Methods, systems, and computer readable media for network node validation

Patent metadata

Field	Value
Publication number	US-10931668-B2
Application number	US-201816024422-A
Country	US
Kind code	B2
Filing date	Jun 29, 2018
Priority date	Jun 29, 2018
Publication date	Feb 23, 2021
Grant date	Feb 23, 2021

Abstract

Methods, systems, and computer readable media for network node validation are disclosed. One method occurs at a first network node. The method includes receiving, from a second network node, a first message associated with a mobile subscriber; sending, by the first network node, a query to the second network node, the query requesting identification information identifying mobile communications equipment of the mobile subscriber; receiving, by the first network node, a response to the query from the second network node, wherein the response includes the identification information; extracting, from the response, the identification information; comparing the identification information extracted from the response and validated identification information identifying the mobile communications equipment of the mobile subscriber; and in response to the identification information matching the validated identification information, recognizing the second network node as being authorized to send the first message and processing the first message.

First claim

What is claimed is:

1. A method for validating a network node, the method comprising:
at a first network node:
receiving, from a second network node, a first message associated with a mobile subscriber;
sending, by the first network node, a query to the second network node, the query requesting identification information identifying mobile communications equipment of the mobile subscriber, wherein the second network node is separate from the mobile communications equipment of the mobile subscriber;
receiving, by the first network node, a response to the query from the second network node, wherein the response includes the identification information, wherein the identification information includes a first international mobile equipment identity (IMEI);
extracting, from the response, the identification information;
comparing the identification information extracted from the response and validated identification information identifying the mobile communications equipment of the mobile subscriber, wherein the validated identification information includes a second IMEI and is from a trusted source separate from the second network node;
in response to the identification information extracted from the response matching the validated identification information, recognizing the second network node as being authorized to send the first message and processing the first message;
in response to the identification information extracted from the response not matching the validated identification information, recognizing the second network node as not being authorized to send the first message and identifying the first message as a network security threat; and
in response to identifying the first message as a network security threat, sending a mobile application part (MAP) purge MS message, sending a Diameter purge request message, discarding the first message, stopping the first message from reaching a location register, sending a message to a node indicating that the second network node is invalid, or copying or storing a portion of the first message.

2. The method of claim 1 wherein the first message includes a Diameter message, a Diameter update location request (ULR) message, a Diameter notification request (NOR) message, a mobile application part (MAP) message, a MAP update location message, or a location validation request message.

3. The method of claim 1 wherein the identification information further includes an equipment identifier, an encryption key, or a mobile subscriber related security value.

4. The method of claim 1 wherein the query includes a mobile application part (MAP) provide subscriber information (PSI) request message, a MAP any time interrogation (ATI) request message, or a Diameter provide subscriber location (PSL) request message and wherein the response includes a MAP PSI response message, a MAP ATI response message, or a Diameter update location request (ULR) message.

5. The method of claim 1 wherein the validated identification information is obtained by querying, using a mobile subscriber identifier associated with the mobile subscriber, a validation data store to obtain the second IMEI associated with the mobile subscriber, wherein the validation data store contains IMEIs indexed by mobile subscriber identifiers.

6. The method of claim 1 wherein the trusted source includes a home network node, a data store, or a previously validated network node.

7. The method of claim 1 wherein processing the first message includes forwarding the first message to a location register, sending a message to a node indicating that the second network node is valid, or copying or storing a portion of the first message.

8. The method of claim 1 wherein the first network node includes a Diameter node, a Diameter routing agent, a Diameter signaling router, a gateway, a signaling router, a signal transfer point (STP), a signaling gateway (SG), a signaling system number 7 (SS7) node, or a signaling node and wherein the second network node includes a mobility management element (MME), a visitor location register (VLR), a mobile switching center (MSC), a node in a visited network, a foreign network node, a serving general packet radio service (GPRS) support node (SGSN), or a gateway.

9. A system for validating a network node, the system comprising:
a first network node comprising:
at least one processor; and
a memory,

wherein the first network node is configured for:
receiving, from a second network node, a first message associated with a mobile subscriber;
sending, by the first network node, a query to the second network node, the query requesting identification information identifying mobile communications equipment of the mobile subscriber, wherein the second network node is separate from the mobile communications equipment of the mobile subscriber;
receiving, by the first network node, a response to the query from the second network node, wherein the response includes the identification information, wherein the identification information includes a first international mobile equipment identity (IMEI);
extracting, from the response, the identification information;
comparing the identification information extracted from the response and validated identification information identifying the mobile communications equipment of the mobile subscriber, wherein the validated identification information includes a second IMEI and is from a trusted source separate from the second network node;
in response to the identification information extracted from the response matching the validated identification information, recognizing the second network node as being authorized to send the first message and processing the first message;
in response to the identification information extracted from the response not matching the validated identification information, recognizing the second network node as not being authorized to send the first message and identifying the first message as a network security threat; and
in response to identifying the first message as a network security threat, sending a mobile application part (MAP) purge MS message, sending a Diameter purge request message, discarding the first message, stopping the first message from reaching a location register, sending a message to a node indicating that the second network node is invalid, or copying or storing a portion of the first message.

10. The system of claim 9 wherein the first message includes a Diameter message, a Diameter update location request (ULR) message, a Diameter notification request (NOR) message, a mobile application part (MAP) message, a MAP update location message, or a location validation request message.

11. The system of claim 9 wherein the identification information further includes an equipment identifier, an encryption key, or a mobile subscriber related security value.

12. The system of claim 9 wherein the query includes a mobile application part (MAP) provide subscriber information (PSI) request message, a MAP any time interrogation (ATI) request message, or a Diameter provide subscriber location (PSL) request message and wherein the response includes a MAP PSI response message, a MAP ATI response message, or a Diameter update location request (ULR) message.

13. The system of claim 9 wherein the validated identification information is obtained by querying, using a mobile subscriber identifier associated with the mobile subscriber, a validation data store to obtain the second NEI associated with the mobile subscriber, wherein the validation data store contains IMEIs indexed by mobile subscriber identifiers.

14. The system of claim 9 wherein the

Assignees

• Oracle Int Corp

Inventors

• Mehta Vikram

Classifications

• H04W12/72

  Subscriber identity · CPC title

• H04W8/18

  Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title