RU2814792C1 - Method and device for countering unauthorized access to subscriber device in wireless communication network - Google Patents

Abstract

FIELD: wireless communication network.

SUBSTANCE: disclosed is a method of countering unauthorized access to a subscriber device in a wireless communication network, characterized by the fact that when receiving, together with the subscriber device, a receiver of a device for countering unauthorized access to the subscriber device of a request for providing a mobile subscriber identifier IMSI, the time of receiving the request and the frequency are recorded, on which the request was sent, when the threshold value of the number of such requests in the time interval is exceeded, and/or if there are signs of operation of a virtual base station in said zone, and/or when transmitting identifiers in the service area is prohibited, transmitting, using the transmitter for the virtual base station, the generated false identifier of the requested subscriber device, which does not match its real identifier IMSI, wherein the response to the request is transmitted with a signal power exceeding the power of the signal from the subscriber device for the virtual base station to ignore the real IMSI received from the subscriber device in parallel with the false identifier.

EFFECT: providing counteraction to operation of technical means designed to obtain identifiers of subscriber devices of cellular communication.

11 cl, 1 dwg

Description

The inventions relate to wireless communication networks, namely to methods and devices for ensuring information security of subscribers [H04W 4/00, H04W 12/00, H04W 12/02, H04W 12/12, H04W 12/121, H04W 12/122, H04W 12 /128, H04W 12/30, H04W 12/40, H04W 12/60, H04W 12/61, H04W 12/63, H04W 12/64, H04W 12/80, H04W 60/00, H04W 60/04].

The number of subscriber cellular devices is constantly growing. Thus, according to data for 2021, the number of smartphone users worldwide amounted to 3.9 billion people, with Russia occupying one of the leading places in this indicator. Cellular subscriber devices are no longer used only for communication, but also for the purpose of entertainment, education, solving comprehensive, including business, problems, as well as for government bodies to perform their functions. And it is obvious that ensuring information security when using a cellular subscriber device is currently one of the most important tasks.

Various possible attacks on subscriber cellular communication devices are known, which are carried out by attackers in order to obtain personal data, information about bank accounts, location data, used Internet resources, to cause communication failures (deterioration of communication, reduction of communication speed, limitation of services provided) and etc.

The most dangerous attacks are carried out by attackers using so-called “virtual base stations” (VBS, “IMSI catcher”, “Fake BS”). These virtual base stations “impersonate” themselves as a legitimate cellular base station and then replace (eclipse) commands to the subscriber device from the base station in order, for example, to obtain permanent identifiers. In telecommunication wireless networks of 2-5 generations, for security purposes when transmitting over a wireless radio channel, temporary constantly changing identifiers are used (TMSI - Temporary Mobile Subscriber Identity, GUTI = MME identifier + TMSI), and other temporary identifiers are also provided, for example, for sending Paging messages in LTE/NR networks use a temporary RNTI. Obviously, replacing a permanent identifier with a temporary one significantly complicates a targeted attack for an attacker (singling out traffic, determining location, confirming the location of a specific subscriber in the local area, etc.). Numerous studies and practical devices have proven that using VBS it is possible to obtain not only temporary, but also permanent identifiers.

Attacks using a virtual base station to obtain a permanent subscriber device identifier are known in various generations of cellular communications. From sources [Easy 4G/LTE IMSI Catchers for Non-Programmers, Stig F. Mjlsnes and Ruxandra F. Olimid, https://www.researchgate.net/publication/318925138_Easy_4GLTE_IMSI_Catchers_for_Non-Programmers], [Practical attacks against privacy and availability in 4G /LTE mobile communication systems, Altaf Shaik, Ravishankar Borgaonkary, N. Asokanz, Valtteri Niemix and Jean-Pierre Seifert, https://www.researchgate.net/publication/283279741_Practical_attacks_against_privacy_and_availability_in_4GLTE_mobile_communication_systems] known method of carrying out an attack to identify permanent identifiers of subscriber devices used in 4th generation networks (LTE networks) for which one or a pair of virtual base stations are used, where the first virtual base station emits a signal at one of the priority frequencies and with a high degree of probability one or more subscriber devices will try to attach to the second virtual base station, that is, the second virtual base station is used to detach the attacked subscriber device from the network. In the process of attaching the subscriber device to the second virtual base station, it sends a request to the subscriber devices currently connected in the network to the base station to receive a permanent IMSI identifier (IDENTITY REQUEST). In this way, an attacker can collect all persistent identifiers in some local area. Further, the collected identifiers can be used in other attacks or actions aimed at restricting the legal rights and freedoms of users of subscriber devices (for example, SS7 attacks, tracking the location of a specific user, etc.).

Virtual base stations can be used to monitor individual subscriber devices and their owners, to establish the identity of the owner of the subscriber device, to track the owner of the subscriber device with a known IMSI in a given area, to listen to conversations using the subscriber device detached from the real base station.

Various methods are used to counter virtual base stations.

There is a known METHOD FOR DETECTING A FAKE BASE STATION [EP3298814 (A1), published: 03/28/2018], including identification by the first wireless device of a plurality of parameters associated with the detection signal transmitted by the second wireless device, wherein the second wireless device is declared as a base station controller, compared by the first a wireless device of a plurality of parameters associated with a detection signal transmitted by a second wireless device with a set of parameters assigned to or otherwise associated with a cluster of neighboring base stations; and determining that the second wireless device is a rogue base station when there is a discrepancy between the parameters associated with the signal detection transmitted by the second wireless device and a set of parameters assigned to or otherwise associated with a cluster of neighboring base stations exceeds a threshold, wherein the detection signal identifies one or more base station capabilities of the second wireless device, and wherein determining that the second wireless device is a fake base station, includes comparing one or more base station capabilities of the second wireless device with a set of base station capabilities associated with a cluster of neighboring base stations to determine whether one or more base station capabilities of the second wireless device are incompatible with the capabilities of the cluster of neighboring base stations, wherein one or more base station capabilities of the second wireless device are incompatible with the capabilities of a cluster of neighboring base stations when the second wireless device lacks capabilities in the set of capabilities associated with the cluster of neighboring base stations.

The disadvantage of the analogue is that this method does not allow identifying all possible virtual base stations, since the parameters of virtual base stations may completely coincide with the parameters of neighboring base stations, in addition, it is possible that legal base stations have some parameters that may differ from the parameters of neighboring legal base stations stations, for example, due to operator settings.

The closest in technical essence is the METHOD FOR DETERMINING AN ATTACKER'S SWITCHING AND CONTROL MEANS [RU 2759156 C1, published: 09.11.2021], which consists in receiving identification information from the communication means to the receiving unit of the serving switching and control means, which differs in that in addition to the communication means receive the value of the received signal level of the serving switching and control facility, query the received identification information into the database to determine the coordinates of the legitimate switching and control facility, and obtain their own coordinates in the distance calculation block designed to calculate the distance from the communication facility to the switching and control facility from the navigation receiver of the communication means, the distance from the communication means to the switching and control means (R1) is calculated using the coordinates, in parallel with this, the value of the level of the received signal is transmitted from the receiving unit to the distance calculation block, designed to calculate the distance from the communication means to the serving switching means and control, where the distance to the serving switching and control facility is calculated based on the level of the received signal (R2), the values obtained in the distance calculation blocks are transferred to the distance difference determination block, where the difference between the received distances (ΔR) is calculated, the resulting value (ΔR) is transmitted to the decisive a block where the module of the received value (|ΔR|) is compared with the specified value (ΔD), if the module of the difference of the calculated distances is greater than the specified value (|ΔR|>ΔD), then a decision is made that this switching and control means belongs to an attacker, in the executive block, based on the decision received from the decision block, a notification is generated and transmitted to the communications operator that the servicing switching and control facility belongs to an attacker.

The main technical problem of the prototype is the low efficiency of identifying a virtual base station due to the presence of a given measurement error in which, when a virtual base station is located in close proximity to a legal base station, the system does not identify it as a virtual base station. In addition, a common technical problem of the analogue and the prototype is that these methods can only detect the operation of the virtual base station, but not interfere with its operation.

The objective of the invention is to eliminate the disadvantages of the analogue and prototype.

The technical result of the invention is to counteract the operation of special technical means created to obtain identifiers of subscriber cellular devices.

The specified technical result is achieved due to the fact that the method of countering unauthorized access to a subscriber device in a wireless communication network, characterized in that when, together with the subscriber device, the receiver of the device for counteracting unauthorized access to the subscriber device receives a request for this subscriber device to provide its international mobile subscriber identifier IMSIs record the time the request was received and the frequency at which the request was transmitted when the threshold value of the number of such requests in a time interval is exceeded by a set count of the number of requests from real base stations in this time interval, and/or if there are signs of a virtual base station operating in a specified area , and/or when the transmission of identifiers is prohibited in the service area, a generated false identifier of the requested subscriber device is transmitted using a transmitter at the frequency of receiving the request, which does not coincide with its real IMSI identifier, while the response to the request is transmitted with a signal power exceeding the signal power from the subscriber device for the virtual base station to ignore the real IMSI identifier it received from the subscriber device in parallel with the false identifier.

In particular, signs of the operation of a virtual base station in the service area of the subscriber device are detected by software and hardware.

In particular, signs of the operation of a virtual base station in the service area of the subscriber device are identified by organizational measures aimed at increasing information security.

In particular, information about the place and time of formation of the false identifier is recorded in the false identifier of the subscriber device to determine the place, time and direction of attacks on the subscriber device.

In particular, a false identifier is generated by selecting from the database the real identifier of the subscriber device, which is located at that time in another local area.

In particular, when requests from virtual base stations are detected, together with sending a false identifier of the subscriber device, the virtual base station sends messages to subscriber devices located in the service area of the base stations about the fact of unauthorized actions on subscriber devices.

A device for preventing unauthorized access to a subscriber device in a wireless communication network, characterized in that it contains a control module and a memory module connected to it for storing databases of real and false identifiers of subscriber devices, real-time clock modules and bindings for determining the time and location of a request from a virtual base station for the subscriber device to provide its identifier and for synchronizing the exact time for simultaneous transmission of the generated IMSI with the real one, a generator for generating false identifiers, a counter for requests for subscriber device identifiers, a receiver that allows receiving service packets from base and virtual base stations to which subscriber devices can join devices and a transmitter capable of transmitting subscriber device identifiers to base and virtual base stations in response to their request; a receiving and transmitting antenna are connected to the receiver and transmitter, respectively

In particular, the receiver and transmitter can be made in the form of a single transceiver module.

In particular, the receiving and transmitting antennas can be made in the form of one transmitting and receiving antenna.

In particular, the real-time clock module and the binding module can be implemented as a GPS/GLONASS/Galileo/BeiDou module.

In particular, a device for preventing unauthorized access to a subscriber device in a wireless communication network can be based on a base station.

The figure schematically shows one of the options for a device to counter unauthorized access to a subscriber device in a wireless communication network, which indicates: 1 - control module, 2 - memory module, 3 - real-time clock module, 4 - binding module, 5 - identifier generator, 6 - request counter, 7 - receiver, 8 - transmitter, 9 - receiving antenna, 10 - transmitting antenna, 11 - base station, 12 - virtual base station, 13 - subscriber devices.

Implementation of the invention.

The essence of the claimed invention is the detection of a virtual base station (IMSI-trap) by its attempt to obtain the identifier of the subscriber device and misinformation of the identified virtual base station with false identifiers, the processing of which forces the attacker to spend additional time on their processing and misinforms him regarding the permanent identifiers of the subscriber devices and zone definition and the operating time of the virtual base station.

A base station in radio communications is a system complex of transceiver equipment that provides centralized service to a group of terminal subscriber devices. A base station in relation to cellular communications is a complex of radio transmitting equipment (repeaters, transceivers) that communicates with the end user device - a cell phone.

A virtual base station is a device that is used by attackers, including to identify the temporary mobile subscriber identification (TMSI), international mobile subscriber identification (IMSI) of the nearest subscriber device and intercept its calls, and some of them to determine the international identification of mobile equipment (IMEI).

The claimed method allows you to mislead the virtual base station and the attacker controlling it, while false identifiers collected by the attacker's virtual base station make it possible to determine the subscriber device that is the target of the attack, the zone and operating time of the virtual base station.

International Mobile Subscriber Identity (IMSI) is an individual subscriber number associated with each GSM, UMTS or CDMA, LTE, NR mobile phone user. When registering on the network, the subscriber device transmits an IMSI, which is used to identify it. In subscriber devices operating in a mobile communication network, the identifier is contained on the SIM card in an elementary file (EF) with the identifier 6F07. The format for storing IMSI on a SIM card is described, for example, by ETSI in the GSM 11.11 specification. In addition, IMSI is used by any mobile network connected to other networks (in particular CDMA or EVDO, LTE) in the same way as in GSM networks. This number is associated either directly with the phone or with an R-UIM card (analogous to a GSM SIM card in the CDMA system).

The IMSI length is usually 15 digits, but can be shorter. For example: 250-07-ХХХХХХХХХХ. The first three digits are MCC (Mobile Country Code). In the example, 250 are Russia (262 are Germany, 257 are Belarus). All operators providing cellular services in a certain country have the same MCC code. It is followed by MNC (Mobile Network Code) - this is a unique cellular operator code valid throughout the country. 07 from the example - SMARTS. The mobile network code may contain two digits according to the European standard or three digits according to the North American standard. All subsequent numbers are directly the user ID MSIN (Mobile Subscriber Identification Number).

Mobile Country Code (MCC), Mobile Network Code (MNC) are transmitted to the subscriber equipment wirelessly through SIB (System Information Block) messages using, for example, a base station that directly communicates wirelessly with the subscriber equipment. This allows the user equipment (UE) (User Equipment) to identify the operator. To connect to the network, the subscriber device sends a connection request message to the base station.

Physical and MAC messages in a wireless network are sent in plain text, and the International Mobile Subscriber Identity (IMSI) after successful authentication is replaced by a Temporary Mobile Subscriber Identity (TMSI) and is used for security reasons to hide other identifiers subscriber, namely to avoid transmission of the International Mobile Subscriber Identity (IMSI) to protect user privacy.

The device for preventing unauthorized access to a subscriber device in a wireless communication network contains a control module 1 and a memory module 2, a real-time clock module 3, a binding module 4, an identifier generator 5, a request counter 6, a receiver 7, a transmitter 8 connected to it. To the receiver 7 and the transmitter 8 are connected to the receiving 9 and transmitting 10 antennas, respectively. The receiver 7 and the transmitter 8 can be made in the form of one transceiver module. The receiving 9 and transmitting antennas 10 can also be made in the form of one transmitting and receiving antenna. The real time clock module 3 and the binding module 4 may be designed as a GPS/GLONASS/Galileo/BeiDou etc. module. The real-time module is used to accurately synchronize the sending of the spoof IMSI with the real IMSI. In order for such a substitution to be possible, the clock error should not exceed several tens of microseconds (the duration of a symbol, for example, in LTE is 66 μs).

A device for preventing unauthorized access to a subscriber device in a wireless communication network can be based on a base station.

To prevent the collection of permanent IMSIs at any facility or service area, the radio-electronic situation is initially assessed, namely, with which cellular base stations 11 the cellular subscriber devices 13 can interact. Based on service messages from base stations 11 (RRC, MAC level messages pass without encryption) received by the receiver 7 through the receiving antenna 9 in the control module 1, the times and frequencies intended for transmitting requests from a particular subscriber device 13 are determined, as well as the delay time for specific subscriber device 13. For some reason, the network core may lose the temporary TMSI identifier of the subscriber device 13, and then the base station 11 submits a request to receive the permanent IMSI identifier of the subscriber device 13. The 3GPP protocol allows sending IMSI before connecting the subscriber device to the base station (respectively, before encryption), this is what attackers use to obtain identifiers.

When assessing the radio-electronic situation, the average number of requests over a certain time from base stations 11 for subscriber devices to provide 12 their identifiers is determined. The presence of a virtual base station 12 in the network area is evidenced not by a single request itself, but by an increase in the number of such requests in the analyzed period of time. For example, when analyzing the radio-electronic situation, it was found that the number of requests from base stations 11 does not exceed two in 5 seconds, or in another example, the number of requests from base stations 11 does not exceed twenty in one hour.

In addition, the presence of a virtual base station 12 can be detected by any other means, for example, hardware and software, identifying signs of a virtual base station in the zone (region), for example, IMSI-Catcher detectors, such as Android IMSI-Catcher Detector, SnoopSnitch, Cell Spy Catcher (Anti Spy), etc., organizational measures aimed at increasing information security, for example, such that in a specific zone (district, facility) the transfer of permanent identifiers is prohibited and any request, even from a legal base station 11, is identified as suspicious. In order not to impede the operation of legal base stations 11, the device is configured in such a way that it goes into active mode when there is a high probability of operation (presence) of the virtual base station 12. To do this, a threshold value for the number of requests from the base station 11 is set in the control module 1 subscriber devices 13 to provide one or more subscriber device 13 with its International Mobile Subscriber Identity (IMSI) at a predetermined time interval. With the above value of requests no more than two per 5 seconds in control module 1, the threshold value is set, for example, three or more requests per 5 seconds. When the number of requests from the base stations 11 is set in another example, in which such a number of requests does not exceed twenty in one hour, the control module sets a threshold value for the number of requests of more than twenty in one hour.

The specified threshold value, as indicated above, is set based on an assessment of the radio-electronic situation in a given detection zone of the virtual base station 12.

One or more devices are deployed, each of which may include one or more receivers 7 with receiving antennas 9, capable of receiving service information from the base station and allowing to “listen” to service packets from all, or from nearby base and virtual base stations, to which they can connect subscriber devices 13 located on the site (in the service area) and one or more transmitters 8 with transmitting antennas 10 capable of transmitting identifiers to base and virtual base stations 12 in response to their request. In accordance with the algorithm for the operation of subscriber devices in a mobile communication network, the subscriber device usually selects the base station with the strongest signal. Thus, the virtual base station 12 takes over the subscriber devices 13. Next, it requests from the subscriber device 13 its IMSI. This request, simultaneously with the subscriber device 13, is received by a device for preventing unauthorized access to the subscriber device in the wireless communication network.

Information processing is carried out using control module 1, based on a PC, FPGA, or mobile device.

The control module 1 of the device receives, through the receiving antenna 9 and the receiver 7, service commands of cellular communication from one and/or several base stations 11 in the local area (service area) and in case of exceeding the number of requests counted by the request counter 6 in the interval specified in the control module 1 time of commands from the base station, which requires the subscriber device 13 to disclose its permanent identifier, the control module 1 identifies this base station as virtual 12. The formation of a false IMSI identifier is carried out using an identifier generator 5, which generates a false identifier and through the transmitter 8, by means of a transmitting antenna 10, simultaneously with the subscriber device, a response from the virtual base station 12 is transmitted to a request with a false identifier that does not match the permanent identifier of the subscriber device 13 to which the request was addressed. A false identifier can be generated in various ways. For example, let the real IMSI of the subscriber device be 250028567233451. The first five digits (MCC and MNC) are left unchanged. The remaining 10 (maybe less depending on the country) are replaced randomly or using a database stored in memory module 2 of the device with time and location binding using real time clock module 3 and binding module 4, respectively, so that according to the generated The identifier could subsequently be determined when and where it was formed. For example (simplified), 6-7 characters are the place of formation of the identifier (for example, Moscow - 12), 8-11 characters are the time of formation (for example, 16:12). And as a result, the false identifier will look like 25002121612000. More complex encoding methods can be used to subsequently obtain information about the time and place of formation of the identifier.

The generated false identifier is written into the memory module 2 for its storage and further use when receiving a subsequent request from the virtual base station 12 to provide this false IMSI identifier in order to determine the place, time and direction of attacks on the subject or a specific subscriber device 13.

As discussed above, the value of the decoy identifier emitted may depend on the time and/or location of the decoy identifier transmission.

Suppose an IMSI is requested from virtual base station 12 in an area with tracking area code (TAC) 25. In this case, the false IMSI identifier will contain the tracking zone code “25” (or the radiation zones can be selected based on another criterion, for example, 01 - North-West of Moscow, 02 - North of Moscow, etc.).

In the same way, the time the device receives a request from the virtual base station 12 is taken into account. In the case of a repeated request from the virtual base station 12 of the subscriber device 13 and/or the use of this identifier to carry out other attacks such as, for example, a request for location/access to subscriber data with using the SS7/Diameter interface, using the false IMSI identifier received from the declared device, using the data contained in the specified false identifier, it is determined in which area and at what time it was transmitted from the device, which can help in implementing organizational measures to search for a virtual base station 12 , determining the direction of an attacker’s attacks and effectively investigating such an incident.

As already said, the transmission of a false identifier by the claimed device is carried out simultaneously with the subscriber device 13, but with greater power, and the virtual base station 12 identifies the response signal from the device due to the exceeding radiation power to its request as from the subscriber device 13.

The signal power level of the transmitter 8 is selected two or more times higher than the power of the subscriber device, which can range from 0.2 to 2 W, for example, the signal power of the transmitter 8 is selected from 4 W to 8 W and higher, depending on the distance from the device to subscriber device 13, taking into account the attenuation of the signal from the transmitter 8 to the virtual base station 12 with the possibility that the virtual base station 12 receives a signal from the transmitter 8 of the device with a power higher than the signal from the subscriber device 13 attacked by the virtual base station 12, and a signal of lower power from the subscriber device 13 was ignored by her.

To complicate the task of analyzing IMSI identifiers by an attacker, as well as to further misinform him, the device can transmit real IMSI identifiers of subscriber devices 13 that are not on the network at the time and/or located in another local area (for example, in another city or town ). Thus, in a further attempt to identify the location of the subscriber device in the future, the attacker will receive the location of the “real” subscriber, but not the one for whom the attacker is collecting data. This will further confuse the attacker.

In addition, when identifying requests from virtual base stations 12 by the algorithm described above, for the purpose of additional protection of network subscribers, the base station 11 can send messages to all subscriber devices 13 located in the radiation zone of the base stations 11 about possible unauthorized actions on subscriber devices 13 with on the part of attackers (for example, through service or SMS messages using mobile base stations).

Control module 1 can implement several algorithms for replacing the real IMSI identifier of the requested subscriber device 13 or all subscriber devices 13 in the TAC tracking area with a false IMSI identifier generated in the identifier generator 5:

1) immediate replacement upon receipt of a request command from the virtual base station 12;

2) replacement if the number of requests specified in the control module 1 is exceeded from each base station 11 and/or in the entire tracking zone, which are counted in the request counter 6 connected to the control module 1;

3) replacement if there is information about the operation of the virtual base station 12 in the area, obtained through organizational measures or during the operation of the IMSI trap detector or any other known method of identifying the virtual base station 12 or if there are base stations 11 in the area with a low level of encryption.

All, several or one of these methods can be used simultaneously.

A record of request commands from virtual base stations 12, the times they were received by the device and the frequencies at which these commands were received, received real IMSI identifiers, generated false IMSI identifiers and other data are recorded in memory module 2.

A device for counteracting the operation of technical means created to obtain permanent identifiers of subscriber mobile communication devices allows:

protect subscriber personal data such as IMSIs, location and other sensitive information. Attackers will be sent a false IMSI instead of the real one, making it difficult for them to track and contact a specific subscriber;

prevent tracking and monitoring of mobile users. The device helps prevent such tracking by replacing the real IMSI with a false one. This will make it difficult for attackers to determine the exact location of the subscriber and his activity;

counteract the fight against mass surveillance. The device helps to resist such mass tracking, which can be carried out, for example, for fraudulent purposes or for mass distribution of information without the consent of recipients (spam), providing anonymity to the subscriber and giving control over his personal information;

protection from attacks and hacks. Sending a false IMSI makes it difficult for attackers to carry out tracking, monitoring and hacking attacks on subscriber data, which can be carried out if the attacker knows the user ID;

reduce the risk of fraud associated with the use of subscriber personal information. Attackers will be provided with an incorrect IMSI identifier, which will make it more difficult for them to carry out fraudulent activities using the subscriber’s personal data and will help prevent and most effectively investigate incidents when an attacker attempts to carry out attacks with intercepted false IMSI identifiers.

In general, a device for countering the operation of technical means designed to obtain permanent identifiers of subscriber mobile communication devices provides protection and anonymity of the subscriber, prevents tracking and monitoring, and also reduces the risk of mobile fraud and thereby counteracts unauthorized access to the subscriber device in a wireless communication network .

Claims (11)

1. A method for countering unauthorized access to a subscriber device in a wireless communication network, characterized in that when, together with the subscriber device, the receiver of the device for counteracting unauthorized access to the subscriber device receives a request for this subscriber device to provide its international mobile subscriber identifier IMSI, the time of receipt of the request and the frequency are recorded , on which the request was transmitted, upon exceeding the threshold value of the number of such requests in a time interval established by counting the number of requests from real base stations in this time interval, and/or when there are signs of operation of a virtual base station in the specified area, and/or when transmission is prohibited identifiers in the service area, a generated false identifier of the requested subscriber device is transmitted using a transmitter for the virtual base station, which does not coincide with its real IMSI identifier, while the response to the request is transmitted with a signal power exceeding the signal power from the subscriber device for the virtual base station to ignore the real IMSI identifier , received by it from the subscriber device in parallel with a false identifier. 2. The method according to claim 1, characterized in that signs of operation of a virtual base station in the service area of the subscriber device are detected by software and hardware. 3. The method according to claim 1, characterized in that signs of operation of a virtual base station in the service area of the subscriber device are detected by organizational measures aimed at increasing information security. 4. The method according to claim 1, characterized in that information about the place and time of formation of the false identifier is recorded in the false identifier of the subscriber device to determine the place, time and direction of attacks on the subscriber device. 5. The method according to claim 1, characterized in that the false identifier is formed by selecting from the database the real identifier of the subscriber device, which is at that time in another local area. 6. The method according to claim 1, characterized in that when requests from virtual base stations are detected, together with sending a false identifier of the subscriber device of the virtual base station, a message is sent to subscriber devices located in the service area of the base stations about the fact of unauthorized actions on the subscriber devices. 7. A device for preventing unauthorized access to a subscriber device in a wireless communication network for implementing the method according to claim 1, characterized in that it contains a control module and a memory module connected to it for storing databases of real and false identifiers of subscriber devices, real-time clock modules and bindings for determining the time and place of a request from a virtual base station for the subscriber device to provide its identifier and for synchronizing the exact time for simultaneous transmission of the generated IMSI with the real one, a generator for generating false identifiers, a counter for requests for identifiers of subscriber devices, a receiver that allows receiving service packets from base and virtual base stations to which subscriber devices can join, and a transmitter capable of transmitting subscriber device identifiers to the base and virtual base stations in response to their request, a receiving and transmitting antenna are connected to the receiver and transmitter, respectively. 8. The device according to claim 7, characterized in that the receiver and transmitter can be made in the form of a single transceiver module. 9. The device according to claim 7, characterized in that the receiving and transmitting antennas can be made in the form of one transmitting and receiving antenna. 10. The device according to claim 7, characterized in that the real-time clock module and the binding module can be made in the form of a GPS/GLONASS/Galileo/BeiDou module. 11. The device according to claim 7, characterized in that the device for preventing unauthorized access to a subscriber device in a wireless communication network can be based on a base station.