CN101778364A - System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login - Google Patents
System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login Download PDFInfo
- Publication number
- CN101778364A CN101778364A CN200910247840A CN200910247840A CN101778364A CN 101778364 A CN101778364 A CN 101778364A CN 200910247840 A CN200910247840 A CN 200910247840A CN 200910247840 A CN200910247840 A CN 200910247840A CN 101778364 A CN101778364 A CN 101778364A
- Authority
- CN
- China
- Prior art keywords
- signaling
- message
- signaling message
- link
- card
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/126—Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
Abstract
The invention discloses a system and a method for discovering and governing the behaviors of copying SIM cards of mobile phones by adopting forced login. The system comprises a plurality of signalling information detecting and processing devices connected to relevant signaling links, a copied card analyzing server and a message transmitter. The system forces users copying the SIM cards to register again through analyzing the position updating messages of mobile users and transmitting a MAP_RESET massage to a mobile exchange center, the users copying the cards can not login networks again after defaulting, and then the system achieves the purpose of discovering and controlling the behaviors of illegally copying the SIM cards without the need of upgrading and the traditional network element and modifying data. The invention can be independently carried out without changing the traditional network equipment, simultaneously realize discovery and control on one system, avoid the problems that other modes need to modify the data of the traditional network equipment, are difficult to discover relevant numbers, have complicated use and the like, and provide an effective measure for telecom operators to control the behaviors of illegally copying the SIM cards to avoid the high losses of the operators.
Description
Technical field
The present invention relates to a kind of the discovery in the communications field and the system and method for administering the bootlegging SIM cards of mobile phones, specifically, repeat logon information by the SIM card that quasi real time notes abnormalities, force it to login again, reach and find and the purpose of administering the bootlegging SIM cards of mobile phones.
Background technology
The unlawful activities of duplicating SIM card in mobile network happen occasionally, and the bootlegging card sends refuse messages in a large number and dials overseas call, and operator is sustained a great loss, the serious impact signaling network, and also refuse messages also causes very big social danger.Need pursue the proper method for this reason, in time find and card is duplicated in control, effectively hit the activity of bootlegging SIM card.
Duplicating card is the software vulnerability that has utilized existing mobile radio communication, its mechanics is roughly as follows: many are duplicated almost while start-up logging under ownership different MS C (telephone exchange node) outside the province of card, because hour of log-on is separated by very near (in the several seconds), many are duplicated card and can successfully climb up network, send refuse messages then in a large number or call, at this moment user's current location of preserving in user attaching HLR (attaching position register) is to climb up the position of that card of network at last.
The method of improvement bootlegging card can increase the record controls program to position updating process on attaching position register, before same IMSI (international mobile subscriber identity) number is not finished login, do not allow on another MSC, to login, but this function relates to the Change In Design to the attaching position register of operation, have a big risk, difficult in real time.
In the MSC of network operation, there is the part type to have software vulnerability, after receiving CANCEL_LOCATION (position deletion) message, can't delete the data of corresponding number and stop its business, this has caused the invalid situation of CANCEL_LOCATION improvement that sends.
Summary of the invention
The object of the present invention is to provide the system and method for finding and administering the bootlegging SIM cards of mobile phones, by analyzing the location of mobile users updating message and sending the mode of MAP_RESET (move to use and reset) message to mobile switching centre, reach and implement to find and the purpose of administering the bootlegging SIM card, and do not need existing network element updating and data modification.
The technical scheme that realizes above-mentioned purpose is:
One of the present invention's a kind of the employing forces to land the system that finds and administer copying SIM cards of mobile phones, the communication network that it is formed based on several signalling points that are connected in the Signaling System Number 7 net by signaling link, wherein: signalling point comprises Signalling Transfer Point, telephone exchange gateway, media gateway, telephone exchange node, mobile switching centre, Visitor Location Register, attaching position register and short message service center, wherein: this system comprises that also some signaling message detection and processing devices, at least one duplicate card Analysis server and at least one signaling message transmitter, wherein:
Described each signaling message detection and processing device is connected in the signaling link that the Signaling System Number 7 net needs signalling message data is detected processing, and link to each other with the described card Analysis server that duplicates, this device is used to gather signaling message, in real time to duplicating card Analysis server reported position updating message;
The described card Analysis server that duplicates links to each other with the signaling message sender device with described each signaling message detection and processing device by data-interface, collection and analyzing and processing are upgraded signaling message from the location of mobile users of signaling message detection and processing device, according to mobile subscriber's position new feature more, sort out the doubtful IMSI number that duplicates card user; Instruction signaling message transmitter sends to force and duplicates the signaling message that card user moves back net;
Described signaling message transmitter is connected in the Signaling System Number 7 net by signaling link, by data link with duplicate the card Analysis server and link to each other, this signaling message transmitter initiates to force to duplicate the signaling message that card user moves back net to duplicating the mobile switching centre that card user logins according to the instruction of duplicating card Analysis server, and the report of the service managing server to the periphery signaling data and the operating state of receiving and dispatching.
Above-mentioned employing forces to land the system that finds and administer the bootlegging SIM cards of mobile phones, wherein: the described signaling message detection and processing device that in each signaling link, connects, laying respectively at attaching position register has on the signaling link of signaling relation, upgrades signaling message with collection position.
Above-mentioned employing forces to land the system that finds and administer the bootlegging SIM cards of mobile phones, and wherein: described and attaching position register has the signaling link of signaling relation to comprise signaling link between signaling link, attaching position register and the Signalling Transfer Point between signaling link, mobile switching centre and the Signalling Transfer Point between the Signalling Transfer Point.
Above-mentioned employing is forced to land the system that finds and administer the bootlegging SIM cards of mobile phones, and wherein: the transmission passage of described signaling link is the TDM mode, or the IP mode.
The present invention's two a kind of the employing forces to land the method for finding and administering copying SIM cards of mobile phones, wherein: comprise the following steps:
One) system is provided with some signaling message detection and processing devices, is connected the signaling link that is associated with attaching position register; Be provided with at least one and duplicate card Analysis server and at least one signaling message transmitter;
Two) system enters operating state:
The first step: the signaling message in detect transmitting, recognize the signaling message type when being location update message, stamp timestamp for this message, transmit and send to and duplicate the card Analysis server;
Second step: duplicate the card Analysis server after receiving location update message, to its classification of decoding, judge that identical IMSI number is in official hour, the position updating process of initiating continuously under different mobile switching centres sorts out as doubtful number, obtains the combination of IMSI number and MSC, then according to the IMSI number, calculate corresponding HLR number inside the province, extract the combination of HLR number and MSC number, enter the card improvement program of duplicating.
Above-mentioned employing forces to land the method for finding and administering copying SIM cards of mobile phones, wherein, the described card improvement program of duplicating, its step comprises:
1) message sender receives the combination of the HLR number and the MSC ID of self-replication card Analysis server;
2) these assembly codings are become the MAP_RESET signaling message, send to the mobile switching centre of described MSC ID by signaling network;
3) message sender is received and is receiveed the response, and the result is informed duplicate the card Analysis server.
Adopted above-mentioned technical scheme, native system duplicates the card Analysis server by some signaling message detection and processing devices, at least one and at least one signaling message transmitter constitutes, force to duplicate the mode that the SIM card user logins again by sending, effectively hit the activity of bootlegging SIM card, to reduce the loss of operator, standard network service order.The present invention can not transform conventional network equipment and independent enforcement, for common carrier finds that in real time duplicating SIM card with improvement provides safe effective means.
Description of drawings
Fig. 1 is the structural representation of one of networking mode example of the present invention;
Fig. 2 is two a structural representation of networking mode example of the present invention;
Fig. 3 is three a structural representation of networking mode example of the present invention;
Fig. 4 is that the present invention's two system enters the flow chart of operating state.
Specific embodiment
One of the present invention's a kind of the employing forces to land the system that finds and administer copying SIM cards of mobile phones, the communication network that it is formed based on several signalling points that are connected in Signaling System Number 7 net 3 by signaling link, wherein: signalling point comprises Signalling Transfer Point, telephone exchange gateway (MSC), media gateway, telephone exchange node, mobile switching centre, Visitor Location Register, attaching position register (HLR) and short message service center.
Native system comprises that also some signaling message detection and processing devices (MPM) 1, at least one duplicate card Analysis server 2 and at least one signaling message transmitter 4, wherein:
Each signaling message detection and processing device 1 is connected in the signaling link that Signaling System Number 7 net 3 needs signalling message data is detected processing, and with duplicate the card Analysis server and link to each other, this device is used to gather signaling message, in real time to duplicating card Analysis server 2 reported position updating message;
Duplicating card Analysis server 2 links to each other with signaling message sender device 4 with each signaling message detection and processing device 1 by data-interface, collection and analyzing and processing are upgraded signaling message from the location of mobile users of signaling message detection and processing device 1, according to mobile subscriber's position new feature more, sort out the doubtful IMSI number that duplicates card user; Instruction signaling message transmitter 4 sends to force and duplicates the signaling message that card user moves back net;
Signaling message transmitter 4 is connected in Signaling System Number 7 net 3 by signaling link, by data link with duplicate card Analysis server 2 and link to each other, this signaling message transmitter 4 initiates to force to duplicate the signaling message that card user moves back net to duplicating the mobile switching centre that card user logins according to the instruction of duplicating card Analysis server 2, and the report of the service managing server to the periphery signaling data and the operating state of receiving and dispatching.
The signaling message detection and processing device 1 that in each signaling link, connects, laying respectively at attaching position register has on the signaling link of signaling relation, upgrades signaling message with collection position; And attaching position register has the signaling link of signaling relation to comprise signaling link between signaling link, attaching position register and the Signalling Transfer Point between signaling link, mobile switching centre and the Signalling Transfer Point between the Signalling Transfer Point, the transmission passage of signaling link is TDM (time division multiplexing) mode, or IP (packet switching) mode.
Below in conjunction with accompanying drawing signaling message detection and processing device is positioned at attaching position register and is elaborated by the different networking modes on the signaling of the signaling relation connection road.
One of networking mode example: as shown in Figure 1: signaling message detection and processing device (MPM) 1 inserts on attaching position register (HLR) and signaling link that Signaling System Number 7 net 3 is connected; this networking mode can be protected all HLR of this province, finds and administer the copying SIM cards of mobile phones that all belong to this province.
Two of networking mode example: as shown in Figure 2: signaling message detection and processing device (MPM) 1 inserts on the signaling link of HSTP High Signaling Transport Point (HSTP) 5 and Low Level Signaling Transfer Point LSTP (LSTP), and this networking mode can protect that all these provinces roam into the other places and all other provinces to roam into the copying SIM cards of mobile phones of this province.Three of networking mode example: as shown in Figure 3: signaling message detection and processing device (MPM) 1 inserts on telephone exchange node (MSC) and signaling link that Signaling System Number 7 net 3 is connected; all other provinces of one-level that this networking mode can protect all these provinces not diffuse out roam into the copying SIM cards of mobile phones of this province, can effectively protect local MSC.
In actual applications, can adopt a kind of of above-mentioned networking mode or combination, but be not limited to the described networking method of attachment of embodiment.
The present invention's two a kind of the employing forces to land the method for finding and administering copying SIM cards of mobile phones, comprises the following steps:
One) equipment is inserted relevant signaling link, system is provided with some signaling message detection and processing devices, is connected the signaling link that is associated with attaching position register; Be provided with at least one and duplicate card Analysis server and at least one signaling message transmitter, MPM with no signaling point code working method be serially connected with the relevant signaling link that needs harassing call interception and with duplicate the card Analysis server and link to each other, message sender and Signalling Transfer Point set up the signaling link relation and with duplicate the card Analysis server and link to each other, system enters operating state then:
See also Fig. 4, the flow chart for system enters operating state comprises:
First step S1: recognizing site updating message step, the signaling message in detect transmitting recognizes the signaling message type when being location update message, for this message is stamped timestamp, and gathers and is duplicated the card Analysis server, otherwise transmit this signaling message;
The second step S2: gather and analytical procedure, duplicate the card Analysis server after receiving location update message, it is decoded sort out and analysis, with the message merger of identical IMSI number;
The 3rd step S3: judge whether identical IMSI number has initiated position updating process under different MSC, if under identical MSC, initiate, think that so this user duplicates card user, if under different MSC, initiate, carry out the 4th step S4 so;
The 4th step S4: whether the time interval of judging the position updating process of initiating at identical IMSI number under different MS C is less than 3 seconds, if then carry out the 41 step S41;
The 41 step S41: extraction step, assert that promptly this IMSI number is doubtful number, extract the combination of IMSI number and MSC;
The 5th step S5: analytical procedure, analyze the combination of interior identical IMSI number of certain hour and MSC, when MSC in specific model, occur above 3 times, assert that so this IMSI number is the high-risk card number sign indicating number that duplicates, IMSI that it is during this period of time all and MSC combination all extract, and find corresponding HLR number inside the province according to the IMSI number, refine the combination into HLR and VLR (virtual location register);
The 6th step S6: forwarding step, message sender is after the combination of receiving the HLR number that duplicates the card Analysis server and MSCID, on signaling link, initiate MAP_RESET (move to use and reset) flow process, send to the mobile switching centre of described MSC ID by signaling network, the corresponding MSC of notice forces this user to initiate location registers again, after this duplicates the card user arrearage, when logining once more, just can't the enjoy network business, and the result informed duplicate the card Analysis server.
Above embodiment is only for the usefulness that the present invention is described, but not limitation of the present invention, person skilled in the relevant technique, under the situation that does not break away from the spirit and scope of the present invention, can also make various conversion or modification, and the technical scheme that all are equal to also should belong within the category of the present invention, should be limited by each claim.
Claims (6)
1. one kind is adopted the system that forces to land discovery and administer copying SIM cards of mobile phones, the communication network that it is formed based on several signalling points that are connected in the Signaling System Number 7 net by signaling link, wherein: signalling point comprises Signalling Transfer Point, telephone exchange gateway, media gateway, telephone exchange node, mobile switching centre, Visitor Location Register, attaching position register and short message service center, it is characterized in that: this system comprises that also some signaling message detection and processing devices, at least one duplicate card Analysis server and at least one signaling message transmitter, wherein:
Described each signaling message detection and processing device is connected in the signaling link that the Signaling System Number 7 net needs signalling message data is detected processing, and link to each other with the described card Analysis server that duplicates, this device is used to gather signaling message, in real time to duplicating card Analysis server reported position updating message;
The described card Analysis server that duplicates links to each other with the signaling message sender device with described each signaling message detection and processing device by data-interface, collection and analyzing and processing are upgraded signaling message from the location of mobile users of signaling message detection and processing device, according to mobile subscriber's position new feature more, sort out the doubtful IMSI number that duplicates card user; Instruction signaling message transmitter sends to force and duplicates the signaling message that card user moves back net;
Described signaling message transmitter is connected in the Signaling System Number 7 net by signaling link, by data link with duplicate the card Analysis server and link to each other, this signaling message transmitter initiates to force to duplicate the signaling message that card user moves back net to duplicating the mobile switching centre that card user logins according to the instruction of duplicating card Analysis server, and the report of the service managing server to the periphery signaling data and the operating state of receiving and dispatching.
2. employing according to claim 1 forces to land the system that finds and administer the bootlegging SIM cards of mobile phones, it is characterized in that: the described signaling message detection and processing device that in each signaling link, connects, laying respectively at attaching position register has on the signaling link of signaling relation, upgrades signaling message with collection position.
3. employing according to claim 1 and 2 is forced to land the system that finds and administer the bootlegging SIM cards of mobile phones, it is characterized in that: described and attaching position register has the signaling link of signaling relation to comprise signaling link between signaling link, attaching position register and the Signalling Transfer Point between signaling link, mobile switching centre and the Signalling Transfer Point between the Signalling Transfer Point.
4. force to land the system that finds and administer the bootlegging SIM cards of mobile phones according to claim 1 or 2 or 3 described employings, it is characterized in that: the transmission passage of described signaling link is the TDM mode, or the IP mode.
5. one kind is adopted the method for forcing to land discovery and administering copying SIM cards of mobile phones, it is characterized in that: comprise the following steps:
One) system is provided with some signaling message detection and processing devices, is connected the signaling link that is associated with attaching position register; Be provided with at least one and duplicate card Analysis server and at least one signaling message transmitter;
Two) system enters operating state:
The first step: the signaling message in detect transmitting, recognize the signaling message type when being location update message, stamp timestamp for this message, transmit and send to and duplicate the card Analysis server;
Second step: duplicate the card Analysis server after receiving location update message, to its classification of decoding, judge that identical IMSI number is in official hour, the position updating process of initiating continuously under different mobile switching centres sorts out as doubtful number, obtains the combination of IMSI number and MSC, then according to the IMSI number, calculate corresponding HLR number inside the province, extract the combination of HLR number and MSC number, enter the card improvement program of duplicating.
6. employing according to claim 5 is forced to land the method for finding and administering copying SIM cards of mobile phones, it is characterized in that, and the described card improvement program of duplicating, its step comprises:
1) message sender receives the combination of the HLR number and the MSC ID of self-replication card Analysis server;
2) these assembly codings are become the MAP_RESET signaling message, send to the mobile switching centre of described MSC ID by signaling network;
3) message sender is received and is receiveed the response, and the result is informed duplicate the card Analysis server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910247840A CN101778364A (en) | 2009-12-31 | 2009-12-31 | System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910247840A CN101778364A (en) | 2009-12-31 | 2009-12-31 | System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101778364A true CN101778364A (en) | 2010-07-14 |
Family
ID=42514648
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200910247840A Pending CN101778364A (en) | 2009-12-31 | 2009-12-31 | System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101778364A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102137356A (en) * | 2010-08-05 | 2011-07-27 | 华为技术有限公司 | Method for detecting copying of SIM card, and method, device and system for monitoring short message |
| CN102204289A (en) * | 2011-05-26 | 2011-09-28 | 华为技术有限公司 | Method and device for intercepting copy card notes |
| CN102487508A (en) * | 2010-12-02 | 2012-06-06 | 中国移动通信集团吉林有限公司 | Method and device for identifying copy user identity module card number |
| CN103384383A (en) * | 2013-07-05 | 2013-11-06 | 福建富士通信息软件有限公司 | Anti-number-faking detection method |
| CN109089002A (en) * | 2017-06-13 | 2018-12-25 | 中国移动通信集团陕西有限公司 | A kind of method for blocking and equipment of the illegal networking telephone |
-
2009
- 2009-12-31 CN CN200910247840A patent/CN101778364A/en active Pending
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102137356A (en) * | 2010-08-05 | 2011-07-27 | 华为技术有限公司 | Method for detecting copying of SIM card, and method, device and system for monitoring short message |
| CN102487508A (en) * | 2010-12-02 | 2012-06-06 | 中国移动通信集团吉林有限公司 | Method and device for identifying copy user identity module card number |
| CN102487508B (en) * | 2010-12-02 | 2014-06-04 | 中国移动通信集团吉林有限公司 | Method and device for identifying copy user identity module card number |
| CN102204289A (en) * | 2011-05-26 | 2011-09-28 | 华为技术有限公司 | Method and device for intercepting copy card notes |
| WO2011144090A2 (en) * | 2011-05-26 | 2011-11-24 | 华为技术有限公司 | Method and apparatus for intercepting short message from duplicate card |
| WO2011144090A3 (en) * | 2011-05-26 | 2012-04-26 | 华为技术有限公司 | Method and apparatus for intercepting short message from duplicate card |
| CN102204289B (en) * | 2011-05-26 | 2013-10-09 | 华为技术有限公司 | Method and device for intercepting copy card notes |
| CN103384383A (en) * | 2013-07-05 | 2013-11-06 | 福建富士通信息软件有限公司 | Anti-number-faking detection method |
| CN109089002A (en) * | 2017-06-13 | 2018-12-25 | 中国移动通信集团陕西有限公司 | A kind of method for blocking and equipment of the illegal networking telephone |
| CN109089002B (en) * | 2017-06-13 | 2021-06-25 | 中国移动通信集团陕西有限公司 | Method and device for blocking illegal network telephone |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107683617B (en) | System and method for pseudo base station detection | |
| CN102694900B (en) | Phone call intercepting method and device | |
| CN100393144C (en) | Method for checking transmitting data volume | |
| Dabrowski et al. | The messenger shoots back: Network operator based IMSI catcher detection | |
| CN105516986A (en) | Method for detecting pseudo base station, terminal, data processor and system | |
| CN105307119A (en) | Pseudo base station positioning method based on RSSI base station signal estimation | |
| CN102685147B (en) | Mobile communication honeypot capturing system and implementation method thereof | |
| CN104244281A (en) | Base station detection method and base station detection device | |
| CN101778364A (en) | System and method for discovering and governing behaviors of copying SIM cards of mobile phones by adopting forced login | |
| CN105828413A (en) | Safety method of D2D mode B discovery, terminal and system | |
| CN104581731A (en) | Determining method and system for mobile phone terminal hijack process by pseudo base station | |
| CN104869554A (en) | System for realizing mobile communication through co-location of SIM card and corresponding method | |
| CN102387491B (en) | A kind of signaling tracking method and device | |
| CN113595799A (en) | Mobile network shooting range system and network flow attack simulation method | |
| CN103369482A (en) | Equipment and method for monitoring short messages of mobile terminal | |
| CN101827359A (en) | System and method for discovering and handling illegally copied SIM cards | |
| CN102098642B (en) | System and method for realizing short message transfer in mobile network | |
| EP2584814B1 (en) | Method and radio network control for tracking the international mobile station equipment identity of user equipment | |
| CN102858026B (en) | A kind of method of triggering ad-hoc location terminal, system and terminal | |
| CN102790979B (en) | Method and device for realizing priority alarm (PAM) in communication between machines | |
| CN106470408B (en) | A kind of international roaming short message protecting method, device and system | |
| CN101860832A (en) | Device and method for identifying shared mobile phone number of mobile phone subscriber | |
| CN103037337A (en) | Method intercepting sent short message and device thereof | |
| KR101253615B1 (en) | Security system on 3g wcdma networks | |
| CN105682082A (en) | Terminal identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C12 | Rejection of a patent application after its publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20100714 |