KR20070029437A - Incoming packet filtering apparatus and method for packet in packet radio network - Google Patents

Abstract

An apparatus and a method for filtering reception packets in a wireless packet network are provided to prevent an unnecessary waste of wireless network resources by enabling a gateway to filter the packets to be received to mobile terminals. A gateway, receiving a reception packet, detects destination IP address of the received packet(701,702). Then the gateway checks whether routing to the destination IP address has been established in a routing table(703). If routing to the destination IP address hasn't been established in the routing table, the gateway extracts a payload protocol type and a port number from the packet and makes an inquiry to an HLR about location information of a mobile terminal corresponding to the destination IP address together with IMSI(International Mobile Subscriber Identity) of the mobile terminal(705). The HLR searches for a DB entry for the IMSI value and provides a location information response message to the gateway. The gateway, receiving the location information response message, checks whether the location information response message contains an error value(706,707). If the location information response message doesn't contain an error value indicating "port unreachable", the gateway transmits a bearer request message to a CN(Correspondent Node)(708).

Description

Incoming packet filtering apparatus and method in a wireless packet network {INCOMING PACKET FILTERING APPARATUS AND METHOD FOR PACKET IN PACKET RADIO NETWORK}

1 is a diagram illustrating a process of processing an incoming packet when a received packet is generated from a wireless packet network to a mobile communication terminal using a fixed internet protocol address.

2 is a block diagram showing a configuration of a mobile communication terminal in which a server application is implemented according to a preferred embodiment of the present invention.

3 is a block diagram showing the configuration of a home location register according to a preferred embodiment of the present invention.

4 is a block diagram showing the configuration of a gateway according to a preferred embodiment of the present invention.

5A is a flowchart illustrating a method of executing a server application of a mobile communication terminal according to an exemplary embodiment of the present invention.

5B is a flowchart illustrating a server application stopping method of a mobile communication terminal according to an exemplary embodiment of the present invention.

6 is a diagram showing the structure of a port registration request message according to an embodiment of the present invention.

7 is a flowchart illustrating the operation of a gateway according to a preferred embodiment of the present invention when an incoming packet is received.

8 is a ladder diagram illustrating a port registration method according to a preferred embodiment of the present invention.

The present invention relates to an apparatus and method for processing incoming traffic from a wireless packet network to a mobile communication terminal, and more particularly, to an apparatus and method for determining and filtering the validity of an arrival packet at a gateway.

An incoming packet is a packet that flows into a network when a mobile communication terminal is in an idle state, using an Internet Protocol (IP) address of the mobile communication terminal as a destination.

FIG. 1 is a diagram illustrating a process of processing an incoming packet when a received packet is generated from a wireless packet network to a mobile communication terminal using a fixed IP address.

Step 110: A mobile terminal MS having a fixed IP address where a server application is implemented, and a packet transmitted by a CN node in the Internet INT is a gateway of a wireless packet network {eg, a PLMN (Public Land Mobile Network)}. Passed Gat.

Step 120: The gateway Gat determines whether the destination IP address of the incoming packet is a mobile communication terminal registered in the gateway Gat, and if it is registered, informs the home location register (hereinafter referred to as HLR) of the mobile communication terminal. Query the location

In step 130, when the mobile communication terminal MS is in a location registered in the wireless packet network, the home location register HLR provides the gateway Gat with location information of the mobile communication terminal MS.

In step 140, the gateway Gat transmits a message requesting to establish a bearer to a radio access network (hereinafter referred to as a RAN) in which a mobile communication terminal MS is located. Reference numeral Rou represents a router.

Step 150: The radio access network RAN pages the mobile terminal MS. Reference AP denotes an access point. The mobile terminal MS responds to this paging.

In step 160, a transmission path is established through a transmission path setting process.

In step 170, when the transmission path is established, the incoming packet buffered in the gateway Gat is transmitted to the mobile communication terminal MS through the transmission path.

The mobile terminal MS receiving the packet through the above process reads the destination port from the packet and delivers the packet data to the corresponding server application. If there are no applications open on the port, packet reset (RST) for the Transmission Control Protocol (hereinafter referred to as TCP) and the User Datagram Protocol (hereinafter referred to as UDP) respectively. And Internet Control Message Protocol (ICMP). Generates port unreachable packets.

If it is assumed that the correspondent node CN located in the Internet INT attempts to access the mobile terminal MS using the wrong port, it uses the wireless network resources unnecessarily, and the mobile terminal user uses the wireless network to send a response to the wrong attempt. You pay for the use of resources. If the malicious person attempts to do this without any restrictions on an unspecified number of fixed IP users, it can cause serious confusion regarding charging as well as waste of wireless network resources. As a specific example, if a malicious person randomly transmits a large number of packets to terminals of a plurality of fixed subscribers, there may be a risk of congestion of the wireless packet network.

This is a problem caused by determining whether the incoming call is based only on the IP address of the mobile communication terminal. In other words, if a mobile communication terminal has an unactivated port and attempts to reach the mobile communication terminal, it not only consumes unnecessary wireless network resources but also charges the user incorrectly.

Therefore, when an incoming packet to a fixed IP mobile communication terminal occurs, it is necessary to make a meaning (valid as a valid packet) only when the server application is running in the mobile communication terminal with the same port number as the destination port number of the packet.

Accordingly, the present invention provides an apparatus and method for filtering an incoming packet to avoid unnecessary consumption of wireless network resources or incorrect charging of a user to process an incoming packet from a wireless packet network to a mobile communication terminal.

To this end, the present invention provides an apparatus for filtering an incoming packet, comprising: a mobile communication terminal in which a server application is implemented; a home location register for managing a list of server ports activated in the mobile communication terminal as an entity; And extracting protocol and port information from an incoming packet of the gateway to query the home location register with the location information of the mobile communication terminal and to determine whether to filter the incoming packet according to the query result.

To this end, the second invention relates to a method for a gateway to filter an incoming packet from a wireless packet network to a mobile communication terminal, the gateway receiving the incoming packet and detecting an internet protocol address, and the internet detected by the gateway. Checking a routing possibility of a protocol address; if the internet protocol address is a routable address; routing the internet protocol packet by the gateway; and if the internet protocol address is not a routable address, the gateway is a home location register. Querying the location information of the mobile communication terminal to receive a location information response message, and the gateway analyzes the received location information response message and transmits or discards a packet to a counterpart node according to the result. Specialty It shall be.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, specific details such as a detailed list structure, a message name, etc. are shown, which are provided to help a more general understanding of the present invention, and it is understood that the present invention may be practiced without these specific details. It will be self-evident to those of ordinary knowledge. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

An apparatus for filtering an incoming packet according to an embodiment of the present invention includes a mobile communication terminal in which a server application is implemented, a home location register that manages a list of server ports activated in the mobile communication terminal as an entity, and the mobile communication. And a gateway for extracting protocol and port information from an incoming packet to a terminal, querying the home location register with the location information of the mobile communication terminal, and determining whether to filter the incoming packet according to the query result.

According to an embodiment of the present invention, when server applications of a mobile communication terminal are activated, a corresponding port is registered in real time in a wireless packet network (server port list of a). Thus, when an incoming packet to the mobile communication terminal is generated, the next incoming procedure is performed only if the destination port number of the packet is registered in advance, and if it is not included, error handling (eg, "TCP RST", Protects the wireless packet network by enabling " ICMP port unreachable "

2 is a block diagram showing the configuration of a mobile communication terminal implemented with a server application according to an embodiment of the present invention.

The TCP and UDP server application unit 210 represents a plurality of activated TCP and UDP server applications. Examples shown are TCP server # 1, TCP server # 2, UDP server # 1, and the like. The IP stack unit 220 provides an Internet protocol service to the TCP, UDP server application unit 210. The port list unit 230 manages port information of server applications connected to the IP stack unit 220 and activated. For example, as shown, the port list unit 230 has a plurality of TCP port numbers and a plurality of UDP port numbers.

The session manager 240 is connected to the IP socket 220 to establish, maintain, or release a connection such as TCP or UDP. The modem 250 is connected to the IP socket 220 to control voice or data communication of the mobile communication terminal.

3 is a block diagram showing the configuration of a home location register according to a preferred embodiment of the present invention.

The HLR controller 310 controls the overall operation of the home location register HLR. The database unit 350 stores subscriber information. The illustrated DB unit 350 shows only the subscriber's International Mobile Subscriber Identity (IMSI) and the port for each protocol of the server application that is currently active, which is merely described in the present invention. It is intended to clarify the description by showing only the data that are directly relevant. In fact, it should be noted that in addition to this, it is possible to have more various subscriber information.

The DB processing unit 320 stores various information in the DB unit 350 or reads the stored information from the DB unit 350. The call admission control unit 330 determines whether to accept the requested call setup. The communication unit 340 is a module for communication between other network nodes.

4 is a block diagram showing the configuration of a gateway according to a preferred embodiment of the present invention.

The controller 410 collectively controls the operation of each functional block constituting the gateway to. The internet matching unit 420 is for internet matching, and uses, for example, Point-to-Point Protocol (PPP), Dynamic Host Configuration Protocol (DHCP), Layer 2 Tunneling Protocol (L2TP), and the like. The communication unit 430 is responsible for the communication function up to the link level. When the incoming packet arrives, the packet detection unit 440 receives the protocol type (TCP, UDP, ICMP, Internet Group Multicast Protocol (hereinafter referred to as IGMP), etc.), port number, and destination IP of the packet. Extract the address. The IP stack unit 450 provides a function of routing an IP packet arriving from the Internet or a mobile communication terminal to a destination IP address.

5A is a flowchart illustrating a server application execution method of a mobile communication terminal according to an exemplary embodiment of the present invention.

In step 510, the mobile communication terminal checks whether a server application is executed. If the execution of the server application is detected, the mobile communication terminal registers the protocol type and the corresponding port number used in the port list unit 230 in step 530. In operation 550, the mobile communication terminal generates a port registration request message PORT_REG_REQ, and transmits it to the home location register HLR in operation 570.

5B is a flowchart illustrating a method of stopping a server application of a mobile communication terminal according to an exemplary embodiment of the present invention.

In step 520, the mobile communication terminal checks whether the server application is stopped. When detecting the suspension of the server application, the mobile communication terminal deletes the corresponding port number from the port list unit 230 in step 540. In step 560, the terminal generates a port registration cancellation message PORT_CAN_REQ. In step 580, the terminal transmits the port registration cancellation message to the home location register HLR.

6 is a diagram showing the structure of a port registration request message according to a preferred embodiment of the present invention.

The port registration request message according to a preferred embodiment of the present invention consists of a list of corresponding ports for each protocol type. As shown, the port registration request message includes a type field, a length field, a plurality of protocol areas (protocol 1, protocol 2, ...), a plurality of port areas corresponding to each protocol (port # 1, port #). 2, ...).

The type may be a port registration request or a port deregistration request, and the protocol may be TCP or UDP.

When the port registration request message is implemented as an independent message, the port registration request message must include IMSI information for identifying the mobile communication terminal. Meanwhile, the port registration request message may be piggybacked on the general signaling message to exist as an information element.

7 is a flowchart illustrating the operation of a gateway according to a preferred embodiment of the present invention when an incoming packet is received.

The gateway receiving the incoming packet in step 701 detects the destination IP address in step 702. In operation 703, the routing table checks whether a route is set to the destination IP address of the packet. If the routing table is not routed to the destination IP address, in step 705, the gateway extracts the protocol type (eg, TCP, UDP, ICMP, IGMP, etc.) and port number of the payload and corresponds to the destination IP address. Query the location information of the mobile communication terminal with the home location register HLR together with the IMSI of the mobile communication terminal.

The home location register HLR receiving the location information request searches for and extracts a DB entry for the IMSI value and provides the gateway with the current location information of the mobile communication terminal if the port of the requested protocol is registered for the mobile communication terminal. However, if the protocol is not allowed or the requested port is not registered, the error value of the geolocation response message is set to "Port Unreachable" and forwarded to the gateway.

In step 706, the gateway receiving the response to the location information query, that is, the location information response message, checks whether the location information response message has a predetermined error value in step 707. The error value here may for example be "unreachable".

If the location information response message does not have an error value indicating "not reachable", the transmission path request message is transmitted to the counterpart node CN in step 708.

If the location information response message has an error value indicating "Unreachable", in step 709, "TCP RST" for TCP and "ICMP port not reached" for UDP are transmitted to the counterpart node CN.

8 is a ladder diagram illustrating a port registration method according to a preferred embodiment of the present invention.

In step 810, the mobile communication terminal MS starts a server application. In step 820, the port registration request message PORT_REG_REQ is transmitted to the home location register HLR.

In step 830, the home location register HLR receiving the port registration request message PORT_REG_REQ searches for an entry of the DB unit 340 using the IMSI value of the corresponding mobile communication terminal as a key from the port registration request message PORT_REG_REQ. Then, the protocol type extracted from the port registration request message PORT_REG_REQ and the corresponding port values are registered here.

When registration is completed, in step 840, the home location register HLR sends a port registration response message PORT_REG_RES to the mobile terminal MS to respond.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

As described above, the present invention prevents unnecessary consumption of wireless network resources by filtering the incoming packet to the mobile communication terminal, there is no fear of wrong charging to the user, and a malicious person randomly unspecifies a plurality of fixed subscribers. Even when transmitting a large amount of packets toward the terminal of the packet, the risk of congestion of the packet radio packet network is reduced. In addition, the service provider can determine and control whether to allow a specific protocol or port for each subscriber.

Claims (21)

A mobile communication terminal in which a server application is implemented; A home location register for managing a list of server ports activated in the mobile communication terminal as an entity; A gateway for extracting protocol and port information from the incoming packet to the mobile communication terminal, querying the home location register with the location information of the mobile communication terminal, and determining whether to filter the incoming packet according to the query result; Incoming packet filtering device, characterized in that. The method of claim 1, And generate a port registration request message and transmit the generated port registration request message to the home location register when the mobile communication terminal detects activation of the server application. The method of claim 2, And the home location register is configured to store the protocol type and the corresponding port of the terminal server application extracted from the port registration request message in a subscriber database. The method of claim 3, And the home location register determines whether to allow an incoming call by determining whether a protocol and a port included in the location information request message received from the gateway are stored in the subscriber database. The method of claim 1, And when the mobile communication terminal detects an interruption of activation of the server application, generates a port deregistration message and transmits it to the home location register. The method of claim 5, And the home location register is configured to delete the protocol type and the corresponding port of the terminal server application extracted from the port deregistration message from the subscriber database. The method according to claim 2 or 5, And the mobile communication terminal is configured to manage a protocol type and a port of the activation server application as a list. The method of claim 5, And the mobile communication terminal manages the protocol type and port of the activation server application as a list, and deletes the protocol type and port from the list when detecting the interruption of the activation of the server application. . The method of claim 1, And the gateway is configured to transmit a location information request message together with the international mobile subscriber ID number of the mobile communication terminal to query the location information. The method of claim 9, And the location information response message includes current location information or an error value of the mobile communication terminal. The method of claim 10, wherein the location information response message, If the port of the protocol requested for the mobile communication terminal is registered in the home location register, and includes the current location information of the mobile communication terminal, And a predetermined error value if the protocol requested for the mobile communication terminal is not allowed or registered. The method of claim 11, The gateway receives the location information response message from the home location register, analyzes the location information response message, and determines whether to filter the incoming packet according to the result; If the location information response message includes the current location information of the mobile communication terminal, the transmission request message is transmitted to the counterpart node. If the location information response message includes the error value, the transmission control protocol resets the transmission control protocol to the user datagram protocol. In the case, the incoming packet filtering device, characterized in that configured to send the "Internet control message protocol port unreachable" to the other node. The method of claim 1, The gateway determines whether or not routing is possible according to whether the Internet protocol address is routed to a destination Internet protocol address of a packet in a routing table, and when it is determined that routing is impossible, Incoming packet filtering device, characterized in that configured to query the location information. The method of claim 1, And the type of the protocol is a transmission control protocol, a user datagram protocol, an internet control message protocol, or an internet group multicast protocol. In the gateway filtering the incoming packet from the wireless packet network to the mobile communication terminal, Receiving, by the gateway, an incoming packet and detecting an internet protocol address; Checking the routeability of the detected internet protocol address by the gateway; If the internet protocol address is a routable address, the gateway routing the internet protocol packet; If the internet protocol address is not a routable address, the gateway inquiring a location information of the mobile communication terminal to a home location register to receive a location information response message; And analyzing, by the gateway, the received location information response message and transmitting or discarding a packet to a counterpart node according to the result. The method of claim 15, The process of querying the home location register with the location information of the mobile communication terminal by the gateway, Extracting a protocol type and a port number; And transmitting a location information request message together with an international mobile subscriber identification number of a mobile communication terminal corresponding to the destination internet protocol address. The method of claim 15, The location information response message includes the current location information or an error value of the mobile communication terminal. The method of claim 17, wherein the location information response message, If the port of the protocol requested for the mobile communication terminal is registered in the home location register, and includes the current location information of the mobile communication terminal, And a predetermined error value if the protocol requested for the mobile communication terminal is not allowed or registered. The method of claim 17, The process of the gateway to analyze the received location information response message and transmit the result to the counterpart node, If the location information response message includes the current location information of the mobile communication terminal, the gateway transmits a transmission request message to the counterpart node. If the location information response message includes an error value, the transmission control protocol resets the transmission control protocol. In the case of a datagram protocol, a method of transmitting an "Internet control message protocol port not reachable" to a counterpart node. The method of claim 15, The checking of the routing possibility of the Internet protocol address may include determining whether the Internet protocol address is routable or impossible depending on whether the Internet protocol address is routed to a destination Internet protocol address of a packet in a routing table. The method of claim 15, The payload protocol type is a transmission control protocol, a user datagram protocol, an internet control message protocol, or an internet group multicast protocol.

Images