Patent Description:
A Mobile Country Code (MCC) and a Mobile Network Code (MNC) together uniquely identify the serving core network of a mobile subscriber. The MCC can be a three- decimal digit number that corresponds to a country, and the MNC can be a two- or three- decimal digit number that corresponds to a mobile network within that country. An International Mobile Subscriber Identity (IMSI) uniquely identifies User Equipment (UE), such as a mobile phone.

<CIT> discloses a method of validating subscriber location information occurs at a network node by receiving a message containing location information associated with a subscriber, and determining whether the location information is valid based on a location validation algorithm, wherein the location validation algorithm uses prior location information associated with the subscriber in determining with the location information is valid. <CIT> discloses a method for enhanced security for Cellular Internet of Things (CloT) in mobile networks that includes monitoring network traffic on a service provider network at a security platform to identify a subscriber identity for a new session, in which the session is associated with a CloT device; determining an application identifier for user traffic associated with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the subscriber identity and the application identifier.

In one example embodiment, a firewall obtains a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time. The firewall obtains a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time. The firewall determines whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code. If it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, the firewall determines whether a difference between the second time and the first time is less than a threshold difference. If it is determined that the difference between the second time and the first time is less than the threshold difference, the firewall associates the second network packet with a potential security threat.

Systems and apparatus for implementing the methods described herein, including network nodes, computer programs, computer program products, computer readable media and logic encoded on tangible media for implementing the methods are also described.

<FIG> illustrates a system <NUM> for identifying a potential security threat based on location information corresponding to a mobile subscriber. System <NUM> includes User Equipment (UE) <NUM>, home network <NUM>, and roaming network <NUM>. UE <NUM> may be a mobile phone with a unique International Mobile Subscriber Identity (IMSI). Home network <NUM> may be associated with Mobile Country Code (MCC) <NUM>(<NUM>) and Mobile Network Code (MNC) <NUM>(<NUM>) which together uniquely identify home network <NUM>. Roaming network <NUM> may be associated with MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) which together uniquely identify roaming network <NUM>.

Home network <NUM> includes radio base station <NUM>(<NUM>) (e.g., eNodeB), Home Public Land Mobile Network (HPLMN) Mobile Packet Core <NUM>, and firewall <NUM>. Radio base station <NUM>(<NUM>) and HPLMN Mobile Packet Core <NUM> may be configured to provide one or more services to UE <NUM> (e.g., Internet connectivity). Roaming network <NUM> includes radio base station <NUM>(<NUM>) (e.g., eNodeB) and Visited Public Land Mobile Network (VPLMN) Mobile Packet Core <NUM>. Roaming network <NUM> is configured to enable UE <NUM> to access the service(s) provided by home network <NUM> when UE <NUM> cannot access home network <NUM> directly. Thus, system <NUM> may provide roaming capabilities for UE <NUM>.

Typically, the mobile network operator of home network <NUM> would pay the mobile network operator of roaming network <NUM> for enabling UE <NUM> to access the service(s) provided by home network <NUM>, and later charge the user of UE <NUM> a roaming fee. In this example, however, the user of UE <NUM> is a bad actor who is attempting to engage in roaming fraud whereby the user accesses the service(s) provided by home network <NUM> via roaming network <NUM> in such a way that the mobile network operator of home network <NUM> cannot charge the user of UE <NUM> for the services provided and is unable to recoup losses for the payment to the mobile network operator of roaming network <NUM>.

In some cases, roaming fraud (e.g., IMSI hijacking) can cause UE <NUM> to appear to access both home network <NUM> and roaming network <NUM> in an impossibly small window of time from the point of view of the mobile network operators. The window of time is impossibly small because the time to travel from a first location to directly access home network <NUM>, to a second location to access roaming network <NUM>, is greater than the difference in the apparent times of access. For instance, if home network <NUM> is only directly accessible in the United States of America and roaming network <NUM> is only directly accessible in Europe, it would not be possible for UE <NUM> to access both home network <NUM> and roaming network <NUM> in less than an hour.

Accordingly, firewall <NUM> includes security threat identification logic <NUM>, which enables firewall <NUM> to perform operations described herein. Briefly, security threat identification logic <NUM> may allow the mobile network operator of home network <NUM> to detect physically impossible location changes of UE <NUM> and identify potential roaming fraud. In one example, firewall <NUM> obtains network packet <NUM>(<NUM>) from UE <NUM> at time T = <NUM>. Network packet <NUM>(<NUM>) indicates MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>). At time T = <NUM>, firewall <NUM> obtains network packet <NUM>(<NUM>) from UE <NUM>. Network packet <NUM>(<NUM>) indicates MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>). In one example, network packets <NUM>(<NUM>) and <NUM>(<NUM>) may be Packet Data Protocol (PDP) packets.

Firewall <NUM> may determine whether MCC <NUM>(<NUM>) is different from MCC <NUM>(<NUM>) and/or whether MNC <NUM>(<NUM>) is different from MNC <NUM>(<NUM>). In some situations, firewall <NUM> may determine only that MCC <NUM>(<NUM>) is different from MCC <NUM>(<NUM>) (and ignore, or refrain from performing, a comparison of MNC <NUM>(<NUM>) and MNC <NUM>(<NUM>)). In this case, firewall <NUM> determines both that MCC <NUM>(<NUM>) is different from MCC <NUM>(<NUM>), and that MNC <NUM>(<NUM>) is different from MNC <NUM>(<NUM>). In response, firewall <NUM> determines whether the difference between time T = <NUM> and time T = <NUM> is less than a threshold difference. The threshold difference may be, for example, a minimum time for UE <NUM> to physically travel from a location corresponding to MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) to a location corresponding to MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>).

If firewall <NUM> determines that the difference between time T = <NUM> and time T = <NUM> is less than the threshold difference, firewall <NUM> may associate network packet <NUM>(<NUM>) with a potential security threat (e.g., roaming fraud). In one example, firewall <NUM> may issue an event log (e.g., a syslog) indicating that network packet <NUM>(<NUM>) is associated with the potential security threat. In another example, firewall <NUM> may drop, block, and/or redirect network packet <NUM>(<NUM>) and/or any subsequent network packets that belong to the same network session as network packet <NUM>(<NUM>). Firewall <NUM> may repeat this process whenever a new network packet with MCC and MNC data is received.

Firewall <NUM> may thereby provide user-granular visibility using logs and user manageability in the same platform. This is an improvement over typical fraud detection systems in mobile network operator environments, which are typically handled by the billing, charging, and mediation systems department and are cumbersome for the team managing the mobile packet core and roaming agreements with partners. The cost to integrate existing fraud detection systems with a multi-vendor mobile packet core is expensive to maintain, and the IoT needs even more time to implement (e.g., inter-vendor operability tests between detection systems and the packet core, etc.). Many fraud detection systems are legacy systems due to the significant resources for migration and changeover. Accordingly, firewall <NUM> may represent a lower-cost and more effective alternative for roaming fraud detection.

In one example, network packet <NUM>(<NUM>) may further indicate a Cell Identification (CI) of UE <NUM> at time T = <NUM>, and network packet <NUM>(<NUM>) may further indicate a CI of UE <NUM> at time T = <NUM>. In this example, firewall <NUM> may determining whether the first CI is different from the second CI and, if so, determine whether the difference between time T = <NUM> and time T = <NUM> is less than the threshold difference. Thus, in certain cases, a CI (and/or Location Area Code (LAC)) may also/alternatively be used to determine the location of UE <NUM>. This may be particularly useful in cases where the MCC/MNC are the same but the CI is different and corresponds to a roaming partner. Therefore, a knob may be provided as an option for a mobile network operator to include the CI in the syslog.

An example Command Line Interface (CLI) is provided as follows. The CLI may be part of the "policy-map type inspect gtp" submode. policy-mapy type inspect gtp <gtp_policy_name>
parameters
[no] location-logging [cellid].

where "cell-id" is the Cell Global Identifier (CGI) or the Extended CGI (ECGI) that will be included in the syslog if present.

Firewall <NUM> may issue one or more syslogs to notify the mobile network operator of the location change with the CI information. In one example, the mobile network operator may activate a "logging timestamp" in order to view the time difference between locations via syslogs. At least two syslogs may be provided in accordance with operations described herein, one for PDP context activation (when UE <NUM> connects to home network <NUM>) and one for location change (when UE <NUM> connects to roaming network <NUM>). An example of the first syslog is provided for when PDP context activation for UE <NUM> is successfully complete and there is no existing PDP context (or when there is an existing PDP context but the location information is the same):.

An example of the second syslog is provided for when PDP context activation or a handoff occurs and the location has changed:.

Turning now to <FIG>, and with continued reference to <FIG>, shown is an example database <NUM> that stores location and timestamp information corresponding to IMSI <NUM>, IMSI <NUM>,. Database <NUM> may be stored locally at, or remote from, firewall <NUM>. Database <NUM> includes columns <NUM>(<NUM>)-<NUM>(N) respectively corresponding to IMSI <NUM>, IMSI <NUM>,. Database <NUM> also includes rows <NUM>(<NUM>), <NUM>(<NUM>), etc. Row <NUM>(<NUM>) includes the most recent [MCC, MNC] tuple associated with IMSI <NUM>, IMSI <NUM>,. IMSI N (e.g., MCC <NUM> is the most recent MCC associated with IMSI <NUM> and MNC <NUM> is the most recent MNC associated with IMSI <NUM>, etc.). Row <NUM>(<NUM>) includes the most recent timestamp associated with the [MCC, MNC] tuples (e.g., timestamp <NUM> is the time at which the network packet carrying MCC <NUM> and MNC <NUM> was obtained, timestamp <NUM> is the time at which the network packet carrying MCC <NUM> and MNC <NUM> was obtained, etc.).

With reference to system <NUM>, IMSI <NUM> may correspond to UE <NUM>, MCC <NUM> may correspond to MCC <NUM>(<NUM>), MNC <NUM> may correspond to MNC <NUM>(<NUM>), and timestamp <NUM> may correspond to T = <NUM>. Firewall <NUM> may store MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) in database <NUM>. Before determining whether MCC <NUM>(<NUM>) is different from MCC <NUM>(<NUM>) or MNC <NUM>(<NUM>) is different from MNC <NUM>(<NUM>), firewall <NUM> may retrieve MCC <NUM>(<NUM>), MNC <NUM>(<NUM>), and timestamp <NUM> from database <NUM>. Firewall <NUM> may compare MCC <NUM>(<NUM>), MNC <NUM>(<NUM>), and timestamp <NUM> with MCC <NUM>(<NUM>), MNC <NUM>(<NUM>), and the time at which network packet <NUM>(<NUM>) was obtained in order to determine whether network packet <NUM>(<NUM>) is a security threat (e.g., roaming fraud). In one example, firewall <NUM> may also store MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) in database <NUM> at the time of handoff between home network <NUM> and roaming network <NUM>. A mobile network operator may have the option to activate timestamp logging and look up the relevant timestamps to extrapolate the information for further analysis.

At the time of PDP context creation, the MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) may be stored in database <NUM> and/or the PDP context. Database <NUM> may have certain advantages over the PDP context, such as helping to maintain a history of the location of UE <NUM> even after the PDP context is expired. In one example, database <NUM> may store only the most recent MCC and MNC for UE <NUM>. Alternatively, database <NUM> may store all MCCs and MNCs for UE <NUM>. In yet another example, database <NUM> may store some but not all MCCs and MNCs for UE <NUM> (e.g., a given number of the most recent MCCs and MNCs obtained for UE <NUM>, the most recent MCCs and MNCs for UE <NUM> obtained within a given time period, etc.).

Turning now to <FIG>, and with continued reference to <FIG>, shown is an example matrix <NUM> that includes minimum times for a mobile subscriber to travel between locations. Matrix <NUM> includes at least columns <NUM>(<NUM>)-<NUM>(<NUM>) and rows <NUM>(<NUM>)-<NUM>(<NUM>). Each column <NUM>(<NUM>)-<NUM>(<NUM>) and row <NUM>(<NUM>)-<NUM>(<NUM>) corresponds to a [MCC, MNC] tuple. For example, column <NUM>(<NUM>) corresponds to [MCC <NUM>, MNC <NUM>], column <NUM>(<NUM>) corresponds to [MCC <NUM>, MNC <NUM>], etc. Similarly, row <NUM>(<NUM>) corresponds to [MCC <NUM>, MNC <NUM>], row <NUM>(<NUM>) corresponds to [MCC <NUM>, MNC <NUM>], etc. Matrix <NUM> also includes minimum times for a mobile subscriber to travel between locations corresponding to [MCC, MNC] tuples. For example, matrix <NUM> includes the minimum time for a mobile subscriber to travel from the location corresponding to [MCC <NUM>, MNC <NUM>] to the location corresponding to [MCC <NUM>, MNC <NUM>].

With reference to system <NUM>, MCC <NUM> may correspond to MCC <NUM>(<NUM>), MNC <NUM> may correspond to MNC <NUM>(<NUM>), MCC <NUM> may correspond to MCC <NUM>(<NUM>), and MNC <NUM> may correspond to MNC <NUM>(<NUM>). When firewall <NUM> obtains network packet <NUM>(<NUM>), firewall <NUM> may determine whether the difference between T = <NUM> and T = <NUM> is less than the corresponding minimum time provided in matrix <NUM> (here, the minimum time indicated for [MCC <NUM>, MNC <NUM>] and [MCC <NUM>, MNC <NUM>]. Matrix <NUM> may be preconfigured (e.g., by a manufacturer) and/or adjustable by a mobile network operator. Although in this example matrix <NUM> uses [MCC, MNC] tuples, it will be appreciated that in other examples matrix <NUM> may use only MCC data to detect fraud (e.g., the entire MCC, the first digit of the MCC to represent a geographic region, etc.).

An example CLI configuration for matrix <NUM> is provided as follows:
gtp-mcc-mnc <list_of_ mcc_mnc>
<[mcc, mnc]>
<[mcc, mnc]>. ### [no] gtp-location-change <name>
gtp-location-change fraud_alert_matrix
<[mcc, mnc]> to <list_of_mcc_mnc> min-time <NUM>:<NUM>:<NUM>
<[mcc, mnc]> to <[mcc, mnc]> min-time <NUM>:<NUM>:<NUM>
<[mcc, mnc]> to <[mcc, mnc]> min-time <NUM>:<NUM>:<NUM>
<[mcc, mnc]> to <[mcc, mnc]> min-time <NUM>:<NUM>:<NUM>
gtp-location-change loc_changes_log
<[mcc, mnc]> to <list_of_mcc_mnc> min-time <NUM>:<NUM>:<NUM>
<[mcc, mnc]> to <[mcc, mnc]> min-time <NUM>:<NUM>:<NUM>
### Apply the above to the GTP policy-map
### [no] location-tracking [not] <gtp_location_change_map> <drop | log>
policy-map type inspect gtp mygtp
parameters
location-logging cellid. ## log at creation and handoff time. location-tracking loc_changes_log log. ## log based on matrix above
location-tracking fraud_alert_matrix drop ## drop based on matrix above.

Network packets <NUM>(<NUM>) and <NUM>(<NUM>) may be create PDP context requests for PDP context activation and/or update context PDP requests for PDP context handoff. For example, network packet <NUM>(<NUM>) may be a create PDP context request, and network packet <NUM>(<NUM>) may be an update context PDP request. Alternatively, network packets <NUM>(<NUM>) and <NUM>(<NUM>) may both be create PDP context requests. PDP packets may include Information Elements (IEs) comprising location information such as MCC and MNC. Thus, firewall <NUM> may extract/retrieve MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) from an IE of network packet <NUM>(<NUM>), and MCC <NUM>(<NUM>) and MNC <NUM>(<NUM>) from an IE of network packet <NUM>(<NUM>).

Firewall <NUM> may obtain network packets <NUM>(<NUM>) and/or <NUM>(<NUM>) via General Packet Radio Service (GPRS) Tunneling Protocol (GTP). Firewall <NUM> may support GTP version <NUM> (GTPv0), GTPv1, GTPv2, etc., which may implement IEs which vary depending on the particular GTP version that is implemented. GTPv1, for example, may implement Routing Area Identity (RAI) or User Location Information (ULI) IEs, which identify the serving core network of the mobile subscriber. If both the RAI IE and the ULI IE are received, location information from both IEs may be stored and compared to later [MCC, MNC] tuples. For example, if the RAI IE carries a first [MCC, MNC] tuple, and the ULI IE carries a second [MCC, MNC] tuple, an alert may be generated when an IE carrying a third [MCC, MNC] tuple is received, or when an IE carrying only one of the first and second [MCC, MNC] tuples is received (and an IE carrying the other [MCC, MNC] tuple is not).

<FIG> illustrates an example RAI IE <NUM> that includes location information corresponding to UE <NUM> in GTPv1. RAI IE <NUM> includes bits designated for location information. Bits <NUM> to <NUM> of octet <NUM> are designated for the IE type (here, decimal number <NUM>). Bits <NUM> to <NUM> of octet <NUM> are designated for the first decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MNC. If the MNC only includes two digits, bits <NUM> to <NUM> of octet <NUM> may be coded as "<NUM>. " Bits <NUM> to <NUM> of octet <NUM> are designated for the first decimal digit of the MNC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MNC. Bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the LAC. Bits <NUM> to <NUM> of octet <NUM> are designated for the Routing Area Code (RAC). Firewall <NUM> may utilize a RAI IE parser to extract the location information (e.g., MCC and MNC) from RAI IE <NUM> in order to perform operations described herein.

<FIG> illustrates an example ULI IE <NUM> that includes location information corresponding to UE <NUM> in GTPv1. Bits <NUM> to <NUM> of octet <NUM> are designated for the IE type (here, decimal number <NUM>). Bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the length of ULI IE <NUM>. Bits <NUM> to <NUM> of octet <NUM> are designated for the geographic location type, and bits <NUM> to <NUM> of octets <NUM> to m are designated for the geographic location. The geographic location type indicates the type of location information that is present in the geographic location field. If the decimal value of the geographic location type is <NUM>, the geographic location field includes a CGI of where the mobile subscriber is currently registered. If the decimal value of the geographic location type is <NUM>, the geographic location field includes a Service Area Identity (SAI) of where the mobile subscriber is currently registered. If the decimal value of the geographic location type is <NUM>, the geographic location field includes a RAI of where the mobile subscriber is currently registered.

<FIG> illustrate example alternative geographic location fields 600A-600C for ULI IE <NUM>. Geographic location field 600A illustrates the geographic location field for CGI; geographic location field 600B illustrates the geographic location field for SAI; and geographic location field 600C illustrates the geographic location field for RAI. Bits <NUM> to <NUM> of octet <NUM> of geographic location fields 600A-600C are designated for the first decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MNC. Bits <NUM> to <NUM> of octet <NUM> are designated for the first decimal digit of the MNC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MNC. Bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the LAC.

In geographic location field 600A, bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the CI. In geographic location field 600B, bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the Service Area Code (SAC). In geographic location field 600C, bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the Routing Area Code (RAC). Firewall <NUM> may utilize a ULI IE parser to extract the location information (e.g., MCC/MNC and other geographic location information) from ULI IE <NUM> in order to perform operations described herein.

<FIG> illustrates an example Serving Network (SN) IE <NUM> that includes location information corresponding to UE <NUM> in GTPv2. SN IE <NUM> may identify the serving core network operator identifier (e.g., provided by the Mobility Management Entity (MME) MME, Serving GPRS Support Node (SGSN) configured to the S4 interface (S4-SGSN) or enhanced Packet Data Gateway (ePDG)), or the PLMN identity of the selected PLMN. Bits <NUM> to <NUM> of octet <NUM> are designated for the IE type (here, decimal number <NUM>). Bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the length of SN IE <NUM>. Bits <NUM> to <NUM> of octet <NUM> is designated for the instance value. Bits <NUM> to <NUM> of octet <NUM> are designated as spare bits. Bits <NUM> to <NUM> of octet <NUM> are designated for the first decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MCC. Bits <NUM> to <NUM> of octet <NUM> are designated for the third decimal digit of the MNC. If the MNC only includes two digits, bits <NUM> to <NUM> of octet <NUM> may be coded as "<NUM>. " Bits <NUM> to <NUM> of octet <NUM> are designated for the first decimal digit of the MNC. Bits <NUM> to <NUM> of octet <NUM> are designated for the second decimal digit of the MNC. Bits <NUM> to <NUM> of octets <NUM> to n + <NUM> (where n is the length) are present only if explicitly specified.

SN IE <NUM> may be present in a create session request and/or an update bearer request for handoffs. Firewall <NUM> may extract the MCC and MNC from SN IE <NUM>. If SN IE <NUM> prompts the PDP context to be created for the first time, firewall <NUM> may store the MCC and MNC and issue a syslog with the location information. If the PDP context already exists, firewall <NUM> may perform a location change check and issue a syslog if the location has changed, and may also update the location.

<FIG> illustrates an example ULI IE <NUM> that includes location information corresponding to UE <NUM> in GTPv2. Bits <NUM> to <NUM> of octet <NUM> are designated for the IE type (here, decimal number <NUM>). Bits <NUM> to <NUM> of octets <NUM> and <NUM> are designated for the length of ULI IE <NUM>. Bits <NUM> to <NUM> of octet <NUM> is designated for the instance value. Bits <NUM> to <NUM> of octet <NUM> are designated as spare bits. Bit <NUM> of octet <NUM> is designated for a CGI flag. Bit <NUM> of octet <NUM> is designated for a SAI flag. Bit <NUM> of octet <NUM> is designated for a RAI flag. Bit <NUM> of octet <NUM> is designated for a Tracking Area Identifier (TAI) flag. Bit <NUM> of octet <NUM> is designated for an ECGI flag. Bit <NUM> of octet <NUM> is designated for a Location Area Identification (LAI) flag. Bit <NUM> of octet <NUM> is designated for a Macro eNodeB ID flag. Bit <NUM> of octet <NUM> is designated for an Extended Macro eNodeB ID flag.

Bits <NUM> to <NUM> in octets a to a + <NUM> are designated for the CGI. Bits <NUM> to <NUM> in octets b to b + <NUM> are designated for the SAI. Bits <NUM> to <NUM> in octets c to c + <NUM> are designated for the RAI. Bits <NUM> to <NUM> in octets d to d + <NUM> are designated for the TAI. Bits <NUM> to <NUM> in octets e to e + <NUM> are designated for the ECGI. Bits <NUM> to <NUM> in octets f to f + <NUM> are designated for the LAI. Bits <NUM> to <NUM> in octets g to g + <NUM> are designated for the Macro eNodeB ID or the Extended Macro eNodeB ID. Bits <NUM> to <NUM> in octets h to n + <NUM> (where n is the length of ULI IE <NUM>) are present only if explicitly specified.

The flags in octet <NUM> indicate whether the corresponding type is present in a respective field. If a flag is set to <NUM>, the corresponding field is not present. For example, if the CGI flag is set to <NUM>, bits <NUM> to <NUM> in octets a to a + <NUM> designated for the CGI are not present. Conversely, if the CGI flag is set to <NUM>, bits <NUM> to <NUM> in octets a to a + <NUM> designated for the CGI are present. ULI IE <NUM> may contain only one identity of the same type (e.g., more than one CGI cannot be included), but ULI IE <NUM> may contain more than one identity of a different type (e.g., may contain both ECGI and TAI). If more than one identity of a different type is present, ULI IE <NUM> may include those identities in the following order: CGI, SAI, RAI, TAI, ECGI, LAI, Macro eNodeB ID / Extended Macro eNodeB ID. Only one of the Macro eNodeB ID or Extended Macro eNodeB ID may be present in ULI IE <NUM>.

Furthermore, only one of the CGI and ECGI may be present in ULI IE <NUM>. For initial attach / PDP context activation, the ECGI and TAI may be provided via the S11 interface. This may be forwarded from a MME to a Serving Gateway (SGW) and then to a Packet Data Network (PDN) Gateway (PGW) via the S5/S8 interface(s). The CGI/SAI together with RAI may be provided via the S4 interface. For handoffs, the MME may include the ECGI and/or TAI. The S4-SGSN may provide the CGI, SAI, or RAI, or the CGI/SAI together with the RAI. The SGW may forward this information via the S5/S8 interface if received from the MME/SGSN.

<FIG> illustrates an example <NUM> system <NUM> for identifying a potential security threat based on location information corresponding to a mobile subscriber. System <NUM> includes UE <NUM>, roaming network <NUM>, and home network <NUM>. Roaming network <NUM> includes Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN) <NUM>, SGW <NUM>, MME <NUM>, SGSN <NUM>, UTRAN <NUM>, and Global System for Mobile communications (GSM) Enhanced Data Rates for GSM Evolution (EDGE) Radio Access Network (GERAN) <NUM>. Roaming network <NUM> further includes firewall <NUM>, which in turn includes security threat identification logic <NUM>. Home network <NUM> includes PGW <NUM>, Policy and Charging Rules Function (PCRF) <NUM>, Home Subscriber Server (HSS) <NUM>, Internet <NUM>, and Operator IP Services <NUM> (e.g., IP Multimedia Subsystem, etc.).

E-UTRAN <NUM> may comprise an eNodeB that connects UE <NUM> to SGW <NUM> and MME <NUM>. SGW <NUM> may route and forward user data packets, and MME <NUM> may control various aspects of user access. SGSN <NUM> may track of the location of UE <NUM> and perform security functions and access control in conjunction with UTRAN <NUM> and GERAN <NUM>. Security threat identification logic <NUM> may cause firewall <NUM> to perform operations described herein. PGW <NUM> may provide connectivity from UE <NUM> to Internet <NUM>. PCRF <NUM> makes policy control decisions with assistance from Operator IP Services <NUM>. HSS <NUM> is a central database that contains user-related and subscription-related information associated with UE <NUM>. While <FIG> illustrates a <NUM> system, it will be appreciated that the techniques described herein may be similarly implemented on a telecommunications system of any generation (e.g., <NUM>, <NUM>, <NUM>, <NUM>, etc.).

<FIG> illustrates an example system <NUM> for identifying a security threat based on location information corresponding to a mobile subscriber using a RAI IE. System <NUM> includes UE <NUM>, base stations <NUM>(<NUM>) and <NUM>(<NUM>), SGSNs/SGWs <NUM>(<NUM>) and <NUM>(<NUM>), firewall <NUM>, and Gateway GPRS Support Node (GGSN) / PGW <NUM>. Firewall <NUM> includes security threat identification logic <NUM>. Base station <NUM>(<NUM>) and SGSN/SGW <NUM>(<NUM>) may be part of a home network, and base station <NUM>(<NUM>) and SGSN/SGW <NUM>(<NUM>) may be part of a roaming network. GGSN/PGW <NUM> may help route user data packets between UE <NUM> and one or more external networks.

In this example, at a first time, UE <NUM> sends a PDP context create request including a RAI IE to SGSN/SGW <NUM>(<NUM>) via base station <NUM>(<NUM>). The RAI IE includes a MCC of <NUM> and a MNC of <NUM>. SGSN/SGW <NUM>(<NUM>) provides the MCC and MNC to firewall <NUM>, which stores the MCC and the MNC and issues a syslog indicating that the subscriber location is "<NUM>" (i.e., a concatenation of the MCC and the MNC). At a second time, UE <NUM> sends a PDP context update request including another RAI IE to SGSN/SGW <NUM>(<NUM>) via base station <NUM>(<NUM>). UE <NUM> may send the PDP context update request in accordance with a handoff procedure between base station <NUM>(<NUM>) and <NUM>(<NUM>). The RAI IE includes an MCC of <NUM> and an MNC of <NUM>. SGSN/SGW <NUM>(<NUM>) provides the MCC and MNC to firewall <NUM>, which determines that the new MCC and MNC are different from the previously stored MCC and MNC. If firewall <NUM> determines that the location change occurred impossibly fast, firewall <NUM> may take preventative action, such as issuing a syslog indicating that the subscriber location changed from "<NUM>" to "<NUM>.

The position of firewall <NUM> in the service provider infrastructure in system <NUM> enables early prevention of fraudulent activity before it reaches the core (e.g., MME, GGSN, PGW, etc.). Furthermore, firewall <NUM> may detect location changes based on inspection of network packets (e.g., GTP messages on the S5/S8 and Gp interfaces) and output syslogs which may be used for auditing and extrapolating information regarding possible fraudulent activities, as well as alarming.

<FIG> illustrates an example call flow diagram 1100A for PDP context creation in system <NUM>. Call flow diagram 1100A illustrates PDP context creation for GTPv1, although GTPv2 may follow a similar procedure. At <NUM>, SGSN/SGW <NUM>(<NUM>) provides the PDP context create request including the RAI IE to firewall <NUM>. The RAI IE includes the MCC of <NUM> and the MNC of <NUM>. At <NUM>, firewall <NUM> stores the PDP context based on the IMSI identifying UE <NUM>. Firewall <NUM> stores the concatenated MCC and MNC values as part of the PDP context. At <NUM>, firewall <NUM> provides the PDP context create request to GGSN/PGW <NUM>. At <NUM>, GGSN/PGW <NUM> provides a PDP context create response to firewall <NUM>. At <NUM>, firewall <NUM> provides the PDP context create response to SGSN/SGW <NUM>(<NUM>).

<FIG> illustrates an example call flow diagram for PDP context updating in system <NUM>. Call flow diagram 1100B illustrates PDP context creation for GTPv1, although GTPv2 may follow a similar procedure. At <NUM>, SGSN/SGW <NUM>(<NUM>) provides the PDP context update request including the RAI IE to firewall <NUM>. The RAI IE includes the MCC of <NUM> and the MNC of <NUM>. The RAI IE also include the same IMSI as the previous RAI IE. At <NUM>, firewall <NUM> determines that the IMSIs are identical, compares the stored MCC and MNC with the new MCC and MNC, determines that the MCCs and MNCs are different, and logs the difference (e.g., outputs a syslog). Firewall <NUM> may further update the new concatenated MCC and MNC in the PDP context data structure. It will be appreciated that firewall <NUM> may perform similar operations if the subsequent message is a second PDP context creation, provided the previous PDP context entry has not expired. At <NUM>, firewall <NUM> provides the PDP context update request to GGSN/PGW <NUM>.

<FIG> illustrates a hardware block diagram of a computing device <NUM> that may perform the functions of any of the servers or computing or control entities referred to herein in connection with security threat identification. It should be appreciated that <FIG> provides only an illustration of one embodiment and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

As depicted, the device <NUM> includes a bus <NUM>, which provides communications between computer processor(s) <NUM>, memory <NUM>, persistent storage <NUM>, communications unit <NUM>, and input/output (I/O) interface(s) <NUM>. Bus <NUM> can be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, bus <NUM> can be implemented with one or more buses.

Memory <NUM> and persistent storage <NUM> are computer readable storage media. In the depicted embodiment, memory <NUM> includes Random Access Memory (RAM) <NUM> and cache memory <NUM>. In general, memory <NUM> can include any suitable volatile or non-volatile computer readable storage media. Instructions for security threat identification logic <NUM> may be stored in memory <NUM> or persistent storage <NUM> for execution by processor(s) <NUM>.

One or more programs may be stored in persistent storage <NUM> for execution by one or more of the respective computer processors <NUM> via one or more memories of memory <NUM>. The persistent storage <NUM> may be a magnetic hard disk drive, a solid state hard drive, a semiconductor storage device, Read-Only Memory (ROM), Erasable Programmable ROM (EPROM), flash memory, or any other computer readable storage media that is capable of storing program instructions or digital information.

Communications unit <NUM>, in these examples, provides for communications with other data processing systems or devices. In these examples, communications unit <NUM> includes one or more network interface cards. Communications unit <NUM> may provide communications through the use of either or both physical and wireless communications links.

I/O interface(s) <NUM> allows for input and output of data with other devices that may be connected to device <NUM>. For example, I/O interface <NUM> may provide a connection to external devices <NUM> such as a keyboard, keypad, a touch screen, and/or some other suitable input device. External devices <NUM> can also include portable computer readable storage media such as database systems, thumb drives, portable optical or magnetic disks, and memory cards.

Software and data used to practice embodiments can be stored on such portable computer readable storage media and can be loaded onto persistent storage <NUM> via I/O interface(s) <NUM>. I/O interface(s) <NUM> may also connect to a display <NUM>. Display <NUM> provides a mechanism to display data to a user and may be, for example, a computer monitor.

<FIG> is a flowchart of a method <NUM> for location-based identification of a potential security threat. Method <NUM> may be performed by a firewall, for example. At <NUM>, the firewall obtains a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time. At <NUM>, the firewall obtains a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time. The first network packet may be obtained as part of a first network session, and the second network packet may be obtained as part of a second network session. In one example, the first and second network sessions may be consecutive.

At <NUM>, the firewall determines whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code. At <NUM>, if it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, the firewall determines whether a difference between the second time and the first time is less than a threshold difference. At <NUM>, if it is determined that the difference between the second time and the first time is less than the threshold difference, the firewall associates the second network packet with a potential security threat.

The programs described herein are identified based upon the application for which they are implemented in a specific embodiment. However, it should be appreciated that any particular program nomenclature herein is used merely for convenience, and thus the embodiments should not be limited to use solely in any specific application identified and/or implied by such nomenclature.

The present embodiments may employ any number of any type of user interface (e.g., Graphical User Interface (GUI), command-line, prompt, etc.) for obtaining or providing information, where the interface may include any information arranged in any fashion. The interface may include any number of any types of input or actuation mechanisms (e.g., buttons, icons, fields, boxes, links, etc.) disposed at any locations to enter/display information and initiate desired actions via any suitable input devices (e.g., mouse, keyboard, etc.). The interface screens may include any suitable actuators (e.g., links, tabs, etc.) to navigate between the screens in any fashion.

The environment of the present embodiments may include any number of computer or other processing systems (e.g., client or end-user systems, server systems, etc.) and databases or other repositories arranged in any desired fashion, where the present embodiments may be applied to any desired type of computing environment (e.g., cloud computing, client-server, network computing, mainframe, stand-alone systems, etc.). The computer or other processing systems employed by the present embodiments may be implemented by any number of any personal or other type of computer or processing system (e.g., desktop, laptop, Personal Digital Assistant (PDA), mobile devices, etc.), and may include any commercially available operating system and any combination of commercially available and custom software (e.g., machine learning software, etc.). These systems may include any types of monitors and input devices (e.g., keyboard, mouse, voice recognition, etc.) to enter and/or view information.

The various functions of the computer or other processing systems may be distributed in any manner among any number of software and/or hardware modules or units, processing or computer systems and/or circuitry, where the computer or processing systems may be disposed locally or remotely of each other and communicate via any suitable communications medium (e.g., Local Area Network (LAN), Wide Area Network (WAN), Intranet, Internet, hardwire, modem connection, wireless, etc.). For example, the functions of the present embodiments may be distributed in any manner among the various end-user/client and server systems, and/or any other intermediary processing devices. The software and/or algorithms described above and illustrated in the flow charts may be modified in any manner that accomplishes the functions described herein. In addition, the functions in the flow charts or description may be performed in any order that accomplishes a desired operation.

The software of the present embodiments may be available on a non-transitory computer useable medium (e.g., magnetic or optical mediums, magneto-optic mediums, floppy diskettes, Compact Disc ROM (CD-ROM), Digital Versatile Disk (DVD), memory devices, etc.) of a stationary or portable program product apparatus or device for use with stand-alone systems or systems connected by a network or other communications medium.

The communication network may be implemented by any number of any type of communications network (e.g., LAN, WAN, Internet, Intranet, Virtual Private Network (VPN), etc.). The computer or other processing systems of the present embodiments may include any conventional or other communications devices to communicate over the network via any conventional or other protocols. The computer or other processing systems may utilize any type of connection (e.g., wired, wireless, etc.) for access to the network. Local communication media may be implemented by any suitable communication media (e.g., LAN, hardwire, wireless link, Intranet, etc.).

The system may employ any number of any conventional or other databases, data stores or storage structures (e.g., files, databases, data structures, data or other repositories, etc.) to store information. The database system may be implemented by any number of any conventional or other databases, data stores or storage structures (e.g., files, databases, data structures, data or other repositories, etc.) to store information. The database system may be included within or coupled to the server and/or client systems. The database systems and/or storage structures may be remote from or local to the computer or other processing systems, and may store any desired data.

The embodiments presented may be in various forms, such as a system, a method, and/or a computer program product at any possible technical detail level of integration. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of presented herein.

A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a RAM, a ROM, an Erasable Programmable Read-Only Memory (EPROM or Flash memory), a Static RAM (SRAM), a portable CD-ROM, a DVD, a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a LAN, a wide area network and/or a wireless network.

Computer readable program instructions for carrying out operations of the present embodiments may be assembler instructions, Instruction-Set-Architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or a WAN, or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, Field-Programmable Gate Arrays (FPGA), or Programmable Logic Arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects presented herein.

Aspects of the present embodiments are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the embodiments.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures.

Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

In one form, a method is provided. The method comprises: obtaining a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time; obtaining a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time; determining whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code; if it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, determining whether a difference between the second time and the first time is less than a threshold difference; and if it is determined that the difference between the second time and the first time is less than the threshold difference, associating the second network packet with a potential security threat.

In one example, the first network packet further indicates a first cell identifier of the mobile subscriber at the first time, and the second network packet further indicates a second cell identifier of the mobile subscriber at the second time, the method further comprising: determining whether the first cell identifier is different from the second cell identifier; and if it is determined that the first cell identifier is different from the second cell identifier, determining whether the difference between the second time and the first time is less than the threshold difference.

In one example, the method further comprises: extracting the first mobile country code and the first mobile network code from a first information element of the first network packet; and extracting the second mobile country code and the second mobile network code from a second information element of the second network packet.

In one example, the method further comprises: storing the first mobile country code and the first mobile network code in a database; and before determining whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, retrieving the first mobile country code and the first mobile network code from the database.

In one example, the method further comprises: issuing an event log indicating that the second network packet is associated with the potential security threat. In another example, the second network packet belongs to a network session, the method further comprising: dropping, blocking, or redirecting the second network packet and any subsequent network packets that belong to the network session.

In one example, obtaining the first network packet includes obtaining the first network packet via a general packet radio service tunneling protocol; and obtaining the second network packet includes obtaining the second network packet via the general packet radio service tunneling protocol.

In another form, an apparatus is provided. The apparatus comprises: a network interface configured to obtain and/or provide network packets; and one or more processors coupled to the network interface, wherein the one or more processors are configured to: obtain a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time; obtain a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time; determine whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code; if it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, determine whether a difference between the second time and the first time is less than a threshold difference; and if it is determined that the difference between the second time and the first time is less than the threshold difference, associate the second network packet with a potential security threat.

In another form, one or more non-transitory computer readable storage media are provided. The non-transitory computer readable storage media are encoded with instructions that, when executed by a processor, cause the processor to: obtain a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time; obtain a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time; determine whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code; if it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, determine whether a difference between the second time and the first time is less than a threshold difference; and if it is determined that the difference between the second time and the first time is less than the threshold difference, associate the second network packet with a potential security threat.

Claim 1:
A method comprising:
obtaining (<NUM>) a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time;
obtaining (<NUM>) a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time;
determining (<NUM>) whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code;
if it is determined that the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code, determining (<NUM>) whether a difference between the second time and the first time is less than a threshold difference that is based on a plurality of threshold differences corresponding to respective combinations of mobile country codes and mobile network codes provided in a matrix (<NUM>), the matrix being configured to be preconfigured and/or adjustable by a mobile network operator; and
if it is determined that the difference between the second time and the first time is less than the threshold difference, associating (<NUM>) the second network packet with a potential security threat.