Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/12—Applying verification of the received information
  • H04L63/126—Applying verification of the received information the source of the received data
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/10—Architectures or entities
  • H04L65/1016—IP multimedia subsystem [IMS]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/10—Architectures or entities
  • H04L65/102—Gateways
  • H04L65/1033—Signalling gateways
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/1066—Session management
  • H04L65/1073—Registration or de-registration
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2101/00—Indexing scheme associated with group H04L61/00
  • H04L2101/30—Types of network names
  • H04L2101/395—Internet protocol multimedia private identity [IMPI]; Internet protocol multimedia public identity [IMPU]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L61/00—Network arrangements, protocols or services for addressing or naming
  • H04L61/45—Network directories; Name-to-address mapping
  • H04L61/4588—Network directories; Name-to-address mapping containing mobile subscriber information, e.g. home subscriber server [HSS]

Definitions

• the invention lies in the field of detecting fraud in a network.
• VoIP networks are exposed to the Internet and to the imagination of its malicious actors (or hackers) in terms of attacks and attempts to impersonate IP networks.
• One of the objectives of the invention is to propose a solution to these problems.
• the invention proposes a centralized solution for detecting, on the fly, attempts of fraud in an IMS network, and in particular attempts at identity theft.
• the invention relates to a fraud detection method implemented by an HSS server in an IMS network.
• This process comprises: a step of receiving a message from an I-CSCF or S-CSCF entity, said message mentioning a public identity, a private identity and at least one address of a user in the IMS network,
• the fraud detection method according to the invention furthermore comprises:
• the invention relates to an HSS server comprising:
• the HSS server according to the invention furthermore comprises:
• the invention applies in particular, as described in detail later, to the UAR, MAR and SAR messages.
• the invention proposes to distinguish a malicious user (or hacker) from the legitimate user on the basis of his address in the IMS network.
• the fraud detection method according to the invention does not interfere with the services provided to the account owner.
• the detection of fraud is done on the fly, so that protective measures can be taken as quickly as possible, namely from the first fraudulent access.
• the message according to the invention comprises a binary indicator representative of whether or not the user accesses the IMS network through a NAT entity of address translation. .
• the address included in the message consists of:
• the invention thus makes it possible to detect hacker attacks accessing the IMS network directly or behind a NAT.
• the subsequent processing of the attacks by the operator can possibly take this parameter into consideration.
• the fraud detection method comprises, if the validity and the consistency of the aforementioned public and private identities is not verified, a step of incrementing a first associated fault counter to the set including public identity, private identity and address.
• the fraud detection method according to the invention furthermore comprises, when an inconsistency on an authentication scheme or an authentication failure has been detected, a step of incrementing a second fault counter associated with the set comprising the public identity, the private identity and the address.
• the fraud detection method comprises a step of updating a global fault counter associated with the public identity, this global fault counter totaling the sum of all the first and second counters associated with a set comprising this public identity.
• Each of these counters can be associated with one or more predetermined thresholds, specific fraud management actions being implemented when predetermined criteria based on these counters and thresholds are verified.
• the HSS server when one of these counters exceeds a first predetermined threshold, sends to the I-CSCF entity a message with the identifier of an S-CSCF fraud collection entity.
• This particular aspect of the invention makes it possible to redirect the registration requests sent by hackers to a "honeymoon" to analyze, understand and list the procedures used by the hackers to fraudulently use the accounts of the users.
• honeypot solutions used to date by some operators are not very effective because the probability that a hacker is trapped by such solutions is very low. Indeed, in the current state of the art, a hacker attacks such honeypot only by chance, for example when using an IP scan method to determine the addresses of its targets systematically or randomly.
• the HSS server when one of these counters exceeds a second predetermined threshold, the HSS server according to the invention sends to the I-CSCF entity an error code.
• the various steps of the fraud detection method mentioned above are determined by computer program instructions.
• the invention also relates to a computer program on an information carrier, this program being capable of being implemented in a server
• this program comprising instructions adapted to the implementation of the steps of the fraud detection method as mentioned above.
• Either of these programs can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form , or in any other desirable form.
• the invention also relates to an information carrier, irremovable, or partially or completely removable, readable by a computer, and comprising instructions of a computer program as mentioned above.
• the information carrier may be any entity or device capable of storing the program.
• the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium such as a hard disk, or a USB key ( "USB flash drive”.
• the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means.
• the program according to the invention can be downloaded in particular on an Internet type network.
• the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.
• FIG. 1 represents an HSS server, an I-CSCF entity and an S_CSCF entity conforming to a particular embodiment of the invention in an IMS network;
• FIGS. 2A, 2B and 2C respectively represent the hardware architecture of the HSS server, the I-CSCF entity and the S_CSCF entity of FIG. 1;
• FIG. 3 represents a message according to the invention
• FIG. 4 represents, in flowchart form, the main steps of a fraud detection method according to a particular embodiment of the invention.
• FIG. 1 represents an HSS server, an I-CSCF entity and an S-CSCF entity according to the invention in an IMS network. It also illustrates the different messages exchanged on the SIP and Diameter interfaces when registering a UE subscriber (solid lines) or a UE2 hacker (dashed lines) in this network. Only the messages necessary for the understanding of the invention are represented.
• the IMS network includes an FM fraud manager incorporating an S-CSCF2 entity used in a honeycomb as described later.
• the UE subscriber accesses the IMS network behind a NAT address translation equipment, and that the UE2 hacker directly accesses the IMS network, that is to say without the intermediary of a device. NAT.
• FIGS. 2A, 2B and 2C schematically represent the hardware architecture of the HSS server, the I-CSCF entity and the S-CSCF entity.
• each of these devices has the hardware architecture of a computer.
• the server HSS comprises a processor 11, a random access memory 12, a read-only memory ROM 13 and communication means 14.
• the read-only memory 13 comprises a computer program PI according to the invention for executing a fraud detection method according to the invention and whose main steps E10 to E60 will be described later with reference to FIG. .
• the entity I-CSCF comprises a processor 21, a random access memory 22, a ROM-type read only memory 23 and communication means 24.
• the read-only memory 23 comprises a computer program P2 according to the invention for the execution of a message sending method according to the invention and whose main steps F10 to F40 will be described later with reference to FIG. 5.
• the entity S-CSCF comprises a processor 31, a random access memory 32, a ROM ROM 33 and communication means 34.
• the read-only memory 33 comprises a computer program P3 according to the invention for the execution of a message sending method according to the invention and whose main steps G10 to G50 will be described later with reference to FIG. 6.
• This request comprises, as in known manner, a public identity IDPUB and a private identity IDPRIV of the UE subscriber or the hacker UE2.
• the I-CSCF server upon receipt of this registration request, queries the HSS server to know whether the public identities IDPUB and private IDPRIV are known to the latter and authorized to access the IMS network. For this purpose, the I-CSCF server sends a UAR message to the HSS server during a step F20. The HSS server receives this request UAR during a step E10. As in the prior art, this request UAR comprises the identities public IDPUB and private IDPRIV included in the registration request REGISTER.
• this request UAR furthermore comprises the public address ADPUB of the equipment issuing the registration request REGISTER, possibly supplemented by the private address ADPRIV of this equipment, when it accesses behind a device NAT address translation.
• a public address ADPUB is constituted by a pair (IP address @IPPUB, port @PORTPUB); likewise a private address ADPRIV is constituted by a couple (IP address @IPRIV, port @PORTPRIV).
• the UAR message is therefore in accordance with the MSG message represented in FIG.
• this MSG message includes a NAT binary indicator whose value is representative of whether or not the user accesses the IMS network via a NAT entity for address translation.
• the private address ADPRIV is present in the message MSG.
• the HSS server verifies, during a step E15, the validity and the coherence of the public identities IDPUB and private IDPRIV.
• the HSS server returns a UAA acknowledgment message to the entity
• the entity I-CSCF selects, as in known manner, an entity S-CSCF during a step F40 and makes it follow the registration request received at the step
• the S-CSCF entity receives this REGISTER registration request during a step G10.
• the HSS sends a MAR request to the HSS server to obtain the authentication information.
• this MAR request comprises the public identities IDPUB and private IDPRIV included in the registration request REGISTER.
• this request MAR furthermore includes the public address ADPUB of the equipment issuing the REGISTER registration request, possibly supplemented by the private address ADPRIV of this equipment, when it accesses behind a device NAT address translation.
• This MAR registration request conforms to the MSG message of the figure
• This MAR registration request is received by the HSS server during another instance of the already described step E10.
• the HSS entity implements step E15 to check the validity and consistency of IDPUB and IDPRIV private identities.
• the HSS server returns a MAA acknowledgment message to the S-CSCF entity during a step E31, this acknowledgment message being received from the S-CSCF entity during a step G30.
• the entity S-CSCF sends, during a step G40, a SAR request to the HSS to download the service profile of the subscriber.
• this SAR request includes the IDPUB and private identities IDPRIV included in the REGISTER registration request.
• this SAR request furthermore includes the public address ADPUB of the equipment issuing the REGISTER registration request, possibly supplemented by the private address ADPRIV of this equipment, when it accesses behind a device NAT address translation.
• This SAR request is therefore in accordance with the MSG message of FIG.
• This SAR registration request is received by the HSS server during another instance of the already described step E10.
• the HSS entity implements step E15 to check the validity and consistency of IDPUB public and IDPRIV private identities.
• the HSS server returns a SAA acknowledgment message to the entity
• step E31 this acknowledgment message being received from the S-CSCF entity during a step G50.
• the I-CSCF and S-CSCF entities according to the invention are distinguished from those known from the prior art in that they send, in each of the exchanges on the Diameter interfaces, ADPUB information enabling the identification the UE subscriber or the UE2 hacker by its transport IP address and its port (IP address and the UDP or TCP port on which the registration is received), possibly supplemented by ADPRIV private information when the access is done behind a NAT.
• ADPUB information enabling the identification the UE subscriber or the UE2 hacker by its transport IP address and its port (IP address and the UDP or TCP port on which the registration is received), possibly supplemented by ADPRIV private information when the access is done behind a NAT.
• ADPUB and ADPRIV addresses are accessible by the I-CSCF and S-CSCF entities, for example in the Via SIP header, in the Contact header or in any other piece of information known to those skilled in the art.
• this address information is provided to the HSS server in a new Attribute Value Pair attribute dedicated to that purpose or in existing TAVP Frame-iP Address with extension in the case of access. behind a NAT.
• step E20 or E32 it is memorized (step E20 or E32) information that a fraud has been detected for the triplet ENS ⁇ IDPUB public identity, IDPRIV private identity, ADPUB public address ⁇ , or when access is behind a NAT for the ENS quadruplet (IDPUB public identity, IDPRIV private identity, ADPUB public address, ADPRIV private address).
• a first counter CPT_PB_IDS associated with the set ENS triplet / quadruplet, incremented during a step E22 when the HSS detects a problem of validity and coherence of the identities public IDPUB or private IDPRIV (result of the negative test E15);
• a second counter CPT_PB_AUTH associated with the set ENS triplet / quadruplet, incremented during a step E35 when the HSS detects an inconsistency in an authentication scheme or an authentication failure
• CPT_PB_IDS CPT_PB_AUTH associated with all ENS triples / quads with this IDPUB public identity.
• the first counter CPT_PB_IDS is notably incremented (step E22) as soon as the following errors will be noticed by the HSS on receipt of the commands
• the second counter CPT_PB_AUTH is notably incremented (step E35) as soon as the following errors or information are observed or received by the HSS in the Diameter MAR and SAR commands:
• the global fault counter CPT_GLOB updated in step E37, makes it possible to detect an attack by address variations, in the case where the hacker does not change that an element of the address, for example the port, since in this case, the global counter would increase very quickly.
• two thresholds are defined for each of the counters and more precisely:
• These counters can be used to implement specific actions when a fraud is detected. They are preferentially reset or destroyed if no fraud is detected for a predetermined duration.
• the server HSS sends, during a step E42, a message MSG_FAULT to the fraud manager FM, this message including the public address and possibly the private address of the hacker UE2.
• An ALM alarm can be raised to the operator so that the operator can analyze the hacker's strategy.
• the server HSS when this condition is fulfilled, sends to the entity I-CSCF, during a step E45, a message UAA comprising the identifier S-CSCF2 of an entity S-CSCF of fraud collection.
• This S-CSCF name does not cause the release procedures of the S-CSCF assigned to the UE user who continues to have his service even though an attack is being made on his client account.
• the server HSS sends to the entity I-CSCF, during a step E55, a message comprising an error code ERR, for example the return code Diameter DIAMETER-ERROR-DROP.
• ERR error code
• the I-CSCF server may decide to stop responding to hacker messages; the hacker, thus obtaining more information in response to his attacks could thus put an end to it.
• the thresholds S2, S2 ', S2 will be chosen large enough that the honeycomb S-CSCF2 can recover sufficient relevant information on fraud.
• the communication means 14 of the HSS server are means for receiving the MSG messages, including UAR, MAR and SAR described above, from the I-CSCF or S-CSCF entities according to the invention.
• the processor 11 of the server HSS is able, by executing the instructions of the program PI stored in the memory 13 to check the validity and the coherence of said identities public IDPUB and private IDPRIV, and to detect an authentication problem on the IMS network ;
• the memory 12 of the HSS server is a means for storing information according to which fraud has been detected for a set comprising at least one public IDPUB identity, a private IDPRIV identity and at least one address ADPUB, ADPRIV.
• the communication means 24 and 34 of the I-CSCF and S-CSCF entities constitute means for sending a MSG message to an HSS server according to the invention.
• the information that a fraud has been detected is stored for a triplet or quadruplet set comprising the public IDPUB identity, the private identity and the ADPUB address, possibly ADPRIV when the access is behind a NAT.
• this information is memorized, not for a public identity IDPUB but for an implicit registration set 1RS (initials of the English words "Implicit Registration ID Set”) comprising this public identity.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Multimedia (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• General Business, Economics & Management (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=48613752

Family Applications (1)

Country Status (4)

Families Citing this family (3)

Family Cites Families (8)

• 2013
  • 2013-01-28 FR FR1350689A patent/FR3001595A1/fr not_active Withdrawn
• 2014
  • 2014-01-24 WO PCT/FR2014/050142 patent/WO2014114894A1/fr active Application Filing
  • 2014-01-24 EP EP14704851.6A patent/EP2949100A1/de not_active Withdrawn
  • 2014-01-24 US US14/763,461 patent/US20150358336A1/en not_active Abandoned

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events