JP2020188394A - Terminal, control method of terminal, and program - Google Patents

Abstract

To provide a terminal that can determine an eavesdropping risk in a wireless communication system.SOLUTION: A terminal includes a generation unit, a transmission unit, and a determination unit. The generation unit generates a measurement report so that handover is made to a base station different from a serving base station. The transmission unit transmits the generated measurement report to the serving base station. The determination unit determines a type of the serving base station according to whether or not a response to the measurement report is transmitted from the serving base station.SELECTED DRAWING: Figure 1

Description

The present invention relates to terminals, terminal control methods and programs.

In the existing wireless communication method, it has been judged that the security of communication is guaranteed by applying encryption (Cipher) and integrity protection (Integrity Protection) to the communication in the wireless section. However, these countermeasures have not been devised sufficiently assuming a man-in-the-middle attack (MITM) in the radio section. Therefore, by using the IMSI (International Mobile Subscriber Identity) catcher or the like, it is possible to eavesdrop on wireless communication without being known to both the mobile terminal user and the communication system operator.

For example, as described in Non-Patent Documents 1 and 2, the actual state of wiretapping has become widely recognized mainly in the United States.

"US Justice Ministry New Regulations on Mobile Phone Surveillance Technology", September 4, 2015, [online], [Search April 26, 2019], Internet <URL: https://www.cnn. co.jp/usa/35069965.html> "US Justice Ministry to Strengthen Management of Mobile Phone Tracking Devices", September 4, 2015, [online], [Search April 26, 2019], Internet <URL: https://jp.wsj.com/ articles / SB10327460236075474355904581211491969817086>

The problem of eavesdropping is recognized at the specification stage of 5G (5th Generation) in 3GPP (Third Generation Partnership Project), and the security problems in the specifications that have already been found are taken measures. However, at the time of filing, the 5G specification for eavesdropping by the IMSI catcher treats it as an option. Therefore, even in next-generation wireless communication, there is no change in the situation where the risk avoidance of eavesdropping by the terminal user cannot be controlled.

In addition, government investigative agencies and intelligence agencies may be users of the IMSI catcher. In this case, it cannot be expected that the communication system operator (carrier) will determine whether or not there is a neutral MITM attack.

Therefore, a mechanism is desired in which the user (terminal user) can determine the risk of eavesdropping on the wireless communication system.

In the research for detecting the IMSI catcher, which has been conducted so far, the duplication of various IDs (Identifiers) has been mainly detected by a running test (drive test) or the like. For example, a cell ID, PLMN (Public Land Mobile Network), or the like has been used as an ID for detecting the duplication. The detection of the IMSI catcher using the duplication of IDs is a method using statistical processing on a geographical and time axis. Therefore, it is difficult to apply the detection of the IMSI catcher using the duplication of the ID to the normal communication (Call by Call).

An object of the present invention is to provide a terminal, a terminal control method and a program capable of determining the risk of eavesdropping in a wireless communication system.

According to the first aspect of the present invention, a generation unit that generates a measurement report such that a handover is executed to a base station different from the serving base station, and the generated measurement report are transmitted to the serving base station. A terminal is provided that includes a transmission unit and a determination unit that determines the type of the serving base station depending on whether or not a response to the measurement report has been transmitted from the serving base station.

According to the second aspect of the present invention, a step of generating a measurement report such that the handover is executed to a base station different from the serving base station, and a step of transmitting the generated measurement report to the serving base station. A terminal control method including a step of determining the type of the serving base station according to whether or not a response to the measurement report is transmitted from the serving base station is provided.

According to the third viewpoint of the present invention, the computer mounted on the terminal is subjected to a process of generating a measurement report such that a handover is executed to a base station different from the serving base station, and the generated measurement report. A program for executing a process of transmitting to the serving base station and a process of determining the type of the serving base station according to whether or not a response to the measurement report is transmitted from the serving base station is provided. To.

According to each viewpoint of the present invention, there are provided terminals, terminal control methods and programs that enable determination of the risk of eavesdropping in a wireless communication system. In addition, according to the present invention, other effects may be produced in place of or in combination with the effect.

It is a figure for demonstrating the outline of one Embodiment. It is a figure which shows the schematic structure of the wireless communication system which concerns on 1st Embodiment. It is a figure which shows an example of the processing structure of the terminal which concerns on 1st Embodiment. It is a figure which shows an example of the information stored in the signal quality storage part. It is a flowchart which shows an example of the base station determination operation of the terminal which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the operation of the wireless communication system which concerns on 1st Embodiment. It is a figure for demonstrating the operation of the terminal which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the operation of the wireless communication system which concerns on 1st Embodiment. It is a figure which shows an example of the hardware configuration of the terminal which concerns on 1st Embodiment.

First, an outline of one embodiment will be described. It should be noted that the drawing reference reference numerals added to this outline are added to each element for convenience as an example to aid understanding, and the description of this outline is not intended to limit anything. In the present specification and the drawings, elements that can be similarly described may be designated by the same reference numerals so that duplicate description may be omitted.

The terminal 100 according to one embodiment includes a generation unit 101, a transmission unit 102, and a determination unit 103 (see FIG. 1). The generation unit 101 generates a measurement report such that the handover is executed to a base station different from the serving base station. The transmission unit 102 transmits the generated measurement report to the serving base station. The determination unit 103 determines the type of the serving base station according to whether or not the response to the measurement report is transmitted from the serving base station.

The terminal 100 makes it possible for the user to detect an irregular base station such as that installed for the purpose of eavesdropping. Base stations, such as those installed for eavesdropping purposes, operate so that they remain connected to themselves by their nature. The terminal 100 uses this property to intentionally execute a handover procedure to a base station with poor radio wave conditions, and if the handover is not successful, the serving base station determines that the base station is installed for the purpose of eavesdropping or the like. That is, the terminal 100 can determine the possibility (risk) of a base station installed in the wireless communication system for the purpose of eavesdropping.

Specific embodiments will be described in more detail below with reference to the drawings.

[First Embodiment]
The first embodiment will be described in more detail with reference to the drawings.

FIG. 2 is a diagram showing a schematic configuration of a wireless communication system according to the first embodiment. Referring to FIG. 2, the wireless communication system includes a first base station 10-1 to 10-3, a second base station 20, and a terminal 30.

In the following description, unless there is a particular reason for distinguishing the first base stations 10-1 to 10-3, the term "first base station 10" is simply used. Further, it goes without saying that the configuration shown in FIG. 2 is an example and does not mean to limit the configuration of the wireless communication system.

The first base station 10 is a base station (regular base station) installed by a regular telecommunications carrier (carrier). The first base stations 10-1 to 10-3 shown in FIG. 2 form cells that are distinguished from PCI (Physical Cell Identifier) 1, PCI2, and PCI3, respectively.

The second base station 20 is a base station (camouflaged base station, irregular base station) installed for an illegal purpose such as eavesdropping. In FIG. 2, the second base station 20 is installed in the cell of PCI1.

For example, the second base station 20 behaves as if it were the first base station 10-1 with respect to the terminal 30, and is the terminal 30 with respect to the first base station 10-1. By behaving in this way, the communication between the first base station 10-1 and the terminal 30 is eavesdropped (intercepted).

The terminal 30 performs wireless communication with the base stations (first base station 10, second base station 20). In FIG. 2, the terminal 30 is housed in a cell of PCI1. Therefore, the PCI1 cell becomes the serving cell.

As described above, the second base station 20 is installed for the purpose of eavesdropping, and the user of the terminal 30 and the operator (carrier) of the first base station 10 are aware of the existence of the second base station 20. I don't recognize it.

The terminal 30 according to the first embodiment determines the possibility that an irregular base station such as the second base station 20 exists (that is, the possibility that its own communication is eavesdropped). Specifically, the terminal 30 determines whether the serving base station connected in the serving cell (the cell of PCI1 in FIG. 2) is the first base station 10 or the second base station 20. To do.

FIG. 3 is a diagram showing an example of a processing configuration (processing module) of the terminal 30 according to the first embodiment. Referring to FIG. 3, the terminal 30 includes a radio signal receiving unit 301, a radio signal transmitting unit 302, a signal strength measuring unit 303, a response message confirmation unit 304, a measurement report generating unit 305, and a timer unit 306. The signal quality storage unit 307 and the like are included. Further, the terminal 30 includes a handover control unit 308, an HMI (Human Machine Interface) unit 309, a base station determination unit 310, a determination processing history management unit 311 and a signal quality data change unit 312.

The radio signal receiving unit 301 and the radio signal transmitting unit 302 are connected to an antenna (not shown) to transmit and receive radio signals to and from the base station. The radio signal receiving unit 301 delivers the received signal to the signal strength measuring unit 303 and the response message confirmation unit 304.

The signal strength measuring unit 303 is a means for measuring the signal strength of the received signal. Further, the signal strength measuring unit 303 extracts the PCI from the received signal. The signal strength measuring unit 303 stores the signal strength and the PCI in association with each other in the signal quality storage unit 307.

The response message confirmation unit 304 is a means for confirming whether or not a response message (RRC Connection Reconfiguration message) from the base station has been received after the measurement report has been transmitted from the own device (terminal 30) to the base station.

The measurement report generation unit 305 is a means for generating a measurement report. More specifically, the measurement report generation unit 305 generates a base station determination measurement report (a measurement report in which a handover is executed to a base station different from the serving base station), which will be described later. The generated measurement report is transmitted to the base station via the radio signal transmission unit 302.

The timer unit 306 is a means for providing a timer function to the measurement report generation unit 305 and the handover control unit 308.

The signal quality storage unit 307 is a means (storage means) for storing the signal strength and PCI measured by the signal strength measuring unit 303. More specifically, that is, the signal quality storage unit 307 stores signal quality data in which the signal strength of the received signal from the base station including the serving base station is associated with the PCI of the cell covered by each base station.

For example, the signal quality storage unit 307 stores data as shown in FIG. With reference to FIG. 4, the signal strength of the signal received from each base station is stored for each PCI (for each cell).

The explanation is returned to FIG. The handover control unit 308 is a means for controlling the handover of the own device (terminal 30).

The HMI unit 309 is a means for providing an interface for receiving an operation by a user or the like of the terminal 30.

The base station determination unit 310 is a means for determining the type of the base station communicating with the own device. More specifically, the base station determination unit 310 determines the type of serving base station (regular base station, irregular base station) depending on whether or not a response to the measurement report is transmitted from the serving base station. judge. For example, in the example of FIG. 2, the base station determination unit 310 determines whether the terminal 30 is communicating with the first base station 10 or is likely to be communicating with the second base station 20. To do.

The determination processing history management unit 311 is a means for managing (memorizing) the determination result by the base station determination unit 310.

The signal quality data changing unit 312 is a means for changing the data (signal quality data; signal strength for each cell) acquired from the signal quality accumulating unit 307 in response to an instruction from the base station determination unit 310. As shown in FIG. 3, the signal quality data changing unit 312 is arranged between the signal quality accumulating unit 307 and the handover control unit 308. When the type of the serving base station is determined, the signal quality data changing unit 312 changes the signal quality data read from the signal quality accumulating unit 307, and transfers the changed signal quality data via the handover control unit 308. It is provided to the measurement report generation unit 305. As a result, when the type of the serving base station is determined, the measurement report generation unit 305 will generate the measurement report based on the signal quality data changed by the signal quality data change unit 312.

The operation mode of the terminal 30 includes a "normal mode" and a "determination mode".

In the normal mode, the base station determination unit 310 does not perform any special processing. In this case, the handover control unit 308 directly acquires the signal quality data in which the PCI and the signal strength are associated with each other from the signal quality storage unit 307.

In the determination mode, the signal quality data changing unit 312 changes the content of the signal quality data acquired from the signal quality accumulating unit 307, and provides the changed signal quality data to the handover control unit 308.

Regarding the operation mode of the terminal 30, the user of the terminal 30 may determine the operation mode and input the determined operation mode using the HMI unit 309. That is, the user may switch the timing at which the terminal 30 shifts to the operation of detecting the second base station 20. In this case, when the user selects the detection operation off (normal mode), the terminal 30 transmits a normal measurement report to the serving base station. On the other hand, when the user selects the detection operation on (determination mode), the terminal 30 transmits a base station determination measurement report described later to the serving base station.

Alternatively, the terminal 30 may switch the operation mode automatically (voluntarily). For example, when a handover occurs, the terminal 30 may transition to the normal mode when it is set to the determination mode and it is determined that the target base station is not a base station set for the purpose of eavesdropping or the like. .. Alternatively, the terminal 30 may switch the operation mode from the normal mode to the determination mode at regular or predetermined timings, and perform the determination of the base station intermittently (intermittently).

Subsequently, the operations of the base station determination unit 310, the determination processing history management unit 311 and the signal quality data change unit 312 in the determination mode will be described. Here, the second base station 20 is considered to have the following features due to its practical nature.

(1) The second base station 20 can easily put a target terminal (terminal to be eavesdropped) into its own cell.
(2) The second base station 20 makes it difficult for the target terminal to exit its own cell.
(3) The second base station 20 cannot cooperate with the base stations of other cells. For example, the second base station 20 cannot realize X2 handover and carrier aggregation.
(4) The second base station 20 often disguises PLMN or Cell ID. However, the second base station 20 may disguise other information.

In the disclosure of the present application, the terminal 30 determines the type of the base station by paying attention to the feature (2) among the above (1) to (4).

It is assumed that the second base station 20 ignores or discards the measurement report from the terminal 30 that expects a handover for the purpose of continuing eavesdropping. Further, the second base station 20 may send a message element falsification signal (a falsification signal advantageous to the second base station 20) to the first base station 10.

In the disclosure of the present application, the terminal 30 attempts a handover to a base station other than the serving base station having a signal strength assumed to be able to communicate with the own device, and determines (estimates) the type of the base station from the behavior of the serving base station.

FIG. 5 is a flowchart showing an example of the base station determination operation of the terminal 30 according to the first embodiment.

When the operation mode is set to the "determination mode", the base station determination unit 310 instructs the signal quality data change unit 312 to "data change operation" (step S101).

Upon receiving the instruction, the signal quality data changing unit 312 changes the signal quality data read from the signal quality accumulating unit 307 (step S102). Specifically, the signal quality data change unit 312 reads the above so that a measurement report is generated in which another neighbor base station (adjacent base station) is preferable as the connection destination of the terminal 30 as compared with the serving base station. Change the data.

More specifically, the signal quality data changing unit 312 makes the signal strength of the received signal received from the serving base station weaker than the signal strength of the received signal received from the neighbor base station adjacent to the serving base station. , Change the signal quality data.

The signal quality data changing unit 312 outputs the changed signal quality data (data in which PCI and signal strength are associated) to the handover control unit 308.

In the following description, the special measurement report generated based on the signal quality data changed by the signal quality data changing unit 312 will be referred to as a "base station determination measurement report".

The handover control unit 308 provides the measurement report generation unit 305 with the signal quality data acquired from the signal quality data change unit 312, and instructs the measurement report generation unit 305 to transmit the measurement report.

Upon receiving the instruction, the measurement report generation unit 305 generates a base station determination measurement report based on the acquired data and transmits it to the serving base station (step S103).

At that time, the measurement report generation unit 305 activates the reception waiting timer of the RRC Connection Reconfiguration message in the timer unit 306 (step S104). In the following description, the RRC Connection Reconfiguration message reception wait timer will be referred to as the "response message reception wait timer".

If the serving base station is the first base station 10, the serving base station transmits an RRC Connection Reconfiguration message to the terminal 30 in response to receiving the base station determination measurement report. In this case, the response message confirmation unit 304 recognizes the existence of the RRC Connection Reconfiguration message from the received signal acquired via the radio signal reception unit 301.

After that, the response message confirmation unit 304 notifies the handover control unit 308 that the RRC Connection Reconfiguration message has been received.

The handover control unit 308 releases (stops) the reception waiting timer of the response message set in the timer unit 306 in response to the reception of the message. When the timer for waiting for reception of the response message is released, the timer unit 306 notifies the base station determination unit 310 to that effect.

When the serving base station is the second base station 20, it is assumed that the serving base station does not transmit the RRC Connection Reconfiguration message to the terminal 30. Therefore, the reception waiting timer of the response message set in the timer unit 306 expires (expires). The timer unit 306 notifies the base station determination unit 310 that the timer for waiting for reception of the response message has expired.

The base station determination unit 310 receives notifications (timer release notification, timer expiration notification) from the timer unit 306.

When the timer expiration notification is received (step S105, Yes branch), the base station determination unit 310 determines that the serving base station is the second base station 20 (there is a high possibility that it is the second base station 20). (Step S106).

When the timer release notification is received (step S105, No branch), the base station determination unit 310 determines that the serving base station is the first base station 10 (step S107).

In this way, the base station determination unit 310 determines whether the serving base station is either a regular base station or an irregular base station, depending on whether or not a response to the measurement report is transmitted from the serving base station. judge. Specifically, the base station determination unit 310 determines that the serving base station is a regular base station when the response to the measurement report is transmitted from the serving base station within a predetermined period (before the timer expires). judge. On the other hand, the base station determination unit 310 determines that the serving base station is an irregular base station when the response to the measurement report from the serving base station is not transmitted within a predetermined period.

The base station determination unit 310 stores the determination result regarding the type of the base station in the determination processing history management unit 311. After that, the base station determination unit 310 notifies the user of the determination result via the HMI unit 309 (step S108).

In this way, when the reception waiting timer of the response message is canceled, the base station determination unit 310 determines that the serving base station is the first base station 10 and notifies the user to that effect. On the other hand, when the reception waiting timer of the response message expires, the base station determination unit 310 determines that the serving base station is the second base station 20, and notifies the user to that effect. That is, the base station determination unit 310 notifies the user that the base station (serving base station) being communicated may have been installed for the purpose of eavesdropping.

Subsequently, the operation of the wireless communication system according to the first embodiment will be described with reference to the drawings. FIG. 6 is a sequence diagram showing an example of the operation of the wireless communication system according to the first embodiment. The operation when the terminal 30 is connected to the first base station 10-1 will be described with reference to FIG.

The terminal 30 receives radio signals from each of the first base stations 10-1 to 10-3 and the second base station 20. The terminal 30 measures the signal strength (radio wave strength) from the received signal from each base station and detects the PCI (step S01). As shown in FIG. 2, when the second base station 20 is present in the serving cell, the PCI detected from the received signals from the first base station 10-1 and the second base station 20 is the same. Is assumed. In such a case, the terminal 30 rewrites the signal strength of the signal received earlier with the signal strength of the signal received later.

Here, the signal strength of the signal received from the serving cell (cell of PCI1) is referred to as S01, the signal strength of the signal received from the cell of PCI2 is referred to as S02, and the signal strength of the signal received from the cell of PCI3 is referred to as S03.

The terminal 30 is in the cell of PCI1 (in the cell covered by the serving base station). Therefore, the magnitude of the signal strength is
S01 (PCI1; serving cell)> S02 (PCI2)> S03 (PCI3)
It shall be in the order of. That is, the strength of the signal received by the serving cell (PCI1) is stronger than the strength of the signal received from the other cells (PCI2, PCI3).

Due to the signal strength relationship, the terminal 30 does not need to hand over from the serving base station (first base station 10-1) to another base station. However, in order to confirm the type of the base station, the terminal 30 transmits a measurement report (measurement report for determining the base station) to the serving base station (first base station 10-1) so that an unnecessary handover occurs. ..

Specifically, the terminal 30 sets the signal strength of the neighbor base station adjacent to the serving base station higher than the signal strength of the serving base station, and sets the measurement report for base station determination to the serving base station (first base station). 10-1) (step S02).

For example, the terminal 30 transmits a base station determination measurement report expected to be handed over to the first base station 10-2 installed in the cell of PCI2 to the serving base station (first base station 10-1). .. In this case, the signal strength of each cell included in the base station determination measurement report is
S02 (PCI2)> S01 (PCI1; serving cell)> S03 (PCI3)
It is set in the order of.

For example, as shown on the left side of FIG. 7, the signal intensities S01 to S03 corresponding to each of PCI1 to PCI3 are -10 dBm, -30 dBm, and -40 dBm. In this case, as shown on the right side of FIG. 7, the terminal 30 is a first base station (first base station 10-1 forming a cell of PCI1) to another base station (first base station 10-1 forming a cell of PCI2). The signal quality data is changed so that the handover to the base station 10-2) is executed.

The terminal 30 has a base station determination measurement report (for example, a report such as Event A5) for the purpose of determining the type of base station (first base station 10, second base station 20) that provides a serving cell. Is generated and transmitted to the serving base station.

Since the serving base station that has received the measurement report for base station determination is the first base station 10-1, the first base station 10-1 transmits an RRC Connection Reconfiguration message for handover to the terminal 30 ( Step S03 in FIG. 6).

Upon receiving the response message, the terminal 30 cancels the response message reception waiting timer set in the timer unit 306 (step S04).

Since the response message reception waiting timer has been canceled, the terminal 30 determines that the serving base station is the first base station 10-1 (step S05).

Next, the operation when the terminal 30 is connected to the second base station 20 will be described with reference to FIG. Even in this case, the operations in steps S01 to 02 are the same as the operations described with reference to FIG.

However, the second base station 20 that has received the base station determination measurement report operates so as to avoid the handover of the terminal 30 in order to continue fraudulent acts such as eavesdropping. Specifically, the second base station 20 discards the acquired base station determination measurement report (step S06).

As a result, the response message reception waiting timer set in the timer unit 306 of the terminal 30 expires (step S07).

Since the response message reception waiting timer has expired, the terminal 30 determines that the serving base station is the second base station 20 (step S08).

The second base station 20 disguises the terminal 30 with respect to the first base station 10-1, which is a serving cell, and makes the behavior of the true terminal 30 a true base for the purpose of eavesdropping. It is also conceivable to operate so as to reproduce the first base station 10-1 which is a station.

Specifically, the second base station 20 transfers the measurement report transmitted in step S02 of FIG. 8 to the first base station 10-1, but at that time, the second base station 20 transfers. It is assumed that the contents of the measurement report will be rewritten. That is, the second base station 20 rewrites and transfers the measurement report from "contents that the terminal 30 hands over" to "contents that the terminal 30 does not hand over". Therefore, the first base station 10-1 does not make a decision to execute the handover (Handover Decision).

The terminal 30 according to the first embodiment conveys to the user the risk determination status in which the communication destination base station is the second base station 20 acquired in step S08 of FIG. 8 to the user through the HMI unit 309. Supports the decision action to end and continue communication by. Regarding the notification of the risk determination result using the HMI unit 309, the terminal 30 can use the visual notification by the display and the notification by the voice tone.

As described above, the terminal 30 according to the first embodiment transmits a measurement report for causing the serving base station to perform an originally unnecessary handover in order to determine the type of the base station. If the base station that received the measurement report is a legitimate base station, the handover execution process proceeds according to the measurement report. On the other hand, if the base station that received the measurement report is an irregular base station, the measurement report is ignored and discarded.

The terminal 30 according to the first embodiment can determine the type of base station by the simple processing as described above. In the existing measures against the IMSI catcher, cell IDs are collected in advance by a drive test or the like, and suspicious cell ID allocation is discovered based on the collected cell IDs. As described above, with the existing measures, it is necessary to collect cell IDs and perform statistical processing, and it is difficult to judge the base station in real time (determination of the base station type in one measurement).

The determination using the drive test is a base station determination at the application layer level, and is not a detection means at a lower layer level. The terminal 30 according to the first embodiment can determine the type of base station only by transmitting a special measurement report to the serving base station, and complicated procedures such as collection of cell IDs and statistical processing can be performed. It becomes unnecessary.

As described above, in the countermeasure against the existing IMSI catcher in the same wireless technology system, it is necessary to collect information for determining the base station in advance by a drive test or the like. On the other hand, in the disclosure of the present application, it is not necessary to collect information in advance, and it is possible to determine the risk that the base station is performing an illegal act regardless of the location and under the same wireless system.

Subsequently, the hardware of each device constituting the wireless communication system will be described. FIG. 9 is a diagram showing an example of the hardware configuration of the terminal 30.

The terminal 30 has the configuration illustrated in FIG. For example, the terminal 30 includes a processor 411, a memory 412, an input / output interface 413, a communication interface 414, and the like. The components such as the processor 411 are connected by an internal bus or the like so that they can communicate with each other.

However, the configuration shown in FIG. 9 is not intended to limit the hardware configuration of the terminal 30. The terminal 30 may include hardware (not shown) or may not include an input / output interface 413 if necessary. Further, the number of processors 411 and the like included in the terminal 30 is not limited to the example of FIG. 9, and for example, a plurality of processors 411 may be included in the terminal 30.

The processor 411 is a programmable device such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). Alternatively, the processor 411 may be a device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). The processor 411 executes various programs including an operating system (OS).

The memory 412 is a RAM (Random Access Memory), a ROM (Read Only Memory), an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like. The memory 412 stores an OS program, an application program, and various data.

The input / output interface 413 is an interface of a display device or an input device (not shown). The display device is, for example, a liquid crystal display or the like. The input device is, for example, a device that accepts user operations such as a keyboard and a mouse.

The communication interface 414 is a circuit, a module, or the like that performs wireless communication with the base station. For example, the communication interface 414 includes an RF (radio frequency) circuit and the like.

The function of the terminal 30 is realized by various processing modules. The processing module is realized, for example, by the processor 411 executing a program stored in the memory 412. The program can also be recorded on a computer-readable storage medium. The storage medium may be a non-transient such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. In addition, the program can be downloaded via a network or updated using a storage medium in which the program is stored. Further, the processing module may be realized by a semiconductor chip.

Since the hardware configuration of the base station is obvious to those skilled in the art, the description thereof will be omitted.

[Modification example]
The configuration, operation, and the like of the wireless communication system described in the above embodiment are examples, and are not intended to limit the system configuration and the like.

For example, in the above embodiment, the result of detecting the second base station 20 is notified to the user (user of the terminal 30), but the result may be notified to the first base station 10. When the terminal 30 that has detected the second base station 20 subsequently connects to the first base station 10, it may notify the first base station 10 that the second base station 20 has been detected. For example, the terminal 30 sets the identifier of the second base station 20 and the geographical information (position information of the second base station 20) to the first base station 10 as "detecting the second base station 20". Notice. By such a notification, the existence of the second base station 20 illegally installed by a terrorist or the like becomes clear, and it is possible to eliminate the base station and prevent information leakage.

Alternatively, the terminal 30 may notify (report) the possibility that the serving base station is the second base station 20 to the notification receiving application server prepared in advance on the network. The application server may be prepared by a telecommunications carrier, or may be prepared and operated on the Internet or a corporate network by an organization using the terminal 30. Further, the timing of notification may be after the communication risk of the second base station 20 is reduced and the connection to the first base station 10 is made, or when the above notification is given via the second base station 20 immediately after the determination. The terminal 30 may make a report using an encryption technique such as TLS. When the terminal 30 notifies the application server via the second base station 20, the notification signal by the second base station 20 is detected to be discarded or tampered with by verifying the response signal from the application server. You may.

In the above embodiment, the terminal 30 transmits a measurement report intended for handover and expects to receive the response (RRC Connection Reconfiguration message). At that time, the terminal 30 determines that the communication destination base station may be the second base station 20 based on the result that the response cannot be received. However, even when the communication destination base station is the first base station 10, the handover execution decision (Handover Decision) is not made due to the resource status of the handover destination base station, and the RRC Connection Reconfiguration message may not be transmitted. is there. In consideration of such a case, the terminal 30 may repeatedly transmit the base station determination measurement report shown in FIGS. 6 and 8 and confirm whether or not the response message has been received. When the same result continues a predetermined number of times, the terminal 30 determines the determination result, or makes the above determination an odd number of times and determines the determination result by a majority vote. With such measures, the accuracy of base station determination of the communication destination base station can be improved.

Alternatively, the terminal 30 may replace the base station (target base station) that is expected to be handed over in the generation of the base station determination measurement report when the base station determination process is repeated. For example, the terminal 30 is expected to first transmit a base station determination measurement report that is expected to hand over to the first base station 10-2, and then expect to hand over to the first base station 10-3. A measurement report for determining a base station may be sent. In this way, the terminal 30 may change the expected handover destination base station to generate a determination measurement report.

The terminal 30 records the activation status and the determination result related to the base station determination process for a certain period in the determination process history management unit 311, and the base station determination unit 310 utilizes the history information (the activation status and the determination result) for the second. The possibility (probability) of the base station 20 of the above may be obtained by statistical processing. For example, the terminal 30 may calculate the possibility (probability) of the second base station 20 by dividing the number of times it is determined to be the second base station 20 by the total number of determinations made in a predetermined period. Good.

Here, there is a telecommunications carrier (carrier) that provides a service for notifying the user of the location information of the base station based on the cell ID. Alternatively, an Internet service company may also provide similar services. The terminal 30 may acquire the position of the base station from the cell ID of the base station acquired by using such a service, and display the mapping information of the base station centered on the own device on the display of the own device. .. At that time, the terminal 30 may display the risk determination information in which the communication destination base station is the second base station 20 in an overlapping manner. That is, the HMI unit 309 of the terminal 30 may provide the user with a display reflecting the determination result by the base station determination unit 310 on a map including the position information of the base station acquired based on the cell ID.

Depending on the implementation form of the second base station 20, the second base station 20 may use a unique cell ID instead of using the cell ID of the first base station 10. In such a case, the position of the second base station 20 cannot be specified from the above service (service for acquiring the position of the base station), or the first base station actually used in a distant place far away. It may overlap with the cell ID of 10. When such a second base station exists, the terminal 30 maps the second base station 20 on the map to display a map that is not actually possible, and the second base station 20 You can judge the existence or nonexistence.

In the above embodiment, when generating the measurement report for determining a base station, the order of signal strength is determined by paying attention to the selection of the expected handover destination base station. However, the terminal 30 may focus on the serving base station currently communicating and delete the signal strength of the serving base station from the base station determination measurement report. For example, the signal strength at a certain timing is S01 (PCI1; serving cell)> S02 (PCI2)> S03 (PCI3).
And.
After that, the signal strength is increased due to the movement of the terminal 30 or other factors.
S02 (PCI2)> S01 (PCI1; serving cell)> S03 (PCI3)
May change. Even in such a case, the terminal 30 prompts the serving base station to execute the handover process by deleting the determination measurement report or the information (signal strength) of the serving base station attempting to determine the base station. be able to.

However, the signal strength is
S02 (PCI2)> S01 (PCI1; serving cell)> S03 (PCI3)
In the case of, even if the terminal 30 generates a normal measurement report instead of the base station determination measurement report, there is a high possibility that the handover will be performed to a base station other than the serving base station. Therefore, in the case of the signal strength relationship as described above, the terminal 30 does not have to process the measurement information.

Although the industrial applicability of the present invention is clear from the above description, the present invention can be suitably applied to the state, government agencies, corporations handling important information, wireless communication systems used by individuals, and the like. is there. The disclosure of this application is not limited to camouflaged base stations set up by the state for defense, but also for detecting test base stations set up by universities and companies for testing, and camouflaged base stations set up by malicious individuals and groups (terrorists, etc.). Applicable.

Some or all of the above embodiments may also be described, but not limited to:
[Appendix 1]
A generator (101, 305) that generates a measurement report such that a handover is executed to a base station different from the serving base station.
Transmission units (102, 302) that transmit the generated measurement report to the serving base station, and
A determination unit (103, 310) that determines the type of the serving base station according to whether or not a response to the measurement report is transmitted from the serving base station.
A terminal equipped with.
[Appendix 2]
A storage unit (307) that stores signal quality data in which the signal strength of the received signal from the base station including the serving base station is associated with the PCI (Physical Cell Identifier) of the cell covered by each base station.
When the type of the serving base station is determined, the change unit (312) changes the signal quality data read from the storage unit and provides the changed signal quality data to the generation units (101, 305). When,
With more
The terminal according to Appendix 1, wherein the generation unit (101, 305) generates the measurement report based on the changed signal quality data.
[Appendix 3]
The change part (312)
The signal quality read from the storage unit (307) so that the signal strength of the received signal received from the serving base station is weaker than the signal strength of the received signal received from the neighbor base station adjacent to the serving base station. The terminal described in Appendix 2 that changes data.
[Appendix 4]
The change part (312)
The terminal according to Appendix 2, wherein the signal quality data corresponding to the serving base station is deleted from the signal quality data read from the storage unit.
[Appendix 5]
The determination unit (103, 310)
It is determined whether the serving base station is either a regular base station (10) or an irregular base station (20) depending on whether or not a response to the measurement report is transmitted from the serving base station. , The terminal according to any one of Appendix 1 to 4.
[Appendix 6]
The determination unit (103, 310)
When the response to the measurement report is transmitted from the serving base station within a predetermined period, the serving base station is determined to be the legitimate base station (10).
The terminal according to Appendix 5, wherein when the response to the measurement report from the serving base station is not transmitted within the predetermined period, the serving base station is determined to be the irregular base station (20).
[Appendix 7]
The determination unit (103, 310)
The terminal according to Appendix 5 or 6, which notifies the legitimate base station (10) or the application server on the network of the result of determining that the serving base station is the irregular base station (20). ..
[Appendix 8]
Addition: An interface unit (309) is further provided, which provides the user with a display reflecting the determination result by the determination unit (103, 310) on a map including the position information of the base station acquired based on the cell ID (Identifier). The terminal according to any one of 1 to 7.
[Appendix 9]
The terminal according to any one of Supplementary note 1 to 8, wherein the transmission of the measurement report to the serving base station by the transmission unit (102, 302) and the determination by the determination unit (103, 310) are repeated. ..
[Appendix 10]
The terminal according to Appendix 9, wherein the determination unit (103, 310) determines the determination regarding the serving base station based on the repeated determination results.
[Appendix 11]
A step to generate a measurement report in which the handover is executed to a base station different from the serving base station,
The step of transmitting the generated measurement report to the serving base station, and
A step of determining the type of the serving base station according to whether or not a response to the measurement report has been transmitted from the serving base station, and
How to control the terminal, including.
[Appendix 12]
On the computer (411) mounted on the terminal,
The process of generating a measurement report such that the handover is executed to a base station different from the serving base station,
The process of transmitting the generated measurement report to the serving base station and
A process of determining the type of the serving base station according to whether or not a response to the measurement report has been transmitted from the serving base station, and
A program that executes.
Note that the form of Appendix 11 and the form of Appendix 12 can be expanded to the forms of Appendix 2 to the form of Appendix 10 in the same manner as the form of Appendix 1.

Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be appreciated by those skilled in the art that these embodiments are merely exemplary and that various modifications are possible without departing from the scope and spirit of the invention.

10, 10-1 to 10-3 First base station 20 Second base station 30 Terminal 101 Generation unit 102 Transmission unit 103 Judgment unit 301 Radio signal reception unit 302 Radio signal transmission unit 303 Signal strength measurement unit 304 Response message confirmation Unit 305 Measurement report generation unit 306 Timer unit 307 Signal quality storage unit 308 Handover control unit 309 HMI unit 310 Base station judgment unit 311 Judgment processing history management unit 312 Signal quality data change unit 411 Processor 412 Memory 413 Input / output interface 414 Communication interface

Claims (10)

A generator that generates a measurement report in which a handover is executed to a base station different from the serving base station.
A transmitter that transmits the generated measurement report to the serving base station, and
A determination unit that determines the type of the serving base station according to whether or not a response to the measurement report has been transmitted from the serving base station.
A terminal equipped with. A storage unit that stores signal quality data in which the signal strength of the received signal from the base station including the serving base station is associated with the PCI (Physical Cell Identifier) of the cell covered by each base station.
When the type of the serving base station is determined, the change unit that changes the signal quality data read from the storage unit and provides the changed signal quality data to the generation unit.
With more
The terminal according to claim 1, wherein the generation unit generates the measurement report based on the changed signal quality data. The changed part
The signal quality data read from the storage unit is changed so that the signal strength of the received signal received from the serving base station is weaker than the signal strength of the received signal received from the neighbor base station adjacent to the serving base station. The terminal according to claim 2. The changed part
The terminal according to claim 2, wherein the signal quality data corresponding to the serving base station is deleted from the signal quality data read from the storage unit. The determination unit
Claims 1 to 4 for determining whether the serving base station is either a regular base station or an irregular base station, depending on whether or not a response to the measurement report is transmitted from the serving base station. The terminal described in any one of the above. The determination unit
When the response to the measurement report is transmitted from the serving base station within a predetermined period, the serving base station is determined to be the legitimate base station.
The terminal according to claim 5, wherein when the response to the measurement report is not transmitted from the serving base station within the predetermined period, the serving base station is determined to be the irregular base station. The determination unit
The terminal according to claim 5 or 6, which notifies the legitimate base station or the application server on the network of the result of determining that the serving base station is the irregular base station. Any one of claims 1 to 7, further comprising an interface unit, which provides the user with a display reflecting the determination result by the determination unit on a map including the position information of the base station acquired based on the cell ID (Identifier). The terminal described in the section. A step to generate a measurement report in which the handover is executed to a base station different from the serving base station,
The step of transmitting the generated measurement report to the serving base station, and
A step of determining the type of the serving base station according to whether or not a response to the measurement report has been transmitted from the serving base station, and
How to control the terminal, including. On the computer installed in the terminal
The process of generating a measurement report such that the handover is executed to a base station different from the serving base station,
The process of transmitting the generated measurement report to the serving base station and
A process of determining the type of the serving base station according to whether or not a response to the measurement report has been transmitted from the serving base station, and
A program that executes.

Images