CN101014047A - Method for locating the attack source of multimedia subsystem network, system and anti-attack system - Google Patents

Method for locating the attack source of multimedia subsystem network, system and anti-attack system Download PDF

Info

Publication number
CN101014047A
CN101014047A CNA2007100636055A CN200710063605A CN101014047A CN 101014047 A CN101014047 A CN 101014047A CN A2007100636055 A CNA2007100636055 A CN A2007100636055A CN 200710063605 A CN200710063605 A CN 200710063605A CN 101014047 A CN101014047 A CN 101014047A
Authority
CN
China
Prior art keywords
attack
address information
prevention
clf
response message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CNA2007100636055A
Other languages
Chinese (zh)
Inventor
张瑞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CNA2007100636055A priority Critical patent/CN101014047A/en
Publication of CN101014047A publication Critical patent/CN101014047A/en
Priority to PCT/CN2007/070877 priority patent/WO2008095391A1/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis

Abstract

The invention provides one method, device and anti-attack system of one position IMS network attack source, which comprises the following steps: the anti-attack device tests attacks and sends require to CLF with require content composed of attacker source IP address information, CLF attacker source IP address information and sends the response information to the attack device; anti-attack device gets address information and positions attacker physical position.

Description

A kind of method, device and attack protection system of locating attack source of multimedia subsystem network
Technical field
The present invention relates to the communications field, method, device and the attack protection system in particularly a kind of location IMS (IP Multimedia System, IP Multimedia System) network attack source.
Background technology
Along with popularizing of Internet, the IP technology has obtained application more and more widely.At wireless communication field, 3G receives increasing concern as Internet especially in the expansion of wireless domain.The maker 3GPP of 3G standard (3rd GenerationPartnership Project, third generation partner program) has proposed the notion of IMS in Release 5 versions, formally IP is defined as the bearer network of the following core net of 3G.On this basis, ETSI (European Telecommunications StandardsInstitute, ETSI) etc. organize and proposed FMC (Fixed Mobile Convergence, fixing merge with moving) notion, will fix with the mobile core network unification to IMS.Thereby established IMS in the absolute leadership status that does not fix with mobile core network.
Because the bearer network of IMS is IP, so IMS has also inherited IP network problem under attack easily.Under present circumstances, the PC that a Daepori is logical can send tens thousand of attack messages each second, and this is enough to cause the nucleus equipment among the IMS to be busy with handling attack message, and request stops response to normal users.Typical dos attack that Here it is.
At dos attack, the most effective way is exactly to dispose attack-prevention-device at the core net edge, as fire compartment wall or SBC (Session Border Controler, Session Border Controller) with anti-attack ability.Particularly SBC equipment because have signaling, media processing capacity, so can not only resist the dos attack of IP layer, can also be resisted signaling and Media layer dos attack.Even but disposed fire compartment wall or SBC means as attack protection, can only obtain assailant's source IP address, owing to can't orient the physical location of attack, thereby the generation that can't stop to attack from root, network still can take a large amount of network bandwidths because of attack message, causes regular traffic quality deterioration even interruption.Therefore basic solution is to find out the source of attack as early as possible, cuts off the root of attacking, and guarantees professional normally carrying out.But because the IP address is often by the Dynamic Host Configuration Protocol server dynamic assignment in the IP network, thus by the IP address be can't consumer positioning physical location.
Summary of the invention
Can't be in order to overcome in the prior art by IP address location user's physical location, thus the shortcoming of the generation that can't stop to attack from root, and the embodiment of the invention has proposed method, device and the attack protection system in a kind of IMS of location network attack source.
The described technical scheme of the embodiment of the invention is as follows:
The embodiment of the invention provides the method in a kind of IMS of location network attack source, said method comprising the steps of:
Steps A: attack-prevention-device detects to attack and takes place, and sends query requests to the mutual network element CLF of session positioning function, and the described request content comprises assailant's source IP address information at least.
Step B: after the mutual network element CLF of described session positioning function receives query requests, search described assailant's source IP address information corresponding address information, and send response message, comprise described address information in the described response message to described attack-prevention-device.
Step C: described attack-prevention-device is obtained described address information after receiving the response message of mutual network element CLF of session positioning function, orients assailant's physical location according to described address information.
The embodiment of the invention also provides the device in a kind of IMS of location network attack source, and described device comprises enquiry module, respond module, and locating module.
Described enquiry module is used for sending query requests to the mutual network element CLF of session positioning function when attack-prevention-device detects the attack generation, and the described request content comprises assailant's source IP address information at least.
Described respond module is used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information corresponding address information, and send response message to described attack-prevention-device, comprise described address information in the described response message.
Described locating module obtains described address information after being used for response message that mutual network element CLF that described attack-prevention-device receives the session positioning function sends by respond module, orients assailant's physical location according to described address information.
The embodiment of the invention also provides a kind of system of attack protection, described system comprises the mutual network element CLF of attack-prevention-device and session positioning function, described attack-prevention-device comprises enquiry module and locating module, and the mutual network element CLF of described session positioning function comprises respond module;
Described enquiry module is used for sending query requests to the mutual network element CLF of session positioning function when attack-prevention-device detects the attack generation, and the described request content comprises assailant's source IP address information at least;
Described respond module is used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information corresponding address information, and send response message to described attack-prevention-device, comprise described address information in the described response message;
Described locating module obtains described address information after being used for response message that mutual network element CLF that described attack-prevention-device receives the session positioning function sends by respond module, orients assailant's physical location according to described address information.
The beneficial effect of the embodiment of the invention is:
The described technical scheme of the embodiment of the invention is in the IMS network, and mutual by attack-prevention-device and CLF realized the location to assailant's physical location, makes operator solve the problem of network attack from root.
Description of drawings
Fig. 1 be the embodiment of the invention 1 described a kind of in the IMS network flow chart of the method in the source of seat offence;
Fig. 2 be the embodiment of the invention 2 described a kind of in the IMS network structure chart of the system in the source of seat offence;
Fig. 3 is the structure chart of the system of the embodiment of the invention 3 described a kind of attack protections.
Embodiment
The invention will be further described below in conjunction with the drawings and specific embodiments.
At ETSI ES (ETSI Standard, ETSI's standard) defined CLF (Connectivity session Location and repository Function in 282 004 standards, session positioning function mutual) network element, the main effect of this network element is to preserve the information relevant with the IP address, comprising this IP address physical address corresponding information; Simultaneously, in ETSI ES 282 035 standards, defined the E4 interface of CLF and RACS (Resource and Admission Control Subsystem, resource and access control subsystem).Can inquire the information that the CLF network element is preserved by this interface, comprising IP address physical address corresponding information.When attack-prevention-device detects the attack generation, take out assailant's source IP address, obtain this IP address physical address corresponding information, the source that just can orient attack by the E4 interface from CLF then.
Embodiment 1:
Referring to Fig. 1, the embodiment of the invention proposed a kind of in the IMS network method in the source of seat offence.On attack-prevention-device, realize the E4 interface, mutual by attack-prevention-device and CLF, realization is to the location of assailant's physical location.Described method is as follows:
Step 101: attack-prevention-device starts the attack detecting function, if attack-prevention-device detects attack, just obtains assailant's source IP address by the source IP address of attack message, and assailant's source IP address is noted;
Step 102: attack-prevention-device is sent query requests by the E4 interface to CLF, and promptly according to inquiry request message of requirement structure of ETSI ES 282 035 standards, the content of request comprises the source IP address information of the assailant of record in the step 101 at least;
After step 103:CLF receives query requests, in database,,, generate a correct response message, comprising the physical address information that finds if search successfully according to assailant's source IP address information searching; If search failure, CLF generates an error response message, comprising the reason of mistake.CLF sends to attack-prevention-device with this response message by the E4 interface.
Step 104: after attack-prevention-device receives the response of CLF, if error message, parse error reason wherein and notify the keeper with the pattern of daily record or alarm; If correct response message parses address information wherein, and notify the keeper with the pattern of daily record or alarm.
In some cases, CLF possibly can't provide particular ip address physical address corresponding information, and the physical address information in the response message of step 103 can adopt logical address to replace.Logical address generally is meant when the user surfs the Net the user name of input, can obtain this user's information by user name, and the passport NO. of login and telephone number etc. when activating the service as the user can find this assailant's physical location by above-mentioned user's information.
In the present embodiment, attack equipment can be fire compartment wall or SBC, but be not limited to the said equipment, also can be other equipment, for example: P-CSCF (Proxy Call Session Control Function, Proxy Call Session Control Function), IDS (Intrusion Detect System intruding detection system etc.).
In the present embodiment, query requests and response message send by the E4 interface, in actual applications, also can send by other non-standard interface.
Embodiment 2
Referring to Fig. 2, the embodiment of the invention provides the system in a kind of IMS of location network attack source, and this system comprises enquiry module 201, respond module 202 and locating module 203.Wherein the output signal of enquiry module 201 is input to respond module 202, and the output signal of respond module 202 is input to locating module 203.
Enquiry module 201 is used for sending query requests to CLF when attack-prevention-device detects the attack generation, and this request content comprises assailant's source IP address information at least.
Respond module 202 is used for searching assailant's source IP address information corresponding address information in database after CLF receives the query requests that enquiry module 201 sends, and sends response message to attack-prevention-device, comprises above-mentioned address information in this response message.
Wherein respond module can be specially physical address respond module or logical address respond module.
The physical address respond module is used for after CLF receives the query requests that enquiry module 201 sends, in database, search assailant's source IP address information physical address corresponding information, and send response message to attack-prevention-device, comprise described physical address information in this response message.
The logical address respond module is used for after CLF receives the query requests that described enquiry module 201 sends, in database, search the logical address of assailant's source IP address information correspondence, and send response message to described attack-prevention-device, comprise described logical address in this response message.
Locating module 203 is used for obtaining the address information in the response message after attack-prevention-device receives the response message of CLF, orients assailant's physical location.
By the physical address information that the physical address respond module is sent, locating module 203 can be oriented assailant's physical location according to physical address information.
The logical address of sending by the logical address respond module, locating module 203 can be known this user's information according to logical address, the passport NO. of login and telephone number etc. when activating the service as the user can find this assailant's physical location by above-mentioned user's information.
In the present embodiment, attack-prevention-device is can be fire compartment wall, SBC, P-CSCF or IDS.
The described device of present embodiment also comprises the E4 interface, be used for described attack-prevention-device and send query requests by described E4 interface to the mutual network element CLF of described session positioning function, the mutual network element CLF that also is used for described session positioning function sends response message by described E4 interface to described attack-prevention-device.Above-mentioned E4 interface also can replace with other non-standard interface.
Embodiment 3
Referring to Fig. 3, present embodiment provides a kind of system of attack protection, and this system comprises attack-prevention-device and CLF, and described attack-prevention-device comprises enquiry module 201 and locating module 203, and described CLF comprises respond module 202;
Enquiry module 201 is used for sending query requests to CLF when attack-prevention-device detects the attack generation, and this request content comprises assailant's source IP address information at least.
Respond module 202 is used for after CLF receives the query requests that described enquiry module 201 sends, in database, search assailant's source IP address information corresponding address information, and send response message to attack-prevention-device, comprise above-mentioned address information in this response message.
Wherein respond module can be specially physical address respond module or logical address respond module.
The physical address respond module is used for after CLF receives the query requests that enquiry module 201 sends, in database, search assailant's source IP address information physical address corresponding information, and send response message to attack-prevention-device, comprise described physical address information in this response message.
The logical address respond module is used for after CLF receives the query requests that described enquiry module 201 sends, in database, search the logical address of assailant's source IP address information correspondence, and send response message to described attack-prevention-device, comprise described logical address in this response message.
Locating module 203 is used for obtaining the address information in the response message after attack-prevention-device receives the response message that CLF sends by respond module 202, orients assailant's physical location.
In the present embodiment, attack-prevention-device is can be fire compartment wall, SBC, P-CSCF or IDS.
The described system of present embodiment also comprises the E4 interface, be used for described attack-prevention-device and send query requests by described E4 interface to the mutual network element CLF of described session positioning function, the mutual network element CLF that also is used for described session positioning function sends response message by described E4 interface to described attack-prevention-device.Above-mentioned E4 interface also can replace with other non-standard interface.
The above embodiment of the present invention is by realizing the E4 interface on attack-prevention-device, when attack-prevention-device detects the attack generation, take out assailant's source IP address, obtain this IP address corresponding physical positional information by the E4 interface from CLF then, thereby oriented the source of attacking.The square attacking system that adopts the device among the embodiment 2 is because physical location that can seat offence person, thereby can solve the problem of network attack from root.
Above-described embodiment, the present invention embodiment a kind of more preferably just, the common variation that those skilled in the art carries out in the technical solution of the present invention scope and replacing all should be included in protection scope of the present invention.

Claims (13)

1, a kind of method of locating attack source of multimedia subsystem network is characterized in that, said method comprising the steps of:
Attack-prevention-device detects to attack and takes place, and sends query requests to the mutual network element CLF of session positioning function, and the described request content comprises assailant's source IP address information at least;
After the mutual network element CLF of described session positioning function receives query requests, search described assailant's source IP address information corresponding address information, and send response message, comprise described address information in the described response message to described attack-prevention-device;
Described attack-prevention-device is obtained described address information after receiving the response message of mutual network element CLF of session positioning function, orients assailant's physical location according to described address information.
2, the method in IMS network attack source, location as claimed in claim 1 is characterized in that described address information is physical address information or logical address.
3, the method in IMS network attack source, location as claimed in claim 1 is characterized in that described attack-prevention-device is fire compartment wall, Session Border Controller SBC, Proxy Call Session Control Function P-CSCF or intruding detection system IDS.
As the method in IMS network attack source, the described location of any claim among the claim 1-4, it is characterized in that 4, described query requests and described response message send by the E4 interface respectively.
5, a kind of device of locating IMS network attack source is characterized in that described device comprises enquiry module, respond module, and locating module;
Described enquiry module is used for sending query requests to the mutual network element CLF of session positioning function when attack-prevention-device detects the attack generation, and the described request content comprises assailant's source IP address information at least;
Described respond module is used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information corresponding address information, and send response message to described attack-prevention-device, comprise described address information in the described response message;
Described locating module is used for obtaining described address information after described attack-prevention-device receives the response message that the mutual network element CLF of session positioning function sends by respond module, orients assailant's physical location according to described address information.
6, the device in IMS network attack source, location as claimed in claim 5, it is characterized in that, described respond module is the physical address respond module, be used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information physical address corresponding information, and send response message to described attack-prevention-device, comprise described physical address information in the described response message.
7, the device in IMS network attack source, location as claimed in claim 5, it is characterized in that, described respond module is the logical address respond module, be used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search the logical address of described assailant's source IP address information correspondence, and send response message to described attack-prevention-device, comprise described logical address in the described response message.
8, the device in IMS network attack source, location as claimed in claim 5 is characterized in that described attack-prevention-device is: fire compartment wall, Session Border Controller SBC, Proxy Call Session Control Function P-CSCF or intruding detection system IDS.
9, the device of originating as the described location of any claim among claim 5-8 IMS network attack, it is characterized in that, described device also comprises the E4 interface, be used for described attack-prevention-device and send query requests by described E4 interface to the mutual network element CLF of described session positioning function, the mutual network element CLF that also is used for described session positioning function sends response message by described E4 interface to described attack-prevention-device.
10, a kind of attack protection system, it is characterized in that, described system comprises the mutual network element CLF of attack-prevention-device and session positioning function, and described attack-prevention-device comprises enquiry module and locating module, and the mutual network element CLF of described session positioning function comprises respond module;
Described enquiry module is used for sending query requests to the mutual network element CLF of session positioning function when attack-prevention-device detects the attack generation, and the described request content comprises assailant's source IP address information at least;
Described respond module is used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information corresponding address information, and send response message to described attack-prevention-device, comprise described address information in the described response message;
Described locating module obtains described address information after being used for response message that mutual network element CLF that described attack-prevention-device receives the session positioning function sends by respond module, orients assailant's physical location according to described address information.
11, attack protection as claimed in claim 8 system, it is characterized in that, described respond module is the physical address respond module, be used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search described assailant's source IP address information physical address corresponding information, and send response message to described attack-prevention-device, comprise described physical address information in the described response message.
12, attack protection as claimed in claim 8 system, it is characterized in that, described respond module is the logical address respond module, be used for after the mutual network element CLF of session positioning function receives the query requests that described enquiry module sends, search the logical address of described assailant's source IP address information correspondence, and send response message to described attack-prevention-device, comprise described logical address in the described response message.
13, as any described attack protection of claim system among the claim 10-12, it is characterized in that, described system also comprises the E4 interface, be used for described attack-prevention-device and send query requests by described E4 interface to the mutual network element CLF of described session positioning function, the mutual network element CLF that also is used for described session positioning function sends response message by described E4 interface to described attack-prevention-device.
CNA2007100636055A 2007-02-06 2007-02-06 Method for locating the attack source of multimedia subsystem network, system and anti-attack system Pending CN101014047A (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CNA2007100636055A CN101014047A (en) 2007-02-06 2007-02-06 Method for locating the attack source of multimedia subsystem network, system and anti-attack system
PCT/CN2007/070877 WO2008095391A1 (en) 2007-02-06 2007-10-11 A method for locating the attacking source of the ims network and a device and an anti-attacking system thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNA2007100636055A CN101014047A (en) 2007-02-06 2007-02-06 Method for locating the attack source of multimedia subsystem network, system and anti-attack system

Publications (1)

Publication Number Publication Date
CN101014047A true CN101014047A (en) 2007-08-08

Family

ID=38701328

Family Applications (1)

Application Number Title Priority Date Filing Date
CNA2007100636055A Pending CN101014047A (en) 2007-02-06 2007-02-06 Method for locating the attack source of multimedia subsystem network, system and anti-attack system

Country Status (2)

Country Link
CN (1) CN101014047A (en)
WO (1) WO2008095391A1 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008095391A1 (en) * 2007-02-06 2008-08-14 Huawei Technologies Co., Ltd. A method for locating the attacking source of the ims network and a device and an anti-attacking system thereof
CN101141305B (en) * 2007-10-08 2010-11-24 福建星网锐捷网络有限公司 Network security defensive system, method and security management server
CN102075365A (en) * 2011-02-15 2011-05-25 中国工商银行股份有限公司 Method and device for locating and protecting network attack source
WO2020107446A1 (en) * 2018-11-30 2020-06-04 北京比特大陆科技有限公司 Method and apparatus for obtaining attacker information, device, and storage medium

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1310526A (en) * 2001-04-06 2001-08-29 北京网警创新信息安全技术有限公司 Illegal network activity intercepting, monitoring, tracing, evidence collecting and emergency reacting system and method
KR100615470B1 (en) * 2001-05-09 2006-08-25 (주)트라이옵스 Cracker tracing and certification System Using for Web Agent and method thereof
KR100571994B1 (en) * 2004-03-31 2006-04-17 이화여자대학교 산학협력단 Method for detecting the source IP address spoofing packet and identifying the origin of the packet
US20060294588A1 (en) * 2005-06-24 2006-12-28 International Business Machines Corporation System, method and program for identifying and preventing malicious intrusions
CN101014047A (en) * 2007-02-06 2007-08-08 华为技术有限公司 Method for locating the attack source of multimedia subsystem network, system and anti-attack system

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008095391A1 (en) * 2007-02-06 2008-08-14 Huawei Technologies Co., Ltd. A method for locating the attacking source of the ims network and a device and an anti-attacking system thereof
CN101141305B (en) * 2007-10-08 2010-11-24 福建星网锐捷网络有限公司 Network security defensive system, method and security management server
CN102075365A (en) * 2011-02-15 2011-05-25 中国工商银行股份有限公司 Method and device for locating and protecting network attack source
WO2020107446A1 (en) * 2018-11-30 2020-06-04 北京比特大陆科技有限公司 Method and apparatus for obtaining attacker information, device, and storage medium
CN112789835A (en) * 2018-11-30 2021-05-11 北京比特大陆科技有限公司 Method, device, equipment and storage medium for acquiring attacker information

Also Published As

Publication number Publication date
WO2008095391A1 (en) 2008-08-14

Similar Documents

Publication Publication Date Title
US10805325B2 (en) Techniques for detecting enterprise intrusions utilizing active tokens
US8929360B2 (en) Systems, methods, media, and means for hiding network topology
Luo et al. Preventing DDoS attacks by identifier/locator separation
CN106936791B (en) Method and device for intercepting malicious website access
US20210243170A1 (en) Methods for processing encrypted domain name server, dns, queries received from user equipment in a telecommunication network
Le et al. Policy-based identification of iot devices’ vendor and type by dns traffic analysis
JP2008177714A (en) Network system, server, ddns server, and packet relay device
US9338657B2 (en) System and method for correlating security events with subscriber information in a mobile network environment
CN103812757A (en) Method and system for browser emergency call in real-time communication and mobile device
CN103428200A (en) Method and system for detecting the presence of rogue domain name service providers through passive monitoring
JP2008538470A (en) How to counter the transmission of unsolicited voice information
CN102075924B (en) Session state based method and system for detecting vulnerability of internet protocol (IP) multimedia subsystem (IMS)
CN108063833A (en) HTTP dns resolutions message processing method and device
JP2007200323A (en) Method for protecting sip-based application
KR20100044966A (en) Method, apparatus and system for manageing private network remotely using session initiation protocol
CN105471820A (en) Processing method and processing device for converged communication terminal discovery and ability detection
CN101014047A (en) Method for locating the attack source of multimedia subsystem network, system and anti-attack system
US20180288612A1 (en) User equipment and method for protection of user privacy in communication networks
Špaček et al. Current issues of malicious domains blocking
US9961163B2 (en) Method and system for notifying subscriber devices in ISP networks
McCloghrie An Administrative Infrastructure for SNMPv2
US10547638B1 (en) Detecting name resolution spoofing
JP4466597B2 (en) Network system, network management apparatus, network management method and program
Ovadia et al. {Cross-Router} Covert Channels
CN101997879B (en) Method and system for detecting vulnerabilities of IP multimedia subsystem

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C02 Deemed withdrawal of patent application after publication (patent law 2001)
WD01 Invention patent application deemed withdrawn after publication

Open date: 20070808