Methods, systems, and computer readable media for obscuring diameter node information in a communication network
View Patent ↗According to one aspect, the subject matter described herein includes a system for a system for obscuring DIAMETER node information in a communication network. The system includes a DIAMETER agent platform. The DIAMETER agent platform includes a network interface for receiving a message from a first DIAMETER node. The DIAMETER agent platform further includes a DIAMETER information hiding module for modifying, in the first message, DIAMETER information for the first DIAMETER node so as to obscure the identity of the first diameter node. The diameter agent includes a routing module for routing the modified message to a second DIAMETER node.
1. A system for obscuring DIAMETER node information in a communication network, the system comprising:
a DIAMETER agent platform, comprising:
a processor;
a network interface for receiving a message from a first DIAMETER node; and
a memory that stores instructions, wherein the processor, in communication with the memory executes the instructions of the DIAMETER agent platform to perform the steps of:
a DIAMETER information hiding module, stored in the memory, for modifying, in the message, DIAMETER information for the first DIAMETER node so as to obscure the identity of the first DIAMETER node, wherein the DIAMETER information identifies the first DIAMETER node as an originating host; and
a routing module, stored in the memory, for routing the modified message to a second DIAMETER node, wherein the DIAMETER agent platform is configured to replace, in the message, the DIAMETER information identifying the DIAMETER node with a single virtual DIAMETER identity, wherein the DIAMETER agent platform comprises a DIAMETER signaling router that routes received DIAMETER signaling messages based on DIAMETER information contained within the DIAMETER signaling messages, wherein the DIAMETER signaling router hides DIAMETER network topology by assigning the single virtual DIAMETER identity to a plurality of different DIAMETER nodes, and wherein the DIAMETER signaling router maintains a session-stateless mapping between a subscriber identifier, the DIAMETER information for the first DIAMETER node, and the virtual DIAMETER identification information,
wherein the single virtual DIAMETER identity identifies the message as originating from a virtual DIAMETER node, and
wherein the DIAMETER agent platform receives DIAMETER messages addressed to the single virtual DIAMETER identity and changes a destination address in at least some of the messages to an address of the first DIAMETER node using the session-stateless mapping.
2. The system of claim 1 wherein the first DIAMETER node is one of a home subscriber server (HSS) and a mobility management entity (MME).
3. The system of claim 1 wherein the second DIAMETER node is one of a mobility management entity (MME), a home subscriber server (HSS), a policy and charging rules function (PCRF), an online charging system (OCS), and an offline charging system (OFCS).
4. The system of claim 1 wherein the DIAMETER message includes one of an UpdateLocation Request (ULR) message, an UpdateLocation Answer (ULA) message, a CancelLocation Request (CLR) message, a CancelLocation Answer (CLA) message, Credit-Control-Request (CCR) message, Credit-Control-Answer (CCA) message, Accounting-Request (ACR) message, Accounting-Answer (ACA) message, Re-Auth-Request (RAR) message, and a Re-Auth-Answer (RAA) message.
5. The system of claim 1 wherein the DIAMETER agent platform maintains state information associated with a transaction involving the received message.
6. The system of claim 1 wherein the DIAMETER agent platform is stateless with regard to a transaction involving the received message.
7. The system of claim 1 wherein the DIAMETER agent platform comprises one or more of:
a DIAMETER relay agent, a DIAMETER proxy agent, a DIAMETER redirect agent, and a DIAMETER translation agent.
8. A method for obscuring DIAMETER node information in a communication network, the method comprising:
in a DIAMETER agent platform, comprising a processor, a network interface that receives a message from a first DIAMETER node, and a memory that stores instructions, wherein the processor, in communication with the memory executes the instructions of the DIAMETER agent platform to perform the steps of:
modifying, by a DIAMETER hiding module stored in the memory, DIAMETER identifying information in the message received from the first DIAMETER node so as to obscure the identity of the first DIAMETER node, wherein the DIAMETER identifying information identifies the first DIAMETER node as an originating host; and
routing, by a routing module stored in the memory, the modified message to a second DIAMETER node, wherein the DIAMETER agent platform is configured to replace, in the message, the DIAMETER information identifying the first DIAMETER node with a single virtual DIAMETER identity, wherein the DIAMETER agent platform comprises a DIAMETER signaling router that routes received DIAMETER signaling messages based on DIAMETER information contained within the DIAMETER signaling messages, wherein the DIAMETER signaling router hides DIAMETER network topology by assigning the single virtual DIAMETER identity to a plurality of different DIAMETER nodes, and wherein the DIAMETER signaling router maintains a session-stateless mapping between a subscriber identifier, the DIAMETER information for the first DIAMETER node, and the virtual DIAMETER identification information,
wherein the single virtual DIAMETER identity identifies the message as originating from a virtual DIAMETER node, and
wherein the DIAMETER agent platform receives DIAMETER messages addressed to the single virtual DIAMETER identity and changes a destination address in at least some of the messages to an address of the first DIAMETER node using the session-stateless mapping.
9. The method of claim 8 wherein the first DIAMETER node is one of a home subscriber server (HSS) and a mobility management entity (MME).
10. The method of claim 8 wherein the second DIAMETER node is one of a mobility management entity (MME), a home subscriber server (HSS), a policy and charging rules function (PCRF), an online charging system (OCS), and an offline charging system (OFCS).
11. The method of claim 8 wherein the DIAMETER message includes one of an UpdateLocation Request (ULR) message, an UpdateLocation Answer (ULA) message, a CancelLocation Request (CLR) message, a CancelLocation Answer (CLA) message, Credit-Control-Request (CCR) message, Credit-Control-Answer (CCA) message, Accounting-Request (ACR) message, Accounting-Answer (ACA) message, Re-Auth-Request (RAR) message, and a Re-Auth-Answer (RAA) message.
12. The method of claim 8 wherein the DIAMETER agent platform maintains state information associated with a transaction involving the received message and uses the state information to deliver the message to the second DIAMETER node.
13. The method of claim 8 wherein the DIAMETER agent platform is stateless with regard to a transaction involving the received message.
14. The method of claim 8 wherein the DIAMETER agent platform comprises one or more of:
a DIAMETER relay agent, a DIAMETER proxy agent, a DIAMETER redirect agent, and a DIAMETER translation agent.
15. A non-transitory computer readable medium having stored thereon executable instructions that when executed by the processor of a computer control the computer to perform steps comprising:
in a DIAMETER agent platform, comprising a processor, a network interface that receives a message from a first DIAMETER node, and a memory that stores instructions, wherein the processor, in communication with the memory executes the instructions of the DIAMETER agent platform to perform the steps of:
modifying, by a DIAMETER hiding module stored in the memory, DIAMETER identifying information in the message received from the first DIAMETER node so as to obscure the identity of the first DIAMETER node, wherein the DIAMETER identifying information identifies the first DIAMETER node as an originating host; and
routing, by a routing module stored in the memory, the modified message to a second DIAMETER node, wherein the DIAMETER agent platform is configured to replace, in the message, the DIAMETER information identifying the first DIAMETER node with a single virtual DIAMETER identity, wherein the DIAMETER agent platform comprises a DIAMETER signaling router that routes received DIAMETER signaling messages based on DIAMETER information contained within the DIAMETER signaling messages, wherein the DIAMETER signaling router hides DIAMETER network topology by assigning the single virtual DIAMETER identity to a plurality of different DIAMETER nodes, and wherein the DIAMETER signaling router maintains a session-stateless mapping between a subscriber identifier, the DIAMETER information for the first DIAMETER node, and the virtual DIAMETER identification information,
wherein the single virtual DIAMETER identity identifies the message as originating from a virtual DIAMETER node, and
wherein the DIAMETER agent platform receives DIAMETER messages addressed to the single virtual DIAMETER identity and changes a destination address in at least some of the messages to an address of the first DIAMETER node using the session-stateless mapping.