A Method for Real-Time Session Management on a Mobile Network

Transcription

1 A Method for Real-Time Session Management on a Mobile Network Sekwon Kim, Joohyung Oh, Byoungki Moon, and Chaetae Im Korea Internet Security Center Korea Internet & Security Agency IT Venture Tower, Jungdaero 135, Songpa, Seoul Korea {heath82, jhoh, chtim}@kisa.or.kr, peerless@sk.com Abstract: - New and advanced attack methods and tools have recently emerged as serious threats to the mobile communication and Internet environments such as new scanning techniques, wireless bandwidth crowding and sophisticated billing scams. To respond to these menaces mobile carriers are trying to protect their networks by installing -based security devices between their mobile network and Internet network. However, these security devices cannot detect abnormal traffic or attacks that occur only within the mobile network. Furthermore, since the addresses of multiple terminals are changed to a single through a NAT, it is difficult to identify the attacking device. This paper proposes a method for real-time session management that can identify the UE in a mobile network. The proposed method was implemented and tested in a WCDMA network operating in Korea and was able to effectively manage session of UE without error and delay in real time. Key-Words: - GTP; GTP Call Flow; Session Management 1 Introduction Ever since smartphones were released that could utilize 3G mobile services in 2008, data traffic flowing through the networks has been increasing along with the explosion of smartphone users and proliferation of mobile services. Accompanying this, malicious traffic of the wired environment has also been flowing into the mobile communication network due to the internet tethering services that allow mobile terminals to be setup as a modem to serve other devices. As a result, there is a growing potential security risk to the mobile communication network infrastructure. Attack methods and tools that allow smartphones to troll the mobile communication network, crowd out wireless bandwidth and execute sophisticated billing scams have emerged and been highlighted at conferences recently [1][2][3]. In response, mobile carriers are trying to protect their mobile communication networks by installing -based security devices between their mobile and Internet networks. However, these security devices can not detect abnormal traffic or attacks that occur only within the mobile network. Further, since the addresses of a multitude of terminals is changed to a single through a NAT, it is difficult to identify the attacking device. Therefore a security device that is able to detect abnormal traffic or attacks within the mobile network is now essential. In this paper, it proposed a technique that can be used to manage session information of mobile terminal via GTP protocol analysis[4]. Section II describes the structure of WCDMA networks and GTP protocol, Section III describes generated GTP messages in GTP Call Flow. Section 4 proposes session management method of the mobile terminal, next Section 5 describes the test results of proposed method and conclusions and future work. 2 Overview of a Mobile Network 2.1 WCDMA Network Structure Circuit Switched Network UE UTRAN Packet Switched Network Signal Protocol Stack ellipsis GGSN Internet Iu-PS Gn Gi GNN RANAP SCCP MTP Relay Fig. 1. WCDMA Network Structure. GTP-C UDP GTP-C WCDMA network is basically configured in User Equipment (UE), UTRAN, and a Core Network (CN) as shown in Figure 1. UE is a user equipment to connect to a mobile communication network. The UTRAN is radio access network that supports a UDP ISBN:

2 radio access technology in WCDMA, and it composed of Radio Network Control () and. The UTRAN controls and assigns the radio resources, and guarantees the mobility of the user. CN is divided into Circuit System (CS) to provide voice services and Packet System (PS) to provide data services. In here the PS is configured in Serving GPRS Support Node () and Gateway GPRS Support Node (GGSN). performs functions such as mobility and session management of UE, packet routing and authentication. And, GGSN performs functions such as allocation, mobility management, user traffic handling[5]. 2.2 GPRS Tunneling Protocol (GTP) GTP is a protocol used in the Gn Interface between and GGSN in WCDMA Core Network. In GTP protocol, GTP control plane messages (GTP- C) are used to exchange the tunnel information and to create, update of delete a GTP tunnel. The GTP user data messages (GTP-U) are used to load the T- PDUs (Transport Protocol Data Unit) passing through the GTP tunnel. The GTP-C messages those are used to manage and maintain the GTP tunnels are called tunnel management signaling messages[4]. They include the messages below: 3 GTP Call Flow If UE connects to the WCDMA network, then RRC Connection Establishment, Authentication, NAS Security Setup procedures are performed, and GTP tunnel is produced. Then, GTP tunnel is updated by radio resources allocation /release or Hand-off by moving the position of the UE. Finally, GTP tunnel is deleted when the UE releases connection to WCDMA network. Figure 3 is shown the flow until released from the WCDMA network connection. Message Type : Create PDP Context Request (0x10) TEID : 0x IMSI : [MCC][MNC][MSIN] (Donwlink)TEID Data I : 0x7dc6e085 (Downlink)TEID Control Plane : 0x MSISDN : 82########## Message Type : Create PDP Context Response (0x11) End User Address : Data Transfer (Up/Downlink GTP-U) Message Type : Update PDP Context Request (0x12) (Uplink Control)TEID : (Downlink)TEID Data I : 0x7dc6e085 Extension Value : 0x201 GGSN Idle Table 1. The Type and Functions of GTP-C Messages Message Message Type Function Create Request 0x10 Create Response 0x11 Create GTP Tunnel Update Request 0x12 Update Response 0x13 Update GTP Tunnel Delete Request 0x14 Delete Response 0x15 Delete GTP Tunnel Version PT 0 E S PN Message Type Payload Length Tunnel Endpoint Identifier (TEID) Sequence Number N-PDU Number Next Ext Header Type Message Type : Update PDP Context Request (0x12) (Uplink Control)TEID : (Downlink)TEID Data I : 0x7dc6e085 Extension Value : 0x200 Data Transfer (Up/Downlink GTP-U) Active Fig. 2. GTP Header. Payload GTP Header is shown in Figure 2. GTP messages contain Tunnel Endpoint Identifier (TEID) and it is a unique argument that distinguishes GTP tunnel. That is, UE is distinguished by the TEID, not the address because in WCDMA Network. For example, if 100 UE are connected to same and GGSN, GTP tunnel is created one for each UE, and thus total 100 are created. Here, GTP tunnel for each UE is distinguished by TEID. And TEID is unidirectional (Uplink: GGSN / Downlink:GGSN ). Message Type : Delete PDP Context Request (0x14) (Uplink Control)TEID : Message Type : Delete PDP Context Response (0x15) (Downlin Control)TEID : 0x Fig. 3. GTP Call Flow. In order to create a GTP tunnel assigns each Downlink Control/Data TEID, then send to the GGSN using GTP-C Create Request message along with the unique information of UE such as MSISDN, IMSI. As a response to it, GGSN assigns each Downlink Control/Data TEID and address of UE (End User Address), then send GTP-C Create ISBN:

3 Response message to. After completing the preceding steps, GTP tunnel is created and the UE can send and receive data through the tunnel. In order to efficiently use limited radio resources, WCDMA network releases the radio resource of UE that doesn't receive or send data during a certain period of time. In this case, GTP-C Update Request /Response messages are generated for updating the corresponding GTP tunnel of UE. Similarly, GTP-C Update Request/Response messages are generated for updating GTP tunnel when UE are reallocated radio resource to send or receive data. The GTP-C Update messages contain TEID to change each TEID assigned by and GGSN when creating a GTP tunnel, but Uplink Control TEID can t be changed. And, GTP-C Update Request message includes state information of UE in a particular field, the value is 0x200 (Active) or 0x201 (Idle). Finally, GTP tunnel is deleted when UE releases connection to the WCDMA network. Then sends GTP-C Delete Request message to GGSN In order to remove the GTP tunnel. And GGSN sends a GTP-C Delete Response message to as a response to it. 4 Session Management Method The only value that can be distinguished GTP tunnel is TEID in GTP-C messages for creating or updating or deleting a GTP tunnel. In this section, method and Hash Table structure for effectively managing the session of UE based on the TEID will be described in detail. 4.1 Hash Table Structure unique. And value is time which of GTP-C Create Request message of session is collected. The key of DC Hash Table is a combination of the and DC TEID. WCDMA network has a hierarchical structure. In other words, 1 GGSN is connected a number of that manages TEID individually. Therefore, the Downlink TEID of different GTP tunnel may be same. So, a combination of and DC TEID is used as key of DC Hash Table to prevent duplication in this paper. 4.2 Method for Session Management Start GTP Packet Message Type 0x10 GTP-C Create Request Processing 0x12 (GTP-C Update Request) 0x15(GTP-C Delete Response) 0xFF (GTP-U) 0x11 0x13 0x14 Create GTP-C Response Create Response Processing Processing GTP-C Update Response Processing Fig. 5. The Processing Procedure of the GTP Messages. GTP-C Delete Request Processing Figure 5 is shown the processing procedure of the GTP messages for managing the session. Fist, the Message Type of GTP message is checked if GTP message is input. Then GTP-C Create (0x10, 0x11), Update Response (0x13), Delete Request (0x14) messages are processed. The detailed instruction for each message is as follows: Message Type : Create PDP Context Request (0x10) TEID : 0x IMSI : [MCC][MNC][MSIN] GTP (Donwlink)TEID Data I : 0x7dc6e085 (Downlink)TEID Control Plane : 0x MSISDN : 82########## Source : [Downlink Data(DC) Hash Table] [Downlink Control(DC) Hash Table] Find matching Insert + DC TEID UC TEID Delete x65646c24 0x6569eca4 0x ########## 450######### x18884a24 0x66f66aa4 0x1f7fcdc9 82########## 450######### Insert 0x ########## 450######### Delete UD TEID EUA 0x65646c x6569eca Fig. 6. The Processing of GTP-C Create Request Message. UC TEID Fig. 4. The Hash Table Structure. UD TEID DC TEID MSISDN IMSI EUA Figure 4 is shown the structure of a Hash Table which is composed of a total of five table for managing session information. Every Hash Table is composed of Key and Value basically, Key is a. Combination of DC TEID and (Source of the packet), then generation using a. b. Lookup DC Hash Table and extract of matching row, then delete the row. c. Lookup Session Hash Table. (Here, is in former step) ISBN:

4 d. Extract UC, UD TEID and EUA of matching row, then delete the row. e. Lookup UC, UD, EUA Hash Table (Here, is UC, UD TEID and EAU in former step), then delete the row. f. Insert, in DC Hash Table. (Here, is in step a, is current time) g. Insert DC TEID, MSISDN, IMSI, in Session Hash Table (Here, is in former step) b. Lookup Session Hash Table. (Here, is in former step) c. Uplink Data TEID comparison. d. If they do not match, then lookup UD Hash Table. (Here, is UD TEID in Session Hash Table) e. Delete maching row, then insert, in UD Hash Table. (Here, is the changed UD TEID, is in step b) Message Type : Delete PDP Context Response (0x14) TEID : 0x9e31aba4 Message Type : Create PDP Context Response (0x11) TEID : 0x GTP End User Address : Destination : Find matching 5 Delete [Downlink Data(DC) Hash Table] x18884a24 0x66f66aa4 0x1f7fcdc9 82########## 450######### Find matching Find matching 0x9e31aba4 0x ########## 450######### Delete x1f7fcdc9 82########## 450######### x18884a24 0x66f66aa Lookup Hash Table 7 Find matching [Downlink Control(DC) Hash Table] 4 Find matching 0x9e31aba4 0x ########## 450######### Insert x6569eca Delete Fig. 9. The Processing of GTP-C Delete Request Message. 6 Insert 0x9e31aba Fig. 7. The Processing of GTP-C Create Response Message. a. Combination of DC TEID and (Source of the packet), then generation using a. b. Lookup DC Hash Table, then Extract of matching row. c. Lookup Session Hash Table. (Here, is in former step) d. Insert UC, UD TEID and EUA of matching row. e. Insert, in UC, UD, EAU Hash Table. (Here, is UC, UD, TEID and EUA, is equal to step b) TEID : 0x a. Lookup UC Hash Table and extract in matching row. (Here, is UC TEID) b. Lookup Session Hash Table and extract UD, DC TEID and EUA in matching row. (Here, is in former step) c. Delete matching row in Session Hash Table. d. Lookup UD, DC, EUA Hash Table and delete matching row. (Here, is UD, DC TEID and EUA in Step b) 5 Experiment The proposed method is implemented and installed to WCDMA network of telecommunication firm in Korea. The features and performance are tested about two months and the test environment is shown in Figure Find matching 5 Matching? x1f7fcdc9 82########## 450######### x18884a24 0x66f66aa Aggregation SW Tap SW GGSN 4 Find matching 0x ########## 450######### x9e31aba Update System for GTP Call Flow Management 6 Lookup Hash Table Fig. 10. Test Environment. 7 Find matching 0x9e31aba4 8 Delete & Insert Fig. 8. The Processing of GTP-C Update Response Message. a. Lookup UC Hash Table (Here, is UC TEID), then Extract of matching row. The system received GTP traffic of 1 GGSN as input. The input traffic is approximately 8.0 Gbps/sec without packet loss. In test results, GTP tunnel is frequently created, updated, and deleted (Create/Delete : 100 times/sec, Update : 8,000 ISBN:

5 times/sec), but the proposed method effectively manages session without error and delay in real time. 6 Conclusion and Future Work It is difficult to find a mobile terminal caused malicious traffic because the private address is assigned dynamically to each mobile terminal connected to the network in NAT-based mobile communication network. In this paper, we propose a method for real-time session management of that can identify the UE in WCDMA networks. The system applied proposed method was installed and tested in WCDMA network of Korean telecommunication firm. In test results, the proposed method effectively manages session of UE without error and delay in real time. Recently, telecommunication firm has introduced Long Term Evolution (LTE) to protect mobile communication network by dispersing exploding traffic. Nationwide LTE network is already installed and serviced in Korea. GTP-C and GTP-U exist in a separate section of LTE network unlike WCDMA network. We are expected to study method for managing session of LTE network. Acknowledgment: This research was funded by the MS(Ministry of Science, ICT & Future Planning), Korea in the ICT R&D Program References: [1] K. Kotapati, P. Liu, Y. Sun, T. F. LaPorta, A taxonomy of cyber attacks on 3G networks, Proceedings of the IEEE international conference on Intelligence and Security Informatics, pp , [2] ASMONIA Project, [3] D. F. Guo, A. F. Sui, and L. Shi, Billing Attack Detection and Prevention in Mobile Communication Network, Proceedings of IEEE 13st International Conference on Communication Technology, pp , [4] 3GPP, GPRS Tunneling Protocol (GTP) across the Gn and Gp interface (Release 10), TS V10.2.0, [5] H. Holma, A. Toskala, WCDMA for UMTS Radio Access for third Generation Mobile Communications 3rd, Willey, 2004). [6] 3GPP, General Packet Radio Service (GPRS); Service description; Stage 2, TS V10.3.0, ISBN: