Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

1. A method of detecting a Diameter spoofing attack, the method comprising:

obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of a Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network;

adding a record comprising the normal IMSI to a session table;

obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol; and

determining a category of the IDR message,

wherein the determining the category of the IDR message comprises,

determining that the IDR message is an abnormal IDR message based on an IMSI included in the IDR message not being found in the session table, and

determining that the IDR message is a dangerous IDR message based on some of a bit (bit 2 ) indicating ‘Evolved Packet System (EPS) User State Request’ of IDR-Flags, a bit (bit 3 ) indicating ‘EPS Location Information Request’ and a bit (bit 4 ) indicating ‘Current Location Request’ in the IDR message having a value of ‘1’.

2. The method of claim 1 , wherein the obtaining of the normal IMSI comprises obtaining the normal IMSI included in an Authentication Information Request (AIR) message of the Diameter S6a protocol transmitted from the MME to the HSS of the home network.

3. The method of claim 2 , wherein the obtaining of the normal IMSI further comprises obtaining an IMSI, which is to be deleted, from a Cancel Location Request (CLR) message of the Diameter S6a protocol transmitted from the MME to the HSS of the home network, and the adding of the record comprising the normal IMSI to the session table comprises searching for a record related to the CLR message and deleting the found record.

4. The method of claim 1 , wherein the determining the category of the IDR message comprises determining that the IDR message is an abnormal IDR message based on an origin-host attribute-value pair (AVP) and an origin-realm AVP included in the IDR message not being included in a preset normal host name list.

5. The method of claim 1 , wherein the determining the category of the IDR message comprises determining that the IDR message is an abnormal IDR message based on all of the bit (bit 2 ) indicating ‘EPS User State Request’ of IDR-Flags, the bit (bit 3 ) indicating ‘EPS Location Information Request’ and the bit (bit 4 ) indicating ‘Current Location Request’ in the IDR message having the value of ‘1’.

6. The method of claim 1 , wherein the MME is located in a visiting network.

7. A method of detecting a Diameter spoofing attack using a message of a GTP-C protocol, the method comprising:

obtaining a normal IMSI from a Create Session Request message of a General Packet Radio Service (GPRS) Tunneling Protocol for Control plane (GTP-C) protocol generated by an MME;

obtaining a first tunnel ID (Tunnel Endpoint Identifier (TEID)) from a Create Session Response message transmitted in response to the Create Session Request message, the first tunnel ID being a S11 Serving GateWay (SGW) GTP-C TEID;

adding a record comprising the first tunnel ID and the normal IMSI to a session table;

obtaining a second tunnel ID (TEID) included in a Delete Session Request message of the GTP-C protocol generated by the MME, the second tunnel ID being a S11 SGW GTP-C TEID, the Delete Session Request message not including an IMSI;

deleting a record comprising the second tunnel ID included in the Delete Session Request message from the session table;

obtaining an IDR message of a Diameter S6a protocol; and

determining that the IDR message of the Diameter S6a protocol is an abnormal IDR message based on an IMSI included in the IDR message not being found in the session table, the session table not including information obtained from a packet of a Diameter S6a protocol.

8. The method of claim 7 , wherein the obtaining the first tunnel ID comprises further obtaining an EPS bearer ID (EBI) from the Create Session Request message, and the record added to the session table comprises a value (IMSI+EBI), which is generated as a result of concatenating the normal IMSI and the EBI, as a field of the record.

9. The method of claim 8 , wherein the determining that IDR message is an abnormal IDR message comprises:

extracting an IMSI by extracting upper 34 bits from the IMSI+EBI field of each record of the session table; and

determining the IDR message to be an abnormal IDR message based on the IMSI included in the IDR message not existing among the extracted IMSIs.

10. A fifth generation (5G) mobile communication system comprising:

a 5G core network which comprises a packet tapper in a virtual switch;

an abnormal packet detection system which analyzes a packet obtained through the packet tapper,

wherein the abnormal packet detection system is configured to:

obtain a first normal IMSI from a packet of a Diameter S6a protocol transmitted from an MME to an HSS of a home network and add a record comprising the first normal IMSI to a first session table;

obtain a second normal IMSI from a Create Session Request message packet of a GTP-C protocol generated by the MME and add a record comprising the second normal IMSI to a second session table, and

based on an IDR message of the Diameter S6a protocol being included in the packet obtained through the packet tapper,

determine the IDR message to be an abnormal IDR message based on an IMSI included in the IDR message being found in none of the first session table and the second session table, otherwise determine the IDR message to be a dangerous IDR message based on an IMSI included in the IDR message being found in either one of the first session table and the second session table.

11. The system of claim 10 , wherein the abnormal packet detection system obtains the first normal IMSI included in an AIR message of the Diameter S6a protocol transmitted from the MME to the HSS of the home network.

12. The system of claim 10 , wherein based on the IDR message of the Diameter S6a protocol being included in the packet obtained through the packet tapper, the abnormal packet detection system determines the IDR message to be an abnormal IDR message based on the IMSI included in the IDR message not being found in at least one of the first session table and the second session table or based on an origin-host AVP and an origin-realm AVP included in the IDR message not being included in a preset normal host name list.

13. The system of claim 10 , wherein based on the IDR message of the Diameter S6a protocol being included in the packet obtained through the packet tapper, the abnormal packet detection system determines the IDR message to be a dangerous IDR message based on the IMSI included in the IDR message not being found in at least one of the first session table and the second session table or based on some of a bit (bit 2 ) indicating ‘EPS User State Request’ of IDR-Flags, a bit (bit 3 ) indicating ‘EPS Location Information Request’ and a bit (bit 4 ) indicating ‘Current Location Request’ in the IDR message having a value of ‘1’.

14. The system of claim 10 , wherein the MME is located in a visiting network.

15. The system of claim 10 , wherein the abnormal packet detection system further obtains an EBI from the Create Session Request message packet, and the record added to the second session table comprises a value (IMSI+EBI), which is generated as a result of concatenating the second normal IMSI and the EBI, as a field of the record.

16. The system of claim 10 , wherein the abnormal packet detection system obtains a tunnel ID (TEID) included in a Delete Session Request message packet of the GTP-C protocol generated by the MME, searches for a record comprising the tunnel ID included in the Delete Session Request message packet, and deletes the found record.

17. The system of claim 10 , wherein the tunnel ID (TEID) is an S11 SGW GTP-C TEID.