KR101542011B1 - Apparatus, System, Method, and Recording Medium for blocking Attack in LTE System - Google Patents

Abstract

The present invention relates to a method and a system for blocking an attack in a mobile communication system to prevent a malicious attack to a terminal from a server in the mobile communication system including a long term evolution (LTE). According to an aspect of the present invention, the system comprises: a packet data network gateway (PGW) for creating a detachment notification message for a subscriber terminal to transmit the same to a network address translation (NAT) device, when a detachment request is recognized from the subscriber terminal; and a NAT device for (immediately) performing an action for detaching every session connected to the subscriber terminal, when the detachment notification message is received from the PGW, wherein the PGW can recognize the detachment request based on a delete bearer request message received from a mobility management entity (MME), and the detachment notification message may include an IP of the subscriber terminal.

Description

TECHNICAL FIELD The present invention relates to an apparatus, a system, a method, and a recording medium for an attack blocking apparatus, a system, a method,

The present invention relates to an apparatus and method for preventing an attack in a mobile communication system, and a recording medium, for blocking a malicious attack from a server to a terminal in a mobile communication system including LTE (Long Term Evolution).

Generally, an EPC network of an LTE system is divided into three logical entities such as a PDN-GW (Packet Data Network Gateway), a Serving-GW (Serving Gateway) and an MME (Mobility Management Entity).

The PDN-GW is a global mobility anchor for mobility between 3GPP access technology and non-3GPP access technology (such as CDMA2000, WiMAX or WIFI) and a gateway to the external network. It allocates IP (Internet Protocol) (Session Control) interworking with the 3GPP network and a Serving-GW and external network and routing information for packet service as a user plane, and has tunneling and IP routing functions.

Serving-GW is a mobility anchor for mobility between 3GPP access (E-UTRAN, UTRAN, GERAN). Serving-GW interworks with eNodeB and S1-U interface as session control and user plane node that handles payload traffic according to the established session and supports Inter LTE / 3GPP handoff .

The MME is a control plane entity responsible for mobility management of UEs moving between different EUTRAN eNodeBs and also for session management.

In the packet core network of the mobile communication system including the above-described LTE system, in order to manage the limited IP resources, IP is assigned to each time of attaching to the network, and its IP is not fixed.

The received traffic to the mobile communication subscriber terminal is transmitted to a network address translation (NAT) such that only a session with a server with which the subscriber first triggers is connected, (Hereinafter referred to as a first IP) and an IP of the server (hereinafter referred to as a second IP) are registered. Therefore, it is designed to protect subscribers against malicious traffic attacks from other servers.

However, if a malicious subscriber connects a session to a specific server through the first IP used by the malicious subscriber and detaches the session after registering the session with the NAT (session registration between the first IP and the second IP) The first IP used by the subscriber is returned to the packet core network. However, in NAT, since the corresponding session between the registered first IP and the second IP is released after a predetermined period of time, the first IP used by the malicious subscriber is reassigned The other subscribers received could be attacked from a specific server that the malicious subscribers registered for the session.

For example, FIG. 1 is a diagram for explaining an attack scenario and vulnerability of an unauthorized traffic inflow by exploiting an IP address reuse process as in the conventional problems described above. As shown in the figure, when an attacker is a malicious server The malicious server periodically transmits a TCP ACK packet to the returned IP address to maintain the open state of the firewall, thereby allocating the IP address used by the attacker A normal user receives a large amount of dummy packets (TCP ACK, FIN, etc.) transmitted from a malicious server, thereby causing a malfunction in the mobile communication network and causing a threat such as abnormal charging to the user.

Registration No. 10-0932570 (Registered on December 9, 2009)

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide an attack blocking device for a mobile communication system for blocking a malicious attack from a server to a terminal in a mobile communication system including LTE (Long Term Evolution) System, method, and recording medium.

According to an aspect of the present invention, there is provided an apparatus for blocking an attack in a mobile communication system, the apparatus comprising: a connection release unit for recognizing a connection release request from a subscriber station; And a disconnection notification unit for generating a disconnection notification message and transmitting the disconnection notification message to a Network Address Translation (NAT) apparatus upon recognition of the disconnection request, wherein the disconnection notification message is a message indicating that the NAT apparatus has received the disconnection notification message And can perform an operation for receiving and releasing all sessions connected to the subscriber terminal.

Upon receiving the disconnection notification message, the NAT may perform an operation for releasing all sessions connected to the subscriber terminal.

 The disconnection acknowledgment unit may recognize the disconnection request based on a Delete Bearer Request message received from the MME, the disconnection notification message may include an IP of the subscriber terminal, and the malicious The device for blocking an attack may include a PGW.

According to another aspect of the present invention, there is provided an apparatus for preventing an attack in a mobile communication system, the apparatus including an NAT (Network Address Translation) apparatus, ; And a session releasing unit for (immediately) performing an operation for releasing all sessions connected to the subscriber terminal upon receiving the disconnection notification message.

The receiving unit may receive the disconnection notification message from the PGW of the mobile communication system, and the disconnection notification message may include the IP of the subscriber terminal.

According to another aspect of the present invention, there is provided an attack prevention system for a mobile communication system, the method comprising: generating a connection release notification message for the subscriber terminal when a detach request is received from the subscriber terminal; Transfer to NAT (Network Address Translation) device PGW; And a NAT device for (immediately) performing an operation to (immediately) release all sessions connected to the subscriber terminal when the disconnection notification message is received from the PGW. The PGW may include a Delete Bearer Request message The disconnection notification message may include the IP of the subscriber terminal.

According to still another aspect of the present invention, there is provided a method for blocking an attack in a mobile communication system, the method comprising the steps of: (a) detecting a detach request from a subscriber terminal; ; And (b) upon receipt of the disconnection request, generating a disconnection notification message and transmitting the disconnection notification message to a Network Address Translation (NAT) device, wherein upon receiving the disconnection notification message, Lt; RTI ID = 0.0 > and / or < / RTI >

The step (a) may recognize the connection release request based on the Delete Bearer Request message received from the MME, and the connection release notification message may include the IP of the subscriber terminal.

According to another aspect of the present invention, there is provided a method for blocking an attack in a mobile communication system, the method comprising the steps of: (a) disconnecting a subscriber terminal from a mobile communication system Receiving a notification message; And (b) performing an operation to release all sessions associated with the subscriber station upon receipt of the disconnection notification message, wherein the step (a) comprises the steps of: disconnecting from the PGW of the mobile communication system A notification message may be received, and the disconnection notification message may include the IP of the subscriber terminal.

According to another aspect of the present invention, there is provided a method for blocking an attack in a mobile communication system, the method comprising the steps of: (a) in a PGW, Generating a connection release notification message for the subscriber terminal and transmitting the connection release notification message to a network address translation (NAT) device; And (b) performing, in the NAT, an operation for releasing all sessions connected to the subscriber terminal when the disconnection notification message is received from the PGW, wherein in the step (a), the PGW May recognize the disconnect request based on the Delete Bearer Request message received from the MME, and the disconnect notification message may include the IP of the subscriber terminal.

According to another aspect of the present invention, there is provided a computer-readable recording medium having recorded thereon a program for executing an attack blocking method of the mobile communication system.

As described above, according to various aspects of the present invention, in a mobile communication system including LTE (Long Term Evolution), when a subscriber terminal terminates a connection with a specific server and detaches from a network, Since all the sessions of the subscriber station are immediately released, an attack from the malicious server to the terminal can be blocked when the terminal is disconnected.

FIG. 1 is a view for explaining an attack scenario and vulnerability in an existing mobile communication system;
2 is a configuration diagram of a mobile communication system according to an embodiment of the present invention,
3 is a configuration diagram of the PGW of FIG. 1 according to an embodiment of the present invention;
4 is a configuration diagram of the NAT of FIG. 1 according to an embodiment of the present invention.
5 is a flowchart of an attack blocking method in a mobile communication system according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, like reference numerals are used to denote like elements in the drawings, even if they are shown in different drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

2 is a block diagram of a mobile communication system according to an embodiment of the present invention. As shown in the figure, a UE (User Equipment) 1, an eNB (eNode B) 10, a Mobile Management Entity 20, a Serving Gateway (SGW) 50, a Packet Data Network Gateway (PGW) 30, a Network Address Translation (NAT) device 40 and a Packet Data Network (PDN)

The UE 1 is a subscriber terminal device and generally receives a data communication relay of the eNB 10 of the LTE network and transmits the data call origination to the MME 20 as an exchange means. The UE 1 may include mobile terminal devices such as a smart phone, a notepad, and a tablet computer. However, these mobile terminal devices are merely an example of the UE 1, and various types of terminal devices capable of receiving data service through the wireless Internet can be included in the UE 1.

The eNB 10 is a base station equipment of an EUTRAN (Evolved Universal Terrestrial Radio Access Network) access method. Generally, the eNB 10 performs RF transmission and reception, signal intensity and quality measurement, baseband signal processing, .

The MME 20 is an EUTRAN access-type mobile communication exchange center for signaling control between the eNB 10 and the SGW 50. The MME 20 generally decides where to route the incoming data from the UE 1 And is responsible for subscriber information and mobility management, session management, idle subscriber management, paging, and subscriber authentication functions of the UE 1.

The SGW 50 is a serving gateway device for managing the mobility of the UE 1 between the eNB 10 and the second eNB, and performs a session control function for processing payload traffic according to a generally established session do. The SGW 50 interworks with the eNB 10 and supports handover and sets up the PGW 30 and an EPS bearer (Evolved Packet System bearer) and uses tunneling to transmit packet data units ).

The PGW 30 is a packet data network gateway device that allocates an IP address of the UE 1 and controls a session linked with a PDN (Packet Data Network) 60. In general, the SGW 50 and the PDN Maintains the routing information and routing information, performs tunneling and IP routing functions, and delivers PDUs to the SGW 50 and the PDN 60.

In addition, according to the embodiment of the present invention, when a detach request from the UE 1 is recognized, the PGW 30 generates a connection release notification message for the UE 1 and transmits it to the NAT device 40 .

In this embodiment, the disconnection notification message may serve as an indicator for enabling the NAT device 40 to perform an operation for releasing all sessions connected to the subscriber terminal when receiving the disconnection notification message .

The NAT device 40 can be utilized as a basic means for protecting a user from an external attack by installing a (Firewall) between a public and a private network. At this time, when NAT is set to a router which is an external device, that is, a router, only the public IP address allocated to the router is made known to the outside, and only the private IP address is used internally. Therefore, in order to attack an intruder, it is necessary to know the internal private IP address of the private network.

In the present embodiment, the NAT device 40 transmits information about the session, for example, the IP (hereinafter referred to as the first IP) of the UE 1, and the corresponding (Hereinafter referred to as a second IP) of the server and protect the subscriber against a traffic attack against the UE 1 from a malicious other server.

According to the embodiment of the present invention, the NAT device 40 determines whether the disconnection notification message is received from the PGW 30, that is, whether the UE 1 is detached from the PGW 30 via the disconnection notification message When the fact is notified, an operation for releasing all sessions connected to the UE 1 is performed.

The PDN 60 may include, for example, the Internet as a packet data network.

FIG. 3 is a detailed configuration diagram included in the PGW 30 of FIG. 1 as a configuration of an attack shielding apparatus of a mobile communication system according to an embodiment of the present invention. As shown in FIG. 3, And a connection release notification section 33. [

The connection release acknowledgment unit 31 is for recognizing the fact of a connection release request when there is a detach request for the mobile communication network from the UE 1 as a subscriber terminal. For example, Upon receiving the Bearer Request message, it can recognize that there is a connection release request of the UE 1 based on the received Delete Bearer Request message.

The disconnection notifying unit 33 is for notifying the NAT device 40 of the fact that it is aware of the disconnection request from the UE 1 through the disconnection acknowledgment unit 31. For example, (Detach Notify) for notifying the disconnection of the UE 1 to the NAT device 40. In this embodiment, the disconnection notification message includes the IP of the UE 1 can do.

FIG. 4 is a detailed configuration diagram of the NAT device 40 of FIG. 1 as a configuration of an attack blocking device of the mobile communication system according to an embodiment of the present invention. As shown in FIG. 4, And a session cancellation unit 43.

The reception unit 41 is for receiving a connection release notification message (Detach Notify) for the UE 1 as a subscriber terminal from the PGW 30 of the mobile communication system, .

Upon receipt of the connection release notification message through the reception unit 41, the session release unit 43 performs an operation for immediately performing an operation for releasing all sessions connected to the UE 1 based on the connection release notification message will be.

FIG. 5 is a flowchart of an attack blocking method of a mobile communication system according to an embodiment of the present invention. FIG. 5 is applied to each device of FIGS.

The present embodiment describes a case where the UE 1 connects to the server 70 and the session information between the UE 1 and the server 70 such as the IP of the UE 1 and the IP of the server 70 The registered status is assumed.

The UE 1 transmits a Detach Request message to the MME 20 via the eNB 10 in step S501 and the MME 20 transmits a Detach Request message to the MME 20 in step S502. And transmits a Delete Bearer Request message to the PGW 30 (S503).

Then, the PGW 30 receives the IP of the UE 1 based on the Delete Bearer Request message received in step S503, and recognizes the connection release request of the corresponding UE 1 (S505).

The PGW 30 generates a Detach Notify message including the IP address of the corresponding UE 1 and transmits the detach notify message to the NAT device 40 to inform the NAT device 40 of the disconnection of the UE 1 recognized in step S505 40 (S507).

The NAT device 40 immediately performs an operation for releasing all sessions connected to the UE 1 based on the Detach Notify message received from the PGW 30 in step S507. For example, The IP of the corresponding UE 1 and the IP of the server 70 as information are deleted and the corresponding session is released.

 The PGW 30 transmits a Detach Response message to the MME 20 in response to the Delete Bearer Request message received in step S503 (S511), and the MME 20 receives a Delete Bearer Request message from the PGW 30 A Detach Accept message is transmitted to the UE 1 in response to the Detach Request message received in step S501 (S513).

As described above, a method for blocking a malicious attack in a mobile communication system according to an embodiment of the present invention can be implemented as a computer-readable recording medium including a program command for performing various computer-implemented operations . The computer-readable recording medium may include a program command, a local data file, a local data structure, or the like, alone or in combination. The recording medium may be those specially designed and constructed for the embodiments of the present invention or may be those known to those skilled in the computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floppy disks, and ROMs, And hardware devices specifically configured to store and execute the same program instructions. The recording medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a local data structure, or the like. Examples of program instructions may include machine language code such as those generated by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

1: UE (User Equipment)
10: eNB (eNode B)
20: Mobile Management Entity (MME)
30: PGW (PDN Gateway)
31:
33: connection release notification section
40: Network Address Translation (NAT)
41: Receiver
43; Session release section
50: SGW (Serving Gateway)
60: Packet Data Network (PDN)
70: Server

Claims (20)

A disconnection acknowledgment for recognizing a detach request from a subscriber terminal; And
And a disconnection notification unit for generating a disconnection notification message and transmitting the disconnection notification message to a Network Address Translation (NAT) apparatus upon recognition of the disconnection request,
Wherein the connection release notification message serves as an indicator for enabling the NAT device to perform an operation for receiving the connection release notification message and releasing all sessions connected to the subscriber terminal. System's attack blocking device. The method according to claim 1,
Wherein the connection release notification message includes an IP of the subscriber terminal. The method according to claim 1,
Wherein the disconnection acknowledgment unit recognizes the disconnection request based on a Delete Bearer Request message received from the MME. 4. The method according to any one of claims 1 to 3,
Wherein the attack blocking device of the mobile communication system is a PGW. As an apparatus included in a NAT (Network Address Translation) apparatus,
A reception unit for receiving a connection release notification message for a subscriber terminal from the mobile communication system; And
And a session releasing unit for performing an operation for releasing all sessions connected to the subscriber station upon receipt of the connection release notification message,
Wherein the receiving unit receives the disconnection notification message from the PGW of the mobile communication system, and the disconnection notification message includes an IP of the subscriber terminal. delete delete A PGW for generating a connection release notification message for the subscriber terminal and transmitting the connection release notification message to a network address translation (NAT) device when a detach request is received from the subscriber terminal; And
And a NAT device for performing an operation for releasing all sessions connected to the subscriber terminal when the disconnection notification message is received from the PGW. 9. The method of claim 8,
And the connection release notification message includes an IP of the subscriber terminal. 9. The method of claim 8,
Wherein the PGW recognizes the connection release request based on the Delete Bearer Request message received from the MME. A method for performing in a PGW of a mobile communication system,
(a) recognizing a detach request from a subscriber terminal; And
(b) generating, upon acknowledgment of the disconnection request, a disconnection notification message and transmitting the disconnection notification message to a Network Address Translation (NAT) device,
Wherein the NAT performs an operation for releasing all sessions connected to the subscriber terminal upon receiving the disconnection notification message. 12. The method of claim 11,
And the disconnection notification message includes an IP of the subscriber terminal. 12. The method of claim 11,
Wherein the step (a) recognizes the connection release request based on the Delete Bearer Request message received from the MME. A method performed by a NAT (Network Address Translation) apparatus,
(a) receiving a connection release notification message for a subscriber terminal from a mobile communication system; And
(b) performing an operation for releasing all sessions connected to the subscriber terminal upon receipt of the connection release notification message,
Wherein the step (a) receives the disconnection notification message from the PGW of the mobile communication system, and the disconnection notification message includes an IP of the subscriber terminal. delete delete A method performed in a system including a PGW and a NAT,
(a) generating, in the PGW, a connection release notification message for the subscriber terminal and transmitting the connection release notification message to a network address translation (NAT) device when a connection detach request is recognized from the subscriber terminal; And
(b) if the disconnection notification message is received from the PGW in the NAT, performing an operation (immediately) for releasing all sessions connected to the subscriber terminal, How to block. 18. The method of claim 17,
And the disconnection notification message includes an IP of the subscriber terminal. 18. The method of claim 17,
Wherein the PGW recognizes the connection release request based on the Delete Bearer Request message received from the MME in step (a). A computer-readable recording medium having recorded thereon a program for executing an attack blocking method of the mobile communication system according to any one of claims 11 to 14 and 17 to 19.

Images