KR20080046878A - Base station controller and method for prohibiting denial-of-service in mobile communication network - Google Patents

Abstract

A method for preventing denial-of-service in a mobile communication network and a BSC thereof are provided to measure the origination frequency of an originating call in the mobile communication network in each notice time window, determine whether a received call is for denial-of-service before allocating the resources of the BSC, and bypass the call for denial-of-service, thereby preventing denial-of-service by the call. A method for preventing denial-of-service in a mobile communication network comprises the following steps of: allowing a BS(Base Station) to receive a call from a terminal(S310); allowing the BS to identify the terminal which originates the call(S320); allowing a BSC(Base Station Controller) to determine whether the call is for denial-of-service(S330); allowing the BSC to bypass the received call and process the reception of a next call if the call is for denial-of-service; and allowing the BSC to process the received call normally when it is determined that the call is not for denial-of-service(S340).

Description

BASE STATION CONTROLLER AND METHOD FOR PROHIBITING DENIAL-OF-SERVICE IN MOBILE COMMUNICATION NETWORK}

1 is a schematic diagram showing the configuration of a mobile communication network;

2 is a conceptual diagram illustrating a call received by a base station from a plurality of terminals over time.

3 is a flowchart illustrating an operation performed to prevent a denial of service attack in a mobile communication network according to an embodiment.

4 is a flowchart specifically showing an operation performed in a step of determining whether a received call is for a denial of service attack according to an embodiment.

5 is a flowchart specifically showing an operation performed in a step of determining whether a received call is for a denial of service attack according to another embodiment.

<Explanation of symbols for the main parts of the drawings>

S310: Receiving a Call

S320: step of identifying the terminal originating the call

S330: determining whether the call is for a denial of service attack

S340: normal call processing step

The present invention relates to preventing denial-of-service attacks in a mobile communication network. More specifically, the present invention investigates the number of calls originating from each terminal during a predetermined time period and sends more than a predetermined threshold as a result of the survey. The present invention relates to a method for preventing a denial of service attack by ignoring a call originated by the terminal and a base station controller.

Since most of the services of the existing mobile communication network are for voice calls and the structure of the terminal is closed to the general user, the malicious user accesses the mobile network very frequently by inputting excessive dial numbers or modifying the terminal manually for a predetermined time. As a result, the capacity of the mobile communication network system was exceeded, which made it impossible for other subscribers to communicate, i.e., denial-of-service.

However, in recent years, as the mobile communication system has evolved into the third generation communication network, services provided by the communication system are gradually shifting toward data services, and terminals, such as Microsoft's Windows, have PDAs that adopt user-friendly general-purpose operating systems. As it is evolving in the form of a laptop, it is increasingly possible to carry out the aforementioned denial of service attack.

1 briefly illustrates a configuration of a mobile communication network. The mobile communication network 100 includes terminals 110A and 110B, base stations 120A and 120B, a base station controller 130 and a core network 140. The terminals 110A and 110B include mobile phones, PDAs, laptops, and the like, and include means for communicating with other terminals or connecting to the Internet through the mobile communication network 100. The base station 120A, 120B communicates with the terminal through a wireless link, and the base station controller 130 controls the connected base stations 120A, 120B, and also establishes a radio channel, handover processing, and the core network 140. It performs an operation such as communication with the switching center through the network. The core network 140 connects the terminal to the receiving base station controller through the switching center and delivers the outgoing call to the called party. When a malicious user communicates data very frequently through the terminal 110A, the resources of the base stations 120A and 120B or the base station controller 130 are all used to process the data, thereby preventing other users from communicating. Cases may occur.

However, a method for preventing a denial of service attack in such a mobile communication network has not been proposed yet. The present invention relates to a method and an apparatus capable of preventing communication service interruption due to a denial of service attack in a mobile communication network.

Accordingly, the present invention provides a method for preventing a denial of service attack by determining whether a received call is for a denial of service attack before allocating a resource of a base station controller and processing the received call according to the determination result. It is to provide a base station controller.

According to one embodiment, in a method for preventing a denial of service attack in a mobile communication network, receiving a call, identifying a terminal that originated the call, a call originated by the determined terminal within a predetermined time interval A method is provided for preventing a denial of service attack comprising calculating a number, and determining whether the call is for a denial of service attack based on the number of outgoing calls.

According to another embodiment, a method for preventing a denial of service attack in a mobile communication network, the method comprising: receiving a call, determining whether the call originating terminal is a denial of service attack terminal, and if the terminal is a denial of service attack terminal; A method is provided for preventing a denial of service attack comprising ignoring the call.

According to yet another embodiment, a base station controller for preventing a denial of service attack in a mobile communication network, means for receiving a call, means for determining the terminal that originated the call, and the determined terminal is pre-determined. A base station controller is provided that includes means for calculating the number of outgoing calls within a time interval and means for determining whether the call is for a denial of service attack based on the number of outgoing calls.

Hereinafter, various embodiments will be described in detail with reference to the accompanying drawings.

Whether a terminal is a denial of service attack can be determined based on how many calls the terminal makes in a think-time. Thinking time is defined as the time that a normal user tries to wait for the result until the user attempts to make a call and the call fails as a result, and then waits for the result after a call attempt. The call attempts that are automatically made by the program for the denial of service attack occur after a very short time, or continually with little time, so this feature can be used to sort out the call of the service denial attack. . Therefore, assuming, for example, 5 seconds in a typical wireless communication, a terminal that transmits three or more calls within that time can be determined as a denial of service attack terminal.

2 illustrates outgoing calls received by a base station over time, for example a call received by the base station from three terminals (a, b, c). In detail, in FIG. 2, when a typical height time interval is defined as an “elevation time window”, in the height time window 210, one call is received from the terminals a, b, and c at the base station. In the height time window 220, the terminal a makes three calls and the terminal b makes one call. In the height time window 230, the terminal a makes one call and the terminal c makes two calls. As shown in FIG. 2, since the terminal a in the one-hour window 220 frequently calls out unreasonably, the terminal a may be assumed to be a terminal of a malicious user who performs a denial of service attack.

For example, as shown in Figure 2, it is possible to determine that the terminal sending three or more calls within a given time for the denial of service attack. This is because even if two calls are made within a high time, such as the terminal c in the time window 230, since the call is originated from the boundary area of the neighboring window, it may not actually be for a denial of service attack. Regarding the number of outgoing calls that can be determined as a denial of service attack terminal, 3 is merely an example and is not limited thereto.

3 is a flowchart illustrating an operation performed to prevent a denial of service attack in a mobile communication network according to an exemplary embodiment.

First, when the base station receives a call from the terminal (step S310), the base station identifies the terminal that originated the call (step S320). In one embodiment, as shown in FIG. 1, when base station 120A receives a call from terminal 110A, base station 120A is included in the received call, for example, a mobile equipment identifier (MEID), IMSI ( The terminal originating the call is identified by using an identifier for the originating terminal 110A such as an international mobile subscriber identifier. The base station controller then determines whether the call originated by the terminal is for a denial of service attack (step S330). For example, as shown in FIG. 1, the base station controller 130 may determine that the terminal has initiated a denial of service attack based on whether the identified terminal 110A originated a call at least above a predetermined frequency (or threshold) per hour. Determine if In case of a denial of service attack, the received call is ignored and the next call is processed. If it is determined that the service is not for denial of attack, the received call is processed normally (S340).

The normal call processing step (S340) is a resource allocation step, such as allocating a memory in the base station controller required for the call, determining whether the base station controller is overloaded by receiving the call, and controlling the state of the originating call. Driving a state machine, after which the call is forwarded to the exchange and forwarded to the receiving terminal.

4 is a flowchart specifically illustrating an operation performed in a step of determining whether a received call is for a denial of service attack according to an embodiment. First, step S332 is performed to calculate how many calls the terminal identified in step S320 has made so far within a predetermined height time window. In one embodiment, the elevation time window may be determined based on statistics of the call origination pattern of the terminal user or may be adjusted according to the traffic amount of the current mobile communication network, for example, the size of the elevation time window may be set to about 5 seconds. Can be. Comparing the calculation result in step S332 with the number of calls originated by the terminal and a predetermined threshold value (S334), if the outgoing call is determined to be a denial of service attack, the received call is ignored (S336). In the case where the received call is normally processed (S340). For example, if the number of calls originating from a particular terminal within the one-hour window is three or more, the call may be determined to be a denial of service attack.

When a new height time window is started over time, the number of outgoing calls per terminal may be reset, for example, zero. Therefore, the denial of service attack terminal is determined for each height time window.

5 is a flowchart specifically showing an operation performed in a step of determining whether a received call is for a denial of service attack according to another embodiment. Another embodiment is to improve the resource consumption and processing time delay of the mobile communication network system caused by determining the denial of service attack terminal for each height time window. To this end, by using a table including the identification number of the terminal determined to be a denial of service attack terminal, after confirming that the terminal is registered in this table after the terminal identification step (S320) (S510), if it is registered in the table, The call is ignored and the next call is processed (S520). If the terminal is not registered in the table, the terminal counts the number of calls made during the one-hour window (S530). If the value is a threshold value, for example, 3 or more, the call is ignored (S550). The identification number and the like of the terminal are registered (S560). On the other hand, if the calculated value is less than the threshold, normal call processing is performed (S340).

The denial of service attack terminal table may be stored in the memory of the base station controller, but is not limited thereto. The denial of service attack terminal table may include an identification number of the denial of service attack terminal, a time determined by the denial of service attack terminal, and an attack grade determined based on the degree of denial of service attack per unit time, but is not limited thereto. . In addition, even if the terminal registered in the denial of service attack terminal table after a certain period of time, it is deleted from the table, it is possible to determine whether the terminal performs a normal operation or still being used as a denial of service attack terminal in step S540. have. The timing of deleting the terminal information in the denial of service attack terminal table may be set differently for each terminal according to the attack class indicating the degree of denial of service attack.

Embodiments of the method described above may be embodied as computer readable codes on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

The above embodiments provide a method for preventing a denial of service attack in a mobile communication network. Specifically, the transmission frequency of the outgoing call in the mobile communication network is measured at each time window to determine whether the outgoing call is a denial of service attack before allocating the resources of the base station controller. It helps prevent attacks.

In addition, since the base station controller according to the embodiment described above does not allocate resources to the outgoing call for denial of service attack, communication is almost never lost due to the attack, and more users can communicate smoothly.

Claims (13)

In a method for preventing a denial of service attack in a mobile network, Receiving a call, Identifying the terminal that originated the call, Calculating the number of calls originated by the determined terminal within a predetermined time interval, and Determining whether the call is for a denial of service attack based on the number of outgoing calls; Method for preventing a denial of service attack comprising a. The method of claim 1, And resetting the number of outgoing calls at the predetermined time period. The method of claim 1, Determining whether the call is for a denial of service attack includes ignoring the call if the number of outgoing calls is greater than or equal to a predetermined threshold. The method of claim 3, Determining whether the call is for a denial of service attack further comprises: normalizing the call if the number of the outgoing calls is less than the threshold. 4. The method of claim 3, wherein the threshold is three. As a method for preventing a denial of service attack in a mobile communication network, Receiving a call, Determining whether the call originating terminal is a denial of service attack terminal; and If the terminal is a denial of service attack terminal, ignoring the call Method for preventing a denial of service attack comprising a. The method of claim 6, And determining whether the terminal originating the call is a denial of service attack terminal, based on the frequency with which the terminal originates a call within a predetermined time interval. The method of claim 6, The disregarding the call may include storing an identification number for the terminal determined as the denial of service attack terminal. The method of claim 8, The determining of whether the call originating terminal is a denial of service attack terminal further includes comparing the identification number of the call originating terminal with identification numbers of the denial of service attack single shot stored when the previous call is received. How to.  The method of claim 8, wherein the identification number comprises a mobile equipment identifier (MEID) or an international mobile subscriber identifier (IMSI). A computer readable recording medium storing computer executable instructions for carrying out the method of claim 1. In a base station controller for preventing a denial of service attack in a mobile communication network, Means for receiving a call, Means for determining the terminal that originated the call, Means for calculating the number of calls originated by the determined terminal within a predetermined time interval, and Means for determining whether the call is for a denial of service attack based on the number of outgoing calls. Base station controller to prevent a denial of service attack comprising a. The method of claim 12, And means for determining if the call is for a denial of service attack comprises means for ignoring the call if the number of calls originated by the determined terminal is greater than or equal to a predetermined threshold.

Images