The subject matter disclosed herein relates, in general, to electronic devices, and in particular, to an apparatus, system, and method for filtering over-the-air payloads in a mobile network modem.
Wireless devices with mobile network access (e.g., access to one or more of Global System for Mobile Communications “GSM” network, Code Division Multiple Access “CDMA” network, Universal Mobile Telecommunications System “UMTS” network, CDMA2000 network, or Long-Term Evolution “LTE” network, and the like) are susceptible to attacks against over-the-air (OTA) protocol stacks. Malicious OTA payloads, if received and processed by a mobile network modem, may exploit vulnerabilities in the OTA protocol stacks (a protocol stack may be a GSM protocol stack, a CDMA protocol stack, a UMTS protocol stack, a CDMA2000 protocol stack, an LTE protocol stack, etc.) and therefore may cause behaviors in the mobile network modem or in the wireless device that comprises the mobile network modem that are unwanted by the legitimate operator/user. Known mobile network modems may provide implementation of a full OTA protocol stack and may be capable of parsing incoming OTA payloads and may split them into payloads at the different layers of the protocol stack.
However, due to different interpretations and implementations of mobile network standards, it is also possible that OTA payloads without any malicious intent cause instability and/or prevent normal functioning in the mobile network modem and/or the wireless device that comprises the mobile network modem.
An aspect of the disclosure is related to a method for installing one or more filtering rules, comprising: receiving the filtering rules; and installing the filtering rules into a mobile network modem, in which each filtering rule may be associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload.
Another aspect of the disclosure is related to a device, comprising: a mobile network modem; a memory; and a processor coupled to the memory, the processor to: receive one or more filtering rules, and install the filtering rules into the mobile network modem, in which each filtering rule may be associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload.
Yet another aspect of the disclosure is related to an apparatus for installing one or more filtering rules, comprising: means for receiving the filtering rules; and means for installing the filtering rules into a mobile network modem, in which each filtering rule may be associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload.
Still another aspect of the disclosure is related to a non-transitory computer-readable medium comprising code which, when executed by a processor, causes the processor to perform a method comprising: receiving one or more filtering rules; and installing the filtering rules into a mobile network modem, in which each filtering rule may be associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload.
Aspects of the disclosure are disclosed in the following description and related drawings directed to specific embodiments of the disclosure. Alternate embodiments may be devised without departing from the scope of the disclosure. Additionally, well known elements of the disclosure may not be described in detail or may be omitted so as not to obscure the relevant details of the disclosure.
The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments. Likewise, the term “embodiments” does not require that all embodiments include the discussed feature, advantage or mode of operation.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of embodiments of the disclosure. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “includes” and/or “including”, when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
Further, many embodiments are described in terms of sequences of actions to be performed by, for example, elements of a computing device (e.g., a server or device). It will be recognized that various actions described herein can be performed by specific circuits (e.g., application specific integrated circuits), by program instructions being executed by one or more processors, or by a combination of both. Additionally, these sequences of actions described herein can be considered to be embodied entirely within any form of computer readable storage medium having stored therein a corresponding set of computer instructions that upon execution would cause an associated processor to perform the functionality described herein. Thus, the various aspects of the disclosure may be embodied in a number of different forms, all of which have been contemplated to be within the scope of the claimed subject matter. In addition, for each of the embodiments described herein, the corresponding form of any such embodiments may be described herein as, for example, “logic configured to” perform the described action.
The device (e.g., device 100) can include sensors such as ambient light sensor (ALS) 135, accelerometer 140, gyroscope 145, magnetometer 150, temperature sensor 151, barometric pressure sensor 155, red-green-blue (RGB) color sensor 152, ultra-violet (UV) sensor 153, UV-A sensor, UV-B sensor, compass, proximity sensor 167, near field communication (NFC) 169, and/or Global Positioning System (GPS) sensor 160. In some embodiments, multiple cameras are integrated or accessible to the device. For example, a mobile device may have at least a front and rear mounted camera. In some embodiments, other sensors may also have multiple installations or versions.
Memory 105 may be coupled to processor 101 to store instructions for execution by processor 101. In some embodiments, memory 105 is non-transitory. Memory 105 may also store one or more models or modules to implement embodiments described below. Memory 105 may also store data from integrated or external sensors.
Network interface 110 may also be coupled to a number of wireless subsystems 115 (e.g., Bluetooth 166, Wi-Fi 111, Cellular 161, or other networks) to transmit and receive data streams through a wireless link to/from a wireless network, or may be a wired interface for direct connection to networks (e.g., the Internet, Ethernet, or other wired or wireless systems). The mobile device may include one or more local area network transceivers connected to one or more antennas. The local area network transceiver comprises suitable devices, hardware, and/or software for communicating with and/or detecting signals to/from wireless APs, and/or directly with other wireless devices within a network. In one aspect, the local area network transceiver may comprise a Wi-Fi (802.11x) communication system suitable for communicating with one or more wireless access points.
The device 100 may also include one or more wide area network transceiver(s) that may be connected to one or more antennas. The wide area network transceiver comprises suitable devices, hardware, and/or software for communicating with and/or detecting signals to/from other wireless devices within a network. In one aspect, the wide area network transceiver may comprise a CDMA communication system suitable for communicating with a CDMA network of wireless base stations; however, in other aspects, the wireless communication system may comprise another type of cellular telephony network or femtocells, such as, for example, TDMA, LTE, LTE Advanced, WCDMA, UMTS, 4G, 5G, or GSM. Additionally, any other type of wireless networking technologies may be used, for example, WiMAX (802.16), Ultra-Wide Band, ZigBee, wireless USB, etc.
Thus, device 100 may be a: mobile device, wireless device, cell phone, personal digital assistant, mobile computer, wearable device (e.g., head mounted display, virtual reality glasses, etc.), robot navigation system, tablet, personal computer, laptop computer, or any type of device that has processing capabilities. As used herein, a mobile device may be any portable, or movable device or machine that is configurable to acquire wireless signals transmitted from, and transmit wireless signals to, one or more wireless communication devices or networks. Thus, by way of example but not limitation, the device 100 may include a radio device, a cellular telephone device, a computing device, a personal communication system device, or other like movable wireless communication equipped device, appliance, or machine. Any operable combination of the above are also considered a “mobile device.”
The mobile device may communicate wirelessly with a plurality of wireless APs using RF signals (e.g., 2.4 GHz, 3.6 GHz, and 4.9/5.0 GHz bands) and standardized protocols for the modulation of the RF signals and the exchanging of information packets (e.g., IEEE 802.11x).
It should be appreciated that embodiments of the disclosure as will be hereinafter described may be implemented through the execution of instructions, for example as stored in the memory 105 or other element, by processor 101 of device and/or other circuitry of device and/or other devices. Particularly, circuitry of device, including but not limited to processor 101, may operate under the control of a program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the disclosure. For example, such a program may be implemented in firmware or software (e.g. stored in memory 105 and/or other locations) and may be implemented by processors, such as processor 101, and/or other circuitry of device. Further, it should be appreciated that the terms processor, microprocessor, circuitry, controller, etc., may refer to any type of logic or circuitry capable of executing logic, commands, instructions, software, firmware, functionality and the like.
Further, it should be appreciated that some or all of the functions, engines or modules described herein may be performed by device itself and/or some or all of the functions, engines or modules described herein may be performed by another system connected through I/O controller 125 or network interface 110 (wirelessly or wired) to device. Thus, some and/or all of the functions may be performed by another system and the results or intermediate calculations may be transferred back to device. In some embodiments, such other device may comprise a server configured to process information in real time or near real time. In some embodiments, the other device is configured to predetermine the results, for example based on a known configuration of the device. Further, one or more of the elements illustrated in
Embodiments of the invention relate to installing filtering rules in a mobile network modem, in which each filtering rule may be associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload. Further, embodiments relate to matching incoming OTA payloads against the filtering rules, and discarding the payloads based on the filtering rules without updating or changing the firmware of the mobile network modem. In one embodiment, the filtering rules may be layer-specific. In other words, each filtering rule may be associated with a specific layer among the different layers of the protocol stack. And hooks may be added to the protocol stack to gain access to payloads at each layer of the protocol stack.
Therefore, at each layer, payloads for the layer may be matched against filtering rules associated with the layer, if any. In one embodiment, a Berkeley Packet Filter may be utilized to find the matching payloads according to the filtering rules. A payload for the layer may be discarded if one of the filtering rules associated with the layer indicates that the payload should be discarded. A discarded payload may be removed from any further processing.
In one embodiment, the filtering rules may be removed (flushed) from the mobile network modem, so that if an incorrectly-constructed filtering rule prevents the normal functioning of the mobile network modem, its effect can be quickly reversed.
In one embodiment, the filtering rules may be compiled into a binary ruleset file, either by a service provider or a device manufacturer. The ruleset file may be digitally signed by its author to ensure its trustworthiness. The ruleset file may be transferred to the wireless device, wirelessly or otherwise, and may be installed into the mobile network modem by the wireless device. The installation of the filtering rules may be achieved through, e.g., a Mobile Station Modem “MSM” Interface (MI). The installed filtering rules may be stored in a permanent storage, such as, a secure file system (SFS) within the mobile network modem. It should be appreciated that the rules may be stored in a permanent storage that does not necessarily need to be secure and may be in a MPSS or APSS, as will be described.
Referring to
Therefore, in one embodiment, the APSS 210, running the HLOS, may receive a binary ruleset file comprising filtering rules from either a service provider or a device manufacturer. The APSS 210 may then install the filtering rules into the MPSS 220 using the MI. The filtering rules may be installed into the MPSS 220 without changing or updating the firmware of the MPSS 220.
The filtering rules may be layer-specific. In other words, each filtering rule may be associated with a specific layer among the different layers of the protocol stack. Once the filtering rules are installed, the MPSS 220 may match payloads at each layer against filtering rules associated with the layer, if any. Within the MPSS 220, hooks may be added to the protocol stack to gain access to payloads at each layer of the protocol stack that is associated with at least one filtering rule. Therefore, payloads at one or more layers of the protocol stack may be accessed through the use of hooks. Any method for matching the payloads against filtering rules may be utilized. In one embodiment, a Berkeley Packet Filter may be utilized by the MPSS 220 to find the matching payloads according to the filtering rules. The MPSS 220 may discard a payload for the layer if one of the filtering rules associated with the layer indicates that the payload should be discarded. A discarded payload is removed from any further processing by the MPSS 220.
In one embodiment, the APSS 210 may, e.g., in response to a user input, remove (flush) the filtering rules that have been installed in the MPSS 220, so that if an incorrectly-constructed filtering rule prevents the normal functioning of the MPSS 220, its effect can be quickly reversed. It should be appreciated that removing the filtering rules may be equivalent to installing an empty ruleset.
Referring to
According to embodiments of the disclosure, the OTA protocol stack may refer to the protocol stack within the control plane of the Layer 2 and the Layer 3 of a protocol architecture. Therefore, taking the LTE protocol stack illustrated in
Referring to
Referring to
The filtering rules may be layer-specific. In other words, each filtering rule may be associated with a specific layer among the different layers of the protocol stack. Further, each filtering rule may specify a type of payload and a condition for the type of payload.
Referring to
One embodiment of the disclosure is related to a device comprising a mobile network modem, a memory, and a processor coupled to the memory, the processor to: receive one or more filtering rules, and installing filtering rules into the mobile network modem, wherein each filtering rule is associated with a layer of an over-the-air (OTA) protocol stack and specifies a type of payload and one or more conditions for the payload.
Therefore, by utilizing the embodiments of the disclosure described herein, filtering rules may be installed into a mobile network modem, and malicious or otherwise problematic OTA payloads may be found and discarded based on the filtering rules. Using layer-specific rules reduces the complexity of the rules and the required processing resources, and keeps the overhead to a minimum for layers that do not have any associated rules. The rules may be easily removed in the event an incorrectly-constructed rule prevents the normal functioning of the mobile network modem.
It should be appreciated that aspects of the disclosure previously described may be implemented in conjunction with the execution of instructions (e.g., applications) by processor 101 of device 100, as previously described. Particularly, circuitry of the device, including but not limited to processor, may operate under the control of an application, program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the disclosure (e.g., the processes of
Methods described herein may be implemented in conjunction with various wireless communication networks such as a wireless wide area network (WWAN), a wireless local area network (WLAN), a wireless personal area network (WPAN), and so on. The term “network” and “system” are often used interchangeably. A WWAN may be a Code Division Multiple Access (CDMA) network, a Time Division Multiple Access (TDMA) network, a Frequency Division Multiple Access (FDMA) network, an Orthogonal Frequency Division Multiple Access (OFDMA) network, a Single-Carrier Frequency Division Multiple Access (SC-FDMA) network, and so on. A CDMA network may implement one or more radio access technologies (RATs) such as cdma2000, Wideband-CDMA (W-CDMA), and so on. Cdma2000 includes IS-95, IS-2000, and IS-856 standards. A TDMA network may implement Global System for Mobile Communications (GSM), Digital Advanced Mobile Phone System (D-AMPS), or some other RAT. GSM and W-CDMA are described in documents from a consortium named “3rd Generation Partnership Project” (3GPP). Cdma2000 is described in documents from a consortium named “3rd Generation Partnership Project 2” (3GPP2). 3GPP and 3GPP2 documents are publicly available. A WLAN may be an IEEE 802.11x network, and a WPAN may be a Bluetooth network, an IEEE 802.15x, or some other type of network. The techniques may also be implemented in conjunction with any combination of WWAN, WLAN and/or WPAN.
Example methods, apparatuses, or articles of manufacture presented herein may be implemented, in whole or in part, for use in or with mobile communication devices. As used herein, “mobile device,” “mobile communication device,” “hand-held device,” “tablets,” etc., or the plural form of such terms may be used interchangeably and may refer to any kind of special purpose computing platform or device that may communicate through wireless transmission or receipt of information over suitable communications networks according to one or more communication protocols, and that may from time to time have a position or location that changes. As a way of illustration, special purpose mobile communication devices, may include, for example, cellular telephones, satellite telephones, smart telephones, heat map or radio map generation tools or devices, observed signal parameter generation tools or devices, personal digital assistants (PDAs), laptop computers, personal entertainment systems, e-book readers, tablet personal computers (PC), personal audio or video devices, personal navigation units, or the like. It should be appreciated, however, that these are merely illustrative examples relating to mobile devices that may be utilized to facilitate or support one or more processes or operations described herein.
The methodologies described herein may be implemented in different ways and with different configurations depending upon the particular application. For example, such methodologies may be implemented in hardware, firmware, and/or combinations thereof, along with software. In a hardware implementation, for example, a processing unit may be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, electronic devices, other devices units designed to perform the functions described herein, and/or combinations thereof.
The herein described storage media may comprise primary, secondary, and/or tertiary storage media. Primary storage media may include memory such as random access memory and/or read-only memory, for example. Secondary storage media may include mass storage such as a magnetic or solid state hard drive. Tertiary storage media may include removable storage media such as a magnetic or optical disk, a magnetic tape, a solid state storage device, etc. In certain implementations, the storage media or portions thereof may be operatively receptive of, or otherwise configurable to couple to, other components of a computing platform, such as a processor.
In at least some implementations, one or more portions of the herein described storage media may store signals representative of data and/or information as expressed by a particular state of the storage media. For example, an electronic signal representative of data and/or information may be “stored” in a portion of the storage media (e.g., memory) by affecting or changing the state of such portions of the storage media to represent data and/or information as binary information (e.g., ones and zeroes). As such, in a particular implementation, such a change of state of the portion of the storage media to store a signal representative of data and/or information constitutes a transformation of storage media to a different state or thing.
In the preceding detailed description, numerous specific details have been set forth to provide a thorough understanding of claimed subject matter. However, it will be understood by those skilled in the art that claimed subject matter may be practiced without these specific details. In other instances, methods and apparatuses that would be known by one of ordinary skill have not been described in detail so as not to obscure claimed subject matter.
Some portions of the preceding detailed description have been presented in terms of algorithms or symbolic representations of operations on binary digital electronic signals stored within a memory of a specific apparatus or special purpose computing device or platform. In the context of this particular specification, the term specific apparatus or the like includes a general purpose computer once it is programmed to perform particular functions pursuant to instructions from program software. Algorithmic descriptions or symbolic representations are examples of techniques used by those of ordinary skill in the signal processing or related arts to convey the substance of their work to others skilled in the art. An algorithm here, and generally, is considered to be a self-consistent sequence of operations or similar signal processing leading to a desired result. In this context, operations or processing involve physical manipulation of physical quantities. Typically, although not necessarily, such quantities may take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared or otherwise manipulated as electronic signals representing information. It has proven convenient at times, principally for reasons of common usage, to refer to such signals as bits, data, values, elements, symbols, characters, terms, numbers, numerals, information, or the like. It should be understood, however, that all of these or similar terms are to be associated with appropriate physical quantities and are merely convenient labels.
Unless specifically stated otherwise, as apparent from the following discussion, it is appreciated that throughout this specification discussions utilizing terms such as “processing,” “computing,” “calculating,”, “identifying”, “determining”, “establishing”, “obtaining”, and/or the like refer to actions or processes of a specific apparatus, such as a special purpose computer or a similar special purpose electronic computing device. In the context of this specification, therefore, a special purpose computer or a similar special purpose electronic computing device is capable of manipulating or transforming signals, typically represented as physical electronic or magnetic quantities within memories, registers, or other information storage devices, transmission devices, or display devices of the special purpose computer or similar special purpose electronic computing device. In the context of this particular patent application, the term “specific apparatus” may include a general purpose computer once it is programmed to perform particular functions pursuant to instructions from program software.
Reference throughout this specification to “one example”, “an example”, “certain examples”, or “exemplary implementation” means that a particular feature, structure, or characteristic described in connection with the feature and/or example may be included in at least one feature and/or example of claimed subject matter. Thus, the appearances of the phrase “in one example”, “an example”, “in certain examples” or “in some implementations” or other like phrases in various places throughout this specification are not necessarily all referring to the same feature, example, and/or limitation. Furthermore, the particular features, structures, or characteristics may be combined in one or more examples and/or features.
While there has been illustrated and described what are presently considered to be example features, it will be understood by those skilled in the art that various other modifications may be made, and equivalents may be substituted, without departing from claimed subject matter. Additionally, many modifications may be made to adapt a particular situation to the teachings of claimed subject matter without departing from the central concept described herein. Therefore, it is intended that claimed subject matter not be limited to the particular examples disclosed, but that such claimed subject matter may also include all aspects falling within the scope of appended claims, and equivalents thereof.