Signaling storm reduction from radio networks
A method for signaling storm reduction is disclosed, comprising concentrating a plurality of signaling messages from a radio access network node to a core network node at a signaling concentrator; and processing the plurality of signaling messages with a mobile device identifier rule, at a rate equal to or greater than a line rate of a link from the radio access network to the signaling concentrator, wherein processing the plurality of signaling messages further comprises determining whether to drop each of the plurality of signaling messages.
1. A method of performing service request throttling in a Radio Access Network (RAN), comprising:
determining a core network-configured threshold for a rate of service requests from a wireless device;
measuring the rate of service requests from the wireless device; and
taking an action regarding new service requests from the wireless device when the threshold for a rate of service requests is exceeded, wherein the wireless device comprises a User Equipment (UE) or an Internet of Things (loT) device;
wherein taking an action regarding new service requests from the wireless device when the threshold for a rate of service requests is exceeded comprises:
permitting a wireless device to attach;
permitting the wireless device to establish a data connection with the core network which is capped or has throttled bandwidth;
flagging certain activities by the wireless device as being anomalous, wherein an anomalous activity includes a number attach requests, detach requests or sequence of requests above a threshold and within a certain time,
determining the wireless device performing the certain activities is a rogue device; and
disallowing a related attachment request from the rogue device.
2. The method of claim 1 wherein taking an action regarding new service requests from the wireless device when the threshold for a rate of service requests is exceeded comprises denying new service requests from the wireless device.
3. The method of claim 1 further comprising:
determining a threshold for IDLE/CONNECTED transactions;
measuring the amount of IDLE/CONNECTED transactions from the wireless device; and
taking an action regarding new service requests from the wireless device when the threshold for IDLE/CONNECTED transactions is exceeded.
4. The method of claim 3 wherein taking an action regarding new service requests from the wireless device when the threshold for IDLE/CONNECTED transactions is exceeded comprises denying new service requests from the UE.
5. The method of claim 1 wherein the service request throttling is performed at one of an eNodeB, a NodeB, a Wi-Fi access point and a multi-radio access technology (multi-RAT) access node.
6. The method of claim 1 wherein taking an action regarding new service requests from the wireless device when the threshold for a rate of service requests is exceeded comprises:
permitting a wireless device to attach; and
not permitting the wireless device to establish a data connection with the core network.
7. The method of claim 1 wherein throttling is put in place temporarily by a policy at a core network node.
8. The method of claim 1 wherein throttling permits a large number of users to send and receive urgent text messages in an emergency situation.
9. The method of claim 1 wherein an activity is flagged as being anomalous when the activity further includes at least one of:
a sequence of mobility registration requests within a certain time;
unusual upload activity;
unusual download activity;
activity indicating a port scan of network resources; and
activity on a particular set of ports previously identified as belonging to a rogue UE or anomalous node.
10. The method of claim 1 wherein determining the device performing the certain activities is a rogue device includes considering at least one of:
an International Mobile Subscriber Identity (IMSI);
an International Mobile Station Equipment Identity (IMEI);
an operating system;
an operating system version;
a browser;
a browser version;
an application name;
an application version;
protocols at various layers; and
an Internet Protocol (IP) address.
11. The method of claim 9 wherein the rogue device comprises one of a rogue eNodeB, a rogue base station, and a rogue relay node.
12. The method of claim 9 wherein detection of a rogue device is based on pattern matching.
13. The method of claim 9 wherein detection of a rogue device is based on deep packet inspection (DPI) heuristics, signatures, or rules.