Identifying an illegitimate base station based on improper response

Patent metadata

Field	Value
Publication number	US-11638152-B2
Application number	US-201916699075-A
Country	US
Kind code	B2
Filing date	Nov 28, 2019
Priority date	Nov 28, 2019
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

Various embodiments include methods, components and wireless devices configured to identify illegitimate base station. The processor of the wireless device may determine that a device in communication with the wireless device is a suspect base station. The processor may send a fabricated message to the device, and may receive one or more response messages from the device. The processor may determine whether one or more of the response messages received from the device is an appropriate response or an inappropriate response to the fabricated message. In response to determining that a response message is an inappropriate response, the processor may determine that the device is an illegitimate base station. In response to determining that the device is an illegitimate base station, the wireless device may perform a protective action.

First claim

What is claimed is:

1. A method of identifying an illegitimate base station performed by a processor of a wireless device, comprising:
sending a fabricated message containing content that is falsified, garbled or otherwise improper to a device in communication with the wireless device in response to determining that the device is a suspect base station;
receiving a response message from the device;
determining whether the response message is an appropriate response or an inappropriate response to the fabricated message, wherein a determination that the response message is an appropriate response is based on a determination that the device has identified the fabricated message as containing content that is falsified, garbled or otherwise improper, and a determination that the response message is an inappropriate response is based on a determination that the device has not identified the fabricated message as containing content that is falsified, garbled or otherwise improper;
determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message; and
performing a protective action in response to determining that the device is an illegitimate base station.

2. The method of claim 1 , wherein the fabricated message comprises an area update message that includes a fabricated Temporary Mobile Subscriber Identity (TMSI).

3. The method of claim 2 , wherein the fabricated TMSI is a fabricated TMSI without integrity protection, and wherein:
an appropriate response comprises an identity request message; and
an inappropriate response comprises a message that does not include an identity request message.

4. The method of claim 1 , further comprising:
determining whether an International Mobile Subscriber Identity (IMSI) was sent to the device in response to receiving a message from the device; and
performing one or more authentication operations in response to determining that an IMSI was sent to the device,
wherein determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message comprises determining that the device is an illegitimate base station in response to determining that an IMSI was not sent to the device.

5. The method of claim 4 , wherein when the message received from the device is an identity request message performing one or more authentication operations comprises:
receiving an authentication request message from the device;
determining whether the authentication request message can be verified;
determining that the device is a legitimate base station in response to determining that the authentication request message can be verified; and
determining that the device is an illegitimate base station in response to determining that the authentication request message cannot be verified.

6. The method of claim 1 , wherein:
sending the fabricated message comprises sending a service request message that includes at least one of a fabricated response (RES) value, a fabricated cipher key sequence number (CKSN), or a key set identifier (ID);
the appropriate response comprises a service reject message; and
the inappropriate response comprises a service accept message.

7. The method of claim 6 , further comprising:
determining whether an International Mobile Subscriber Identity (IMSI) was sent to the device; and
attempting to re-register with the device in response to determining that an IMSI was sent to the device,
wherein determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message comprises determining that the device is an illegitimate base station in response to determining that an IMSI was not sent to the device.

8. The method of claim 7 , wherein:
sending the fabricated message to the device comprises sending an authentication response including the fabricated message;
attempting to re-register with the device comprises:
sending an attach request message to the device; and
receiving an authentication request from the device; and

determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message comprises determining that the device is an illegitimate base station in response to determining that the response message includes an attach accept message,
the method further comprising determining that the device is a legitimate base station in response to determining that the response message includes an authentication reject message.

9. The method of claim 1 , further comprising:
receiving an emergency message from the device; and
sending a message invoking a service to the device;
wherein determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message comprises determining whether the device is an illegitimate base station based on a response to the message invoking the service that is received from the device.

10. The method of claim 9 , further comprising:
determining that the device is a legitimate base station in response to determining that the response to the message invoking the service includes a positive response.

11. The method of claim 10 , further comprising:
performing a soft reset operation in response to determining that the device is a legitimate base station.

12. The method of claim 10 , further comprising:
simulating removal and re-insertion of a universal integrated circuit card (UICC) containing a universal SIM (USIM) card in response to determining that the device is a legitimate base station.

13. The method of claim 1 , wherein:
sending a fabricated message to the device comprises sending one or more fabricated messages to the device;
receiving a response message from the device comprises receiving more than one response from the device; and
determining whether the response message is an inappropriate response to the fabricated message comprises determining whether any one or more of the received response messages is an inappropriate response.

14. A wireless device, comprising:
a wireless transceiver; and
a processor coupled to the wireless transceiver and configured with processor-executable instructions to perform operations comprising:
sending a fabricated message containing content that is falsified, garbled or otherwise improper to a device in communication with the wireless device in response to determining that the device is a suspect base station;
receiving a response message from the device;
determining whether the response message is an appropriate response or an inappropriate response to the fabricated message, wherein a determination that the response message is an appropriate response is based on a determination that the device has identified the fabricated message as containing content that is falsified, garbled or otherwise improper, and a determination that the response message is an inappropriate response is based on a determination that the device has not identified the fabricated message as containing content that is falsified, garbled or otherwise improper;
determining that the device is an illegitimate base station in response to determining that the response message is an inappropriate response to the fabricated message; and
performing a protective action in response to determining that the device is an illegitimate base station.

Assignees

• Qualcomm Inc

Inventors

• Guan Xuepan
• De Subrato Kumar
• Pant Nitin
• Huber Mattias Kaulard
• Budhathoki Krishna Ram
• Bhattacharjee Ankur

Classifications

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04W88/02

  Terminal devices · CPC title

• H04W12/30

  Security of mobile devices; Security of mobile applications · CPC title

• H04W8/26

  Network addressing or numbering for mobility support · CPC title

• H04W60/00

  Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration · CPC title