KR101501670B1 - User identification method of attack/anomaly traffic in mobile communication network - Google Patents

Abstract

The present invention relates to a method for identifying attacking/abnormal traffic inducing users in a mobile communication network, the method comprising the steps of: collecting and analyzing a GTP user (GTP-U) message to detect attacking/abnormal traffic; extracting a key to be used for referring to an index hash table from the GTP-U message detected as the attacking/abnormal traffic; referring to the index hash table for an index value using the extracted key; referring to a session hash table using the index value; and identifying attacking/abnormal traffic inducing user using session information retrieved from the session hash table.

Description

USER IDENTIFICATION METHOD OF ATTACK / ANOMALY TRAFFIC IN MOBILE COMMUNICATION NETWORK [0002]

The present invention relates to a mobile communication network attack / abnormal traffic inducing user identification method for identifying an attack / abnormal traffic inducing user in a mobile communication network.

Recently, the data traffic to the mobile communication network has been increasing, and malicious traffic in the wired environment is flowing into the mobile communication network through the tethering service. Accordingly, the potential security risk of the mobile communication network is increasing. In response, the mobile communication company has installed security equipment to protect its mobile communication network.

However, in a NAT (Network Address Translation) mobile communication network, it is difficult to identify a terminal performing an abnormal operation because a mobile terminal dynamically allocates a private IP address each time it connects to a network.

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and an object of the present invention is to provide a mobile communication network attack / unauthorized traffic inducing user identification method capable of identifying an attack / It has its purpose.

In order to solve the above problems, a method for identifying a user causing a mobile communication network attack / abnormal traffic according to the present invention includes collecting and analyzing a GTP-user message (GTP-U message) to detect an attack / / Extracting a key to be used for an index hash table lookup from a GTP-U message detected as an abnormal traffic, inquiring an index value of the index hash table using the extracted key, The method comprising the steps of: querying the session hash table; and identifying an attack / abnormal traffic inducing user using the session information searched in the session hash table.

The GTP-U message is packet data transmitted and received between the mobility management entity and the serving gateway.

The key extracting step to be used in the index hash table retrieval may include extracting an S1-U S-GW TEID (Tunnel Endpoint Identifier) or an S1-U eNB (evolved Node B) TEID and an eNB IP from the GTP-U message .

The index hash table manages index values used for the session hash table lookup.

The index hash table and the session hash table are updated through collection and analysis of a GTP-C message (GTP control plane message) transmitted and received between the mobility management entity and the serving gateway.

The present invention can identify a user causing attack / unauthorized traffic in a mobile communication network through real-time session management.

1 is a structural diagram of a mobile communication network attack / abnormal traffic inducing user identification system according to an embodiment of the present invention;
FIG. 2 is a block diagram showing the intrusion detection / prevention system shown in FIG. 1. FIG.
3 is a hash table structure associated with the present invention;
4 is a flowchart illustrating a session management method according to an embodiment of the present invention.
5 is a flowchart illustrating a process of processing a session creation message in the session management method of FIG.
FIG. 6 is a flowchart illustrating a process of processing a session modification message in the session management method of FIG. 4;
FIG. 7 is a flowchart illustrating a process of processing a session release message in the session management method of FIG. 4;
8 is a flowchart illustrating a session deletion message processing process in the session management method of FIG.
9 is a flowchart illustrating an attack / abnormal traffic inducing user identification method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

TECHNICAL FIELD The present invention relates to a technique for identifying a user causing attack / unauthorized traffic in a 4G mobile communication network.

The protocol used in 4G mobile communication network is GTP (GPRS Tunneling Protocol). In the GTP protocol, GTP control plane messages (GTP-C) are used to exchange tunnels information and manage tunnels such as tunnel creation, update, and deletion. The types and functions of GTP-C messages are shown in [Table 1]. The GTP user data message (GTP-U) is used to transmit T-PDUs through the GTP tunnel. The GTP protocol includes a Tunnel Endpoint Identifier (TEID), which is a unique value that can distinguish each user in a header, and the TEID has a unidirectional directionality. For example, S11 SGW TEID is an uplink TEID allocated by the S-GW used in S11 (MME <-> S-GW).

FIG. 1 illustrates a structure of a mobile communication network attack / abnormal traffic inducing user identification system according to an embodiment of the present invention.

Referring to FIG. 1, a system according to the present invention includes a user equipment (UE) 10, an evolved Node B (eNB) 20, a mobility management entity A Mobility Management Entity (MME) 30, a Serving Gateway (S-GW) 40, a Packet Data Network Gateway (P-GW) ) 50, an IP network 60, and an intrusion detection / prevention system 70.

The MME 30 is connected to the eNB 20 and is also connected to the S-GW 40, the P-GW 50, and the Home Subscriber Server (HSS) (not shown). The MME 30 also manages the UE 10 in the idle mode and paging the UE 10. The MME 30 processes a signal necessary for the UE 10 to interwork with the EPC (Evolved Packet Core) network.

The S-GW 40 is connected to the eNB 20 and interworks with the MME 30 and the P-GW 50 as well. The S-GW 40 is responsible for delivering and routing user traffic between the eNB 20 and the EPC when the UE 10 starts a data service in a state connected to the eNB 20. In addition, the S-GW 40 manages data services not to be disconnected even when the UE 10 performs handover or roaming.

The P-GW 50 allocates an IP (Internet Protocol) address of the UE 10, and transmits and receives packet data in the EPC network. In addition, the P-GW 50 determines a bearer band, and performs forwarding and routing functions for packet data.

The S-GW 106 and the P-GW 108 are connected to each other between the eNB 20 and the S-GW 40 and between the MME 30 and the S-GW 40, Is referred to as the S5 interface.

In addition, a Home Subscriber Sever (HSS) (not shown) stores subscription information for each UE 10. When the UE 10 accesses the network, it transmits information related to the UE 10 to the MME 30 To be used to control the UE 10.

When the UE 10 is connected to the eNB 20, the UE 10 accesses the IP network 60 using a data transmission path via the eNB 20, the S-GW 40, and the P-GW 50.

The intrusion detection / prevention system 70 includes a session management apparatus 71, a database 72 (hereinafter referred to as "DB"), a detection apparatus 73, and an identification apparatus 74 as shown in FIG. 2 do.

The session management apparatus 71 collects uplink and downlink control messages between the MME 30 and the S-GW 40 to manage each user session. Here, the control message is a GTP control plane message (hereinafter, referred to as 'GTP-C message'). The GTP-C message is used to exchange tunnels, manage tunnels (sessions) such as creating, updating, and deleting tunnels.

The session management apparatus 71 manages session information using a hash table.

This hash table is stored in the DB 72 and has a temporary hash table (hereinafter referred to as 'temporary table'), five index hash tables Quot;), and a session hash table (hereinafter referred to as a &quot; session table &quot;). Each record in the table consists of a key and a value.

The temporary table is for mapping a GTP-C message-specific request / response message pair, and the session table is a table in which each user session is managed. The index table is a table for managing index values for querying the session table.

4 is a flowchart illustrating a session management method according to an embodiment of the present invention.

The session management apparatus 71 receives a GTP-C message, which is a control message exchanged between the MME 30 and the S-GW 40 (S1). Here, the GTP-C message is transmitted in the form of a packet.

When the GTP-C message is received, the session management device 71 confirms whether the corresponding message is a request message (S2).

If the received GTP-C message is a request message, the session management device 71 adds a record to the temporary table and records information on the received GTP-C message in the added record (S3). At this time, the session management device 71 extracts and combines the MME IP and the sequence number from the GTP-C message and generates a key.

If the GTP-C message received in step S2 is not a request message but a response message, the session management device 71 extracts and combines the MME IP and the sequence number in the received GTP-C message, Is used as a key to inquire the temporary table (S4).

As a result of the temporary table inquiry, if there is a matching key in the temporary table, the session management device 71 updates the record value corresponding to the corresponding key with information about the GTP-C message (S5, S6).

Thereafter, the session management device 71 confirms the message type of the received GTP-C message and processes the corresponding message according to the confirmed message type (S7). That is, the session management device 71 manages GTP tunnel (session) information according to the type of the received GTP-C message.

When the processing of the received GTP-C message is completed, the session management apparatus 71 deletes the record in which the information of the GTP-C message received in the temporary table is recorded (S8). That is, the session management device 71 deletes the record of the key that matches the combination key of the MME IP and the sequence number of the received GTP-C message from the temporary table.

5 is a flowchart illustrating a process of processing a session creation message in the session management method of FIG.

If the received GTP-C message is a tunnel creation message, the session management apparatus 71 extracts the S11 S-GW TEID, the S11 MME TEID, the S1-U S-GW TEID, the UE IP, and the Evolved Packet System Bearer ID (EBI) , MME IP, and International Mobile Subscriber Identity (IMSI). Then, the session management device 71 selectively combines the extracted information to generate a key and an index value.

The session management apparatus 71 adds records to the uplink control (UC) index table, the downlink control (DC) index table, the uplink data (UD) index table, and the IP index table, (S711).

The session management apparatus 71 adds a record to the session table and records the session information included in the received GTP-C message using the generated index value as a key (S712).

6 is a flowchart illustrating a process of processing a session modification message in the session management method of FIG.

If the received GTP-C message is a tunnel modification message, the session management apparatus 71 extracts S11 S-GW TEID and EBI from the corresponding message, and generates a key by combining the extracted S11 S-GW TEID and EBI. The session management apparatus 71 inquires of the UC hash table the key matching the generated key (S721).

If a matching key exists, the session management device 71 extracts the index value of the inquired key (S722, S723), and inquires the session table using the extracted index value as a key (S724).

When the key corresponding to the extracted value is inquired, the session management device 71 updates the record value of the key with the session information included in the received GTP-C message (S725).

7 is a flowchart illustrating a process of processing a session release message in the session management method of FIG.

If the received GTP-C message is a tunnel revocation message, the session management apparatus 71 extracts S11 S-GW TEID and EBI from the corresponding message, and generates a key by combining the extracted S11 S-GW TEID and EBI. Then, the session management device 71 inquires of the UC index table of the key that matches the generated key (S731).

As a result, if a key corresponding to the index table exists, the session management device 71 extracts the index value (IMSI + EBI) of the matching key (S732, S733) The table is inquired (S734).

If there is a matching key in the session table, the session management device 71 extracts the record value of the inquired key and deletes it (S735).

Then, the session management device 71 inquires the UD and DD index tables and deletes the record of the corresponding key if there is a matching key (S736, S737).

8 is a flowchart illustrating a session deletion message processing process in the session management method of FIG.

If the received GTP-C message is a tunnel deleted, the session management apparatus 71 extracts S11 S-GW TEID and EBI from the corresponding message, and generates a key by combining the extracted S11 S-GW TEID and EBI.

The session management device 71 inquires the UC index table using the generated key, and if there is a matching key, extracts the index value of the corresponding key (S741 to S743).

The session management device 71 inquires the session table using the extracted index value as a key in step S744 and extracts a key for inquiring the UC / DC / UD / DD / IP index table from the inquired record in step S745.

After extracting the key, the session management device 71 deletes the inquired record in the session table (S746).

The session management device 71 inquires the UC / DC / UD / DD / IP index table using the extracted key (S747). Then, the session management device 71 deletes the inquired record in all the index tables (S748).

9 is a flowchart illustrating an attack / abnormal traffic inducing user identification method according to an embodiment of the present invention.

First, the detection device 73 of the intrusion detection / prevention system 70 collects and analyzes user data transmitted and received between the MME 30 and the S-GW 40, and based on the analysis result, (S11, S12). Here, the user data is a GTP user data message (GTP-U message). When the attack / abnormal traffic is detected, the detection device 73 delivers the GTP-U message determined as the attack / abnormal traffic to the identification device 74.

The identification device 74 extracts a key to be used in the index table inquiry in the GTP-U message (S13). Here, the identification device 74 extracts the S1-US-GW TEID or the S1-U eNB TEID and the eNB IP.

The identifying device 74 inquires the UD and the DD index table using the extracted key (S14).

If there is a key that matches the extracted key, the identification device 74 extracts the index value of the key (S15).

The identifying device 74 inquires the session table using the index value as a key (S16).

Then, the identifying device 74 extracts a record value of the key that matches the searched index value in the session table (S17). Here, the identification device 74 identifies an attack / abnormal traffic-inducing user through analysis of the extracted record value. As described above, when attack / abnormal traffic is detected through the session management, the present invention can identify the user who caused the traffic.

While the present invention has been described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It will be apparent that various modifications, alterations, and other equivalent embodiments are possible without departing from the scope of the invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

10: UE
20: eNB
30: MME
40: S-GW
50: P-GW
60: IP Network
70: Intrusion detection / prevention system

Claims (5)

Collecting and analyzing a GTP-user message (GTP-U message) to detect attack / unauthorized traffic;
Extracting an S1-U S-GW TEID (Tunnel Endpoint Identifier) or an S1-U eNB (evolved Node B) TEID and an eNB IP, which is a key for use in an index hash table inquiry from the GTP-U message detected as the attack / Wow,
Retrieving a UD and DD index hash table using the extracted key and extracting an index value of the extracted key if a key corresponding to the extracted key exists;
Querying the session hash table using the extracted index value as a key,
And identifying the attacking / abnormal traffic inducing user by using the session information retrieved from the session hash table. The method according to claim 1,
The GTP-U message includes:
Wherein the packet data is packet data transmitted and received between the mobility management entity and the serving gateway. delete The method according to claim 1,
The index hash table includes:
And managing index values used in the session hash table lookup. The method according to claim 1,
The index hash table and the session hash table are stored in the index hash table,
Wherein the GTP control plane message is updated by collecting and analyzing a GTP-C message transmitted and received between the mobility management entity and the serving gateway.

Images