Mitigating the impact from internet attacks in a RAN using internet transport

The present disclosure relates to methods and devices for mitigating the impact from Internet attacks in a Radio Access Network, RAN (10), using Internet transport. This object is obtained by a method performed in a User Equipment, UE (13) associated with the RAN (10) using Internet transport. The method comprises receiving from at least a network node (11, 12, 21, 22, 23) in the RAN (10), information associated with an Internet attack. Obtaining, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service. The method further comprises to perform the obtained mitigation action to mitigate the impact on the RAN service level.

TECHNICAL FIELD

The present disclosure relates to methods, devices and computer programs of mitigating the impact of Internet attacks in a RAN using Internet transport.

BACKGROUND

3GPP Long Term Evolution, LTE, is the fourth-generation mobile communication technologies standard developed within the 3rd Generation Partnership Project, 3GPP, to improve the Universal Mobile Telecommunication System, UMTS, standard to cope with future requirements in terms of improved services such as higher data rates, improved efficiency, and lowered costs. The Universal Terrestrial Radio Access Network, UTRAN, is the radio access network of a UMTS and Evolved UTRAN, E-UTRAN, is the radio access network of an LTE system. In an UTRAN and an E-UTRAN, a User Equipment, UE or wireless device, is wirelessly connected to a Radio Base Station, RBS, commonly referred to as a NodeB, NB, in UMTS, and as an evolved NodeB, eNodeB or eNB, in LTE. An RBS is a general term for a radio network node capable of transmitting radio signals to a UE and receiving signals transmitted by a UE.

Traditional transport services e.g. leased lines or Virtual Private Networks, VPNs, are used for transport in the Radio Access Network, RAN. These transport services are very expensive in particular for high bandwidth data services. Internet transport services are much cheaper than traditional transport services. Using Internet for transport services in the RAN will lower the transport cost dramatically. An Internet transport service cost can be a fraction of the cost of a traditional leased lines and VPN services. There is a clear trend in Enterprise networking to use Internet transport services for transport and Mobile Network Operators are starting to put forward this requirement also for the RAN.

Using Internet as transport will expose the connected equipment in the RAN to various attack threats e.g. hackers, viruses, bot-nets, trojans etc. Hackers will search connected devices in the RAN for vulnerability. An attack can start with a port-scan of an IP address on the equipment in the RAN to figure out open ports and then try to connect to the equipment in order to intrude the RAN-equipment.

A counter measurement used in transport networks today are Intrusion Detection System, IDS, and Intrusion Prevention System, IPS.

An IDS is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. There are different types of IDS, but they all are designed to detect suspicious traffic in different ways. An IDS is primarily focused on identifying possible incidents, logging information about them, and reporting attempts.

An IPS can respond to a detected threat by attempting to prevent it from succeeding. IPS use several techniques to counter the attack e.g. dropping packets from attacker, changing the security environment (e.g. reconfiguring a firewall) or making changes in attacker's packet headers.

The IPS functionality tries to stop or limit the impact of a network attack by working in-line with the real network traffic, to be able to take actions to actively prevent or block intrusions or denial of services attacks that are detected. These actions are in the form of activating filters to drop/block IP packets, resetting the connection, reassemble fragmented IP packet etc.

One problem when a radio access network and core network is connected to an unsecure network like the Internet is that the IPS has no knowledge of the impact an Internet attack will have on the RAN and the services delivered to the end-users connected to the RAN.

The IPS can take an action to drop traffic from an Internet attacker, but at the same time the usable capacity for e.g. a RBS in the RAN will be limited. This will result in that the RBS in the RAN will still try to serve equal amount of UEs as if the RBS had expected full capacity on the Internet transport services. This will result in very limited end-user performance and Quality of Experience, QoE. It is only when the RBS has so low/limited capacity that the radio signalling can't get through that the RBS will understand that the RBS must be taken out of service. The RBS can't detect that end-user traffic between a S/PGW in the CN and the RBS is dropped due to an Internet attack, even if a significant part of the packets are dropped. The impact will only be seen by the UE as a very limited connection/service.

There is therefore a need for an improved solution for handling Internet attacks in a RAN using Internet transport, which solution solves or at least mitigates at least one of the above mentioned problems.

SUMMARY

An object of the present disclosure is to provide a method, device and computer program to mitigating the impact from Internet attacks in a Radio Access Network, RAN, using Internet transport, which seeks to mitigate, alleviate, or eliminate one or more of the above-identified deficiencies in the art and disadvantages singly or in any combination.

According to aspects, the disclosure presents a method, performed in a in a User Equipment, UE associated with a Radio Access Network, RAN using Internet transport, of mitigating the impact from Internet attacks. The method comprises receiving from at least a network node in the RAN, information associated with an Internet attack. In a next step the UE obtains, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service. Further the UE performs the obtained mitigation action to mitigate the impact on the RAN service level.

According to further aspects, the disclosure relates to a computer program comprising computer program code which, when executed in the UE, causes the UE to execute the method according to above.

According to a yet further aspect, the disclosure presents a method, performed in a network node in a Radio Access Network, RAN, using Internet transport, of mitigating the impact from Internet attacks. The method comprises obtaining intrusion detection information informing the network node that the RAN is under attack. Selecting, based on the intrusion detection information, a mitigation action. The mitigation action comprises sending a message comprising information associated with the Internet attack to the UE connected to the RAN. Further the method comprises performing the selected mitigation action to mitigate the impact on the RAN service level.

According to a further aspect, the disclosure relates to UE, associated with a RAN using Internet transport, of mitigating the impact from Internet attacks. The UE comprises a processor and a memory. The memory contains instructions executable by the processor whereby the UE is operative to. Receive from a network node in the RAN information associated with an internet attack. Obtain, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service. And perform the obtained mitigation action to mitigate the impact on the RAN service level.

According to further aspects, the disclosure relates to a network node in the RAN, using Internet transport, of mitigating the impact from Internet attacks. The network node comprises a processor and a memory. The memory contains instructions executable by the processor whereby the network node is operative to obtain intrusion detection information informing the network node that the RAN is under attack. The network node is further operative to select, based on the intrusion detection information, a mitigation action. The mitigation action comprises sending a message comprising information associated with the internet attack to the UE connected to the RAN. And to perform the selected mitigation action to mitigate the impact on the RAN service level.

DETAILED DESCRIPTION

FIG. 1schematically illustrates an example of a cellular communication network1in which aspects of the present disclosure can be implemented. The cellular communication network1comprises a radio access network, RAN,10and a Core network, CN,30. Two network nodes31,32are illustrated in the CN30, but the CN30comprises several more network nodes. The RAN10comprises a radio access transport network20. The radio access transport network20handles data traffic between e.g. radio base stations11,12and between radio base stations11,12and the CN30. In this example of the cellular communication network1Internet transport services are used in the radio access transport network20. In this example the radio access transport network20comprises several network nodes21,22,23. UEs13communicate with the RAN10.

It is an object of the present disclosure to provide embodiments solving the problem of Internet attacks in the RAN10using Internet transport. According to an aspect of the present disclosure the UE13receives from a network node11,12,21,22,23in the RAN10, information associated with an Internet attack. The UE13then obtains a mitigation action, based on the information, wherein the mitigation action mitigates the impact of the attack on the RAN service. Thus the impact on the RAN service level can be mitigated by the mitigation performed by the UE13.

An example of a radio access network10is UTRAN, Universal Terrestrial Radio Access Network. The UTRAN is the radio access network10in UMTS, Universal Mobile Telecommunications System. Another radio access network10is E-UTRAN. The E-UTRAN is the radio access network10in an LTE system. The proposed methods could be performed in any node in the RAN10or outside the RAN10e.g. a cloud implementation.

FIG. 2illustrates the steps in a method, performed in the UE13associated with the RAN10using Internet transport, of mitigating the impact from Internet attacks. In a first step S1the UE13receives from at least a network node11,12,21,22,23in the RAN10, information associated with an Internet attack.

In a next step S2the UE13obtains, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service. The method further comprises, in a next step S3that the UE13performs the obtained mitigation action to mitigate the impact on the RAN service level.

Stated differently in the step S2the UE obtains, based on the information, the mitigation action that can mitigate the impact of the attack on the RAN service level. According to one aspect of the present disclosure the UE13obtains the mitigation action that best can mitigate the impact on the attack on the RAN service level. Thus will the impact on the RAN service level due to the Internet attack be reduced or eliminated when the mitigation action is performed in step S3.

The network node11,12,21,22,23in the RAN can be affected by an Internet attack in different ways. The internet attack can e.g. result in limited Internet transport capacity for the network node11,12,21,22,23, processing capacity in the network node11,12,21,22,23. The internet attack can also affect the memory and the buffers in the network node11,12,21,22,23, so that the network node11,12,21,22,23cannot perform other tasks with the same capacity as when not under an Internet attack.

As mentioned above there are several mitigations actions that the UE13can obtain, in step S2, based on the information received in step S1. Some of the mitigations actions will be described below.

One mitigation action that the UE13can obtain according to one aspect of the present disclosure is to move the UE13to another network node11,12,21,22,23.

According to an aspect of the present disclosure the information is received from a first network node11,12,21,22,23in the RAN10, and the method then further comprises to inform a second network node11,12,21,22,23in the RAN10about the attack.

FIG. 3illustrates the steps in a method, performed in a network node11,12,21,22and23in a Radio Access Network, RAN,10using Internet transport, of mitigating the impact from Internet attacks. In a first step S10the network node11,12,21,22and23obtains intrusion detection information informing the network node11,12,21,22and23that the RAN10is under attack. In a next step S20the network node11,12,21,22and23selects, based on the intrusion detection information, a mitigation action, wherein the mitigation action comprises sending a message that comprises information associated with the Internet attack to a User Equipment, UE13connected to the RAN10. The method further comprises, in a next step S30that the network node11,12,21,22and23performs S30the selected mitigation action to mitigate the impact on the RAN service level.

In other words in the first step S10the network node11,12,21,22and23can receive the intrusion detection information from another network node11,12,21,22and23or obtain the intrusion detection information from the within the network node11,12,21,22and23.

Stated differently in the step S20the network node11,12,21,22and23selects, based on the intrusion detection information, the mitigation action that can inform the UE13of the Internet attack. Thus will the impact on the RAN service level due to the Internet attack can be reduced or eliminated when the UE13receives the information associated with the Internet attack and performs a mitigation action as descried above.

According to one aspect of the present disclosure the mitigation action comprises instructing the UE13, being connected to the network node11,12,21,22,23in the RAN10to move to another network node11,12,21,22,23.

According to yet another aspect of the present disclosure the instructions further comprises timer-value defining the validity time for the mitigation action.

In another exemplary embodiment of the present disclosure the mitigation action further comprises rejecting a connection attempt from the UE13.

Further according to another aspect of the present disclosure the mitigation action comprises proposing a new network node11,12,21,22,23based on a UE13report of Cell availability.

According to one aspect of the present disclosure the network node11,12is a Radio Base Station, RBS. And in another exemplary embodiment of present disclosure the network node21,22,23is a Base Station Controller, BSC. According to a yet further aspect of the present disclosure the network node21,22,23is a Radio Network Controller, RNC.

In an exemplary embodiment of the present disclosure the obtaining comprises receiving the intrusion detection information from an IDS. In yet another an exemplary embodiment of the present disclosure the obtaining comprises retrieving the intrusion detection information from within the node since the IDS is located within the network node11,12,21,22,23.

Turning now toFIG. 4, a schematic diagram is disclosed illustrating an exemplary embodiment of the UE13associated with the RAN10using Internet transport, of mitigating the impact from Internet attacks. The UE13comprises a processor110and a memory120, the memory212containing instructions executable by the processor110. The processor110is a Central Processing Unit, CPU, microcontroller, Digital Signal Processor, DSP, or any other suitable type of processor capable of executing computer program code. The memory212is a Random Access Memory, RAM, a Read Only Memory, ROM, or a persistent storage, e.g. a single or combination of magnetic memory, optical memory, or solid state memory or even remotely mounted memory. According to one aspect, the disclosure further relates to the above mentioned computer program, comprising computer readable code which, when run on the UE13causes the UE13to perform any of the aspects of the method described above. When the above-mentioned computer program code is run in the processor110of the UE13it causes the UE13receive from a network node11,12,21,22,23in the RAN10information associated with an internet attack. The computer program codes further causes the UE13to obtaining, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service. Further, the computer program code causes the network node11,12,21,22,23to perform the obtained mitigation action to mitigate the impact on the RAN service level.

According to one aspect, the disclosure further relates to the above mentioned computer program, comprising computer readable code which, when run on the UE13causes the UE13to perform any of the aspects of the method described above.

According to one aspect of the disclosure the processor110comprises one or several of:a receiver1101adapted receive, from a network node11,12,21,22,23in the RAN10information associated with an internet attack;obtaining module1102adapted to obtain, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service; anda performing module1103adapted to perform the selected mitigation action to mitigate the impact on the RAN service level.

According to a further aspect the mitigation action comprises moving the UE13to another network node11,12,21,22,23in the RAN10. According to one aspect the UE13comprises a performing module1103configured for this purpose.

In another aspect of the present disclosure the information is received from a first network node11,12,21,22,23and the UE13is further configured to inform a second network node11,12about the Internet attack. According to one aspect the UE13comprises a performing module1103configured for this purpose.

The receiver module1101, obtaining module1102and performing module1103are implemented in hardware or in software or in a combination thereof. The modules1101,1102and1103are according to one aspect implemented as a computer program stored in the memory120which run on the processing circuitry110. The UE13is further configured to implement all the aspects of the disclosure as described in relation to the methods above.

Turning now toFIG. 5, a schematic diagram is disclosed illustrating an exemplary embodiment of the network node11,12,21,22and23in the RAN10, using Internet transport of mitigating the impact from Internet attacks. The network node11,12,21,22and23comprises a processor210and a memory220, the memory210containing instructions executable by the processor210. The processor210is a Central Processing Unit, CPU, microcontroller, Digital Signal Processor, DSP, or any other suitable type of processor capable of executing computer program code. The memory210is a Random Access Memory, RAM, a Read Only Memory, ROM, or a persistent storage, e.g. a single or combination of magnetic memory, optical memory, or solid state memory or even remotely mounted memory.

According to one aspect, the disclosure further relates to the above mentioned computer program, comprising computer readable code which, when run on the network node11,12,21,22and23causes the network node11,12,21,22and23to perform any of the aspects of the method described above.

When the above-mentioned computer program code is run in the processor210of the network node11,12,21,22and23it causes the network node11,12,21,22and23to obtain intrusion detection information informing the network node11,12,21,22and23that the RAN10is under attack. The computer program codes further causes the network node11,12,21,22and23to select a mitigation action, wherein the mitigation action comprises sending a message comprising information associated with the internet attack to the UE13connected to the RAN10. Further, the computer program code causes the network node11,12,21,22and23to perform the selected mitigation action.

According to one aspect, the disclosure further relates to the above mentioned computer program, comprising computer readable code which, when run on the network node11,12,21,22and23, causes the network node11,12,21,22and23to perform any of the aspects of the method described above.

According to one aspect of the disclosure the processor110comprises one or several of:a receiving module2101adapted receive from the network node11,12,21,22,23in the RAN10information associated with an internet attack,an obtaining module2102adapted to obtaining, based on the information, a mitigation action, the mitigation action mitigating the impact of the attack on the RAN service; anda performing module2103adapted to perform the obtained mitigation action to mitigate the impact on the RAN service level.

According to an aspect of the present disclosure the mitigation action comprises instructing the UE13, being connected to the network node11,12,21,22,23to move to another network node11,12,21,22,23. According to one aspect the network node11,12,21,22and23comprises a performing module2103configured for this purpose.

In another aspect of the present disclosure the instructions further comprises a timer-value defining the validity time for the mitigation action. According to one aspect the network node11,12,21,22and23comprises an obtaining module2102configured for this purpose.

According to an aspect of the present disclosure the obtained mitigation action comprises rejecting a connection attempt from the UE13. According to one aspect the network node11,12,21,22and23comprises an obtaining module2102configured for this purpose.

In another exemplary embodiment of the present disclosure the mitigation action further comprising proposing a new network node11,12,21,22,23based on the UE13report of Cell availability. According to one aspect the network node11,12,21,22and23comprises an obtaining module2102configured for this purpose.

According to an aspect of the present disclosure the network node11,12is a Radio Base Station, RBS. According to yet another aspect of the present disclosure the network node21,22,23is a Base Station Controller, BSC. In another aspect according of the present disclosure the network node21,22,23is a Radio Network Controller, RNC.

According to an aspect of the present disclosure the obtaining comprises receiving the intrusion detection information from an IDS. According to one aspect the network node11,12,21,22and23comprises an obtaining module2102configured for this purpose.

According to yet another an aspect of the present disclosure the obtaining comprises receiving the intrusion detection information from within the network node11,12,21,22,23since the IDS is located within the network node11,12,21,22,23. According to one aspect the network node11,12,21,22and23comprises an obtaining module2102configured for this purpose.

The present disclosure is not limited to only attacks from the Internet transport network in the RAN10. According to aspects of the present disclosure Internet transport is not used in the RAN10. In these and in embodiments where Internet transport is used attack can also occur from other sources in the RAN10, CN30or UE13. These attacks can also be mitigated with the methods, devices and computer programs described above.

Aspects of the disclosure are described with reference to the drawings, e.g., block diagrams and/or flowcharts. It is understood that several entities in the drawings, e.g., blocks of the block diagrams, and also combinations of entities in the drawings, can be implemented by computer program instructions, which instructions can be stored in a computer-readable memory, and also loaded onto a computer or other programmable data processing apparatus. Such computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer and/or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer and/or other programmable data processing apparatus, create means for implementing the functions/acts specified in the block diagrams and/or flowchart block or blocks.

In some implementations and according to some aspects of the disclosure, the functions or steps noted in the blocks can occur out of the order noted in the operational illustrations. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality/acts involved. Also, the functions or steps noted in the blocks can according to some aspects of the disclosure be executed continuously in a loop.

In the drawings and specification, there have been disclosed exemplary aspects of the disclosure. However, many variations and modifications can be made to these aspects without substantially departing from the principles of the present disclosure. Thus, the disclosure should be regarded as illustrative rather than restrictive, and not as being limited to the particular aspects discussed above. Accordingly, although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation.