Method and Apparatus for Detecting Man-In-The-Middle Attack

A method for detecting a man-in-the-middle attack, comprising:

• sending, by a secondary evolved Node B (SeNB), a first check request message to a macro evolved Node B (MeNB), wherein the first check request message comprises first identifier information of an evolved random access bearer (ERAB) and a first data packet count value corresponding to the first identifier information, and wherein the first check request message is used to enable the MeNB to generate a second check request message according to the first identifier information, and send the second check request message to a user terminal;
• receiving, by the SeNB, a check response message sent by the MeNB;
• determining, by the SeNB according to second indication information, that no man-in-the-middle attack exists between the SeNB and the user terminal when the check response message is a second check response message and the second check response message comprises the second indication information;
• determining, by the SeNB according to third indication information, that the man-in-the-middle attack exists between the SeNB and the user terminal when the check response message is a third check response message and the third check response message comprises the third indication information;
• and
• taking a preset measure for processing when the check response message is the third check response message and the third check response message comprises the third indication information.

A method for detecting a man-in-the-middle attack, comprising:

• receiving, by a user terminal, a second check request message sent by a macro evolved Node B (MeNB), wherein the second check request message comprises second identifier information corresponding to first identifier information of an evolved random access bearer (ERAB), and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB;
• obtaining, by the user terminal, a second data packet count value corresponding to the second identifier information;
• and
• sending, by the user terminal, the second identifier information and the second data packet count value corresponding to the second identifier information to the MeNB such that the MeNB determines, according to a first data packet count value and the second data packet count value, whether the man-in-the-middle attack exists.

A method for detecting a man-in-the-middle attack, comprising:

• receiving, by a macro evolved Node B (MeNB), a first check request message sent by a secondary evolved Node B (SeNB), wherein the first check request message comprises first identifier information of an evolved random access bearer (ERAB) and a first data packet count value corresponding to the first identifier information;
• generating, by the MeNB, a second check request message according to the first identifier information and the first data packet count value corresponding to the first identifier information;
• sending the second check request message to a user terminal, wherein the second check request message comprises first indication information, wherein the first indication information is used to instruct the user terminal to obtain second identifier information that matches the first identifier information, and a second data packet count value corresponding to the second identifier information, and determine by comparison whether the first data packet count value corresponding to the first identifier information is the same as the second data packet count value corresponding to the second identifier information, and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB;
• receiving, by the MeNB, a check response message generated by the user terminal according to the second check request message;
• and
• sending the check response message to the SeNB such that the SeNB performs processing according to the check response message.

A method for detecting a man-in-the-middle attack, comprising:

• sending, by a secondary evolved Node B (SeNB), a first check request message to a macro evolved Node B (MeNB), wherein the first check request message comprises first indication information, and wherein the first indication information is used to instruct the MeNB to send a second check request message to a user terminal;
• receiving, by the SeNB, a check response message sent by the MeNB;
• determining, by the SeNB according to the check response message, whether the man-in-the-middle attack exists;
• taking, by the SeNB, a preset measure for processing when the man-in-the-middle attack exists;
• and
• sending an exception report to the MeNB when the man-in-the-middle attack exists.

A method for detecting a man-in-the-middle attack, comprising:

• receiving, by a user terminal, a second check request message sent by a macro evolved Node B (MeNB), wherein the second check request message comprises second identifier information corresponding to first identifier information of an evolved random access bearer (ERAB), and a first data packet count value corresponding to the first identifier information, and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB;
• obtaining, by the user terminal, the second identifier information corresponding to the first identifier information, and a second data packet count value corresponding to the second identifier information;
• determining, by the user terminal according to the first data packet count value corresponding to the first identifier information, and the second data packet count value corresponding to the second identifier information, whether the man-in-the-middle attack exists between a secondary evolved Node B (SeNB) and the user terminal;
• generating, by the user terminal, a check response message according to a result of the determining;
• and
• sending the check response message to the MeNB.

A method for detecting a man-in-the-middle attack, comprising:

• receiving, by a macro evolved Node B (MeNB), a first check request message sent by a secondary evolved Node B (SeNB);
• generating, by the MeNB, a second check request message according to the first check request message;
• sending the second check request message to a user terminal, wherein the second check request message comprises first indication information, and wherein the first indication information is used to instruct the user terminal to obtain first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information;
• receiving, by the MeNB, a check response message generated by the user terminal according to the second check request message;
• and
• sending the check response message to the SeNB, wherein the check response message comprises the first identifier information and the first data packet count value corresponding to the first identifier information such that the SeNB determines, according to the first data packet count value, whether the man-in-the-middle attack exists.

A method for detecting a man-in-the-middle attack, comprising:

• sending, by a secondary evolved Node B (SeNB), a first check request message to a macro evolved Node B (MeNB), wherein the first check request message is used to enable the MeNB to generate a second check request message according to the first check request message, and send the second check request message to a user terminal;
• receiving, by the SeNB, a check response message sent by the MeNB, wherein the check response message comprises first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information;
• obtaining, by the SeNB according to the first identifier information, second identifier information that matches the first identifier information, and a second data packet count value corresponding to the second identifier information, wherein the second identifier information is an evolved random access bearer (ERAB) corresponding to the DRB;
• determining, by the SeNB according to the first data packet count value and the second data packet count value, whether the man-in-the-middle attack exists;
• taking, by the SeNB, a preset measure for processing when the man-in-the-middle attack exists:
• and sending an exception report to the MeNB when the man-in-the-middle attack exists.

A method for detecting a man-in-the-middle attack, comprising:

• receiving, by a user terminal, a second check request message sent by a macro evolved Node B (MeNB);
• obtaining, by the user terminal according to the second check request message, first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information;
• and
• sending, by the user terminal, a check response message to the MeNB, wherein the check response message comprises the first identifier information and the first data packet count value corresponding to the first identifier information such that the MeNB sends the check response message to a secondary evolved Node B (SeNB), and wherein the SeNB determines, according to the first data packet count value, whether the man-in-the-middle attack exists between the SeNB and the user terminal.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a first check request message sent by a secondary evolved Node B (SeNB), wherein the first check request message comprises first identifier information of an evolved random access bearer (ERAB) and a first data packet count value corresponding to the first identifier information;
• a transmitter coupled to the receiver and configured to:
• generate a second check request message according to the first identifier information;
• and
• send the second check request message to a user terminal, wherein the second check request message comprises first indication information, wherein the first indication information is used to instruct the user terminal to obtain second identifier information that matches the first identifier information, and a second data packet count value corresponding to the second identifier information, and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB,
• wherein the receiver is further configured to receive a first check response message generated by the user terminal according to the second check request message, wherein the first check response message comprises the second identifier information and the second data packet count value;
• and
• a processor coupled to the receiver and the transmitter and configured to:
• determine that no man-in-the-middle attack exists between the SeNB and the user terminal when the first data packet count value corresponding to the first identifier information is the same as the second data packet count value corresponding to the second identifier information;
• and
• determine that the man-in-the-middle attack exists between the SeNB and the user terminal when the first data packet count value corresponding to the first identifier information is different from the second data packet count value corresponding to the second identifier information.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a transmitter configured to send a first check request message to a macro evolved Node B (MeNB), wherein the first check request message comprises first identifier information of an evolved random access bearer (ERAB) and a first data packet count value corresponding to the first identifier information, and wherein the first check request message is used to enable the MeNB to generate a second check request message according to the first identifier information, and send the second check request message to a user terminal;
• a receiver coupled to the transmitter and configured to receive a check response message sent by the MeNB;
• and
• a processor coupled to the receiver and the transmitter and configured to:
• determine, according to second indication information, that no man-in-the-middle attack exists between the apparatus and the user terminal when the check response message is a second check response message and the second check response message comprises the second indication information;
• determine, according to third indication information, that the man-in-the-middle attack exists between the apparatus and the user terminal when the check response message is a third check response message and the third check response message comprises the third indication information;
• and
• take a preset measure for processing when the check response message is the third check response message and the third check response message comprises the third indication information.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a second check request message sent by a macro evolved Node B (MeNB), wherein the second check request message comprises second identifier information corresponding to first identifier information of an evolved random access bearer (ERAB), and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB;
• a processor coupled to the receiver and configured to obtain the second identifier information corresponding to the first identifier information, and a second data packet count value corresponding to the second identifier information;
• and
• a transmitter coupled to the processor and configured to send the second identifier information and the second data packet count value corresponding to the second identifier information to the MeNB such that the MeNB determines, according to a first data packet count value and the second data packet count value, whether the man-in-the-middle attack exists.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a first check request message sent by a secondary evolved Node B (SeNB), wherein the first check request message comprises first identifier information of an evolved random access bearer (ERAB) and a first data packet count value corresponding to the first identifier information;
• and
• a transmitter coupled to the receiver and configured to:
• generate a second check request message according to the first identifier information and the first data packet count value corresponding to the first identifier information;
• and
• send the second check request message to a user terminal, wherein the second check request message comprises first indication information, wherein the first indication information is used to instruct the user terminal to obtain second identifier information that matches the first identifier information, and a second data packet count value corresponding to the second identifier information, and determine by comparison whether the first data packet count value corresponding to the first identifier information is the same as the second data packet count value corresponding to the second identifier information, and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB, and
• wherein the receiver is further configured to:
• receive a check response message generated by the user terminal according to the second check request message;
• and
• send the check response message to the SeNB such that the SeNB performs processing according to the response message.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a transmitter configured to send a first check request message to a macro evolved Node B MeNB, wherein the first check request message comprises first indication information, and wherein the first indication information is used to instruct the MeNB to send a second check request message to a user terminal;
• a receiver coupled to the transmitter and configured to receive a check response message sent by the MeNB;
• a processor coupled to the receiver and the transmitter and configured to determine, according to the check response message, whether the man-in-the-middle attack exists, and
• wherein the transmitter is further configured to:
• take a preset measure for processing when the processor determines that the man-in-the-middle attack exists;
• and
• send an exception report to the MeNB when the processor determines that the man-in-the-middle attack exists.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a second check request message sent by a macro evolved Node B (MeNB), wherein the second check request message comprises second identifier information corresponding to first identifier information of an evolved random access bearer (ERAB), and a first data packet count value corresponding to the first identifier information, and wherein the second identifier information is a data radio bearer (DRB) corresponding to the ERAB;
• a processor coupled to the receiver and configured to:
• obtain the second identifier information corresponding to the first identifier information, and a second data packet count value corresponding to the second identifier information;
• and
• determine, according to the first data packet count value corresponding to the first identifier information, and the second data packet count value corresponding to the second identifier information, whether the man-in-the-middle attack exists between a secondary evolved Node B (SeNB) and the apparatus;
• and
• a transmitter coupled to the processor and configured to:
• generate a check response message according to a result determined by the processor;
• and
• send the check response message to the MeNB.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a first check request message sent by a secondary evolved Node B (SeNB);
• and
• a transmitter coupled to the receiver and configured to:
• generate a second check request message according to the first check request message;
• and
• send the second check request message to a user terminal, wherein the second check request message comprises first indication information, and wherein the first indication information is used to instruct the user terminal to obtain first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information,
• wherein the receiver is further configured to:
• receive a check response message generated by the user terminal according to the second check request message;
• and
• send the check response message to the SeNB, wherein the check response message comprises the first identifier information and the first data packet count value corresponding to the first identifier information such that the SeNB determines, according to the first data packet count value, whether the man-in-the-middle attack exists.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a transmitter configured to:
• send a first check request message to a macro evolved Node B (MeNB), wherein the first check request message is used to enable the MeNB to generate a second check request message according to the first check request message;
• and
• send the second check request message to a user terminal;
• a receiver coupled to the transmitter and configured to receive a check response message sent by the MeNB, wherein the check response message comprises first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information;
• a processor coupled to the receiver and the transmitter and configured to:
• obtain, according to the first identifier information, second identifier information that matches the first identifier information, and a second data packet count value corresponding to the second identifier information, wherein the second identifier information is an evolved random access bearer (ERAB) corresponding to the DRB;
• and
• determine, according to the first data packet count value and the second data packet count value, whether the man-in-the-middle attack exists, and wherein the transmitter is further configured to:
• take a preset measure for processing when the processor determines that the man-in-the-middle attack exists;
• and
• send an exception report to the MeNB when the processor determines that the man-in-the-middle attack exists.

An apparatus for detecting a man-in-the-middle attack, comprising:

• a receiver configured to receive a second check request message sent by a macro evolved Node B (MeNB);
• a processor coupled to the receiver and configured to obtain, according to the second check request message, first identifier information of a data radio bearer (DRB) and a first data packet count value corresponding to the first identifier information;
• and
• a transmitter coupled to the processor and configured to send a check response message to the MeNB, wherein the check response message comprises the first identifier information and the first data packet count value corresponding to the first identifier information such that the MeNB sends the check response message to a secondary evolved Node B (SeNB), and wherein the SeNB determines, according to the first data packet count value, whether the man-in-the-middle attack exists between the SeNB and the apparatus.