Authenticating network elements in a communication system

A system that incorporates teachings of the present disclosure may include, for example, a computer-readable storage medium in a communication device having computer instructions to establish communications with a cellular base station, generate a message request, and transmit to an authentication device by way of the cellular base station the message request. The computer-readable storage medium can also have computer instructions to receive from the authentication device by way of the cellular base station a message response, authenticate the message response, and determine from the authenticated message response whether the cellular base station is an approved network element of a cellular communication system. Other embodiments are disclosed.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to authenticating network elements in a communication system.

BACKGROUND

In GSM communication networks, rogue base stations capable of intercepting phone calls are commonly referred to as IMSI catchers (IMSI standing for International Mobile Subscriber Identity). When cellular phones are near an IMSI catcher they generally receive a stronger signal from the IMSI catcher than a cellular base station tower at a distance. With a stronger signal, the IMSI catcher can cause the cellular phone to establish communications with the IMSI catcher rather than a legitimate cellular base station tower. Once the cellular phone is in communication with the IMSI catcher, calls initiated by a user of the cellular phone can be intercepted by a user of the IMSI catcher, thereby compromising the cellular phone user's privacy.

DETAILED DESCRIPTION

One embodiment of the present disclosure includes a communication device having a wireless transceiver coupled to a processor. The processor can be operable to establish communications with a wireless base station, generate an encrypted message request, and transmit to a server by way of the wireless base station the encrypted message request. The processor can also be operable to receive from the server by way of the wireless base station an encrypted message response, decrypt the encrypted message response, and determine that the wireless base station is an approved network element of a communication system providing communication services to the communication device based on at least two conditions comprising information included in the decrypted message response and an ability of the wireless base station to deliver to the communication device the encrypted message response transmitted by the server.

One embodiment of the present disclosure includes a computer-readable storage medium in a communication device having computer instructions to establish communications with a cellular base station, generate a message request, and transmit to an authentication device by way of the cellular base station the message request. The computer-readable storage medium can also have computer instructions to receive from the authentication device by way of the cellular base station a message response, authenticate the message response, and determine from the authenticated message response whether the cellular base station is an approved network element of a cellular communication system. The authentication device can be communicatively coupled to the cellular base station, and remotely located therefrom.

One embodiment of the present disclosure includes an authentication device having a memory coupled to a controller. The controller can operable to receive by way of a cellular base station a message request from a communication device, generate a message response, and transmit to the communication device by way of the cellular base station the message response to enable the communication device to determine whether the cellular base station is an approved network element of a cellular communication system.

FIG. 1depicts an illustrative embodiment of a communication system100. The communication system100can be represented by a cellular communication network123with a plurality of base stations121that provide wireless communication services over an expansive geographic region such as a city, state, or nation. The cellular communication network123can operate according to wireless access protocols such as Global System for Mobile (GSM), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Universal Mobile Telecommunications (UMTS), World interoperability for Microwave (WiMAX), Software Defined Radio (SDR), or Long Term Evolution or LTE, and so on). Other present and next generation wide area wireless network technologies are contemplated by the present disclosure.

Cellular phones supporting LTE can support packet-switched voice and packet-switched data communications and thus may operate as IP Multimedia Subsystem (IMS)-compliant devices. In this embodiment, the cellular base station121can communicate directly with an IMS network150—symbolically depicted by the bidirectional arrow between the cellular communication network123and the IMS network150. The IMS network150can be coupled to a Home Subscriber Server (HSS)140, a tElephone NUmber Mapping (ENUM) server130, and other common network elements of an IMS network150. The IMS network150can establish communications between IMS-compliant communication devices (CDs)101,102, Public Switched Telephone Network (PSTN) CDs103,105, and combinations thereof by way of a Media Gateway Control Function (MGCF)120coupled to a PSTN network160. The MGCF120is generally not necessary when a communication session involves IMS CD to IMS CD communications. A communication session involving at least one PSTN CD may utilize the MGCF120.

IMS CDs101,102can register with the IMS network150by contacting a Proxy Call Session Control Function (P-CSCF) which communicates with an interrogating CSCF (I-CSCF), which in turn, communicates with a Serving CSCF (S-CSCF) to register the CDs with the HSS140. To initiate a communication session between CDs, an originating IMS CD101can submit a Session Initiation Protocol (SIP INVITE) message to an originating P-CSCF104which communicates with a corresponding originating S-CSCF106. The originating S-CSCF106can submit the SIP INVITE message to one or more application servers (ASs)117that can provide a variety of services to IMS subscribers.

Additionally, the originating S-CSCF106can submit queries to the ENUM system130to translate an E.164 telephone number in the SIP INVITE message to a SIP Uniform Resource Identifier (URI) if the terminating communication device is IMS-compliant. The SIP URI can be used by an Interrogating CSCF (I-CSCF)107to submit a query to the HSS140to identify a terminating S-CSCF114associated with a terminating IMS CD such as reference102. Once identified, the I-CSCF107can submit the SIP INVITE message to the terminating S-CSCF114. The terminating S-CSCF114can then identify a terminating P-CSCF116associated with the terminating CD102. The P-CSCF116may then signal the CD102to establish Voice over Internet Protocol (VoIP) communication services, thereby enabling the calling and called parties to engage in voice and/or data communications.

If the terminating CD is instead a PSTN CD such as CD103or CD105(in instances where the cellular phone only supports circuit-switched voice communications), the ENUM system130can respond with an unsuccessful address resolution which can cause the originating S-CSCF106to forward the call to the MGCF120via a Breakout Gateway Control Function (BGCF)119. The MGCF120can then initiate the call to the terminating PSTN CD over the PSTN network160to enable the calling and called parties to engage in voice and/or data communications.

In some instances the aforementioned communication process between IMS CDs is symmetrical. Accordingly, the terms “originating” and “terminating” inFIG. 1may be interchangeable. It is further noted that communication system100can be adapted to support video conferencing. In addition, communication system100can be adapted to provide the IMS CDs101,102with multimedia and Internet services. It is further contemplated that the CDs ofFIG. 1can be communicatively coupled to an access point such as a femtocell (not shown), a WiFi router, a DECT base unit, or another suitable wireless access point to establish communications with the IMS network150ofFIG. 1.

The IMS network150and/or the cellular communication network123may also be communicatively coupled to a server132which as will be described below can enable a cellular communication device105to determine whether a cellular base station121which it has established communications with is a legitimate network element of the cellular communication network123.

FIG. 2depicts an exemplary embodiment of a communication device200. Communication device200can serve in whole or in part as an illustrative embodiment of the devices depicted inFIG. 1. The communication device200can comprise a wireline and/or wireless transceiver202(herein transceiver202), a user interface (UI)204, a power supply214, a location receiver216, and a controller206for managing operations thereof. The transceiver202can support short-range or long-range wireless access technologies such as Bluetooth, WiFi, Digital Enhanced Cordless Telecommunications (DECT), or cellular communication technologies, just to mention a few. Cellular technologies can include, for example, CDMA-1X, UMTS/HSDPA, GSM/GPRS, TDMA/EDGE, EV/DO, WiMAX, SDR, LTE, as well as other next generation cellular wireless communication technologies as they arise. The transceiver202can also be adapted to support circuit-switched wireline access technologies (such as PSTN), packet-switched wireline access technologies (such as TCPIP, VoIP, etc.), and combinations thereof.

The UI204can include a depressible or touch-sensitive keypad208with a navigation mechanism such as a roller ball, a thumbwheel, a joystick, a mouse, or a navigation disk for manipulating operations of the communication device200. The keypad208can be an integral part of a housing assembly of the communication device200or an independent device operably coupled thereto by a tethered wireline interface (such as a USB cable) or a wireless interface supporting for example Bluetooth. The keypad208can represent a numeric dialing keypad commonly used by phones, and/or a Qwerty keypad with alphanumeric keys used by smart phones. The UI204can further include a display210such as monochrome or color LCD (Liquid Crystal Display), OLED (Organic Light Emitting Diode) or other suitable display technology for conveying images to an end user of the communication device200. In an embodiment where the display210is touch-sensitive, a portion or all of the keypad208can be presented by way of the display210with navigation features.

The UI204can also include an audio system212that utilizes common audio technology for conveying low volume audio (such as audio heard only in the proximity of a human ear) and high volume audio (such as speakerphone for hands free operation). The audio system212can further include a microphone for receiving audible signals of an end user. The audio system212can also be used for voice recognition applications. The UI204can further include an image sensor213such as a charged coupled device (CCD) camera for capturing still or moving images.

The power supply214can utilize common power management technologies such as replaceable and rechargeable batteries, supply regulation technologies, and charging system technologies for supplying energy to the components of the communication device200to facilitate long-range or short-range portable applications. The location receiver216can utilize common location technology such as a global positioning system (GPS) receiver capable of assisted GPS for identifying a location of the communication device200based on signals generated by a constellation of GPS satellites, thereby facilitating common location services such as navigation.

The communication device200can use the transceiver202to also determine a proximity to a cellular, WiFi, Bluetooth, or other wireless access points by common sensing techniques such as utilizing a received signal strength indicator (RSSI) and/or a signal time of arrival (TOA) or time of flight (TOF). The controller206can utilize computing technologies such as a microprocessor, a digital signal processor (DSP), and/or a video processor with associated storage memory such a Flash, ROM, RAM, SRAM, DRAM or other storage technologies.

The communication device200can be adapted to perform the functions of CDs101,102,103and105ofFIG. 1. It will be appreciated that the communication device200can also represent other common devices that can operate in communication system100ofFIG. 1.

FIG. 3depicts an illustrative embodiment of a rogue base station302(referred to herein for illustrative purposes only as an IMSI catcher302) operating in the communication system100ofFIG. 1. The IMSI catcher302can be adapted to transmit a cellular signal that supersedes the signal strength of signals transmitted by the cellular base station121. When the cellular phone105detects the signal of the IMSI catcher302and is able to establish communications therewith, the IMSI catcher302can direct the cellular phone105to utilize the IMSI catcher302to establish communication services with the cellular communication network123. Unbeknownst to the cellular phone105, however, it has established communications with an IMSI catcher302which is acting illegitimately as a cellular base station121.

Generally, the IMSI catcher302is communicatively coupled to a communication network305. Communication network305can be a PSTN network, an IMS network, an Internet Service Provider (ISP) network or any other type of communication system that can provide voice and/or data services. The network305may be operated by a different service provider than the service provider of the cellular communication network123. When the cellular phone105originates a call, the IMSI catcher302can complete the call at a terminal device320targeted by the cellular phone105by way of the communication network305over communication link306by emulating the call function that would have normally taken place over the cellular communication network123. The terminal device320can be a landline phone (or a cellular phone—not shown). A full duplex communication session can take place between the cellular phone105and terminal320by way of the IMSI catcher302and the communication network305.

However, once another terminal device321attempts to communicate with the cellular phone105over communication link308, the communication that would normally take place over link310by way of a cellular base station121would fail because to the cellular communication network123the cellular phone105appears not to be in operation since it is not communicatively coupled to any the cellular base stations121of the cellular communication system123. This asymmetry in communications can be used in part to identify rogue base stations such as the IMSI catcher302ofFIG. 3in accordance with the embodiments disclosed herein.

FIG. 4depicts an illustrative method400that operates in portions of the devices ofFIGS. 1-2to detect the rogue base station ofFIG. 3.FIGS. 5-6depict supporting illustrations of the embodiments of method400. Method400can begin with step402in which a communication device such as the cellular phone105ofFIGS. 1-3establishes communications with a wireless base station such as cellular base station121. In step404, the cellular phone105can be adapted to generate an encrypted message request which it directs to the server132at step406to authenticate the cellular base station121. The cellular phone105can utilize any encryption technique to encrypt the message request. For illustration purposes only, it is assumed that the cellular phone105is adapted to use a public key infrastructure (PKI) technique for secure communications with the server132.

In one embodiment, the cellular phone105and the server132can be configured by a PKI certificate authority. Once configured, the cellular phone105and server132can exchange secure messages that cannot be readily modified by a cellular base station121. In one embodiment, step404can represent several exchanges between the cellular phone105and the server132. For instance, once the cellular phone105establishes communications with the cellular base station121in step402depicted by communication link502ofFIG. 5, the cellular phone105can initiate data communications with the server132and transmit an X.509 certificate including a public key of the cellular phone105. The server132can identify the cellular phone105from its certificate and in reply submit its X.509 certificate to the cellular phone105with a copy of its public key over communication link506. The certificate of the server132can then be conveyed by the base station121to the cellular phone105over communication link508.

With the public keys exchanged between the cellular phone105and the server132, the cellular phone105and the server132can engaged in encrypted communications. The cellular phone105can encrypt in step404a message request with the public key of the server132and sign the encrypted message with the private key of the cellular phone105. In step406, the cellular phone406can transmit the signed encrypted message to the server132by way of the base station121, which is received by the server in step408. In step410, the server132can generate an encrypted message response with the public key of the cellular phone and sign it with the server's private key. The server132can then transmit the signed encrypted message response to the cellular phone105via the base station121. If the base station121is a legitimate base station, then the cellular phone105can receive at step412the signed encrypted message response over communication link506and supply the encrypted message response to the cellular phone105over communication link508.

At step414, the cellular phone105can decrypt the message response in step414using the PKI technology discussed above. For example, the cellular phone105can decrypt the encrypted message response from the server132with the private key of the cellular phone105and decrypt the signature of the server132with the public key of the server132. Once the message response has been decrypted successfully, the cellular phone105can determine that the message response is authentic and not a forgery created by the base station121. In one embodiment, the cellular phone105can be adapted to detect the authenticity of the cellular base station121based solely on the ability of the cellular base station121to deliver the signed encrypted response message to the cellular phone105. However, as a precaution, the cellular phone105can be adapted to also rely on a successful decryption of the encrypted message response at step414as a second condition to determine at step416that the cellular base station121is a legitimate network element of the cellular communication network123. Once the cellular base station121has been authenticated, in step418, the cellular phone105can safely engage in voice and/or data communications as directed by the user of the cellular phone105.

If, on the other hand, the cellular phone105is unable to successfully decrypt the message response utilizing PKI technology, and the resulting message is indecipherable, then the cellular phone105can be adapted to proceed to step422where it detects a communication fault. There may be instances that a legitimate law enforcement agency has the legal right to use an authorized mobile base station to monitor calls of one or more individuals. To determine whether the communication fault requires mitigation, the cellular phone105can submit a request to the cellular base station121to provide information such as an identifier to legitimize its function in the cellular communication network123. The mobile base station of the law enforcement agency can be adapted to supply the cellular phone105a secure identifier which identifies it as a law enforcement base station. The identifier can be made secure with PKI technology as described earlier, and can be supplied to the cellular phone105by a trusted certificate authority and/or the law enforcement agency.

If a legitimate identifier is transmitted to the cellular phone105by the mobile cellular base station of the law enforcement agency in step424, the cellular phone105can proceed to step426and continue to utilize the communication services of the mobile base station. If, however, a legitimate identifier is not received from the mobile base station because it is likely a rogue base station without authority to function in the cellular communication network123, the cellular phone105can proceed to step428where it establishes communications with another cellular base station accessible to the cellular phone105. In step430, the cellular phone105can perform the validation steps with the server132described earlier to determine if the new cellular base station is a valid network element of the communication system100. If the new cellular base station is a valid network element, the cellular phone105can notify the server132(or another network element of the communication system100) that it has detected a rogue cellular base station at step432. The notification supplied by the cellular phone105can include the GPS coordinates of the cellular phone105when it was in communication with the purported rogue base station to assist the service provider of the communication system100and/or law enforcement to locate the rogue base station and possibly apprehend the parties engaging in unlawful monitoring of cellular communication services.

Referring back to step412, if an encrypted message response is not received by the cellular phone105in this step, then it is likely that the cellular phone105has established communications with an IMSI catcher302such as shown in FIG.6. This situation can arise from the cellular phone105transmitting an encrypted message request over communication link602, which the IMSI catcher302relays to communication network605over communication link604. The communication network605in turn supplies the encrypted message request of the cellular phone105to the server132over communication link606. Since the server132is unaware of the IMSI catcher302, the server132initiates a data communication session over the cellular communication network123by way of communication link608to respond to the encrypted message request of the cellular phone105. Upon receiving the encrypted message response of the server132, the cellular base station121will attempt to transmit to the cellular phone105over a wireless data channel depicted by communication link610the encrypted message response. Since the cellular phone105is not communicatively coupled to the cellular communication network123, the communication attempt over link610fails and the communication session ends.

Upon failing to receive the encrypted message response after a timeout period in step420, the cellular phone105can reinitiate steps406through412in the event a message interruption occurred or some other anomalous activity that prevented a legitimate cellular base station121to supply the encrypted message response. The cellular phone105can be provisioned to make a predetermined number of attempts. If all attempts fail, the cellular phone105can proceed to any combination of steps422-432as described above.

Upon reviewing the aforementioned embodiments, it would be evident to an artisan with ordinary skill in the art that said embodiments can be modified, reduced, or enhanced without departing from the scope and spirit of the claims described below. For example, method400can be adapted so that the cellular phone105and the server132exchange unencrypted messages. Additionally, method400can be adapted so that the cellular phone105relies only on the ability of the cellular base station121to deliver to the cellular phone105a message response of the server132to determine the legitimacy of the cellular base station121. Method400can also be adapted so that the cellular phone105submits a notice to the server132via the rogue base station indicating that the cellular base station to which the cellular phone105is communicatively couple to is a rogue base station. This latter embodiment is possible since the rogue base station does not block calls initiated by the cellular phone105to the server132. Other suitable embodiments are contemplated by the present disclosure.

FIG. 7depicts an exemplary diagrammatic representation of a machine in the form of a computer system700within which a set of instructions, when executed, may cause the machine to perform any one or more of the methods discussed above. One or more instances of the machine can operate, for example, as the devices ofFIGS. 1-2. In some embodiments, the machine may be connected (e.g., using a network) to other machines. In a networked deployment, the machine may operate in the capacity of a server or a client user machine in server-client user network environment, or as a peer machine in a peer-to-peer (or distributed) network environment.

The computer system700may include a processor702(e.g., a central processing unit (CPU), a graphics processing unit (GPU, or both), a main memory704and a static memory706, which communicate with each other via a bus708. The computer system700may further include a video display unit710(e.g., a liquid crystal display (LCD), a flat panel, or a solid state display. The computer system700may include an input device712(e.g., a keyboard), a cursor control device714(e.g., a mouse), a disk drive unit716, a signal generation device718(e.g., a speaker or remote control) and a network interface device720.

The disk drive unit716may include a tangible computer-readable storage medium722on which is stored one or more sets of instructions (e.g., software724) embodying any one or more of the methods or functions described herein, including those methods illustrated above. The instructions724may also reside, completely or at least partially, within the main memory704, the static memory706, and/or within the processor702during execution thereof by the computer system700. The main memory704and the processor702also may constitute tangible computer-readable storage media.