication procedure can begin. If the to be identified user end device however expects an authentication procedure, then it is proposed according to the further advantageous embodiment of the invention that after the registration of the user end device with the simulator - an authentication procedure is commenced;
- the to be identified user end device rejects the authentication procedure as erroneous;
- the simulator again begins an identification procedure in the course of which the simulator asks the to be identified user end device for its IMSI (International Mobile Subscriber Identity) or IMEI
(International Mobile Equipment Identity); and - the simulator receives the IMSI or the IMEI of the to be identified user end device.
According to this further embodiment initially an authentication procedure is started. However because the simulator, and / or the new base station, cannot identify themselves as being part of the simulator (which is required however in UMTS networks), the to be identified user end device rejects the authentication procedure as erroneous, for example on the basis of a MAC
error. Thus the simulator begins the identification procedure, through which the to be identified end device simulates an impression that the new base /
station (which is in fact a part of the simulator itself) requires, for identification purposes, the identification parameters (e.g. IMSI or IMEI) of the to be identified user end device. Thereafter the user end device transmits its IMSI
or IMEI to the simulator on the basis of which a clear identification of the user end device is possible.
According to a preferred embodiment of the invention, it is proposed that - the attempt to register with the simulator by the user end device to be identified, after the user end device has recognized the simulator as a new base station, be rejected or the connection between the user end device and the new base station be interrupted and / or disrupted by some other means; and - on the basis of a protocol to be used in the mobile radio network for the transmission of data the user end device be compelled to automatically register at another base station of another radio cell of another mobile radio network for the transmission of data according to another protocol.
As an advantage the to be identified user end device is forced upon rejection of the registration attempt into the mobile radio network to automatically register with a base station of a GSM (Global System for Mobile Communication) radio cell. Primarily the telephone conversations held over the identified user end device and the GSM radio cell are listened to with the aid of common listening methods for GSM mobile radio networks.
Upon successful identification of the user end device, the user end device is thus pointed to a conventional GSM mobile radio network. This can take place for example through defined information elements (IE), through interference (so called jamming) of the UMTS connection, or through other suitable means.
Upon a disruption or interference of the UMTS connection, the user end device is directed to create a connection over an alternative mobile radio network, particularly over the GSM network, on the basis of the protocol used for the data transmission in the mobile radio network. This takes place for example in the context of a so called "Cell Reselection" procedure.
Following the development of the connection to the GSM network, the entire conversation process in the user end device proceeds in the usual manner according to the GSM standard. In order to listen to the conversations, usual processes can be applied such as for example those that are known from DE
199 20 222 Al. Reference is specifically made to this document in regard to the known methods for listening into a user end device in a GSM network. In this respect the content of this document is incorporated herein by reference.
According to another advantageous embodiment of the present invention it is proposed that following the identification of the user end device - by means of a monitor user end device the determined identification parameters and the security capabilities of the identified user end device be transmitted to a real base station of the mobile radio network;
- the real base station sends back RAND (random number) and AUTN (authentication token) to the monitor user end device;
- the simulator interrupts the connection to the real base station of the mobile radio network;
- the simulator is operated as an other base station of an other radio cell of a GSM mobile radio network and builds a connection to the identified device;
- an authentication procedure is initiated between the identified user end device and the simulator; and - where the authentication procedure is successfully terminated, the simulator causes the identified user end device not to use encryption in the subsequent data transmission.
The simulator establishes upon interruption of the connection to the real base station of the mobile radio network another connection to the identified user end device over a base station of a GSM (Global System for Mobile Communication) radio cell.
The monitor user end device is a preferred part of the simulator. The RAND
and AUTN number sets that the simulator obtains from a real base station of the mobile radio network involve parameters that are required in UMTS for the authentication of a base station in relation to a user end device. The monitor user end device simulates a real base station, in other words a desired connection, and causes the real base station to thus transmit RAND and AUTN to the simulator. From the point of view of the real base station, the simulator is a real user end device. It is only possible with the assistance of the RAND and AUTN parameters to establish a conversation connection between a base station and an identified user end device that is to be listened to.
The establishment of a connection to the user end device that is to be listened to proceeds on the basis of a simulated GSM base station of a GSM radio cell of a GSM mobile radio network. The simulated GSM base station is preferably part of the simulator. Following successful authentication, the simulated GSM base station sends security parameters to the user end device that is to be listened to. The security parameters encompass, among other things, a command to the user end device, to operate without encryption (the so-called "No Encryption" parameter); that is, to transmit non-encrypted data.
The proposed concept according to this embodiment works with two different mobile radio networks, namely the UMTS and the GSM networks. For this reason, the to be listened to user end device must be a Multi-Radio-Mode user end device which supports several differing mobile radio networks, namely UMTS and GSM networks. The concept encompasses a simulated GSM base station, a simulated UMTS base station, and a monitor user end device. The delay periods between the access to the authentication parameters and the suppression of the encryption should be as short as possible in order to prevent the real UMTS network from sending new RAND
and AUTN prior to the encryption suppression. The delay periods should be in the realm of a few seconds, maximally within a minute.
As a further solution to the problem of the present invention, beginning with a simulator for the identification of a mobile user end device in a digital cellular mobile radio network of the type described at the beginning herein, is a simulator characterized by - a measurement system for obtaining, from base stations located in the spatial proximity, parameters relevant for the transfer of data to the simulator;
- means of operating the simulator as a new base station while taking into consideration the obtained parameters, however with a different Location Area Code (LAC);
- means for receiving identification parameters of the to be identified user end device during registration of the user end device with the simulator; and - means for identifying the user end device on the basis of transmitted identification parameters.
As a preferred method the measurement system is designed as a monitor user end device.
According to a preferred embodiment of the present invention it is proposed that the simulator feature means for the execution of the processes according to the invention.
According to another aspect of the present invention, a process is suggested for the execution of gathering or manipulating access to a mobile user end device in a digital cellular mobile radio network through which data are transferred according to a primary protocol. The gathering or manipulating of access to the user end device comprises an interception, a determination of bearings and a locating of the user end device. What is proposed is that the end device be initially identified by some process in which it is located using an IMSI (International Mobile Subscriber Identity) contained on a SIM
(Subscriber Identity Module)-Card or by an IMEI (International Mobile Equipment Identity) assigned to the user end device. The entire identification of the user end device occurs within the environment of the digital cellular mobile radio network through which the data are transferred according to the first protocol (for example UMTS protocol). The identification begins with the operation of the UTRAN simulator within the mobile radio network as a virtual base station so that the to-be-identified user end device registers there and it ends with the determination of IMEI and / or IMSI. Thereafter the identified user end device is redirected to another mobile radio network for the execution of the gathering or manipulating accesses through which data are transferred according to a second protocol (for example, GSM protocol). In this manner generally known processes can be relied on for the interception, determination of bearings or locating of the identified user end device.
Without limitation to functionality, the capturing or manipulating access to the user end device can rely on existing mechanisms and tools.
Preferably the gathering or manipulating of access to the mobile user end device comprises a determination of bearings or a locating of the user end device. This takes place for example when information relating to the user end device, and especially information by which the position of the user end device can be determined, is transmitted to the UTRAN simulator. This information is preferably values for the field strengths with which the user end device receives signals from visible base stations of the mobile radio network.
By recognizing the network topology, especially of the position of the base stations, the bearings of the user end device can be determined and / or it can be located. While the determination of bearings solely comprises the determination of the user end device's direction, the locating shall also consist of a determination of the distance to the end device. Alternatively or additionally, information that is obtained via a satellite based positioning system (for example, Global Positioning System, GPS) relating to the position of the user end device can be transmitted from the user end device to the UTRAN simulator. This GPS information can be utilized on its own to locate the user end device or it can be used to correct the position of the user end device established via the field strengths of the received signals.
Brief Description of the Drawings A preferred design example for the invention is more closely shown in the following discussion with reference to the figures. They show:
Figure 1 a simulator according to the invention for the identification of a mobile user end device in a digital cellular mobile radio network according to a preferred design form;
Figure 2 a depiction of a UMTS radio cell with differing Location Area Codes;
Figure 3 a flow chart of a process according to the invention for the identification of a user end device according to a primary design form;
Figure 4 a flow chart of a process according to the invention for the identification of a user end device according to a second design form; and Figure 5 a flow chart of a process according to the invention for listening to a user end device according to the preferred design form.
Detailed Description of the Preferred Embodiments Security forces have, among other matters, the assignment to solve crimes that have already taken place and / or to prevent crimes from occurring. An important aspect in fulfilling these assignments is the ability in specific well grounded situations to identify a suspect on the basis of mobile telephone use and to listen in on, record, and evaluate conversations that the person holds over the mobile telephone.
There are various mobile radio networks for the transmission of data. Very widely used in terms of network coverage as well as in terms of the number of mobile user end devices in use are GSM (Global System for Mobile Communications) - mobile radio networks. For the past several years UMTS
(Universal Mobile Telecommunications System) mobile radio networks have become more available and increasingly used. Both standards differ for example in authentication, integrity protection, and encryption. A further difference is that in UMTS a so-called Code Division Multiple Access (CDMA) process is employed while in GSM a combination of Frequency Division Multiple Access and Time Division Multiple Access (FDMA/TDMA) processes are relied upon. On the basis of these significant differences, the processes and devices used for the identification and listening to a mobile user end device cannot be carried over to UMTS networks.
The present invention proposes for the first time a process through which at site identification and listening of user end devices belonging to suspects is possible even in UMTS mobile radio networks.
A device is shown in Figure 1 for executing the process according to the invention. The device appropriate to the invention is a so called UTRAN
(UMTS Terrestrial Radio Access Network) simulator. The simulator 1 includes a simulated UMTS base station 2, which is designated as NodeB, and a simulated monitor user end device 3, which works according to the UMTS
standard and is designated as Monitor UE (User Equipment). In addition the simulator 1 includes an RNC (Radio Network Controller) functionality 4.
Between the simulated NodeB 2 and the RNC-functionality 4, a so called lub intersection 5 is provided. In addition, a directing and service calculator 10 is provided which directs the steps of the process according to the invention.
In addition, the simulator 1 includes a simulated GSM base station 12 which is designated as a base station (BS) and a simulated GSM end station 13, which works according to the GMS standard. The simulated UMTS user end device 3 and the simulated GSM user end device 13 can be incorporated into a single unit. This is easily possible because the UMTS user end device normally include a GSM functionality in order to ensure a secure and reliable connection in areas with insufficient UMTS coverage. In any case the simulator 1 includes a BSC (Base Station Controller) functionality 14.
Between the simulated BS 12 and the BSC functionality, an intersection 15 is provided.
In addition an external measurement system 11 is provided which measures the parameters relevant for UMTS of the base stations in the vicinity of simulator 1. Naturally the measurement system 11 can also be integrated into the simulator 1. A UMTS monitor user end device 3 is preferably used as the measurement system 11 so that no additional measurement systems are required. The measurement system 3 and / or 11 establish an overview of the cellular UMTS environment which is then transmitted to the UTRAN simulator 1.
The simulator 1 is engaged for the implementation of the process in a real UMTS environment which includes a real base station (NodeB) 6 and a real user end device (UE) 7. Naturally there can be more base stations in the UMTS environment than the illustrated base station 6 and more user end devices than the illustrated user end device 7. The user end device 7 is the to be identified and possibly to be listened to user end device and is designated as the Target-UE. An optional UMTS user end device becomes, according to the terminology used herein, a Target-UE 7 when it is registered (also partially) or has been booked in the UTRAN simulator 1. Between the real user end device 7 and the simulated NodeB 2, a Uu air intersection 8 is provided. Between the simulated end device 3 and the real NodeB 6 a further air intersection 9 is provided.
In figure 2 a cellular UMTS mobile radio network is represented that comprises many radio cells 120-128, 130-133. Some of the radio cells 120-128 belong to a first so called Location Area whereby all radio cells are 5 attributed to the same Location Area Code (LAC) (for example LAC=1000).
Other radio cells 130-133 belong to a second location Area whereby all radio cells 130-133 are attributed to the same Location Area Code (for example LAC=2000) which differs from the first Location Area Code. Base stations (NodeBs) cover one or more of the radio cells (120-128), 130-133. The base 10 stations are however not shown in order to preserve the clear arrangement of Figure 2.
Figure 3 shows a flow chart of the process according to the invention for the identification of the end device 7. The process begins in a function block 20.
15 The simulator I is attributed to the spatially near to the to be identified UMTS
user end device 7 in a UMTS network (function block 21). The UTRAN
simulator is operated in one of the geographic radio cells 120-128, 130-133 in which the base station is booked on the to be identified user end device 7. It is possible that the user end device 7 is booked together with other user end devices on the base station. With the measurement system 3, 11; the base stations surrounding the simulator 1 with parameters relevant to UMTS are measured in a function block 22 and / or captured by some other method and transmitted to the simulator 1. These parameters include for example so called Scrambling Codes of the radio cells 120-128, 130-133, the transmission power of the base stations, the identification parameters of NodeBs, and systems information.
In a function block 23, the UTRAN simulator 1 sends on its part system information in the same frequency band as the neighboring base stations but with higher transmission power so that the user end devices located spatially near to the simulator 1(and thereby also the to be identified user end device
- the to be identified user end device rejects the authentication procedure as erroneous;
- the simulator again begins an identification procedure in the course of which the simulator asks the to be identified user end device for its IMSI (International Mobile Subscriber Identity) or IMEI
(International Mobile Equipment Identity); and - the simulator receives the IMSI or the IMEI of the to be identified user end device.
According to this further embodiment initially an authentication procedure is started. However because the simulator, and / or the new base station, cannot identify themselves as being part of the simulator (which is required however in UMTS networks), the to be identified user end device rejects the authentication procedure as erroneous, for example on the basis of a MAC
error. Thus the simulator begins the identification procedure, through which the to be identified end device simulates an impression that the new base /
station (which is in fact a part of the simulator itself) requires, for identification purposes, the identification parameters (e.g. IMSI or IMEI) of the to be identified user end device. Thereafter the user end device transmits its IMSI
or IMEI to the simulator on the basis of which a clear identification of the user end device is possible.
According to a preferred embodiment of the invention, it is proposed that - the attempt to register with the simulator by the user end device to be identified, after the user end device has recognized the simulator as a new base station, be rejected or the connection between the user end device and the new base station be interrupted and / or disrupted by some other means; and - on the basis of a protocol to be used in the mobile radio network for the transmission of data the user end device be compelled to automatically register at another base station of another radio cell of another mobile radio network for the transmission of data according to another protocol.
As an advantage the to be identified user end device is forced upon rejection of the registration attempt into the mobile radio network to automatically register with a base station of a GSM (Global System for Mobile Communication) radio cell. Primarily the telephone conversations held over the identified user end device and the GSM radio cell are listened to with the aid of common listening methods for GSM mobile radio networks.
Upon successful identification of the user end device, the user end device is thus pointed to a conventional GSM mobile radio network. This can take place for example through defined information elements (IE), through interference (so called jamming) of the UMTS connection, or through other suitable means.
Upon a disruption or interference of the UMTS connection, the user end device is directed to create a connection over an alternative mobile radio network, particularly over the GSM network, on the basis of the protocol used for the data transmission in the mobile radio network. This takes place for example in the context of a so called "Cell Reselection" procedure.
Following the development of the connection to the GSM network, the entire conversation process in the user end device proceeds in the usual manner according to the GSM standard. In order to listen to the conversations, usual processes can be applied such as for example those that are known from DE
199 20 222 Al. Reference is specifically made to this document in regard to the known methods for listening into a user end device in a GSM network. In this respect the content of this document is incorporated herein by reference.
According to another advantageous embodiment of the present invention it is proposed that following the identification of the user end device - by means of a monitor user end device the determined identification parameters and the security capabilities of the identified user end device be transmitted to a real base station of the mobile radio network;
- the real base station sends back RAND (random number) and AUTN (authentication token) to the monitor user end device;
- the simulator interrupts the connection to the real base station of the mobile radio network;
- the simulator is operated as an other base station of an other radio cell of a GSM mobile radio network and builds a connection to the identified device;
- an authentication procedure is initiated between the identified user end device and the simulator; and - where the authentication procedure is successfully terminated, the simulator causes the identified user end device not to use encryption in the subsequent data transmission.
The simulator establishes upon interruption of the connection to the real base station of the mobile radio network another connection to the identified user end device over a base station of a GSM (Global System for Mobile Communication) radio cell.
The monitor user end device is a preferred part of the simulator. The RAND
and AUTN number sets that the simulator obtains from a real base station of the mobile radio network involve parameters that are required in UMTS for the authentication of a base station in relation to a user end device. The monitor user end device simulates a real base station, in other words a desired connection, and causes the real base station to thus transmit RAND and AUTN to the simulator. From the point of view of the real base station, the simulator is a real user end device. It is only possible with the assistance of the RAND and AUTN parameters to establish a conversation connection between a base station and an identified user end device that is to be listened to.
The establishment of a connection to the user end device that is to be listened to proceeds on the basis of a simulated GSM base station of a GSM radio cell of a GSM mobile radio network. The simulated GSM base station is preferably part of the simulator. Following successful authentication, the simulated GSM base station sends security parameters to the user end device that is to be listened to. The security parameters encompass, among other things, a command to the user end device, to operate without encryption (the so-called "No Encryption" parameter); that is, to transmit non-encrypted data.
The proposed concept according to this embodiment works with two different mobile radio networks, namely the UMTS and the GSM networks. For this reason, the to be listened to user end device must be a Multi-Radio-Mode user end device which supports several differing mobile radio networks, namely UMTS and GSM networks. The concept encompasses a simulated GSM base station, a simulated UMTS base station, and a monitor user end device. The delay periods between the access to the authentication parameters and the suppression of the encryption should be as short as possible in order to prevent the real UMTS network from sending new RAND
and AUTN prior to the encryption suppression. The delay periods should be in the realm of a few seconds, maximally within a minute.
As a further solution to the problem of the present invention, beginning with a simulator for the identification of a mobile user end device in a digital cellular mobile radio network of the type described at the beginning herein, is a simulator characterized by - a measurement system for obtaining, from base stations located in the spatial proximity, parameters relevant for the transfer of data to the simulator;
- means of operating the simulator as a new base station while taking into consideration the obtained parameters, however with a different Location Area Code (LAC);
- means for receiving identification parameters of the to be identified user end device during registration of the user end device with the simulator; and - means for identifying the user end device on the basis of transmitted identification parameters.
As a preferred method the measurement system is designed as a monitor user end device.
According to a preferred embodiment of the present invention it is proposed that the simulator feature means for the execution of the processes according to the invention.
According to another aspect of the present invention, a process is suggested for the execution of gathering or manipulating access to a mobile user end device in a digital cellular mobile radio network through which data are transferred according to a primary protocol. The gathering or manipulating of access to the user end device comprises an interception, a determination of bearings and a locating of the user end device. What is proposed is that the end device be initially identified by some process in which it is located using an IMSI (International Mobile Subscriber Identity) contained on a SIM
(Subscriber Identity Module)-Card or by an IMEI (International Mobile Equipment Identity) assigned to the user end device. The entire identification of the user end device occurs within the environment of the digital cellular mobile radio network through which the data are transferred according to the first protocol (for example UMTS protocol). The identification begins with the operation of the UTRAN simulator within the mobile radio network as a virtual base station so that the to-be-identified user end device registers there and it ends with the determination of IMEI and / or IMSI. Thereafter the identified user end device is redirected to another mobile radio network for the execution of the gathering or manipulating accesses through which data are transferred according to a second protocol (for example, GSM protocol). In this manner generally known processes can be relied on for the interception, determination of bearings or locating of the identified user end device.
Without limitation to functionality, the capturing or manipulating access to the user end device can rely on existing mechanisms and tools.
Preferably the gathering or manipulating of access to the mobile user end device comprises a determination of bearings or a locating of the user end device. This takes place for example when information relating to the user end device, and especially information by which the position of the user end device can be determined, is transmitted to the UTRAN simulator. This information is preferably values for the field strengths with which the user end device receives signals from visible base stations of the mobile radio network.
By recognizing the network topology, especially of the position of the base stations, the bearings of the user end device can be determined and / or it can be located. While the determination of bearings solely comprises the determination of the user end device's direction, the locating shall also consist of a determination of the distance to the end device. Alternatively or additionally, information that is obtained via a satellite based positioning system (for example, Global Positioning System, GPS) relating to the position of the user end device can be transmitted from the user end device to the UTRAN simulator. This GPS information can be utilized on its own to locate the user end device or it can be used to correct the position of the user end device established via the field strengths of the received signals.
Brief Description of the Drawings A preferred design example for the invention is more closely shown in the following discussion with reference to the figures. They show:
Figure 1 a simulator according to the invention for the identification of a mobile user end device in a digital cellular mobile radio network according to a preferred design form;
Figure 2 a depiction of a UMTS radio cell with differing Location Area Codes;
Figure 3 a flow chart of a process according to the invention for the identification of a user end device according to a primary design form;
Figure 4 a flow chart of a process according to the invention for the identification of a user end device according to a second design form; and Figure 5 a flow chart of a process according to the invention for listening to a user end device according to the preferred design form.
Detailed Description of the Preferred Embodiments Security forces have, among other matters, the assignment to solve crimes that have already taken place and / or to prevent crimes from occurring. An important aspect in fulfilling these assignments is the ability in specific well grounded situations to identify a suspect on the basis of mobile telephone use and to listen in on, record, and evaluate conversations that the person holds over the mobile telephone.
There are various mobile radio networks for the transmission of data. Very widely used in terms of network coverage as well as in terms of the number of mobile user end devices in use are GSM (Global System for Mobile Communications) - mobile radio networks. For the past several years UMTS
(Universal Mobile Telecommunications System) mobile radio networks have become more available and increasingly used. Both standards differ for example in authentication, integrity protection, and encryption. A further difference is that in UMTS a so-called Code Division Multiple Access (CDMA) process is employed while in GSM a combination of Frequency Division Multiple Access and Time Division Multiple Access (FDMA/TDMA) processes are relied upon. On the basis of these significant differences, the processes and devices used for the identification and listening to a mobile user end device cannot be carried over to UMTS networks.
The present invention proposes for the first time a process through which at site identification and listening of user end devices belonging to suspects is possible even in UMTS mobile radio networks.
A device is shown in Figure 1 for executing the process according to the invention. The device appropriate to the invention is a so called UTRAN
(UMTS Terrestrial Radio Access Network) simulator. The simulator 1 includes a simulated UMTS base station 2, which is designated as NodeB, and a simulated monitor user end device 3, which works according to the UMTS
standard and is designated as Monitor UE (User Equipment). In addition the simulator 1 includes an RNC (Radio Network Controller) functionality 4.
Between the simulated NodeB 2 and the RNC-functionality 4, a so called lub intersection 5 is provided. In addition, a directing and service calculator 10 is provided which directs the steps of the process according to the invention.
In addition, the simulator 1 includes a simulated GSM base station 12 which is designated as a base station (BS) and a simulated GSM end station 13, which works according to the GMS standard. The simulated UMTS user end device 3 and the simulated GSM user end device 13 can be incorporated into a single unit. This is easily possible because the UMTS user end device normally include a GSM functionality in order to ensure a secure and reliable connection in areas with insufficient UMTS coverage. In any case the simulator 1 includes a BSC (Base Station Controller) functionality 14.
Between the simulated BS 12 and the BSC functionality, an intersection 15 is provided.
In addition an external measurement system 11 is provided which measures the parameters relevant for UMTS of the base stations in the vicinity of simulator 1. Naturally the measurement system 11 can also be integrated into the simulator 1. A UMTS monitor user end device 3 is preferably used as the measurement system 11 so that no additional measurement systems are required. The measurement system 3 and / or 11 establish an overview of the cellular UMTS environment which is then transmitted to the UTRAN simulator 1.
The simulator 1 is engaged for the implementation of the process in a real UMTS environment which includes a real base station (NodeB) 6 and a real user end device (UE) 7. Naturally there can be more base stations in the UMTS environment than the illustrated base station 6 and more user end devices than the illustrated user end device 7. The user end device 7 is the to be identified and possibly to be listened to user end device and is designated as the Target-UE. An optional UMTS user end device becomes, according to the terminology used herein, a Target-UE 7 when it is registered (also partially) or has been booked in the UTRAN simulator 1. Between the real user end device 7 and the simulated NodeB 2, a Uu air intersection 8 is provided. Between the simulated end device 3 and the real NodeB 6 a further air intersection 9 is provided.
In figure 2 a cellular UMTS mobile radio network is represented that comprises many radio cells 120-128, 130-133. Some of the radio cells 120-128 belong to a first so called Location Area whereby all radio cells are 5 attributed to the same Location Area Code (LAC) (for example LAC=1000).
Other radio cells 130-133 belong to a second location Area whereby all radio cells 130-133 are attributed to the same Location Area Code (for example LAC=2000) which differs from the first Location Area Code. Base stations (NodeBs) cover one or more of the radio cells (120-128), 130-133. The base 10 stations are however not shown in order to preserve the clear arrangement of Figure 2.
Figure 3 shows a flow chart of the process according to the invention for the identification of the end device 7. The process begins in a function block 20.
15 The simulator I is attributed to the spatially near to the to be identified UMTS
user end device 7 in a UMTS network (function block 21). The UTRAN
simulator is operated in one of the geographic radio cells 120-128, 130-133 in which the base station is booked on the to be identified user end device 7. It is possible that the user end device 7 is booked together with other user end devices on the base station. With the measurement system 3, 11; the base stations surrounding the simulator 1 with parameters relevant to UMTS are measured in a function block 22 and / or captured by some other method and transmitted to the simulator 1. These parameters include for example so called Scrambling Codes of the radio cells 120-128, 130-133, the transmission power of the base stations, the identification parameters of NodeBs, and systems information.
In a function block 23, the UTRAN simulator 1 sends on its part system information in the same frequency band as the neighboring base stations but with higher transmission power so that the user end devices located spatially near to the simulator 1(and thereby also the to be identified user end device
7) are recognized by the simulator 1 as new (simulated) base stations.
Furthermore the simulator 1 transmits with a different Location Area Code (for example LAC=3000) so that the spatially near to the simulator 1 located user end devices (and thereby also the to be identified user end device 7) obtain the impression that they have moved spatially into a new area with a new LAC.
The LAC of the simulated base station 2 is selected in such a manner that it is not used by the regular base stations 6 in the vicinity of the simulator 1.
A so called location update procedure is initiated thereby in these user end devices (and thus also in the to be identified user end device 7) within the scope of which the user end devices register with their identification parameters at the simulated base station 2 (function block 24). The identification parameters include for example a IMSI (International Mobile Subscriber Identity), a TMSI (Temporary Mobile Subscriber Identity) and / or an IMEI (International Mobile Subscriber Identity). On the basis of these identification parameters the identification of the user end device 7 thus takes place in function block 25. The process for the identification of the user end device 7 ends in a function block 26. The simulated spatial region with a new LAC is shown in a figure 2 via reference indicator 140.
The actual name and the personal data of the user end device 7 user are registered with the operator (so called provider) of the mobile radio network and can be accessed there possibly in the scope of an official investigation or through other methods. Only the provider has at its disposal the so called Cross-Reference lists which enable the attribution of the IMSI to a user and /
or of the IMSI to a call number. The TMSI is - as the name already indicates - only temporary in nature and permits thus no clear attribution of a specific user or a specific call number. For this reason it is important that the IMSI
or the IMEI and not the TMSI be present.
In the event the to be identified user end device 7 is transmitted upon registration with simulator 1 in function block 24 only with the TMSI
(Temporary Mobile Subscriber Identity) as an identification parameter and waits for an authentication procedure, the invention can be supplemented according to the process flow chart in Figure 4 such that subsequent to the registration of the user end device 7 with the simulator 1 in a function block the authentication procedure is started. However because the simulator 1 and or the simulated base station 2 cannot identify itself as part of the simulator 1 in relation to user end device 7 (which is actually not required in UMTS networks), the to be identified user end device 7 rejects in a function block 28 the authentication procedure for example on the basis of a MAC
error. Thus the simulator 1 starts on its part in a function block 29 an identification procedure whereby the to be identified user end device received a simulated impression 7 that simulated base station 2 requires the IMSI of the to be identified user end device 7 for reasons of identification.
Thereupon the user end device 7 transmits in a function block 30 its IMSI to the simulator 1 on the basis of which the clear identification of the user end device 7 is possible within the function block 25. The process ends in function block 26.
Subsequent to the identification of the target user end device 7 according to the processes in figure 3 and figure 4, conversations received on or sent from the user end device 7 can be listened to by various methods. According to a first embodiment the flow chart of which is illustrated in Figure 5, the process to listen in on the user end device 7 begins in a function block 40. In a function block 41 the identification of the user end device 7 takes place. The block 41 thus includes all process steps 20 to 26 of Figure 3 and/ or 20 to 30 of Figure 4. Thereupon the Location Update procedures of the user end device 7 are rejected by the simulator 1 and / or the simulated base station 2 in a function block 42.
At this point the user end device 7 registers in a function block 43 according to a so called Cell Reselection procedure over the simulated GSM base station 12 in a GSM radio cell of a GSM network. UMTS user end devices must also be able according to their standard to be used in a GSM network. The rejection of a target user end device 7 by the UMTS network in the GSM
network can take place by various methods. Thus the rejection can occur for example through a command (a predetermined information) which is transmitted over a so called BCCH (Broadcast Control Channel). Alternatively, the rejection can also take place through optional information which is transmitted over the so called FACH (Forward Access Channel) or the so called DCCH (Dedicated Control Channel). The UTRAN simulator that is located in the UMTS user end devices contain this command (this information) and book themselves into an existing GSM network. One can imagine that the connection to the UMTS network can be restricted by other means for example through disruption (so called jamming) and can in the end be terminated.
All conversations that are received or sent over the target user end device 7 are now no longer carried over the UMTS network but over the GSM network.
More specifically the conversations are carried over the simulated GSM base station 12, the simulated GSM user end device 13, and further to a real GSM
base station 16. In a function block 44 the conversations can be listened to over a target user end device 7 in the GSM environment as it has been disclosed for example in DE 199 20 222 Al. The process then ends in a function block 45.
Naturally it is also possible to listen in to the conversations held over the target user end device 7 but also to perform already the identification of the user end device 7 in the GSM environment with conventional means. Thus even before the Location Update procedure is ended, it is diverted from the UMTS network to the GSM network and its IMSI and IMEI identity parameters are captured there in the GSM environment by means of known processes.
Furthermore at that point a further manipulation of the target user end device 7 is possible.
It is also possible according to the present invention to listen to conversations held over the target user end device 7 through a so called Quasi-Transparent process. For this it is required that the simulator 1 initially obtain security information from the real UMTS base station 6 and then build with this information a connection between a simulated GSM base station 12 and the user end device 7. In addition, with the aid of the identification parameters of the end user device 7 obtained prior thereto in the context of the identification, a connection needs to be built from the GSM user end device 13 to the real GSM base station 16. Conversations from or to the target user end device 7 are now no longer held directly to the real base station 6 and / or 16, but only indirectly over the UTRAN simulator 1. The listened to conversations can be recorded in full or in part in simulator 1 for example for later evaluation or evidentiary requirements. Furthermore the conversations are mandatorily directed over the GSM network and not over the UMTS network even if sufficient UMTS coverage exists.
Furthermore the simulator 1 transmits with a different Location Area Code (for example LAC=3000) so that the spatially near to the simulator 1 located user end devices (and thereby also the to be identified user end device 7) obtain the impression that they have moved spatially into a new area with a new LAC.
The LAC of the simulated base station 2 is selected in such a manner that it is not used by the regular base stations 6 in the vicinity of the simulator 1.
A so called location update procedure is initiated thereby in these user end devices (and thus also in the to be identified user end device 7) within the scope of which the user end devices register with their identification parameters at the simulated base station 2 (function block 24). The identification parameters include for example a IMSI (International Mobile Subscriber Identity), a TMSI (Temporary Mobile Subscriber Identity) and / or an IMEI (International Mobile Subscriber Identity). On the basis of these identification parameters the identification of the user end device 7 thus takes place in function block 25. The process for the identification of the user end device 7 ends in a function block 26. The simulated spatial region with a new LAC is shown in a figure 2 via reference indicator 140.
The actual name and the personal data of the user end device 7 user are registered with the operator (so called provider) of the mobile radio network and can be accessed there possibly in the scope of an official investigation or through other methods. Only the provider has at its disposal the so called Cross-Reference lists which enable the attribution of the IMSI to a user and /
or of the IMSI to a call number. The TMSI is - as the name already indicates - only temporary in nature and permits thus no clear attribution of a specific user or a specific call number. For this reason it is important that the IMSI
or the IMEI and not the TMSI be present.
In the event the to be identified user end device 7 is transmitted upon registration with simulator 1 in function block 24 only with the TMSI
(Temporary Mobile Subscriber Identity) as an identification parameter and waits for an authentication procedure, the invention can be supplemented according to the process flow chart in Figure 4 such that subsequent to the registration of the user end device 7 with the simulator 1 in a function block the authentication procedure is started. However because the simulator 1 and or the simulated base station 2 cannot identify itself as part of the simulator 1 in relation to user end device 7 (which is actually not required in UMTS networks), the to be identified user end device 7 rejects in a function block 28 the authentication procedure for example on the basis of a MAC
error. Thus the simulator 1 starts on its part in a function block 29 an identification procedure whereby the to be identified user end device received a simulated impression 7 that simulated base station 2 requires the IMSI of the to be identified user end device 7 for reasons of identification.
Thereupon the user end device 7 transmits in a function block 30 its IMSI to the simulator 1 on the basis of which the clear identification of the user end device 7 is possible within the function block 25. The process ends in function block 26.
Subsequent to the identification of the target user end device 7 according to the processes in figure 3 and figure 4, conversations received on or sent from the user end device 7 can be listened to by various methods. According to a first embodiment the flow chart of which is illustrated in Figure 5, the process to listen in on the user end device 7 begins in a function block 40. In a function block 41 the identification of the user end device 7 takes place. The block 41 thus includes all process steps 20 to 26 of Figure 3 and/ or 20 to 30 of Figure 4. Thereupon the Location Update procedures of the user end device 7 are rejected by the simulator 1 and / or the simulated base station 2 in a function block 42.
At this point the user end device 7 registers in a function block 43 according to a so called Cell Reselection procedure over the simulated GSM base station 12 in a GSM radio cell of a GSM network. UMTS user end devices must also be able according to their standard to be used in a GSM network. The rejection of a target user end device 7 by the UMTS network in the GSM
network can take place by various methods. Thus the rejection can occur for example through a command (a predetermined information) which is transmitted over a so called BCCH (Broadcast Control Channel). Alternatively, the rejection can also take place through optional information which is transmitted over the so called FACH (Forward Access Channel) or the so called DCCH (Dedicated Control Channel). The UTRAN simulator that is located in the UMTS user end devices contain this command (this information) and book themselves into an existing GSM network. One can imagine that the connection to the UMTS network can be restricted by other means for example through disruption (so called jamming) and can in the end be terminated.
All conversations that are received or sent over the target user end device 7 are now no longer carried over the UMTS network but over the GSM network.
More specifically the conversations are carried over the simulated GSM base station 12, the simulated GSM user end device 13, and further to a real GSM
base station 16. In a function block 44 the conversations can be listened to over a target user end device 7 in the GSM environment as it has been disclosed for example in DE 199 20 222 Al. The process then ends in a function block 45.
Naturally it is also possible to listen in to the conversations held over the target user end device 7 but also to perform already the identification of the user end device 7 in the GSM environment with conventional means. Thus even before the Location Update procedure is ended, it is diverted from the UMTS network to the GSM network and its IMSI and IMEI identity parameters are captured there in the GSM environment by means of known processes.
Furthermore at that point a further manipulation of the target user end device 7 is possible.
It is also possible according to the present invention to listen to conversations held over the target user end device 7 through a so called Quasi-Transparent process. For this it is required that the simulator 1 initially obtain security information from the real UMTS base station 6 and then build with this information a connection between a simulated GSM base station 12 and the user end device 7. In addition, with the aid of the identification parameters of the end user device 7 obtained prior thereto in the context of the identification, a connection needs to be built from the GSM user end device 13 to the real GSM base station 16. Conversations from or to the target user end device 7 are now no longer held directly to the real base station 6 and / or 16, but only indirectly over the UTRAN simulator 1. The listened to conversations can be recorded in full or in part in simulator 1 for example for later evaluation or evidentiary requirements. Furthermore the conversations are mandatorily directed over the GSM network and not over the UMTS network even if sufficient UMTS coverage exists.
Claims (23)
PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS:
1. Process for the identification of a mobile user end device (7) in a digital cellular mobile radio network, through which data are transmitted according to a first protocol, comprising the following steps executed within the range of the first protocol:
- a simulator is arranged in close proximity to the to be identified user end device (7);
- from a measurement system (11) the relevant parameters for data transmissions are determined by mobile radio network base stations (6) in close proximity to the simulator (1) and transferred to the simulator (1);
- subject to the determined parameters, the simulator (1) is operated as a new base station (2);
- the to be identified user end device (7) recognizes the simulator (1) as a new base station (2) and registers itself there, at which point - an authorization procedure is started in which the to be identified user end device (7) rejects the authentication procedure as erroneous, the simulator (1) starts the identification procedure during which the simulator (1) requests the to be identified user end device (7) for its identification parameters and the simulator (1) receives the identification parameters of the to be identified user end device (7); and - the user end device (7) is identified within the range of the first protocol on the basis of the transmitted identification parameter.
- a simulator is arranged in close proximity to the to be identified user end device (7);
- from a measurement system (11) the relevant parameters for data transmissions are determined by mobile radio network base stations (6) in close proximity to the simulator (1) and transferred to the simulator (1);
- subject to the determined parameters, the simulator (1) is operated as a new base station (2);
- the to be identified user end device (7) recognizes the simulator (1) as a new base station (2) and registers itself there, at which point - an authorization procedure is started in which the to be identified user end device (7) rejects the authentication procedure as erroneous, the simulator (1) starts the identification procedure during which the simulator (1) requests the to be identified user end device (7) for its identification parameters and the simulator (1) receives the identification parameters of the to be identified user end device (7); and - the user end device (7) is identified within the range of the first protocol on the basis of the transmitted identification parameter.
2. Process according to claim 1, characterized in that the registration attempt of the to be identified user end device (7) is rejected at the simulator (1) after the identification procedure or the connection between the user end device (7) and the new base station (2) is interrupted and / or disrupted by other means, the user end device (2) is forced to automatically register with another base station of another radio cell of an alternative mobile radio network through which the data are transmitted according to a second protocol that deviates from the first protocol, transmitted within the range of the second protocol of the to be identified user end device (7) in the context of a registration of its to be identified parameters, and the simulator (1) receives the identification parameters of the user end device (7).
3. Process according to claims 1 or 2, characterized in that the user end device (7) is rejected - after identification for the purpose of an interception, a determination of bearings, and / or a locating - to an alternative mobile radio network according to which the data are transmitted according to a second protocol that deviates from the first protocol.
4. Process according to one of the claims 1 to 3, characterized in that in the mobile radio network a UMTS protocol is used as the first protocol.
5. Process according to one of the claims 1 to 4, characterized in that in the alternative mobile radio network a GSM protocol is used as the second protocol.
6. Process according to one of the claims 1 to 5, characterized in that the measurement system (11) determines Scrambling Codes, operating frequencies, and / or transmission strengths used by the surrounding base stations (6) to be the relevant parameters for data transmission.
7. Process according to one of the claims 1 to 6, characterized in that the to be identified user end device (7) transmits upon registration with the simulator (1) and / or in the context of the identification procedure at least one of the following identification parameters to the simulator (1): IMSI, TMSI, P-TMSI and IMEI.
8. Process according to claim 7, characterized in that if the to be identified user end device (7) transmits upon registration with the simulator (1) solely the TMSI as the identification parameter, - an identification procedure is started and upon rejection by the to be identified user end device (7);
- an authentication procedure is started;
- the to be identified user end device (7) rejects the authentication procedure as erroneous;
- the simulator (1) starts again an identification procedure during the course of which the to be identified user end device (7) calls for its IMSI and / or its IMEI; and - the simulator (7) receives the IMSI and / or the IMEI of the to be identified user end device (7).
- an authentication procedure is started;
- the to be identified user end device (7) rejects the authentication procedure as erroneous;
- the simulator (1) starts again an identification procedure during the course of which the to be identified user end device (7) calls for its IMSI and / or its IMEI; and - the simulator (7) receives the IMSI and / or the IMEI of the to be identified user end device (7).
9. Process according to claims 1 to 8, characterized in that the simulator (1) transmits in the same frequency band yet at a higher performance than the base stations surrounding simulator (1).
10. Process according to claims 1 to 9, characterized in that the simulator (1) is operated in the same or in a spatially proximate located geographical radio cell (120-128, 130-133), in the base station (6) of which the to be identified user end device (7) is registered.
11. Process according to claims 1 to 10, characterized in that the to be identified user end device (7) is fooled by the presence of the simulator (1) operating as the new base station (2), by a movement of the user end device (7) in a new spatial field that is assigned another Location Area Code and, on the basis of the first protocol that is used in the mobile radio network for the transmission of data, and as a result of the first protocol that is used in the mobile radio network for the transmission of data, the user end device (7) is forced to automatically register with the simulator (1).
12. Process according to one of the claims 1 to 11, characterized in that - by means of a monitor user end device (2) the determined identity parameters and the security capability of the identified user end device (7) are transmitted to a real base station (6) of the mobile radio network;
- the real base station (6) sends back to the monitor user end device (3) a random number and an authentication token;
- the simulator (1) interrupts the connection to the real base station (6) of the mobile radio network;
- the simulator (1) is operated as a different base station (12) of another radio cell of a GSM-mobile radio network and builds a different connection to the identified user end device (7);
- an authentication procedure is started between the identified user end device (7) and the simulator (1); and - provided the authentication procedure ends successfully, the simulator (1) causes the identified user end device (7) not to use any encryption during the subsequent data transmission.
- the real base station (6) sends back to the monitor user end device (3) a random number and an authentication token;
- the simulator (1) interrupts the connection to the real base station (6) of the mobile radio network;
- the simulator (1) is operated as a different base station (12) of another radio cell of a GSM-mobile radio network and builds a different connection to the identified user end device (7);
- an authentication procedure is started between the identified user end device (7) and the simulator (1); and - provided the authentication procedure ends successfully, the simulator (1) causes the identified user end device (7) not to use any encryption during the subsequent data transmission.
13. A simulator (1), arranged in spatial proximity to a to be identified mobile user end device (7), for the identification of a mobile user end device (7) in a digital cellular mobile radio network, through which data are transmitted according to a first protocol, comprising:
- a measurement system (11) for the determination of the relevant parameters for the data transmission from base stations (6) of the mobile radio network in spatial proximity to the simulator (1);
- means (2) for operating the simulator (1) as a new base station in the mobile radio network subject to the determined parameters;
- means (2) for receiving identification parameters of the to be identified user end device (7) during the registration of the user end device (7) with the simulator (1), whereby - an authentication procedure is started, the to be identified user end device rejects the authentication procedure as erroneous, the simulator (1) starts an identification procedure during which the simulator (1) calls the to be identified user end device (7) for its identification parameters and the simulator (1) receives the identification parameters of the to be identified user end device (7); and - means (10) for the identification of the user end device (7) within the field of the first protocol on the basis of transmitted identification parameters.
- a measurement system (11) for the determination of the relevant parameters for the data transmission from base stations (6) of the mobile radio network in spatial proximity to the simulator (1);
- means (2) for operating the simulator (1) as a new base station in the mobile radio network subject to the determined parameters;
- means (2) for receiving identification parameters of the to be identified user end device (7) during the registration of the user end device (7) with the simulator (1), whereby - an authentication procedure is started, the to be identified user end device rejects the authentication procedure as erroneous, the simulator (1) starts an identification procedure during which the simulator (1) calls the to be identified user end device (7) for its identification parameters and the simulator (1) receives the identification parameters of the to be identified user end device (7); and - means (10) for the identification of the user end device (7) within the field of the first protocol on the basis of transmitted identification parameters.
14. Simulator (1) according to claim 13, characterized in that the simulator (1) possesses means to reject the registration attempt of the to be identified user end device (7) with the simulator (1) after the identification procedure or to interrupt and / or disrupt the connection between the user end device (7) and the new base station (2) in a different manner, whereby the user end device (7) is accordingly forced to transmit for an automatic registration at another base station of another radio cell of an alternative mobile radio network in which data are transmitted according to a second protocol that deviates from the first protocol, the to be identified user end device (7) transmits its identification parameters within the field of the second protocol in the context of the registration and the simulator (1) possesses means (12) for receiving the identification parameters of the to be identified user end device (7).
15. Simulator (1) according to claims 13 or 14, characterized in that the simulator (1) possesses means to execute a process according to one of the claims 3 to 12.
16. Process to execute the gathering or manipulating of access to a mobile user end device (7) in a digital cellular mobile radio network through which data are transmitted according to a first protocol, comprising the following steps:
- the user end device (7) is identified by determination of the IMSI
(International Mobile Subscriber Identity) contained on a SIM
(Subscriber Identity Module) card or of a IMEI (International Mobile Equipment Identity) assigned to the user end device, - whereby the entire identification occurs within the range of the digital cellular network in which the data are transmitted according to the first protocol, and - the mobile user end device (7), upon the identification of the mobile user end device (7), is directed toward processing the gathering or manipulating of access in a different mobile radio network by transmission of the data according to a second protocol.
- the user end device (7) is identified by determination of the IMSI
(International Mobile Subscriber Identity) contained on a SIM
(Subscriber Identity Module) card or of a IMEI (International Mobile Equipment Identity) assigned to the user end device, - whereby the entire identification occurs within the range of the digital cellular network in which the data are transmitted according to the first protocol, and - the mobile user end device (7), upon the identification of the mobile user end device (7), is directed toward processing the gathering or manipulating of access in a different mobile radio network by transmission of the data according to a second protocol.
17. Process according to claim 16, characterized in that the first protocol is a Universal Mobile Telecommunications System (UMTS) protocol.
18. Process according to claim 16, characterized in that the first protocol is a Global System for Mobile Communications (GSM) protocol.
19. Process according to claim 16, characterized in that the gathering and manipulating of access to the mobile user end device (7) comprises a determination of the bearings or a locating of the user end device (7).
20. Process according to claim 16, characterized in that the gathering or manipulating of access to the user end device (7) comprises of a transmission of information relating to the user end device (7).
21. Process according to claim 20, characterized in that within the realm of the information transmission, information relating to the actual position of the user end device (7) is transmitted.
22. Process according to claim 21, characterized in that values for the field strengths are transmitted by which the user end device (7) receives signals from visible base stations belonging to the mobile radio network.
23. Process according to claim 21, characterized in that information relating to the position of the user end device (7) is transmitted by means of a satellite based positioning system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CA2645313A CA2645313A1 (en) | 2008-11-27 | 2008-11-27 | Method and device for identifying a mobile terminal in a digital cellular mobile radio network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CA2645313A CA2645313A1 (en) | 2008-11-27 | 2008-11-27 | Method and device for identifying a mobile terminal in a digital cellular mobile radio network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2645313A1 true CA2645313A1 (en) | 2010-05-27 |
Family
ID=42211996
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA2645313A Abandoned CA2645313A1 (en) | 2008-11-27 | 2008-11-27 | Method and device for identifying a mobile terminal in a digital cellular mobile radio network |
Country Status (1)
| Country | Link |
|---|---|
| CA (1) | CA2645313A1 (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2860892A1 (en) * | 2013-10-10 | 2015-04-15 | EXFO Oy | Method and apparatuses for identifying a mobile device in wireless networks |
-
2008
- 2008-11-27 CA CA2645313A patent/CA2645313A1/en not_active Abandoned
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2860892A1 (en) * | 2013-10-10 | 2015-04-15 | EXFO Oy | Method and apparatuses for identifying a mobile device in wireless networks |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2619998C (en) | Method and device for identifying a mobile terminal in a digital cellular mobile radio network | |
| US10117094B2 (en) | Systems and methods for identifying rogue base stations | |
| Jover | LTE security, protocol exploits and location tracking experimentation with low-cost software radio | |
| US8155079B2 (en) | Method, measuring system, base station, network element, and measuring device | |
| EP1908319B1 (en) | Acquiring identity parameters by emulating base stations | |
| US20070115886A1 (en) | Method of verifying integrity of an access point on a wireless network | |
| Golde et al. | Let me answer that for you: Exploiting broadcast information in cellular networks | |
| Song et al. | Fake bts attacks of gsm system on software radio platform | |
| CN106686600B (en) | Method and device for detecting pseudo base station | |
| CN104581731A (en) | Determining method and system for mobile phone terminal hijack process by pseudo base station | |
| US6665530B1 (en) | System and method for preventing replay attacks in wireless communication | |
| CN104270762A (en) | Method for detecting false station in GSM and LTE network | |
| Hadžialić et al. | An approach to analyze security of GSM network | |
| AU2008200801B2 (en) | Process and device to identify a mobile user in a digital cellular mobile radio network | |
| US20090023424A1 (en) | Acquiring identity parameter | |
| Yocam et al. | 5G mobile networks: reviewing security control correctness for mischievous activity | |
| CA2645313A1 (en) | Method and device for identifying a mobile terminal in a digital cellular mobile radio network | |
| AU2012209008B2 (en) | Process and device to identify a mobile user in a digital cellular mobile radio | |
| Ziayi et al. | YAICD: Yet another IMSI catcher detector in GSM | |
| Lee et al. | Securing the wireless emergency alerts system | |
| EP1000520A1 (en) | System and method for preventing replay attacks in wireless communication | |
| Li et al. | The Dark Side of Scale: Insecurity of Direct-to-Cell Satellite Mega-Constellations | |
| Ziayi et al. | Research Article YAICD: Yet Another IMSI Catcher Detector in GSM | |
| KR101042525B1 (en) | Method and apparatus for preventing illegal tapping in wideband code division multiple access system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| FZDE | Discontinued |
Effective date: 20130613 |