KR100375242B1 - Method of determining an unautholized mobile station - Google Patents

Abstract

Disclosed is a method for discriminating an illegal mobile terminal. a) using the terminal, b) updating the count value count1 in the terminal and the count value count2 of the HLR through the step a), and c) the two count values updated through the step b) are the same. D) if the count value of the determination result of step c) is not equal to each other, the SSD is transmitted, e) the SSD transmitted through step d) is updated, and f) step e) is updated. Determining whether the SSD exceeds the threshold A, and g) notifying the subscriber management apparatus when the SSD exceeds A. The counter value can be effectively used to determine the counterfeit terminal.

Description

How to determine illegal mobile terminal {METHOD OF DETERMINING AN UNAUTHOLIZED MOBILE STATION}

The present invention relates to an illegal mobile terminal discrimination method, and more particularly, to an illegal mobile terminal discrimination method capable of discriminating an illegal mobile terminal without affecting the load of a signal network.

Typically, terminal authentication refers to a process of confirming whether a terminal is normally subscribed in a process of establishing a call in a mobile communication network. At this time, a terminal that is not normally subscribed to is called a cloning phone, and an electronic serial number (ESN) and a mobile phone number (MIN) of a legally registered terminal are input to the terminal. It is a machine planted by software.

The above terminal authentication is included in the International Standard for Mobile Phone IS-95A. Through this authentication process, it is possible to distinguish the illegally registered terminal from the legally registered terminal.

However, since the call setup time is long and difficulty in distributing the authentication key during terminal authentication, there is a problem that a call is generated without a terminal authentication procedure because it is not actually used. In addition, mobile communication companies that provide mobile communication services do not actually use because of an increase in the load of the signal network, and thus there is a problem in that there is no way to cope with illegally copied terminals.

The present invention has been made to solve the above problems, and an object of the present invention is to provide an illegal mobile terminal discrimination method capable of discriminating an illegal copy terminal without affecting call setup and signal network load.

The method according to the present invention for achieving the above object,

a) connecting a call using a terminal;

b) updating a first count value inside the terminal and a second count value of a home location registration system;

c) determining whether the first and second count values coincide with each other;

d) if the first and second count values do not coincide with each other as a result of the determination of step c), transmitting the shared secret data;

e) updating the shared secret data transmitted via step d);

f) determining whether the shared secret data updated via step e) exceeds a first threshold;

g) If the shared secret data exceeds the first threshold as a result of the determination in step f), the moving distance is calculated based on the position information of the terminal among the call detail information stored through the step a), and the moving distance is set to the first. Determining whether the second threshold is exceeded and notifying the subscriber management apparatus when the second threshold is exceeded.

In addition, retrieving abnormal charging data from the data of the subscriber service billing system stored in the step a), determining whether the charging data retrieved in the step exceeds a predetermined threshold, and the charging data in the step And notifying the subscriber management apparatus when the predetermined threshold is exceeded. Accordingly, it is possible to more accurately and conveniently determine whether the mobile terminal to be used is illegal.

1 is a system configuration for explaining the illegal mobile terminal determination method according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating the HLR of FIG. 1.

3 is a flowchart illustrating a method for determining an illegal mobile terminal according to an embodiment of the present invention.

FIG. 4 is a diagram illustrating a signal flow at count update performed in the HLR of FIG. 1.

<Explanation of symbols for main parts of the drawings>

100: exchanger 200: HLR

300: CDR processing unit 400: CSBS

500: subscriber management device

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

The system for explaining the illegal mobile terminal determination method according to an embodiment of the present invention may be configured as shown in FIG.

That is, a switch 100 that receives information about a mobile terminal (not shown) from a home location register (HLR) (hereinafter referred to as an HLR) and provides a service, and the HLR 200. Subscriber management device 500 for receiving a count (COUNT) value and update count information, such as from the OMP (operation maintenance processor: 250) of the over the TCP / IP,

CDR processing device 300 for transmitting the call detail record (CDR) such as the number the subscriber has called, the time and call time, the base station to which the terminal belongs, and the subscriber management device 500, and the billing of the subscriber And a customer service billing system (CSBS) (hereinafter referred to as CSBS) for transmitting data to the subscriber management apparatus 500.

The HLR 200 performs location registration and deletion, call processing, subscriber information management, additional service registration / cancellation, system operation management and maintenance, operator matching, No 7 lower layer support management, and routing information management. The configuration is as shown in FIG.

That is, MUX (multiplexer: 210, 220) performs relay line matching and data connection of the switching center. FEP (front end processor, 230) is a CCS No 7 common line signal processing processor composed of message transfer part (MTP), signaling connection control part (SCCP), transaction capability application part (TCAP), etc. 7 The M162 board, a dedicated processor for common signal processing, is embedded.

In addition, a back end processor (BEP) 240 is a processor in which an application service element (ASE), a transaction capability application part (TCAP) interface, an ASE DB engine, and the like are embedded, and have a real-time database function. It also has an X.25 processing function for CSBS matching.

OMP (operation maintenance processor: 250) is composed of workstations (TCP) according to the OMC configuration used for HLR system maintenance, HLR DB management, protocol management such as MTP / SCCP / TCAP IP matching function.

Here, the BEP and the OMP, the FEP and the OMP, and the FEP and the BEP are connected by Ethernet.

An illegal terminal discrimination method using the system will be described with reference to FIG. 4.

The method according to this embodiment,

Step S100 of using the terminal, step S110 of updating the count value count1 in the terminal and count value count2 of the HLR through the step S100, and two counts updated through the step S110 Determining whether the values are the same (S120), and if the count value of the determination result of the step S120 is not the same, transmitting the SSD (shared secret data) (S130);

When the determination result of the step S120 is the same count value, repeating the step S110, updating the SSD transmitted through the step S130 (S140), and the SSD updated through the step S140 is the first Determining whether the threshold is exceeded (S150), notifying the subscriber management apparatus 500 when the SSD exceeds the first threshold as a result of the determination of step S150 (S200);

If the SSD does not exceed the first threshold as a result of the determination of step S150, repeating the step S140, searching for the moving distance among the CDRs stored through the step S100 (S160), and the step Determining whether the moving distance found through S160 exceeds the second threshold (S170); and notifying the subscriber management apparatus 500 when the moving distance exceeds the second threshold as a result of the determination of step S170 (S200). Wow,

Repeatedly performing the step S160 when the moving distance does not exceed the second threshold as a result of the determination of the step S170; retrieving abnormal charging data among the CSBS data stored through the step S100 (S180); Determining whether the charging data retrieved through the step S180 exceeds a third threshold (S190); and notifying the subscriber management apparatus 500 when the charging data exceeds the third threshold as a result of the determination of the step S190 ( S200), and if the charging data does not exceed the third threshold as a result of the determination of step S190, repeating step S180.

As described above, the method according to the present embodiment collects three pieces of information and is comprehensively executed.

The first uses an abnormal change in the count value in the HLR data.

That is, when making a call using the terminal in step S100, the process proceeds to step S110, where the count value count1 and the count value count2 of the HLR are increased by one at the same time. The counts increase to a total of 64 and start again from zero.

In step S120, the updated two count values are compared. If the two count values are not the same, the process proceeds to step S130.

The reason for this is to ensure the accuracy of the identification of the illegal copy terminal since the value may vary due to data error in the wireless section.

In step S130, the exchange 100 transmits the SSD which is shared secret data to the terminal. Herein, when the terminal is an illegal copy terminal, if the terminal continues to call through the terminal, the SSD is continuously updated (step S140).

In step S150, it is determined whether the number of times of updating the SSD exceeds a preset first threshold value, and when the number of times of updating of the SSD exceeds the first threshold value, the terminal used in the subscriber management apparatus 500 is an illegal copy terminal. You will receive a notification.

The second uses the call details of the CDRs.

That is, the movement distance search in step S160 means that two calls are made by the same terminal, and search for exceeding a local movable distance during the time between the two calls.

For example, if a call is made in 12:00 in Seoul by the same terminal and a call is made in Busan at 12:30, it means that the transfer between Seoul and Busan is impossible for a time of 30 minutes. Therefore, it can be seen that an illegal copy terminal is used in one of Seoul and Busan.

In step S170, when the moving distance as described above is compared with a preset second threshold, when the second threshold is exceeded, the terminal used in the subscriber management apparatus 500 is notified that the terminal is an illegal copying terminal (step S200).

Third, charging data of CSBS is used.

After retrieving the charging data stored in the CSBS in step S180, the flow proceeds to step S190 to compare the retrieved charging data with a preset third threshold value.

If the retrieved billing data exceeds the third threshold, it is notified that the used terminal is an illegal copy terminal (step S200).

The illegal copy terminal can be effectively determined based on the three notification contents collected as described above.

3 is a diagram illustrating a signal flow during a count update performed in the HLR. First, the terminal assigns ESN, MIN, and SSD as input values and assigns them to a function called a CAVE algorithm. The result is an AUTHR value, and the same calculation is performed in the HLR 200 as well.

Then, the terminal sends a message AUTHREQ to the HLR 200, the field value included here are AuthPara, RAND, AUTHR, COUNT. Most of the messages sent from the terminal to the exchange 100 are written in C language, the AUTHREQ is a structure, and the four field values are variables in the structure.

Since the AUTHR value is generated with the same parameter in the counterfeit terminal, the same value is transmitted, but the COUNT value is different between the normal terminal and the counterfeit terminal.

The AUTHREQ signal flow 1 is such an authentication request signal, and the authreq flow 2 is a command from the exchange 100 to increase the COUNT by one because all values match. The terminal increases the value of CallHistoryCount.

The third ASREPORT flow is a command to increase the COUNT value of the HLR 200 when the terminal successfully increases the COUNT. At this time, the actual variable COUNTRPT transmitted in the field is successful, no response, not attempt, and the HLR 200 receives these values to determine whether the COUNT value is increased.

Here, the successful increases the value of ACCallHistoryCount by one, the no response increases the value of ACCallHistoryCount according to an option, and the not attempt maintains the value of ACCallHistoryCount.

As described above, according to the present invention, it is possible to effectively counter the illegal user of the terminal by improving the probability of counterfeit of the counterfeit terminal, and increase the profit of the mobile communication service provider. Since there is a difficulty in key distribution, it is possible to overcome the problem that a call is generated without a terminal authentication procedure because it is not actually used, and the load of a signal network generated during terminal authentication can be significantly reduced.

Although the present invention has been described in detail by the above embodiments, various modifications are possible without departing from the spirit and scope of the present invention.

Claims (3)

a) connecting a call using a terminal; b) updating a first count value inside the terminal and a second count value of a home location registration system; c) determining whether the first and second count values coincide with each other; d) if the first and second count values do not coincide with each other as a result of the determination of step c), transmitting the shared secret data; e) updating the shared secret data transmitted via step d); f) determining whether the shared secret data updated via step e) exceeds a first threshold; And g) If the shared secret data exceeds the first threshold as a result of the determination of step f), the movement distance is calculated from the position information of the terminal among the call detail information stored through the step a), and the movement distance is set to the second distance. Determining whether the threshold is exceeded and notifying the subscriber management apparatus when the second threshold is exceeded. delete 2. The method of claim 1, further comprising: retrieving abnormal charging data among data of the subscriber service billing system stored through the step a), determining whether the charging data retrieved in the step exceeds a predetermined threshold; And notifying the subscriber management apparatus when the charging data exceeds the predetermined threshold.