Method and system blocking charging attack

Abstract

The inventive embodiment discloses a method for preventing charging overflow attack. The method comprises the following steps: acquiring the identification information of a mobile station; transmitting the identification information of the mobile station to an entity for preventing the attack; and transmitting a deactivation action message to the entity after monitoring the deactivation action of the mobile station, wherein the deactivation action message is used for informing the entity of setting the session table corresponding to the identification information of the mobile station to invalid. The invention also discloses a system for preventing charging overflow. The method and the system can prevent charging overflow attack under the condition of less system change.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to a method and system for preventing charging attacks. Background technique [0002] GPRS (General Packet Radio Service, General Wireless Packet Service) is used to transmit packet data in the traditional mobile network GSM (Global System for Mobile communication, Global System for Mobile Communications), for which a series of functions have been added on the basis of the original GSM network Entities, mainly including PCU (Packet Control Unit, packet control unit), GSN (GPRS Supporting Node, GPRS support node), CG (Charging Gateway, charging gateway) and other network elements, and upgrade the network entities of the GSM network to support Group business. GSN includes SGSN (Service GPRSSupport Node, service GPRS support node) and GGSN (Gateway GPRS Support Node, gateway GPRS support node). The PCU of the GPRS network in the 3G standard is integrated on the access network s...

AI Technical Summary

Problems solved by technology

[0009] In the process of realizing the present invention, the inventor finds that at least the following problems exist in the prior art: an attacker can use a normal MS device, and after careful design, establish a session on the firewall and deactivate it, and continuously send messages from the PDN host Sending traffic to the firewall keeps the MS session record of the firewall in an active state. Once the IP used by the attacker MS is used by a new user, the firewall will forward data to the new user based on this session, and the new user will charge for the forwarded data. attack will succeed

Similarly, the billing overflow attack initiated from the MS side can also be carried out in the above-mentioned manner, and the firewall cannot stop it, so the prior art cannot solve the billing overflow attack problem

Images