Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W8/00—Network data management
  • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks

Definitions

• the present invention relates to the field of machine type communication (MTC) technology, and in particular, to a method and system for monitoring abnormal behavior of a terminal.
• MTC machine type communication
• the existing cellular wireless communication system is composed of a core network (CN, Core Network), an access network (RAN, Radio Access Network), and a terminal, as shown in FIG.
• the CN is responsible for non-access stratum transactions, such as terminal location update, and the CN is an anchor point of the user plane
• the RAN is composed of a base station, or is composed of a base station and a base station controller, and the RAN is responsible for access layer transactions, such as management of radio resources.
• a user equipment (UE, User Equipment) refers to various devices that can communicate with a cellular wireless communication network, such as a mobile terminal, a notebook computer, and the like.
• the Mobility Management Entity (MME) or the Serving GPRS Support Node (SGSN) is the unit responsible for managing terminal access control, location information update, and handover in the core network.
• the Home Subscriber Server (HSS) or the Home Location Register (HLR) is an entity in the core network that is responsible for storing subscription data, identity information, authentication information, and authorization information of the terminal device.
• the HSS or HLR can be used to store the identity information of the user, and the binding information of the user and the terminal device, or only the identity information of the user (the binding information of the user and the terminal device can be saved by the gateway), or directly save the terminal.
• the HSS or HLR is also responsible for the user's subscription database, as well as the execution user. Authentication and authorization, etc.
• the service platform can query user or terminal information from the HSS or HLR.
• the MTC Interoperability Function Entity is a connection entity between the mobile communication network and the external public network, which can implement functions such as protocol conversion, address query, and information storage.
• the interworking function entity is connected to the MTC server, and can be connected to the mobile communication network element such as HSS/HLR or MME/SGSN.
• the main object of the present invention is to provide a method and system for monitoring abnormal behavior of a terminal, so as to implement detection and up-and-down of abnormal behavior of the terminal.
• the present invention provides a method for monitoring abnormal behavior of a terminal, the method comprising:
• the mobility management unit monitors the behavior of the terminal, and sends an event report to the machine type communication interoperation function entity MTC IWF when detecting the occurrence of the monitoring event;
• the MTC IWF sends an information query request signaling to the home subscriber server HSS, and receives the information query feedback signaling returned by the HSS;
• the MTC IWF sends a monitoring event report to the information in the information query feedback signaling.
• the mobility management unit monitors the behavior of the terminal, specifically:
• the mobility management unit acquires subscription data of the terminal from the HSS or the home subscriber location register HLR, where the subscription data includes a monitoring event parameter;
• the mobility management unit performs behavior on the terminal according to the acquired monitoring event parameter. Monitoring. After receiving the attach request signaling or the tracking area update request signaling from the terminal, the mobility management unit sends an update location request signaling to the HSS or the HLR;
• the HSS or HLR sends update location approval signaling to the mobility management unit, and the update location approval signaling includes subscription data of the terminal.
• the event report sent by the mobility management unit includes an international mobile subscriber identity code IMSI of the terminal, and a monitoring event.
• the information query request signaling sent by the MTC IWF includes the IMSI of the terminal.
• the information in the information query feedback signaling sent by the HSS includes: an external identifier of the terminal, and an identifier or address of the MTC server.
• the monitoring event sent by the MTC IWF includes an external identifier and a monitoring event of the terminal.
• the present invention also provides a system for monitoring abnormal behavior of a terminal, the system comprising: a mobility management unit, a machine type communication interoperation function entity MTC IWF and a home subscriber server HSS, the mobility management unit, configured to be used by the terminal The behavior is monitored, and an event report is sent to the MTC IWF when a monitoring event is detected;
• the MTC IWF is configured to send information query request signaling to the HSS, and receive information query feedback signaling returned by the HSS; send a monitoring event report to the MTC server according to the information in the information query feedback signaling;
• the HSS is configured to return information query feedback signaling to the MTC IWF after receiving the information query request signaling from the MTC IWF.
• the mobility management unit is further configured to acquire subscription data of the terminal from the HSS or the home location register HLR, where the subscription data includes a monitoring event parameter, and monitor the behavior of the terminal according to the acquired monitoring event parameter.
• the subscription data of the terminal obtained from the HSS or the HLR is specifically: After receiving the attach request signaling or tracking area update request signaling from the terminal, the mobility management unit sends an update location request signaling to the HSS or HLR, and receives an update sent by the HSS or HLR.
• the location approval signaling includes the subscription data of the terminal in the update location approval signaling.
• the event report sent by the mobility management unit includes an international mobile subscriber identity code IMSI of the terminal, and a monitoring event.
• the information query request signaling sent by the MTC IWF includes the IMSI of the terminal.
• the information in the information query feedback signaling sent by the HSS includes: an external identifier of the terminal, and an identifier or address of the MTC server.
• the monitoring event sent by the MTC IWF includes an external identifier and a monitoring event of the terminal.
• the present invention provides a method and system for monitoring abnormal behavior of a terminal.
• the MTC IWF can obtain the identity or address of the correct MTC server from the HSS/HLR, and obtain the external identifier of the terminal that can be identified in the MTC server; thus, MTC The IWF can send monitoring event reports to the correct MTC server, and the MTC server can correctly identify the terminal that has an abnormal event.
• DRAWINGS can obtain the identity or address of the correct MTC server from the HSS/HLR, and obtain the external identifier of the terminal that can be identified in the MTC server; thus, MTC The IWF can send monitoring event reports to the correct MTC server, and the MTC server can correctly identify the terminal that has an abnormal event.
• FIG. 1 is a schematic structural diagram of a conventional cellular wireless communication system
• FIG. 1 is a flowchart of a method for monitoring abnormal behavior of a terminal according to the present invention
• FIG. 3 is a flowchart of a method for monitoring abnormal behavior of a terminal according to Embodiment 1 of the present invention
• FIG. 4 is a flowchart of a method for monitoring abnormal behavior of a terminal according to Embodiment 2 of the present invention. detailed description
• a method for monitoring abnormal behavior of a terminal provided by the present invention mainly includes the following steps: Step 201: The terminal sends an attach request signaling or a tracking area update request signaling to a mobility management unit (MME or SGSN).
• MME mobility management unit
• Step 202 The mobility management unit sends an update location request signaling to the HSS or the HLR.
• Step 204 The mobility management unit monitors the behavior of the terminal according to the monitoring event parameter in the subscription data.
• Step 205 After detecting the monitoring event, the mobility management unit sends an event report to the MTC IWF, where the report includes: an International Mobile Subscriber Identification Number (IMSI) of the terminal, and a monitoring event.
• IMSI International Mobile Subscriber Identification Number
• Step 206 The MTC IWF sends an information query request signaling to the HSS, where the terminal includes the IMSL.
• Step 207 The HSS sends the information query feedback signaling to the MTC IWF, where: the external identifier of the terminal, and the identifier or address of the MTC server.
• Step 208 The MTC IWF sends a monitoring event report to the MTC server according to the information in the information query feedback signaling, where the monitoring event report includes the external identifier of the terminal and the monitoring event.
• the operator when the terminal enters the network, the operator needs to monitor the terminal device and the Universal Integrated Circuit Card (UICC) to change the event service, and monitor whether the user illegally steals the UICC card. .
• UICC Universal Integrated Circuit Card
• the user of the terminal wants the network to send a warning and report it to the MTC server, so that the user of the terminal can view the relevant event warning information on the MTC server.
• Monitor event code or event description;
• Monitor event A terminal device and UICC card association change
• IMEI International Mobile Equipment Identity
• the monitoring event parameter is saved in the HSS as the contract data of the terminal, and the following parameters are also saved in the HSS:
• MTC Mobility Management Entity
• the specific process includes:
• Step 301 After the terminal is powered on, sending the attach request signaling to the MME, where the attach request signaling includes the internal identifier IMSI of the terminal in the mobile communication network;
• Step 302 After receiving the attach request signaling of the terminal, the MME reads the IMSI therein, and sends the IMSI to the HSS in the update location request signaling.
• Step 303 After receiving the update location request signaling sent by the MME, the HSS reads the
• the IMSI queries the local database according to the IMSI to obtain the subscription data of the terminal, which includes: monitoring the event parameter; the HSS sends the update location approval signaling to the MME, and includes the subscription data of the terminal in the update location approval signaling, and the subscription data of the terminal. Includes: Monitoring event parameters.
• the storage format is shown in the following table:
• the MME After receiving the subscription data, if the MTC subscription data includes the monitoring event parameter, the MME reads the parameter: the monitoring event code and the device number.
• the monitoring event code is set to monitor the event, indicating that it is necessary to monitor the event that the terminal device is associated with the UICC card.
• the behavior of the terminal is monitored according to this, that is, whether the monitoring terminal is associated with the UICC card is changed.
• Step 305 The MME sends control signaling to the terminal, requesting the terminal to report its own device number, that is, IMEI.
• Step 306 After receiving the control signaling of the MME, the terminal includes its own IMEI in the feedback signaling and sends the information to the MME.
• Step 307 After receiving the IMEI fed back by the terminal, the MME compares it with the device number in the subscription data. If the two are the same, it is considered that no monitoring event A is detected, and no subsequent operations are performed; if the two are different, Then, it is considered that the monitoring event A is detected, the MME generates an event report, and sends the event report to the MTC IWF.
• Step 308 After receiving the event report sent by the MME, the MTC IWF reads the content in the event report, and the IMSI is included in the information query signaling and sent to the HSS.
• Step 309 After receiving the information query signaling, the HSS reads the IMSI, and queries the local database according to the received IMSI to obtain the external identifier (ExID) of the terminal corresponding to the IMSI and the identifier or address of the MTC server (MTC— Server— A ), then send a message to query the feedback letter To the MTC IWF, the information contained in the information query signaling is shown in the following table:
• Step 310 After receiving the information query feedback signaling sent by the HSS, the MTC IWF reads the information therein.
• the identifier or address of the MTC server may be a serial number used to identify the MTC server, or may be an IP address of the MTC server. Based on the obtained serial number or IP address, the MTC IWF sends a monitoring event report to the corresponding MTC server.
• the monitoring event report contains the following information:
• the service contract with the operator needs to monitor the service of the terminal location change event, and is used to monitor whether someone illegally steals the terminal.
• the user of the terminal wants the network to send a warning and report it to the MTC server, so that the user of the terminal can view the relevant event warning information on the MTC server.
• monitoring event B The operator defines this event as monitoring event B and sets the corresponding monitoring event parameters as follows: Monitoring event code (or event description): Monitoring event B (terminal location change); Terminal location: Tracking area A
• Monitoring event code or event description
• Monitoring event B terminal location change
• Terminal location Tracking area A
• the monitoring event parameter is stored in the HSS as the subscription data of the terminal, and the following parameters are also saved in the HSS:
• MTC Mobility Management Entity
• the specific process includes:
• Step 401 After the terminal moves to the new cell, reads the tracking area information in the cell broadcast information, compares the tracking area information of the new cell with the locally saved tracking area information, and finds that the two do not match, and the terminal sends the tracking.
• the area update request signaling is sent to the new MME, and the tracking area update request signaling includes the temporary internal identifier (GUTI) of the original MME, and the identifier includes the identifier of the original MME.
• GUI temporary internal identifier
• Step 402 After receiving the tracking area update request signaling of the terminal, the MME reads the GUTI, obtains the identifier of the original MME, and sends data request signaling to the original MME. After the original MME receives the data request signaling, the MME sends the data request signaling. The IMSI is sent to the new MME, and the new MME sends the IMSI to the HSS in the update location request signaling.
• Step 403 After receiving the update location request signaling sent by the MME, the HSS reads the IMSI, and queries the local database according to the IMSI to obtain the subscription data of the terminal, where: the monitoring event parameter is included; the HSS sends the update location approval signaling to The MME includes the subscription data of the terminal in the update location approval signaling, and the subscription data of the terminal includes: a monitoring event parameter.
• the storage format is as shown in Table 1 above.
• the MME After receiving the subscription data, if the MTC subscription data includes the monitoring event parameters, the MME reads the parameters therein: the monitoring event code and the terminal location.
• the monitoring event code is set to monitor event B, indicating that the terminal location change event needs to be monitored, and the terminal location is tracking area A.
• each MME belongs to a fixed tracking area and will be its own
• the tracking area information of the genus is saved in the local database.
• the tracking area to which the new MME belongs is the tracking area B.
• Step 405 After reading the terminal location in the terminal subscription data, the MME compares the tracking area information saved by the local database with the terminal location information. If the two are the same, it is considered that no monitoring event B is detected, and no subsequent execution is performed. Operation; if the two are different, it is considered that the monitoring event B is detected, the MME generates an event report, and sends the event report to the MTC IWF.
• Step 406 After receiving the event report sent by the MME, the MTC IWF reads the content in the event report, and the IMSI is included in the information query signaling and sent to the HSS.
• Step 407 After receiving the information query signaling, the HSS reads the IMSI, and queries the local database according to the received IMSI to obtain the external identifier (ExID) of the terminal corresponding to the IMSI and the identifier or address of the MTC server (MTC— Server-A), then, sends information query feedback signaling to the MTC IWF, and the information contained in the information query signaling is as shown in Table 3 above.
• ExID external identifier
• MTC— Server-A MTC— Server-A
• Step 408 After receiving the information query feedback signaling sent by the HSS, the MTC IWF reads the information therein.
• the identifier or address of the MTC server may be a serial number used to identify the MTC server, or may be an IP address of the MTC server. Based on the obtained serial number or IP address, the MTC IWF sends a monitoring event report to the corresponding MTC server.
• the information contained in the monitoring event report is shown in the following table: Information element note
• Protocol identification information Used by the MTC server to identify the received signaling class, set here as "event report”
• the external ID of the terminal is set to ExID
• Monitoring event B Event occurrence location Set to tracking area B
• the present invention further provides a system for monitoring terminal behavior abnormalities, which mainly includes: a mobility management unit, an MTC IWF, and an HSS,
• the mobility management unit is configured to monitor the behavior of the terminal, and send an event report to the MTC IWF when detecting the occurrence of the monitoring event;
• the MTC IWF is configured to send an information query request signaling to the HSS, and receive the information query feedback signaling returned by the HSS; send a monitoring event report according to the information in the information query feedback signaling.
• the HSS is configured to return the information query feedback signaling to the MTC IWFo after receiving the information query request signaling from the MTC IWF.
• the mobility management unit is further configured to acquire the subscription data of the terminal from the HSS or the HLR, where the subscription data includes a monitoring event parameter, and is further configured to monitor the behavior of the terminal according to the acquired monitoring event parameter.
• the acquiring the subscription data of the terminal from the HSS or the HLR is specifically: after receiving the attach request signaling or the tracking area update request signaling from the terminal, the mobility management unit sends the update location request signaling to the HSS or the HLR, and receives the The update location approval signaling sent by the HSS or the HLR includes the subscription data of the terminal in the update location approval signaling.
• the event report sent by the mobility management unit includes the IMSI and the monitoring event of the terminal;
• the information query request signaling sent by the MTC IWF includes the IMSI of the terminal;
• the information in the information query feedback signaling sent by the HSS includes: an external identifier of the terminal, and The ID or address of the MTC server;
• the monitoring event report sent by the MTC IWF includes the external identifier of the terminal and the monitoring event.
• the monitoring event is: the monitoring terminal is associated with the universal integrated circuit card UICC, and correspondingly, the mobility management unit monitors the behavior of the terminal according to the acquired monitoring event parameter, specifically:
• the mobility management unit sends control signaling to the terminal, and the requesting terminal reports the device number; the mobility management unit receives the device number sent by the terminal through the feedback signaling;
• the mobility management unit compares the device number in the feedback signaling with the device number in the subscription data of the terminal. If the two are the same, it is determined that no monitoring event is detected; if the two are different, it is determined that the monitoring event is detected. .
• the monitoring event is: monitoring the location change of the terminal, and correspondingly, the mobility management unit monitors the behavior of the terminal according to the acquired monitoring event parameter, specifically:
• the mobility management unit reads the terminal location in the subscription data of the terminal, and compares the terminal location in the subscription data with the tracking area information saved in the local database. If the two are the same, it is determined that no monitoring event occurs; If it is different, it is judged that a monitoring event is detected.

Landscapes

• Engineering & Computer Science (AREA)
• Databases & Information Systems (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=49004960

Family Applications (1)

Country Status (2)

Cited By (1)

Families Citing this family (3)

Citations (4)

Family Cites Families (2)

• 2012
  • 2012-02-24 CN CN2012100443941A patent/CN103297946A/zh active Pending
  • 2012-04-24 WO PCT/CN2012/074591 patent/WO2013123716A1/fr not_active Ceased

Patent Citations (4)

Also Published As

Similar Documents

Legal Events