KR101013274B1 - Method and system for intercepting unusual call in wireless data communication environment - Google Patents

Abstract

The present invention relates to a method for detecting and limiting an abnormal signal in a wireless data communication network among security technologies of a mobile communication network environment.

According to the invention, (a) detecting the abnormal signal at the abnormal signal control node of the wireless data network; (b) extracting source information of the detected abnormal signal and querying the IP management node when the abnormal signal is detected; (c) obtaining subscriber information corresponding to the source information from the IP management node; And (d) restricting the call of the subscriber based on the obtained subscriber information. The abnormal call blocking method is disclosed in a wireless data communication environment.

Wireless data, abnormal call detection, IP address, subscriber information

Description

Method and system for intercepting unusual call in wireless data communication environment

The present invention relates to a security technology of a mobile communication network environment, and more particularly, to a method and system for detecting and limiting an abnormal signal in a wireless data communication network.

Starting with pagers, through cellular phones, personal cell phones and 3G mobile communications, the mobile environment has developed at a tremendous rate in recent years. With the development of wireless terminals, the search for additional services available through the terminals has been actively developed.

In addition, the widespread use of the Internet and the development of mobile communication technology have shown the possibility of wireless terminal as a means to access the Internet anytime and anywhere beyond a simple communication means. The user can freely move to the desired place while maintaining the network connection. Mobile network refers to a network data service using a phone, commonly referred to as the "mobile Internet." In other words, it is a combination of new wireless technology and Internet technology.

As the use of the mobile Internet and wireless mobile networks become more active, the problem of viruses or intentional hacking is also increasing. In a general wired data communication system, when a problem occurs, an IP address is traced to find a user of the IP, and the IP address is blocked.

However, the technology of the mobile network using the mobile Internet and the mobile communication network is based on wireless data communication technology. In order to perform wireless data communication, a mobile communication terminal must be assigned an IP address from a network system. The IP address assigned to the mobile communication terminal uses an address dynamically assigned by the network (DHCP: Dynamic Host Configuration Protocol) for sharing with other subscribers. Therefore, finding a problem subscriber through an IP address requires considerable time and effort. In other words, finding a subscriber (subscriber phone number, etc.) based on the private IP used by the subscriber is difficult.

In addition, if there is a firewall in front of the Internet network, the subscriber in question can block the hacking city (including virus distribution) packets, but there are ways to prevent hacking attempts, virus distribution and traffic congestion that occur in the internal network before the Internet network. There is no situation. Therefore, in order to solve such a problem, there may be a method of blocking an abnormal signal of a problem by configuring a firewall at a part of the IP network (terminal itself or a base station). However, such a configuration can cause a significant increase in investment costs, and there is a possibility that a problem with a service may occur, so that actual operation is difficult and inefficient.

The present invention has been made to solve such a problem, and an object of the present invention is to provide a method and system for immediately identifying a subscriber when an abnormal signal such as a virus and a hacking attempt occurs in conjunction with a subscriber management node of a mobile communication system. .

In addition, it is another object to provide a method and system that can immediately block the call of the subscriber with the identification of the cause of the abnormal signal generation, such as viruses and hacking attempts.

Further objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. It will also be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the claims.

In order to achieve the above object, the abnormal call blocking method in a wireless data communication environment according to the present invention, (a) detecting the abnormal signal in the abnormal signal control node of the wireless data communication network; (b) extracting source information of the detected abnormal signal and querying the IP management node when the abnormal signal is detected; (c) obtaining subscriber information corresponding to the source information from the IP management node; And (d) limiting the call of the subscriber based on the obtained subscriber information.

According to another aspect of the present invention, an abnormal signal control server for detecting an abnormal signal occurring in the wireless data communication network, extracting source information of the detected abnormal signal and querying the IP management node to obtain subscriber information; And an IP management server configured to store and manage IP address information, terminal information, and subscriber information allocated to the mobile communication terminal in a wireless data communication network, and to provide subscriber information corresponding to source information to the abnormal signal control server. An abnormal call blocking system is provided in a communication environment.

According to the present invention, through the IP address information extracted at the time of hacking and virus detection in the wireless data network, it is possible to identify the corresponding subscriber by interworking with the IP management node of the mobile communication system, and through this, plan to provide statistical information and prepare subscriber countermeasures. It provides an effect that can be done.

In addition, by identifying the cause of the hacking and viruses in the wireless data network and blocking the call of the subscriber, it provides an effect that can prevent and prevent the occurrence of abnormal call even in the situation that the existing packet blocking method is not available.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principle that can be defined, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention. Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

1 is a diagram illustrating a configuration of an abnormal call blocking system in a wireless data communication environment according to an embodiment of the present invention.

Referring to FIG. 1, the abnormal call blocking system according to the present invention includes mobile communication terminals 401 and 402 connected to a wireless data communication network, an abnormal signal control server 100, an IP management server 200, and a network access control server 300. It includes.

The wireless data communication network is an infrastructure network system that enables wireless data communication through a mobile communication system. The wireless data communication network includes WCDMA, EVDO, Wibro, WIFI, and the like. In addition, the mobile communication terminals 401 and 402 are communication devices capable of wireless data communication such as mobile phones, PDAs, and notebook computers equipped with wireless modems.

The abnormal signal control server 100 detects an abnormal signal generated in a wireless data communication network and restricts the detected abnormal signal to provide stability for a communication network such as security enhancement and traffic congestion prevention. The abnormal signal control server 100 may be or include an enterprise management system (EMS) that is in charge of overall management of the mobile communication system. Alternatively, the abnormal signal control server 100 may be a firewall, an IDS (intrusion detection system), an IPS (intrusion prevention system), or the like. In addition, the abnormal signal is intended for hacking attempts, viruses, malicious traffic generation by the subscriber.

A detailed configuration of the abnormal signal control server 100 will be described later.

The IP management server 200 stores and manages IP address information, terminal information, and subscriber information allocated to the mobile communication terminal in the wireless data communication network in the database 210. In addition, the IP management server 200 performs the role of extracting and providing subscriber information corresponding to the source IP address requested to query when the subscriber information request in conjunction with the abnormal signal control server 100. An example of the IP management server 200 may be an IP Location Server (IPLS).

3 is a diagram illustrating a configuration of information stored in a database 210 managed by the IP management server 200.

As shown in FIG. 3, the database 210 managed by the IP management server 200 is divided into IP addresses, IMSI information, MSISDN information, MIN information, terminal status information, and additional information for each subscriber classified as subscriber identification information. The information is stored and managed according to the item. In the IP address item, information on an IP address assigned and allocated to each subscriber station in the mobile communication system is recorded. The IMSI information is an international mobile station identification number of the subscriber station. The MSISDN information is a mobile station international ISDN number of the subscriber station. The MIN information is a mobile station identification number of the subscriber station. The terminal state information and the additional information record the state information and additional information of the subscriber or subscriber terminal.

Since the information of each item may differ slightly depending on the wireless data communication network, the information of each item is changeable. The database 210 records and manages at least one of the IP address information assigned to the subscriber station and the identification information of the subscriber station.

When the IP management server 200 requests the subscriber information query for the source IP address information from the abnormal signal control server 100, the IP management server 200 queries the IP address of the database 210 to identify the subscriber corresponding to the IP address. Extracts information and provides the information to the abnormal signal control server 100 to respond to the subscriber information request. That is, for example, if the table shown in FIG. 3 requests a subscriber information inquiry for '#B' as an IP address, the subscriber (# 002) of the corresponding IP address is searched for, and then the identification information (IMSI) of the subscriber is retrieved. , MSISDN, MIN) to extract (# B1, # B2, # B3) to provide. Of course, in addition to this, the terminal state information (b) and additional information (b ') may also be included and provided.

The network access control server 300 (NAS: Network Access Server) plays a role of controlling access of subscriber stations to a wireless data communication network. The network access control server 300 interoperates with the abnormal signal control server 100 to perform a control process of blocking (session termination) a call of a corresponding subscriber station according to an access control request for a specific subscriber station. The network access control server 300 may be configured of a Packet Data Serving Node (PDSN), a Gateway GPRS Support Node (GGSN), an Inter Working Function (IGWF), and the like, according to a type of a wireless data communication network.

2 is a view showing the configuration of the abnormal signal control server in the abnormal call blocking system according to an embodiment of the present invention.

2, the abnormal signal control server 100 according to the present invention is an abnormal signal detection module 110, source information extraction module 120, subscriber information acquisition module 130, call blocking processing module 140, etc. It includes.

The abnormal signal detection module 110 monitors an abnormal signal in a wireless data communication network and detects an abnormal signal when it occurs. At this time, the abnormal signal may be a hacking attempt, a virus, or malicious traffic generation from a specific subscriber station. The abnormal signal detection module 110 includes a monitoring and detection procedure made in a general firewall, IDS, IPS and the like.

The source information extraction module 120 extracts information on the abnormal signal detected by the abnormal signal detection module 110. The information on the abnormal signal may be, for example, source IP information. Here, the source IP information may be a private IP-based address variably assigned by the mobile communication system. In this case, the source IP address information does not include information on the subscriber terminal in question.

The subscriber information acquisition module 130 interoperates with the IP management server 200 to search and acquire subscriber information based on source information (IP address) extracted by the source information extraction module 120. The subscriber information acquisition module 130 includes an IPLS (IP management server) interworking unit and an inquiry processing unit. The IPLS interworking unit controls the interworking with the IP management server 200. The inquiry processing unit transmits a subscriber information inquiry request signal including source IP information extracted to IPLS interworked through the IPLS interworking unit, and receives subscriber information as a result of the processing. In this case, the provided subscriber information may be IMSI, MSISDN, MIN information, and the like.

The call blocking processing module 140 interoperates with the network access control server 300 and requests to block a call of the corresponding subscriber terminal based on the subscriber information provided from the subscriber information obtaining module 130. The call blocking processing module 140 includes a NAS (network access control server) interworking unit and a session end message transmitting unit. The NAS interworking unit controls the interworking with the network access control server 300. The session termination message transmission unit generates a session termination message for the subscriber station including the subscriber information provided through the subscriber information acquisition module 130 and transmits to the network access control server 300 interworked through the NAS interworking unit. Play a role. Through this, the call of the subscriber to the detected abnormal signal can be blocked and restricted.

4 is a flowchart illustrating a procedure of an abnormal call blocking method in a wireless data communication environment according to an embodiment of the present invention.

Referring to Figure 4, the abnormal call blocking method according to the present invention first proceeds to the procedure for monitoring the abnormal signal. That is, a procedure for monitoring whether a hacking attempt or a virus occurs by the subscriber in the wireless data communication network is performed.

If an abnormal signal occurs while monitoring the abnormal signal, a procedure for detecting the abnormal signal is performed.

If an abnormal signal is detected, a procedure of extracting source information of the detected abnormal signal is performed. The source information of the detected abnormal signal may be, for example, source IP address information of a corresponding discrete signal generated (S30).

When the source information is extracted, a procedure of inquiring and obtaining information of a subscriber to which the corresponding source information (IP address) is allocated is linked with the IP management server through the extracted source information.

Based on the obtained subscriber information, a procedure for requesting to intercept a call of a corresponding subscriber station in connection with a network access control server is performed. The call to the subscriber station of the abnormal signal detected through this procedure is restricted (S50).

5 is a flowchart illustrating a procedure performed for each node of an abnormal call blocking system in a wireless data communication environment according to an embodiment of the present invention.

Referring to FIG. 5, first, a control node (EMS) monitors whether an abnormal signal occurs in a wireless data communication network, and detects an abnormal signal when it occurs.

When an abnormal signal is detected in the control node, a procedure of extracting the source IP address of the abnormal signal is performed.

Next, the source IP address information on the extracted abnormal signal is transmitted to the IP management node (IPLS) to perform a procedure for requesting subscriber information inquiry about the source IP. At this time, taking WCDMA as an example, an MS Info Request (IP Address) message may be used as a message for requesting subscriber information inquiry to an IP management node.

The IP management node performs a procedure of extracting subscriber information corresponding to the source IP address according to the inquiry request. That is, since the IP management node stores and manages the information on the subscriber station and the IP address information allocated and assigned to each subscriber station in the network, the IP management node can query and extract the subscriber information by the IP address. At this time, the subscriber information may be IMSI, MSISDN, MIN, or the like.

The extracted subscriber information is transmitted to the control node. That is, a procedure including the subscriber information is provided in response to the inquiry request from the control node. In this case, for example, the WCDMA may include an MS Info Response (IMSI, MSISDN, IP Address, MS Status) message as a response message to the subscriber node inquiry request to the control node.

The control node performs the procedure of receiving subscriber information on the IP address from the IP management node and providing it as statistical information. That is, the subscriber information and abnormal signal detection information provided to the statistical processing server (not shown) are transmitted to be used as monitoring and statistical data.

In addition, the control node performs a procedure for transmitting the subscriber information provided in response to the request to the access control node. That is, a procedure of generating a session termination message including subscriber information of the acquired abnormal signal and transmitting the same to the access control node is performed. This is to control to limit the call of the subscriber. For example, the procedure for generating a DM (Disconnect Message) including the subscriber information and transmitting the WCDMA to the NAS.

The access control node performs the session deletion processing of the corresponding subscriber in real time through the session termination message including the subscriber information received from the control node. Through this, the call of the subscriber is blocked, and the abnormal call is also blocked to prevent further occurrence of abnormal call.

Although the present invention has been described above by means of limited embodiments and drawings, the present invention is not limited thereto and will be described below by the person skilled in the art to which the present invention pertains. Of course, various modifications and variations are possible within the scope of the claims.

The following drawings, which are attached to this specification, illustrate exemplary embodiments of the present invention, and together with the detailed description of the present invention serve to further understand the technical spirit of the present invention, the present invention includes matters described in such drawings. It should not be construed as limited to.

1 is a diagram illustrating a configuration of an abnormal call blocking system in a wireless data communication environment according to an embodiment of the present invention.

2 is a view showing the configuration of the abnormal signal control server in the abnormal call blocking system according to an embodiment of the present invention.

3 is a diagram illustrating a configuration of information stored in a database managed by an IP management server according to the present invention.

4 is a flowchart illustrating a procedure of an abnormal call blocking method in a wireless data communication environment according to an embodiment of the present invention.

5 is a flowchart illustrating a procedure performed for each node of an abnormal call blocking system in a wireless data communication environment according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

110: abnormal signal detection module 120: source information extraction module

130: subscriber information acquisition module 140: call blocking processing module

Claims (15)

(a) detecting an abnormal signal at the abnormal signal control node of the wireless data communication network; (b) extracting source information of the detected abnormal signal and querying the IP management node when the abnormal signal is detected; (c) obtaining subscriber information corresponding to the source information from the IP management node; And (d) transmitting a session termination command of the subscriber to a network access server (NAS) based on the obtained subscriber information to block the call; . The method of claim 1, The source information extracted in step (b) includes any one of source IP address information, IMSI (International Mobile Station Identification Number) information, MIN (Mobile Station Identification Number), and MSISDN (Mobile Station International ISDN Number) information. A method for blocking abnormal calls in a wireless data communication environment. The method according to claim 1 or 2, In the wireless data communication environment, the subscriber information obtained in step (c) comprises any one or a combination of IMSI information, MIN information, MSISDN information, IP address information, terminal status information, and additional information. How to block an abnormal call. The method according to claim 1 or 2, The abnormal signal control node is an abnormal call blocking method in a wireless data communication environment, characterized in that the enterprise management system (EMS). The method according to claim 1 or 2, The abnormal signal control node, any one of a firewall, IDS (intrusion detection system), IPS (intrusion prevention system) characterized in that the abnormal call blocking method in a wireless data communication environment. The method according to claim 1 or 2, The abnormal signal detected by the abnormal signal control node comprises any one of a hacking attempt, a virus, and malicious traffic generation. The method according to claim 1 or 2, The IP management node stores and manages IP address information, terminal information, and subscriber information allocated to a mobile communication terminal in a wireless data communication system. The method of claim 7, wherein The IP management node, IPLS (IP Location Server) characterized in that the abnormal call blocking method in a wireless data communication environment. delete The method of claim 1, The network access server may be any one of a packet data serving node (PDSN), a gateway GPRS support node (GGSN), and an inter working function (IGWF). The method according to claim 1 or 2, After step (c), And transmitting the obtained subscriber information to a statistics processing server for use in monitoring and providing data. An abnormal signal control server for detecting an abnormal signal generated in a wireless data communication network, extracting source information of the detected abnormal signal, and querying the IP management node to obtain subscriber information; An IP management server that stores and manages IP address information, terminal information, and subscriber information allocated to the mobile communication terminal in a wireless data communication network, and provides subscriber information corresponding to source information to the abnormal signal control server; And A network access server that manages connection and disconnection of a data call in a wireless data communication network, and receives a session termination command of a subscriber based on subscriber information corresponding to the abnormal signal from the abnormal signal control server, thereby blocking the call accordingly. Abnormal call blocking system in a wireless data communication environment. delete 13. The method of claim 12, The source information extracted from the abnormal signal control server may include any one of source IP address information, IMSI (International Mobile Station Identification Number) information, MIN (Mobile Station Identification Number), and MSISDN (Mobile Station International ISDN Number) information. Abnormal call blocking system in a wireless data communication environment. 13. The method of claim 12, The abnormal signal detected by the abnormal signal control server is an abnormal call blocking system in a wireless data communication environment, characterized in that any one of hacking attempts, viruses, malicious traffic generation.

Images