KR101388627B1 - Apparatus for blocking abnormal traffic in 4g mobile network - Google Patents

Abstract

Provided is an apparatus for blocking abnormal traffic in a 4G mobile network. The apparatus for blocking abnormal traffic in a 4G mobile network includes: a packet manager to receive and classify a GTP packet into a GTP-U packet and a GTP-C packet, to extract first packet information from the GTP-U packet, and to extract second packet information from the GTP-C packet; a packet analyzer to receive and analyze the first and second packet information, and to generate packet block information for blocking a GTP packet including an abnormal SIP message for transmitting the generated packet block information to the packet manager; a packet analysis result manager to receive the packet analysis result information from the packet analyzer for extracting user information, and to generate detection/block result information; and a detection/block log storage unit to receive and store the detection/block result information from the packet analysis result manager. [Reference numerals] (100) Packet manager; (200) Packet analyzer; (300) Packet analysis result manager; (400) System manager; (500) System communication unit; (AA) External system; (BB) Traffic input/output state inquiry; (CC) GTP packet; (D2) Second packet information; (D3) Third packet information; (D5) GTP-C packet analysis information; (D6) Detection/block result information; (D7) System operation mode information; (D8) Traffic input/output state information; (DB1) User GTP tunnel information storage unit; (DB2) Operation mode information storage unit; (DB3) Detection/block policy storage unit; (DB4) Detection/block log storage unit; (DD) First packet information; (EE) Packet analysis result information; (FF) Packet transmission user inquiry

Description

Apparatus for blocking abnormal traffic in 4G mobile network}

The present invention relates to an apparatus for blocking abnormal traffic, and more particularly, to an apparatus for blocking abnormal traffic based on session information in a mobile environment using a GPRS Tunneling Protocol (GTP).

The 4G network (or LTE network) includes a 4G Enterprise Radio Access Network (E-RAN) for managing radio resources and a 4G Evolved Packet Core (EPC) for performing data processing / authentication / billing.

The 4G E-RAN includes components such as a user equipment (UE) and an evolved Node B (eNB), and the 4G EPC includes a Mobility Management Entity (MME), a Serving Gateway (S-GW) PDN Gateway), Home Subscriber Server (HSS), Policy & Charging Rule Function (PCRF), and the like.

In the 4G network, data packets can be transmitted / received through the S1-U GTP (GPRS Tunneling Protocol) tunnel generated between the eNB and the S-GW and the generated S5 GTP tunnel generated between the S-GW and the P-GW. The data packet includes a Session Initiation Protocol (SIP) message for setting up a VoLTE call, which may be encapsulated in a payload of a GTP packet and transmitted and received.

The P-GW delivers the data packet into the IMS (IP Multimedia Subsystem) network without considering the values contained in the SIP message. Thus, even if the manipulated value is included in the SIP message, the data packet can be passed into the IMS network without restriction.

Korean Unexamined Patent Publication No. 2013-0010818 discloses an abnormal traffic control apparatus and method.

An object of the present invention is to provide an abnormal traffic blocking apparatus capable of detecting and blocking abnormal traffic that manipulates a user terminal identification number included in a SIP message.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other matters not mentioned can be clearly understood by those skilled in the art from the following description.

An embodiment of the apparatus for blocking abnormal traffic of the present invention for solving the above problems is to receive a GTP packet, classify it into a GTP-U packet and a GTP-C packet, and extract first packet information from the GTP-U packet. A packet manager extracting second packet information from the GTP-C packet, receiving and analyzing the first and second packet information, and generating packet blocking information for blocking a GTP packet including an abnormal SIP message; A packet analysis unit for transmitting to the management unit, a packet analysis result management unit for receiving the packet analysis result information from the packet analysis unit, extracting user information and generating detection / blocking result information, and the detection / blocking unit from the packet analysis result management unit It includes a detection / blocking log storage for receiving and storing the result information.

The first packet information includes a GTP-U TEID extracted from a header of the GTP-U packet, a SIP message extracted from a payload of the GTP-U packet, and a user terminal identification number extracted from the SIP message. The second packet information may include a GTP-C TEID extracted from a header of the GTP-C packet, the GTP-U TEID, a UE IP, and the user terminal identification number.

The SIP message may include a SIP INVITE message.

The packet manager may transmit the GTP packet without blocking the SIP message when the SIP message is not the SIP invitation message.

The user terminal identification number may include a mobile station international ISDN number (MSISDN).

The apparatus may further include a system manager configured to monitor a state of a system through a traffic input / output state, set an operation mode of the system according to a monitoring result, and transmit system operation mode information to an operation mode information storage unit.

The packet manager may apply an IPS mode or BYPASS mode using the system operation mode information.

The apparatus may further include a system communicator configured to analyze and manage a system message transmitted to the system or an external system.

The system message may include a system management message for setting an operation mode of the system, a policy management message for setting a detection / blocking policy of the system, or a detection / block log inquiry message for a detection / blocking log inquiry of the system. can do.

The packet manager may include a packet control module for forwarding or dropping the GTP packet using the packet blocking information.

The packet analyzer may include a GTP tunnel information collection module that extracts session information using the second packet information.

The GTP tunnel information collection module may include a control message management module for completing a single message through a request message and a response message, and a message processing module for managing a user information table through the single message. have.

Another embodiment of the abnormal traffic blocking device of the present invention for solving the above problems, receives a GTP packet and classifies it as a GTP-U packet and a GTP-C packet, GTP-U TEID from the header of the GTP-U packet A packet management unit for extracting a SIP message from a payload of the GTP-U packet and extracting a user terminal identification number from the SIP message, receiving and analyzing the GTP-U TEID and the user terminal identification number, and abnormally Packet analysis unit for generating the packet blocking information for blocking the GTP packet including the SIP message, and transmits to the packet management unit, receives the packet analysis result information from the packet analysis unit to extract the user information, and the detection / blocking result information Packet analysis result management unit to generate, monitor the status of the system through the traffic input and output status, according to the monitoring result of the system Set the operation mode, and a system management unit, and the communication systems to analyze and manage the system, messages sent to the system or outside the system to generate a system operating mode information.

The SIP message may include a SIP invitation message.

The packet manager may transmit the GTP packet without blocking the SIP message when the SIP message is not the SIP invitation message.

The user terminal identification number may include an MSISDN.

The packet manager may apply an IPS mode or BYPASS mode using the system operation mode information.

The packet manager may include a packet control module for forwarding or dropping the GTP packet using the packet blocking information.

The packet analyzer may include a GTP tunnel information collection module for extracting session information using a GTP-C TEID extracted from a header of the GTP-C packet.

The GTP tunnel information collection module may include a control message management module for completing a single message through a request message and a response message, and a message processing module for managing a user information table through the single message. have.

Other specific details of the invention are included in the detailed description and drawings.

According to the abnormal traffic blocking apparatus according to the present invention, by extracting the GTP-U TEID from the header of the GTP-U packet, extracting the SIP message from the GTP-U packet, extracting the user terminal identification number from the SIP message, Since it is compared with the GTP-U TEID and the user terminal identification number recorded in the session information, abnormal traffic that manipulates the user terminal identification number included in the SIP message can be detected and blocked.

1 is a block diagram schematically showing an apparatus for blocking abnormal traffic according to an embodiment of the present invention.
2 illustrates a data frame obtained by processing a GTP-U packet and a GTP-C packet.
3 is a block diagram illustrating a detailed module of a packet management unit.
4 is a block diagram illustrating a detailed module of a packet analyzer.
5 is a block diagram showing a detailed module of the GTP tunnel information collection module.
6 is a data table for describing an operation of a control message management module.
7 is a flowchart for explaining an operation of a message processing module.
8 and 9 are data tables for explaining the operation of the message processing module.
10 is a flowchart illustrating a process of detecting an abnormal SIP in the abnormal SIP detection module.
11 is an exemplary table for detected / blocked abnormal SIP information.
12 is an exemplary table for explaining an abnormal SIP detection / blocking policy setting.
13 is a block diagram showing a detailed module of a packet analysis result management unit.
14 is a block diagram showing a detailed module of the system manager.
15 is a block diagram illustrating a detailed module of a system communication unit.
16 and 17 exemplarily illustrate tables stored in the detection / blocking log storage unit.
18 is a diagram illustrating a structure of a 4G network to which an apparatus for blocking abnormal traffic according to an embodiment of the present invention is applied.
FIG. 19 is a diagram for describing a structure of an IMS network interworking with the 4G network of FIG. 18.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Each block may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative implementations the functions mentioned in the blocks may occur out of order. For example, two blocks that are shown one after the other may actually be executed substantially concurrently, or the blocks may sometimes be performed in reverse order according to the corresponding function.

Although the first, second, etc. are used to describe various elements, components and / or sections, it is needless to say that these elements, components and / or sections are not limited by these terms. These terms are only used to distinguish one element, element or section from another element, element or section. Therefore, it goes without saying that the first element, the first element or the first section mentioned below may be the second element, the second element or the second section within the technical spirit of the present invention.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

1 is a block diagram schematically showing an apparatus for blocking abnormal traffic according to an embodiment of the present invention. 2 illustrates a data frame obtained by processing a GTP-U packet and a GTP-C packet.

1 and 2, first, a schematic configuration of an abnormal traffic blocking apparatus according to an embodiment of the present invention will be described. Referring to FIG. 1, an apparatus for blocking abnormal traffic according to an embodiment of the present invention includes a network interface card (NIC) 10, a packet managing unit 100, a packet analyzing unit 200, a packet analyzing result managing unit 300, The system manager 400, the system communicator 500, and the first to fourth storage units DB1, DB2, DB3, and DB4 are included.

The NIC 10 may receive the GTP packet and transmit it to the packet manager 100, and forward or drop the GTP packet according to the control signal of the packet manager 100. The NIC 10 may be a general network interface card or a hardware accelerated network interface card. GTP packets include GTP-C packets and GTP-U packets, which are used to transmit user's data packets within a 4G network.

The packet manager 100 receives the GTP packet from the NIC 10, classifies it into a GTP-U packet and a GTP-C packet, extracts the first packet information D1 from the GTP-U packet, and extracts the GTP-C packet from the GTP-C packet. The second packet information D2 is extracted. Here, the first packet information D1 may include a GTP-U Tunnel Endpoint Identifier (TEID) extracted from a header of a GTP-U packet, a SIP message extracted from a payload of a GTP-U packet, and It may include a user terminal identification number extracted from the SIP message. The second packet information D2 may include a GTP-C TEID extracted from the header of the GTP-C packet.

Specifically, referring to FIG. 2, the packet manager 100 may extract necessary information from a GTP-U packet to generate a first data frame F1, and the TEID (UL) may be included in the first data frame F1. DATA), Src IP, Dst IP, Protocol, Src Port, Dst Port, Length, etc. may be included. In addition, the packet manager 100 may extract necessary information from the GTP-C packet to generate a second data frame F2, and the Src IP, Src Port, Msg Type, and TEID may be generated in the second data frame F2. Data, such as GTP-C IE. The GTP-C Information Element (IE) may include other information according to the message type. For example, the GTP-C IE may include information such as TEID, MSISDN, IP, and the like.

The packet manager 100 communicates with the second storage DB2 to check a packet filtering policy, a system operation mode, and the like. The second storage unit DB2 may be, for example, an operation mode information storage unit.

The packet analyzer 200 receives and analyzes the first and second packet information D1 and D2 and generates packet blocking information D3 for blocking a GTP packet including an abnormal SIP message. To send. The packet analyzer 200 transmits the packet analysis result information D4 to the packet analysis result management unit 300, and transmits the GTP-C packet analysis information D5 to the first storage unit DB1. The first storage unit DB1 may be, for example, a user GTP tunnel information storage unit. In addition, the packet analyzer 200 communicates with the third storage unit DB3 to confirm the detection / blocking policy. The third storage unit DB3 may be, for example, a detection / blocking policy storage unit.

The packet analysis result manager 300 receives the packet analysis result information D4 from the packet analyzer 200, extracts user information, and generates detection / blocking result information D6. The detection / blocking result information D6 is result information obtained by analyzing the extracted user information. The packet analysis result manager 300 uses the extracted user information to communicate with the first storage unit DB1 to query the packet sender. In addition, the packet analysis result manager 300 transmits the detection / blocking result information D6 to the fourth storage unit DB4. The fourth storage unit DB4 may be, for example, a detection / blocking log storage unit.

The system manager 400 monitors the state of the system through the traffic input / output status, sets the operation mode of the system according to the monitoring result, and transmits the system operation mode information D7 to the second storage unit DB2. The system manager 400 transmits the traffic input / output status information D8 to the system communicator 500.

The system communication unit 500 analyzes and manages system messages transmitted to an internal system or an external system. The system message is a system management message for setting an operation mode of an internal system, a policy management message for setting a detection / blocking policy of an internal system, a detection / block log inquiry message for a detection / blocking log inquiry of an internal system, and communication with a GUI. It includes a GUI protocol for interworking, and an external system interworking protocol for setting a detection / blocking policy in connection with an external system.

Hereinafter, a detailed configuration of an abnormal traffic blocking apparatus according to an embodiment of the present invention will be described with reference to FIGS. 3 to 15.

3 is a block diagram illustrating a detailed module of a packet management unit.

Referring to FIG. 3, the packet manager 100 applies an IPS mode or BYPASS mode of a system by using system operation mode information stored in the second storage unit DB2. The IPS mode is a mode for forwarding or dropping by analyzing an abnormality of the GTP packet transmitted through the NIC 10, and the BYPASS mode does not analyze whether an abnormality of the GTP packet transmitted through the NIC 10 is abnormal and all GTPs are analyzed. This mode forwards packets. The packet manager 100 receives the GTP packet according to the system operation mode, analyzes the GTP packet, and filters the GTP packet based on the set destination IP and the destination port. Subsequently, the GTP packet is classified into a GTP-U packet and a GTP-C packet. The classified GTP-U packet and the GTP-C packet are processed to generate a first data frame F1 and a second data frame F2, and are transmitted to the packet analyzer 200 (see FIG. 2).

In addition, the packet manager 100 controls (ie, forwards or drops) a packet through the packet control module using the packet blocking information D3 transmitted from the packet analyzer 200. However, such packet control only works when the system is in IPS mode.

4 is a block diagram illustrating a detailed module of a packet analyzer. 5 is a block diagram showing a detailed module of the GTP tunnel information collection module. 6 is a data table for describing an operation of a control message management module. 7 is a flowchart for explaining an operation of a message processing module. 8 and 9 are data tables for explaining the operation of the message processing module. 10 is a flowchart illustrating a process of detecting an abnormal SIP in the abnormal SIP detection module. 11 is an exemplary table for detected / blocked abnormal SIP information. 12 is an exemplary table for explaining an abnormal SIP detection / blocking policy setting.

Referring to FIG. 4, the packet analyzer 200 checks a detection / blocking policy by communicating with the third storage unit DB3. According to the detection / blocking policy applied to the system, the first packet information D1 is analyzed and a GTP packet including an abnormal SIP message is detected through the abnormal SIP detection module. The packet analyzer 200 may process the GTP packet according to a result of analyzing the first packet information D1. That is, in order to forward or drop the GTP packet, the packet analyzer 200 transmits the packet blocking information D3 to the packet manager 100. In addition, the packet analyzer 200 includes a GTP tunnel information collection module 210 and extracts session information from the second packet information D2 through the GTP tunnel information collection module 210.

Specifically, referring to FIG. 5, the GTP tunnel information collection module 210 includes a control message management module and a message processing module. The control message management module includes a message buffer to complete a single message through a request message and a response message. That is, when checking the request message, a message line is added to the message buffer using MME IP and Sequence Number as key values. Since the S-GW receives messages from multiple MMEs, the M-ME IP is added as a key value in consideration of duplication of sequence number values. When checking the response message, it is checked from the message line whether there is a message having the same key value among the request messages stored in the message buffer. If the key value of the response message is the same as the key value of the request message, the field contents of the corresponding response message are added to the message line to complete a single message (see FIG. 6, underlined). Data is added from the response message). The completed single message is sent to the message processing module, after which the single message is deleted from the message buffer. The message processing module manages a user information table stored in the first storage unit DB1 through the single message. That is, user information is added, updated, or deleted in the user information table in the first storage unit DB1.

Referring to FIG. 7 to FIG. 9, the message processing module first receives a Create Session message, and the UC TEID + EBI information of the received message is stored in the UC table of the first storage unit DB1. Determine if it exists. If UC TEID + EBI information exists in the UC table, the existing user information table is deleted. Otherwise, the operation continues. That is, sequentially, the UC table, the UD table, and the IP table are generated. 8 shows a method of generating a UC table, a UD table, and an IP table. Creates a UC table, inputs UD TEID information using UC TEID + EBI as a key value, inputs UE IP information using the UD TEID information as a key value again, and inputs the UE IP information into an IP table again. Enter MSISDN information with the key value. 9 shows the completed Create Session message.

In addition, the packet analyzer 200 may check the system operation mode information D7 and operate in the fixed policy mode or the real time mode. The fixed policy mode (or default mode) is a mode in which the detection / blocking policy is queried by the third storage unit DB3 at the time of initial system operation and maintains the queried detection / blocking policy until the system operation is stopped. to be. The real-time policy mode inquires the detection / blocking policy in the third storage unit DB3 at a specific time unit set in the packet analyzer 200, checks whether the detection / blocking policy is changed, and reflects the change if there is a change. Mode.

Here, the operation of the abnormal SIP detection module in the packet analyzer 200 will be described with reference to FIG. 10.

Referring to FIG. 10, the abnormal SIP detection module first receives first packet information D1 (S101).

Next, it is determined whether a SIP message exists in the first packet information D1 (S102).

Subsequently, if there is a SIP message in the first packet information D1, it is determined whether the SIP message is a SIP invitation message (S103).

Subsequently, if the SIP message is the SIP invitation message, the GTP-U TEID is extracted from the first packet information D1 (S104), and the user terminal identification number (eg, MSISDN_1) information is queried based on the GTP-U TEID. In step S105, it is determined whether user terminal identification number (for example, MSISDN_1) information exists (S106). If the SIP message is not the SIP invitation message, the packet manager 100 transmits the GTP packet without blocking.

Subsequently, if the user terminal identification number (eg, MSISDN_2) information exists in the first packet information D1, the user terminal identification number (eg, MSISDN_2) information is extracted from the From field (S107).

Subsequently, the first storage unit DB1 is queried based on the GTP-U TEID in the first packet information D1 to extract user terminal identification number (for example, MSISDN_1) information, and the user terminal identification number (for example, For example, it is determined whether the MSISDN_1 information is the same as the user terminal identification number (for example, MSISDN_2) information extracted from the From field in the first packet information D1 (S108).

If the user terminal identification number (for example, MSISDN_1) extracted by searching the first storage unit DB1 based on the GTP-U TEID in the first packet information D1 and extracted from the From field, For example, if the MSISDN_2) information is not the same, abnormal SIP detection information is generated and transmitted to the packet analysis result manager 300 (S109).

Subsequently, the packet analysis result manager 300 determines whether the damage information is detected / blocked (S110).

Subsequently, when the damage information detection / blocking policy is set, a rule for detecting abnormal SIP damage information is generated, and the generated rule is stored in the third storage unit DB3 (S111). 11 shows an example table for detected / blocked abnormal SIP information. The policy for detecting an abnormal SIP damage information is determined to set an abnormal SIP damage history detection / blocking policy by determining whether to set an abnormal SIP damage history detection / blocking policy by referring to the set policy when detecting an abnormal SIP damage information. In this case, a table for detecting abnormal SIP damage information is automatically generated in memory (see FIG. 12).

13 is a block diagram showing a detailed module of a packet analysis result management unit.

Referring to FIG. 13, the packet analysis result manager 300 receives the packet analysis result information D4 from the packet analyzer 200 and extracts user information through the user information extraction module. Using the extracted user information, the first storage unit DB1 inquires about the packet sending user. In addition, the packet analysis result manager 300 transmits the detection / blocking result information D6 to the fourth storage unit DB4 through the analysis result storage module.

14 is a block diagram showing a detailed module of the system manager.

Referring to FIG. 14, the system manager 400 monitors a state of a system through a traffic input / output status. In addition, the system manager 400 may monitor the state of the system using information such as CPU utilization and memory utilization as well as traffic input / output status. The system monitoring module inquires the traffic I / O status from the NIC 10 and monitors the system status through the system. In addition, the system monitoring module transmits the traffic input / output status information D8 to the system communication unit 500. The system control module controls the operation mode of the system according to the monitoring result of the system monitoring module. That is, the operation mode of the system is set to IPS mode or BYPASS mode. The system control module transmits the system operation mode information D7 to the second storage unit DB2.

15 is a block diagram illustrating a detailed module of a system communication unit.

Referring to FIG. 15, the system communication unit 500 includes a system management message interpretation module, a policy management message interpretation module, a detection / blocking log inquiry message interpretation module, a GUI protocol interpretation module, and an external system interworking protocol interpretation module. The system management message interpretation module interoperates with the second storage unit DB2 to inquire the system operation mode information and interprets the system management message for setting the operation mode of the system. The policy management message interpretation module interoperates with the third storage DB3 to query the detection / blocking policy and interprets the policy management message for setting the detection / blocking policy of the system. The detection / blocking log inquiry message interpretation module interoperates with the fourth storage DB4 to search the detection / blocking log and interprets the detection / blocking log inquiry message for the detection / blocking log inquiry of the system. The GUI protocol interpretation module interprets the GUI protocol input for controlling the system in conjunction with the GUI. The external system interworking protocol analysis module analyzes the external system interworking protocol inputted to set the detection / blocking policy in connection with the external system.

16 and 17 exemplarily illustrate tables stored in the detection / blocking log storage unit.

18 is a diagram illustrating a structure of a 4G network to which an apparatus for blocking abnormal traffic according to an embodiment of the present invention is applied.

Referring to FIG. 18, the 4G network 1000 includes a 4G Enterprise Radio Access Network (E-RAN) for managing radio resources and a 4G Evolved Packet Core (EPC) for performing data processing / authentication / billing. Can be.

The 4G E-RAN may include a user terminal 1100 and an eNB 1200. For example, the user terminal 1100 may be a mobile terminal subscribed to a 4G network. The eNB 1200 may provide a wireless connection between the user terminal 1100 and the 4G network as a base station.

The 4G EPC may include an MME 1300, an S-GW 1400, a P-GW 1500, a Home Subscriber Server 1600, and a Policy & Charging Rule Function 1700. The MME 1300 can send and receive GTP packets through the S1-MME GTP tunnel with the eNB 1200. [ The S-GW 1400 can send and receive GTP packets through the S1-U GTP tunnel with the eNB 1200. [ The MME 1300 can transmit and receive GTP packets through the S-GW 1400 and the S11 GTP tunnel. The P-GW 1500 may be connected to the P-CSCF 2100 of the IMS network and the Internet.

In a 4G network, the S1-U GTP tunnel is a path for data traffic, the S11 GTP tunnel is a path for signaling, and the S5 GTP tunnel is a path for data traffic and signaling.

The abnormal traffic blocking apparatus described with reference to FIGS. 1 to 15 includes the eNB 1200 and the MME 1300 and the S-GW 1400 (P1, P2), or the S-GW 1400 and the P-GW 1500. ) May be provided between (P3). In addition, the abnormal traffic blocking apparatus described with reference to FIGS. 1 to 15 may be provided as an internal component of the S-GW 1400 or the P-GW 1500. Although not clearly illustrated in FIG. 18, the 4G network may be linked with a 3G network, a femtocell network, and the like through the S-GW 1400.

FIG. 19 illustrates a structure of an IMS network interworking with the 4G network of FIG. 18.

Referring to FIG. 19, the IMS network 2000 includes a P-CSCF 2100, an I-CSCF 2200, an S-CSCF 2300, a Border Gateway Control Function 2400, an HSS 2500, and an S-. It may include a GW 2600, a Media Gateway Control Function (MGCF) 2700, an Application Server (2800), and a Media Gateway (M-GW) 2900.

The SIP message transmitted from the user terminal 1100 in the 4G network can be delivered to the inside of the IMS network through the P-GW 1500. [ The P-CSCF 2100 associated with the P-GW 1500 may send the SIP message to the I-CSCF 2200 and the I-CSCF 2200 may send the SIP message to the S-CSCF 2300 . The S-GW 2600 may be connected to a Public Switching Telephone Network (PSTN), and the M-GW 2900 may be connected to a PLMN (Public Land Mobile Network).

Since the abnormal traffic blocking apparatus described with reference to FIGS. 1 to 15 is provided inside the 4G network (P1 to P3), abnormal traffic that manipulates a user terminal identification number included in a SIP message is detected, and the abnormal traffic is an IMS network. It can be blocked from being delivered to the inside of the.

The steps of a method or algorithm described in connection with embodiments of the present invention may be implemented directly in a hardware module, a software module, or a combination of the two executed by a processor. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any form of computer readable media known in the art Lt; / RTI > An exemplary recording medium is coupled to a processor, which is capable of reading information from, and writing information to, the recording medium. In the alternative, the recording medium may be integral to the processor. The processor and the recording medium may reside in an application specific integrated circuit (ASIC). The ASIC may reside within the user terminal. Alternatively, the processor and the recording medium may reside as discrete components in a user terminal.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

10: NIC 100: packet management unit
200: packet analysis unit 300: packet analysis result management unit
400: system manager 500; System communication unit
DB1, DB2, DB3, DB4: first to fourth storage unit

Claims (20)

A packet manager configured to receive a GTP packet, classify it into a GTP-U packet and a GTP-C packet, extract first packet information from the GTP-U packet, and extract second packet information from the GTP-C packet;
A packet analyzer configured to receive and analyze the first and second packet information, generate packet blocking information for blocking a GTP packet including an abnormal SIP message, and transmit the packet blocking information to the packet manager;
A packet analysis result management unit which receives the packet analysis result information from the packet analysis unit, extracts user information, and generates detection / blocking result information; And
And a detection / blocking log storage unit for receiving and storing the detection / blocking result information from the packet analysis result management unit. The method of claim 1,
The first packet information includes a GTP-U TEID extracted from a header of the GTP-U packet, a SIP message extracted from a payload of the GTP-U packet, and a user terminal identification number extracted from the SIP message. ,
And the second packet information includes a GTP-C TEID, the GTP-U TEID, a UE IP, and the user terminal identification number extracted from a header of the GTP-C packet. 3. The method of claim 2,
The SIP message, abnormal traffic blocking device including a SIP INVITE (SIP INVITE) message. The method of claim 3,
The packet management unit, if the SIP message is a SIP message that does not include the SIP invitation message, abnormal traffic blocking apparatus for transmitting without blocking the GTP packet. 3. The method of claim 2,
The user terminal identification number, abnormal traffic blocking device including an MSISDN (Mobile Station International ISDN Number). The method of claim 1,
And a system management unit for monitoring a state of a system through a traffic input / output status, setting an operation mode of the system according to a monitoring result, and transmitting system operation mode information to an operation mode information storage unit. The method according to claim 6,
The packet management unit, the abnormal traffic blocking device to apply the IPS mode or BYPASS mode using the system operation mode information. The method according to claim 6,
Abnormal traffic blocking device further comprises a system communication unit for analyzing and managing system messages transmitted to the system or an external system. The method of claim 8,
The system message may include a system management message for setting an operation mode of the system, a policy management message for setting a detection / blocking policy of the system, or a detection / block log inquiry message for a detection / blocking log inquiry of the system. Abnormal traffic blocking device. The method of claim 1,
The packet management unit includes a packet control module for forwarding or dropping the GTP packet using the packet blocking information. The method of claim 1,
The packet analysis unit, abnormal traffic blocking apparatus including a GTP tunnel information collection module for extracting session information using the second packet information. 12. The method of claim 11,
The GTP tunnel information collection module includes a control message management module for completing a single message through a request message and a response message, and a message processing module for managing a user information table through the single message. Traffic blocker. Receiving a GTP packet and classifying it into a GTP-U packet and a GTP-C packet, extracting a GTP-U TEID from the header of the GTP-U packet, extracting a SIP message from the payload of the GTP-U packet, A packet manager extracting a user terminal identification number from the SIP message;
A packet analyzer configured to receive and analyze the GTP-U TEID and the user terminal identification number, generate packet blocking information for blocking a GTP packet including an abnormal SIP message, and transmit the packet blocking information to the packet manager;
A packet analysis result management unit which receives the packet analysis result information from the packet analysis unit, extracts user information, and generates detection / blocking result information;
A system manager for monitoring a state of a system through a traffic input / output status, setting an operation mode of the system according to a monitoring result, and generating system operation mode information; And
Abnormal traffic blocking device including a system communication unit for analyzing and managing the system messages transmitted to the system or an external system. 14. The method of claim 13,
The SIP message, abnormal traffic blocking device comprising a SIP invitation message. 15. The method of claim 14,
The packet management unit, if the SIP message is a SIP message that does not include the SIP invitation message, abnormal traffic blocking apparatus for transmitting without blocking the GTP packet. 14. The method of claim 13,
The user terminal identification number, abnormal traffic blocking device comprising an MSISDN. 14. The method of claim 13,
The packet management unit, the abnormal traffic blocking device to apply the IPS mode or BYPASS mode using the system operation mode information. 14. The method of claim 13,
The packet management unit includes a packet control module for forwarding or dropping the GTP packet using the packet blocking information. 14. The method of claim 13,
And the packet analyzer comprises a GTP tunnel information collection module for extracting session information using a GTP-C TEID extracted from a header of the GTP-C packet. 20. The method of claim 19,
The GTP tunnel information collection module includes a control message management module for completing a single message through a request message and a response message, and a message processing module for managing a user information table through the single message. Traffic blocker.

Images