Roaming interface signaling security for LTE networks

A consistent effort has been made to provide fast, secure and uninterrupted mobile connectivity around the world. Mobile network operators use the private Interconnection network (IPX) to communicate with each other and with other service providers for international roaming and a large range of services. In LTE/4G, many core network nodes are involved in the communication and connection set-up for the subscriber in roaming scenarios. Currently, Diameter based protocols and the S9 interface are rolled out on the IPX network. We analyze the roaming interface (S9) in the LTE networks which is used for communicating charging, service control and QoS control signaling messages. This research explores Diameter Protocol features for the charging mechanisms and describes how manipulation in policy control and charging rules can influence the subscriber plan and services. The concept has been implemented and tested using a specification conformant LTE emulator. To mitigate the attack we will describe approaches and protection strategies that can be deployed.