Methods, systems, and computer readable media for conducting a time distance security countermeasure for outbound roaming subscribers using diameter edge agent

A system for conducting a time distance security countermeasure for outbound roaming subscribers using a Diameter edge agent (DEA), the system comprising:

• a Diameter edge agent (DEA) including at least one processor;
• a transit time database local to the DEA for storing minimum transit times related to a pair of countries;
• and a security engine local to the DEA and implemented using the at least one processor for receiving an ingress Diameter message related to a mobile subscriber from a mobility management entity (MME) located in a non-home network, wherein the ingress Diameter message is an authentication information request (AIR) message or a Diameter update location request (ULR) message, sending a routing information request (RIR) message containing a mobile subscriber identifier associated with the mobile subscriber to a home subscriber server (HSS) in a home network of the mobile subscriber, receiving identification information identifying a mobility management entity (MME) in the home network that conducted a most recent attachment of the mobile subscriber in the home network, utilizing the identification information to send an insert subscriber data request (IDR) message containing the mobile subscriber identifier to the identified MME, receiving, from the MME, an insert subscriber data acknowledgement (IDA) message containing user equipment (UE) attachment timestamp data corresponding to the most recent attachment of the mobile subscriber in the home network, determining a transit time of the user equipment using the UE attachment timestamp data and timestamp information corresponding to the ingress Diameter message, and analyzing the transit time of the user equipment to determine if the ingress Diameter message is to be designated as a suspicious ingress message, wherein analyzing the transit time includes comparing the transit time of the user equipment to a predefined minimum transit time between two countries;
• wherein the transit time is determined to be equal to a calculated time difference existing between the timestamp information corresponding to the ingress Diameter message and the UE attachment timestamp data corresponding to the most recent attachment;
• and wherein the security engine is further configured for comparing the calculated time difference to a predefined minimum transit value stored in the transit time database and for determining that the predefined minimum transit value exceeds the transit time.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:

• receiving, by a DEA, an ingress Diameter message related to a mobile subscriber from a mobility management entity (MME) located in a non-home network, wherein the ingress Diameter message is an authentication information request (AIR) message or a Diameter update location request (ULR) message;
• sending a routing information request (RIR) message containing a mobile subscriber identifier associated with the mobile subscriber to a home subscriber server (HSS) in a home network of the mobile subscriber;
• receiving identification information identifying a mobility management entity (MME) in the home network that conducted a most recent attachment of the mobile subscriber in the home network;
• utilizing the identification information to send an insert subscriber data request (IDR) message containing the mobile subscriber identifier to the identified MME;
• receiving, from the MME, an insert subscriber data acknowledgement (IDA) message containing user equipment (UE) attachment timestamp data corresponding to the most recent attachment of the mobile subscriber in the home network;
• determining, by the DEA, a transit time of the user equipment using the UE attachment timestamp data and timestamp information corresponding to the ingress Diameter message;
• and analyzing, by the DEA, the transit time of the user equipment to determine if the ingress Diameter message is to be designated as a suspicious ingress message, wherein analyzing the transit time includes comparing the transit time of the user equipment to a predefined minimum transit time between two countries;
• wherein the transit time is determined to be equal to a calculated time difference existing between the timestamp information corresponding to the ingress Diameter message and the UE attachment timestamp data corresponding to the most recent attachment;
• and wherein analyzing the transit time includes comparing the calculated time difference to a predefined minimum transit value stored in a transit time database hosted by the DEA and determining that the predefined minimum transit value exceeds the transit time.