Mobile network security system

1. A security system for a mobile network having a gateway for receiving messages from outside the network and a network element storing mobile terminal location information, comprising a processor wherein the security system is adapted to:

monitor by the processor in real time look-up requests made to said network element and entering the network through the gateway,

monitor by the processor in real time a message entering the network through the gateway and its correspondence to said look-up requests; and

decide by the processor that said message is likely to be unsolicited, and

wherein the system further comprises a data store device and a timer device,

wherein the system processor is adapted to store in the data store device look-up request information obtained from said look-up requests received from the gateway,

wherein, when a message is received, the system processor is adapted to use said timer device to decide that said message is likely to be unsolicited if a prior look-up request corresponding to said message had not been received within a pre-set time period; and

wherein the system processor is adapted to monitor in said look-up request information obtained from said look-up requests a source address of a look-up request and to monitor a source address of said message, and to decide that the message is likely to be unsolicited if the message source address is different from the corresponding look-up request source address.

2. The system as claimed in claim 1 , wherein the system is adapted to store the look-up request information in the data store device for only a pre-set time duration, and to determine when the data store device is searched upon receipt of a message if a corresponding prior look-up request has been received within said pre-set time period if information concerning such a look-up request is stored in the data store device.

3. The system as claimed in claim 1 wherein the system is adapted to activate the timer device upon receipt of a look-up request.

4. The system as claimed in claim 3 , wherein the timer device is configured to run from the time of receipt T 0 to a preset time limit T preset — end .

5. The system as claimed in claim 1 , wherein the system is adapted to facilitate setting the timer device time limit T preset — end for a category of look-up request.

6. The system as claimed in claim 1 , wherein the system is adapted to block messages which are likely to be unsolicited.

7. The system as claimed in claim 1 , wherein the system is configurable to send a positive or a negative acknowledgement according to the monitoring.

8. The system as claimed in claim 1 , wherein the system is adapted to mark as suspicious and keep for further investigation a source address of a look-up request corresponding to a message likely to be unsolicited.

9. A method implemented by a security system for monitoring messages in a mobile network having a gateway for receiving messages from outside the network and a network element storing mobile terminal location information, comprising a processer, the method comprising the steps of the security system:

monitoring by the processor in real time look-up requests made to said network element and entering the network through the gateway;

monitoring by the processor in real time a message entering the network through the gateway and its correspondence to said look-up requests; and

deciding by the processor that said message is likely to be unsolicited, and

wherein, the system stores a look-up request information obtained from said look-up requests received from the gateway in a data store device, wherein, when a message is received, the processor uses said timer device to decide that a message is likely to be unsolicited if a corresponding prior look-up request corresponding to said request had not been received within a pre-set time period; and

wherein the system processor is adapted to monitor in said look-up request information obtained from said look-up requests a source address of a look-up request and to monitor a source address of said message, and to decide that the message is likely to be unsolicited if the message source address is different from the corresponding look-up request source address.

10. The method as claimed in claim 9 , wherein the system monitors a source address of a look-up request and a source address of a corresponding message, and decides that the message is likely to be unsolicited if its source address is different from that of the corresponding look-up request.

11. The method as claimed in claim 9 , wherein the system stores the look-up request information in the data store device for only a pre-set time duration, and determines when the data store device is searched upon receipt of a message if a corresponding prior look-up request has been received within said pre-set time period if information concerning such a look-up request is stored in the data store device.

12. The method as claimed in claim 9 wherein the system activates a timer device upon receipt of a look-up request.

13. The method as claimed in claim 12 , wherein the timer device runs from the time of receipt T 0 to a preset time limit T present — end .

14. The method as claimed in claim 9 , wherein the time limit T preset — end is set for a category of look-up request.

15. The method as claimed in claim 9 , wherein the system blocks messages which are likely to be unsolicited.

16. The method as claimed in claim 9 , comprising the further step of sending a positive or a negative acknowledgement according to the monitoring.

17. The system as claimed in claim 9 , wherein the system marks as suspicious and keeps for further investigation a source address of a look-up request corresponding to a message likely to be unsolicited.

18. A non-transitory computer readable medium comprising software code for performing a method when executing on a digital data processor of a security system, the method being for monitoring messages in a mobile network having a gateway for receiving messages from outside the network and a network element storing mobile terminal location information, and the method comprising the steps of:

monitoring by the processor in real time look-up requests made to said network element and entering the network through the gateway;

monitoring by the processor in real time a message entering the network through the gateway and its correspondence to said look-up requests; and

deciding by the processor that said message is likely to be unsolicited;

wherein the system further comprises a data store device and a timer device,

wherein the system processor is adapted to store in the data store device look-up request information obtained from said look-up requests received from the gateway,

wherein, when a message is received, the system processor is adapted to use said timer device to decide that said message is likely to be unsolicited if a prior look-up request corresponding to said message had not been received within a pre-set time period; and

wherein the system processor is adapted to monitor in said look-up request information obtained from said look-up requests a source address of a look-up request and to monitor a source address of said message, and to decide that the message is likely to be unsolicited if the message source address is different from the corresponding look-up request source address.