Methods, systems, and computer-readable media for implementing ingress message rate limiting with network function identifiers

Abstract

Methods, systems, and computer-readable media for ingress message rate limiting are disclosed. One method includes receiving, at a network node from a service consumer network function, a service request message and extracting, from the received service request message, an access token that includes a consumer network function instance identifier that identifies the service consumer network function. The method also includes determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded, and performing a message rate limiting action in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded.

Description

[0001] CLAIM OF PRIORITY

[0002] This application claims the priority benefit of U.S. Patent Application Serial No. 17 / 134,635, filed December 28, 2020, U.S. Patent Application Serial No. 17 / 129,487, filed December 21, 2020, Indian Provisional Patent Application Serial No. 202041049614, filed November 13, 2020, and Indian Provisional Patent Application Serial No. 202041048552, filed November 6, 2020, the disclosures of which are incorporated herein by reference in their entirety. TECHNICAL FIELD

[0003] The subject matter described herein relates to enhancing security in 5G communication networks. More specifically, the subject matter described herein relates to methods, systems, and computer readable media for implementing ingress message rate limiting with network function identifiers. BACKGROUND

[0004] In a 5G telecommunications network, a network node that provides a service is referred to as a producer network function (NF). A network node that consumes a service is referred to as a consumer NF. A network function can be both a producer NF and a consumer NF, depending on whether it is consuming or providing a service.

[0005] A given producer NF can have many service endpoints, where a service endpoint is a contact point for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of an Internet Protocol (IP) address and a port number, or a fully qualified domain name that resolves to an IP address and a port number on the network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF can include more than one NF instance. It should also be noted that multiple NF instances can share the same service endpoint.

[0006] A producer NF registers with a network function repository function (NRF). The NRF maintains service profiles of available NF instances that identify the services supported by each NF instance. A consumer NF can subscribe to receive information about producer NF instances that have registered with the NRF. In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes with the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the SCP, and the SCP load balances traffic among producer NF service instances that provide the required service, or routes traffic directly to the destination producer NF instance.

[0007] In addition to SCPs, other examples of intermediary proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include security edge protection proxies (SEPPs), service gateways, and nodes in a 5G service mesh. SEPPs are network nodes used to protect control plane traffic exchanged between different 5G public land mobile networks (PLMNs). As such, SEPPs perform message filtering, policing, and topology hiding on all application programming interface (API) messages.

[0008] However, improved security measures at one or more NFs are needed. SUMMARY

[0009] Methods, systems, and computer-readable media for ingress message rate limiting using network function identifiers are disclosed. An example method includes receiving, at a network node from a service consumer network function, a service request message and extracting from the received service request message an access token that includes a consumer network function instance identifier that identifies the service consumer network function. The method further includes determining that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded using the consumer network function instance identifier and performing a message rate limiting action in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded.

[0010] According to an aspect of the subject matter described herein, a method, wherein the service request message is a service-based interface (SBI) service request message.

[0011] According to an aspect of the subject matter described herein, a method, wherein the consumer network function instance identifier is contained in a subject claim of the access token.

[0012] According to an aspect of the subject matter described herein, a method, wherein the network node is further configured to extract a consumer public land mobile network (PLMN) identifier from a consumer PLMN claim in the access token.

[0013] According to an aspect of the subject matter described herein, a method, wherein the network node comprises a security edge protection proxy (SEPP), a service producer network function, or a service communication proxy (SCP).

[0014] According to an aspect of the subject matter described herein, a method, wherein determining that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded comprises obtaining an allowed ingress message rate associated with the service consumer network function; obtaining a current ingress message rate associated with the service consumer network function; and comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate meets or exceeds the allowed ingress message rate.

[0015] According to an aspect of the subject matter described herein, a method, the message rate limiting action comprises dropping the request message, generating or modifying a throttling rate for dropping a portion of the ingress messages, or notifying a network operator or management system.

[0016] An example system for ingress message rate limiting comprises a network node comprising at least one processor and a memory. The network node is configured for a method in which the network node is configured for: receiving a service request message from a service consumer network function; extracting an access token from the received service request message, the access token comprising a consumer network function instance identifier identifying the service consumer network function; determining that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded using the consumer network function instance identifier; and performing a message rate limiting action in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded.

[0017] According to an aspect of the subject matter described herein, a system, wherein the service request message is a service-based interface (SBI) service request message.

[0018] According to an aspect of the subject matter described herein, a system, wherein the consumer network function instance identifier is contained in a subject claim of the access token.

[0019] According to an aspect of the subject matter described herein, a system, wherein the network node is further configured to extract a consumer public land mobile network (PLMN) identifier from a consumer PLMN claim in the access token.

[0020] According to an aspect of the subject matter described herein, a system, wherein the network node comprises a security edge protection proxy (SEPP), a service producer network function, or a service communication proxy (SCP).

[0021] According to an aspect of the subject matter described herein, a system, wherein determining that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded comprises obtaining an allowed ingress message rate associated with the service consumer network function; obtaining a current ingress message rate associated with the service consumer network function; and comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate meets or exceeds the allowed ingress message rate.

[0022] According to an aspect of the subject matter described herein, a system, wherein the message rate limiting action comprises dropping the request message, generating or modifying a throttling rate for dropping a portion of the ingress messages, or notifying a network operator or management system.

[0023] An example non-transitory computer-readable medium comprises computer-executable instructions embodied in the non-transitory computer-readable medium that when executed by at least one processor of at least one computer cause the at least one computer to perform steps comprising receiving, at a network node, a service request message from a service consumer network function and extracting, from the received service request message, an access token comprising a consumer network function instance identifier that identifies the service consumer network function. The steps further comprise determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded, and performing a message rate limiting action in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded.

[0024] The subject matter described herein can be implemented in hardware, software, firmware, or any combination thereof. As such, the terms "function," "node," or "module" as used herein refer to hardware, which can also include software and / or firmware components, for implementing the described features. In one example implementation, the subject matter described herein can be implemented using a computer readable medium having computer executable instructions stored thereon that, when executed by a processor of a computer, control the computer to perform steps such as any one or more of the steps of the present disclosure. Example computer readable media suitable for implementing the subject matter described herein include non-transitory computer-readable media, such as disk memory devices, chip memory devices, programmable logic devices, and application specific integrated circuits. In addition, a computer readable medium that implements the subject matter described herein can reside on a single device or computing platform or can be distributed across multiple devices or computing platforms. BRIEF DESCRIPTION OF DRAWINGS

[0025] The subject matter described herein will now be explained with reference to the drawings, wherein:

[0026] Figure 1 is a network diagram illustrating an example 5G core network architecture;

[0027] Figure 2 is a block diagram illustrating example message signaling received by a service producer network function from a service consumer network function;

[0028] Figure 3 is a message flow diagram illustrating Figure 3 is a message flow diagram illustrating an access token request procedure;

[0029] Figure 4 depicts an example encoded access token and a corresponding decoded access token;

[0030] Figure 5 is a message flow diagram illustrating an example of ingress message rate limiting performed by a message rate limiting engine;

[0031] Figure 6 FIG. 1 is a diagram illustrating an example network node configured for ingress message rate limiting;

[0032] Figure 7 FIG. 2 is a diagram illustrating an example message throttling rate related record database; and

[0033] Figure 8 FIG. 3 is a flow diagram illustrating an example process for implementing ingress message rate limiting with network function identifiers. DETAILED DESCRIPTION

[0034] Reference will now be made in detail to various embodiments of the subject matter described herein, some examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

[0035] Figure 1 FIG. 1 is a block diagram illustrating an example 5G system network architecture 10, e.g., a home 5G Core (5GC) network. Figure 1 The architecture 10 in FIG. 1 includes a Network Function Repository Function (NRF) 100 and an SCP 101, which can be located in the same home Public Land Mobile Network (PLMN). As described above, the NRF 100 can maintain profiles of available producer Network Function (NF) service instances and their supported services, and allow consumer NFs or SCPs to subscribe and get notified of the registration of new / updated producer NF service instances. The SCP 101 can also support service discovery and selection of producer NF instances. The SCP 101 can perform load balancing for connections between consumer and producer NFs. In addition, using the methods described herein, the SCP 101 can perform selection and routing based on preferred NF locations.

[0036] The NRF 100 is a repository for NF or service profiles of producer NF instances. In order to communicate with a producer NF instance, a consumer NF or SCP must obtain the NF or service profile or producer NF instance from the NRF 100. The NF or service profile is a JavaScript Object Notation (JSON) data structure defined in Third Generation Partnership Project (3GPP) Technical Specification (TS) 29.510. The NF or service profile definition includes at least one of a Fully Qualified Domain Name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address. In Figure 1In the middle, any node (except the NRF 100) can be either a consumer NF or a producer NF, depending on whether they are requesting services or providing services. In the illustrated example, the nodes include a policy control function (PCF) 102 that performs policy-related operations in the network, a unified data management (UDM) function 104 that manages user data, and an application function (AF) 106 that provides application services. Figure 1 The nodes illustrated in the middle also include a session management function (SMF) 108 that manages sessions between an access and mobility management function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a mobility management entity (MME) in a 4G network. An authentication server function (AUSF) 112 performs authentication services for user equipment (UE), such as user equipment (UE) 114, seeking access to the network.

[0037] A network slice selection function (NSSF) 116 provides network slice services for devices seeking to access specific network capabilities and characteristics associated with a network slice. A network exposure function (NEF) 118 provides application programming interfaces (APIs) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs attached to the network. The NEF 118 performs similar functions to a service capability exposure function (SCEF) in a 4G network.

[0038] A radio access network (RAN) 120 connects the user equipment (UE) 114 to the network via a wireless link. The radio access network 120 can be accessed using a gNodeB (gNB) (not shown in the middle) or other wireless access point. Figure 1 A user plane function (UPF) 122 can support various proxy functionality for user plane services. One example of such proxy functionality is multi-path transmission control protocol (MPTCP) proxy functionality. The UPF 122 can also support performance measurement functionality that can be used by the UE 114 to obtain network performance measurements. Figure 1 A data network (DN) 124 is also illustrated in the middle through which the UE accesses data network services, such as Internet services.

[0039] A security edge protection proxy (SEPP) 126 filters incoming traffic from another PLMN and performs topology hiding for traffic leaving the home PLMN. The SEPP 126 can communicate with a SEPP in a foreign PLMN that manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs can traverse two SEPP functions, one for the home PLMN and one for the foreign PLMN.

[0040] The SEPP 126 can utilize an N32-c interface and an N32-f interface. The N32-c interface is a control plane interface between two SEPPs that can be used to perform an initial handshake (e.g., a TLS handshake) and negotiate various parameters for N32-f interface connectivity and related message forwarding. The N32-f interface is a forwarding interface between two SEPPs that can be used to forward various communications (e.g., 5GC service requests and responses) between consumer NFs and producer NFs after application of application-level security protection.

[0041] One potential issue with the existing 5G architecture is that a consumer NF can trigger a signaling storm by sending a large number of service request messages to a producer NF, SEPP, or SCP in a home PLMN. While the receiving producer NF, SEPP, or SCP in the home network can initiate global message rate limiting processing to reduce or mitigate the consequences of the signaling storm from the culprit consumer NF, the global message rate limiting can similarly discard messages from legitimate consumer NFs and SEPPs that are not responsible for or not associated with the signaling storm at an equal rate.

[0042] Figure 2 is a diagram depicting signaling connections that exist between each of a plurality of service consumer network functions 200-204 and a service producer network function 126. In some embodiments, the service producer network function 126 requires some manner of ingress rate limiting in order to protect itself from excessive 5GC signaling from subscribed consumer network functions. For example, the service producer network function 126 can be configured with global rate limiting functionality that is used to throttle or limit the number of ingress messages received from consumer network functions. As Figure 2 As shown in the diagram of FIG. 2, the producer network function 126 can be configured to receive signaling messages from a plurality of consumer network functions 200-204. Among the plurality of consumer network functions that are sending messages, one or more consumer functions can be sending an excessive number of signaling messages that causes the producer network function 126 to initiate a message throttling mechanism that manages the ingress rate of messages received at the producer network function 126. While the global message rate limiting measure can mitigate the negative effects of a signaling storm from a particular consumer network function (e.g., consumer network function 200), such rate limiting can also unfairly discard or throttle traffic associated with legitimate consumer network functions (e.g., consumer network functions 202-204) that are not responsible for or not associated with the signaling storm. As Figure 2As illustrated in FIG. 2, the global rate limiting mechanism executed by the producer network function throttles all incoming messages and inappropriately throttles consumer network functions (e.g., consumer network functions 202-204) that send messages in accordance with allowed limits or thresholds. As a result, consumer network functions 202-204 are throttled to the same degree as the culprit consumer network function (e.g., consumer network function 200).

[0043] In some embodiments of the disclosed subject matter, a network node can be provisioned with a message rate limiting engine (as discussed in further detail below). Notably, the message rate limiting engine can be configured to maintain a watch on a current message rate originating from a particular consumer network function and determine whether that rate exceeds an allowed threshold. To accomplish this, the message rate limiting engine at the network node can be configured to identify an access token (and included consumer network function instance identifier) that can be stored in an HTTP and / or JSON message header of a service message sent by the consumer network function. In some embodiments, the access token can be an OAuth2 access token requested from an authorization server such as the NRF.

[0044] Figure 3 is a message flow diagram illustrating an access token request procedure executed by a consumer network function. Referring to Figure 3 , service consumer network function 302 can send an access token request message 311 to an authorization server 304 (e.g., the NRF). In particular, request message 311 includes an Nnrf_AccessToken_Get request message that specifies an intended NF service name and NF type, a service consumer network function type, a client identifier, and the like. Upon receiving request message 311, authorization server 304 is configured to authorize the requesting client (i.e., service consumer network function 302) and generate a uniquely encoded access token (e.g., an OAuth2 access token) for that client. After generating the encoded access token, authorization server 304 generates and sends a response message 313 directed to service consumer network function 302. In particular, response message 313 can include an Nnrf_AccessToken_Get response message that includes the encoded access token generated by the authorization server and its corresponding expiration time.

[0045] Once the service consumer network function 302 obtains the necessary service access authorization by successfully obtaining an access token, the service consumer network function 302 can be configured to include the obtained access token in a network function service request message (e.g., SBI service request message) to a service producer network function. In particular, the service consumer network function can embed the encoded access token in a network function service request message sent to the service producer network function. In response to receiving the network function service request message, the service producer network function is configured to extract the encoded access token from the service request message. In particular, the service producer network function can be adapted to verify the integrity and claims contained in the access token. If the claims and integrity in the access token are successfully verified, the service producer network function is configured to allow the service consumer network function to access the requested service. That is, the service producer network function can be configured to send a network function service response message to the service consumer network function indicating that the requested service is authorized and will be accessible.

[0046] Figure 4 An exemplary encoded access token 402 and a decoded access token 404 are depicted. Notably, the encoded access token 402 is received by a consumer network function from an authorization server or NRF in this form. The encoded access token 402 is also used in the HTTP header of a service request message generated and sent by the consumer network function. The encoded access token is ultimately decoded by a receiving producer network function and / or its message rate limiting engine, as further discussed below.

[0047] Figure 5 A message signaling diagram illustrating exemplary rate limiting techniques performed by the message rate limiting engine 514 is depicted. As Figure 5 shown in FIG. 5A, the message rate limiting engine 514 is hosted by a service producer network function 512. In alternative embodiments, the message rate limiting engine 514 is hosted by a SEPP or SCP node. Figure 5 A pair of consumer network functions 521-522 are further illustrated. As Figure 5 shown in FIG. 5B, the service producer network function 512 can be configured with a record database (see, e.g., record database 700 discussed below and shown in FIG. 7), which can contain a plurality of record entries corresponding to service consumer network functions that have communicated with the service producer network function (or host of the message rate limiting engine 514), respectively. Figure 7

[0048] As Figure 5 ​As shown, the service producer network function 512 receives an NF service request message 502 from the service consumer network function 521. It is worth noting that the service request message 502 includes information previously received by the service consumer network function 521 (e.g., from the above regarding...). Figure 3 The access token obtained by the NRF (Network Response Function) described herein is an encoded access token. Furthermore, the access token includes multiple claims, any of which the message rate limiting engine 514 can access. For example, one claim in the access token is a topic claim containing an identifier of the consumer network function instance that sent the consumer network function 521. Another accessible claim in the access token includes a consumer PLMN identifier. While the following description primarily focuses on accessing and extracting identifier data from topic claims and consumer PLMN claims, any claim included in the access token can be accessed by the message rate limiting engine to obtain identification information that can be used for rate limiting purposes without departing from the scope of the disclosed topics.

[0049] Upon receiving the service request message 502 and the access token, the service producer network function 512 and / or the message rate limiting engine 514 are configured to decode the encoded access token and initiate an access token verification and service authorization process (see box 503). For example, the message rate limiting engine 514 may be configured to verify the integrity of the claims included in the access token. Notably, the message rate limiting engine 514 is configured to obtain a consumer network function instance identifier (CRI) that uniquely identifies the consumer network function 521 from the subject claim of the decoded access token (and / or a consumer PLMN identifier that uniquely identifies the consumer PLMN from the consumer PLMN claim of the decoded access token). Once the consumer network function instance identifier is obtained, the message rate limiting engine 514 is configured to use the CRI to cross-reference entries in the record database. Specifically, the record database may include network function identifiers (and / or consumer PLMN identifiers, consumer NF group identifiers, etc.) and associated message rate limiting parameters (e.g., such as...). Figure 7The message rate limiting engine 514 can determine any existing message passing limits imposed on the particular service consumer network function 521 by comparing the consumer network function instance identifier to one or more consumer network function identifiers included in entries of the record database. For example, the message rate limiting engine 514 can access the record database and determine various message passing information related to the service consumer network function, such as the current message passing rate being performed by the network function 521, the predefined allowed message rate for the network function 521, and the message throttling rate currently applied (if applicable) to messages sent by the service consumer network function. In the event the message rate limiting engine 514 verifies the integrity of the access token and further determines that the service consumer network function 521 is communicating in a manner that complies with the acceptable ingress message rate for the producer network function 512, the message rate limiting engine 514 will send a service response message to the consumer network function 521 indicating that access to the requested service has been granted. In addition, the message rate limiting engine 514 will continue to allow the consumer network function 521 to communicate with the producer network function 512 without performing any message rate limiting or throttling actions.

[0050] In Figure 5 In the second scenario shown in FIG. 5, the service consumer network function 522 sends its own network function service request message to the service producer network function 512. Similar to the message 502 indicated above, the service request message 505 includes the encoded access token previously obtained by the service consumer network function 522 (e.g., from the NRF). In addition, the encoded access token also includes a plurality of accessible claims, one of which is a subject claim containing a consumer network function instance identifier that uniquely identifies the sending consumer network function 522. Another accessible claim is a consumer PLMN claim containing a consumer PLMN identifier that uniquely identifies the sending consumer PLMN.

[0051] After receiving the service request message 505 and the access token, the service producer network function 512 and / or the message rate limiting engine 514 is configured to decode the access token and initiate an access token verification and service authorization procedure (similar to block 503). For example, the message rate limiting engine 514 can be configured to verify the integrity of the claims declared in the received access token. Notably, the message rate limiting engine 514 is configured to obtain the consumer network function instance identifier that uniquely identifies the consumer network function 523 (and / or the consumer PLMN identifier from the consumer PLMN claim) from the subject claim of the access token. Once the consumer network function instance identifier is obtained, the message rate limiting engine 514 is configured to utilize the network function instance identifier to cross-reference entries of a record database. By comparing the consumer network function instance identifier to one or more network function identifiers included in entries of the record database, the message rate limiting engine 514 is able to determine any message limits imposed on the particular service consumer network function 522. For example, the message rate limiting engine 514 can access the record database and determine that a message throttling rate is currently being applied to the sending service consumer network function. In the event that the message rate limiting engine 514 determines that the service consumer network function 521 is subject to an ingress message to producer network function 512 throttling rate, the message rate limiting engine 514 will perform a message rate limiting or throttling action. For example, the message rate limiting engine 514 can be configured to discard a number of messages sent by the consumer network function 522 based on the established rate limit predefined in the record database. More specifically, the message rate limiting engine 514 can limit ingress messages from the service consumer network function 522 to the producer network function 512 to a particular message delivery throttling rate defined in the record database (e.g., 10 TPS) (see, e.g., database 700 in Figure 7

[0052] It will be recognized that Figure 5 are for illustrative purposes and that different and / or additional messages and / or actions can be used. It will also be recognized that the various messages and / or actions described herein can occur in different orders or sequences.

[0053] Figure 6 ​is a diagram illustrating an example network node 600 configured to implement ingress message rate limiting with network function identifiers. Network node 600 can represent any suitable entity for performing aspects of ingress message rate limiting. In some embodiments, node 600 can represent or include one or more 5GC network functions, such as a service producer network function, a SEPP, a SCP, and / or the like. In some embodiments, network node 600 can represent or include a network gateway, a network proxy, an edge security device, or any related computing device configured to host NF, SEPP, and / or SCP nodes or functionality. In some embodiments, network node 600 can include any producer network function, such as a NRF, a PCF, a BSF, a NSSF, a NEF, a UDM / AUSF, a UDR, a UDSF, and / or the like.

[0054] In some embodiments, network node 600 or related modules can be configured (e.g., via programmed logic) to perform ingress message rate limiting on 5GC service request messages based on a consumer network function instance identifier corresponding to an originating service consumer network function. By performing ingress message rate limiting in this manner, network node 600 (e.g., a service producer network function) is able to reduce or mitigate the impact of an incoming 5GC request signaling storm on that network node or other downstream network functions in a home network. For example, network node 600 or related modules can be configured to identify a consumer network function instance identifier included in an access token (e.g., an OAuth2 access token). More specifically, the consumer network function instance identifier is included in a subject claim contained within the access token. In some embodiments, the network node, message rate limiting engine, or related modules are further configured to extract a consumer PLMN identifier from a consumer PLMN claim in the access token. This consumer PLMN identifier can be used by the network node and / or message rate limiting engine to perform rate limiting procedures on the sending consumer PLMN, as described below.

[0055] In some embodiments, the network node and / or message rate limiting engine is configured to group multiple service consumer network functions for rate limiting purposes. In such scenarios, the network node and / or message rate limiting engine will require some configuration by a network operator or administrator to enable grouping of consumer NFs.

[0056] Reference Figure 6The network node 600 can include one or more communication interfaces 602 for communicating messages via a communication environment (e.g., a home 5GC network). In some embodiments, the communication interface(s) 602 can include a first communication interface for communicating with one or more service consumer network functions and / or SEPPs in a first network, a second communication interface for communicating with one or more service consumer network functions and / or SEPPs in a second network, and a third communication interface for communicating with one or more service consumer network functions and / or SEPPs in a home network (e.g., a home 5GC network).

[0057] The network node 600 can include a message rate limiting (MRL) engine 604. The message rate limiting engine 604 can be any suitable entity (e.g., software executing on at least one processor) for performing one or more aspects of the disclosed ingress message rate limiting. In some embodiments, the message rate limiting engine 604 can include functionality to obtain a consumer network function instance identifier identifying an originating service consumer network function from a service request message sent from a service consumer network function and to perform ingress message rate limiting functions at the function network node 600 using the network function instance identifier. For example, obtaining a consumer network function instance identifier from a 5GC signaling message can include obtaining the instance identifier from an HTTP header in an access token included in a 5GC-based network function service request message.

[0058] In this example, for each 5GC service request message received by the network node 600, the message rate limiting engine 604 can use the consumer network function instance identifier to determine whether an allowed ingress message rate associated with the sending consumer network function instance identifier has reached or exceeded a predefined threshold. Responsive to determining that the allowed ingress message rate associated with the network function instance identifier has reached or exceeded the threshold, the message rate limiting engine 604 can perform a message rate limiting action. Examples of rate limiting actions can include dropping the received request message, generating or modifying a throttle rate for dropping a portion of ingress messages sent by a particular consumer service network function, and / or notifying a network operator or management system about the ingress message rate or related events.

[0059] In some embodiments, the message rate limit engine 604 can be configured to determine whether to perform ingress message rate limiting by obtaining an allowed ingress message rate associated with a consumer service network function, obtaining a current ingress message rate associated with the consumer service network function, and comparing the current ingress message rate to the allowed ingress message rate. If the current ingress message rate reaches or exceeds the allowed ingress message rate, then a message rate limit action can be performed. If the current ingress message rate reaches or exceeds the allowed ingress message rate, then the message rate limit engine 604 can allow the message to be handled or processed, e.g., without ingress message rate limiting.

[0060] In some embodiments, the network node 600 can access a data store 606 (e.g., to read information therefrom and / or to write information thereto). The data store 606 can be any suitable entity for storing various data (e.g., a computer-readable medium or memory). In some embodiments, the data store 606 can include logic to obtain an identifier from an access token, logic to check whether to perform ingress message rate limiting, logic to implement or trigger a message rate limit action, and logic to track current ingress message rates associated with various originating entities (e.g., consumer service network function instant identifiers, PLMN IDs, etc.).

[0061] In some embodiments, the data store 606 can include message rate limit data. For example, the data store 606 can include information identifying current message rates, allowed message rates, and / or message throttling rates for various consumer network functions or network nodes therein. In this example, the identifiers obtained from 5GC service request messages or access tokens therein can be used to index or otherwise identify the relevant message rates and throttling rates. The data store 606 can also be configured to store a record database, such as the record database 700 shown in Figure 7

[0062] Figure 7 is a diagram depicting example message rate related data stored in the record database 700. The record database 700 can include information identifying current message rates, allowed message rates, and / or message throttling rates for various consumer network functions or network nodes therein. For example, each rate in the record database 700 can represent a number of messages, requests, or transactions per time period, e.g., transactions per second (TPS).

[0063] Referring to Figure 7 ​The record database 700 indicates that the table recording the database 700 includes columns and / or fields for network and / or network function instance ID, current message rate, allowed message rate, and message throttling rate. The network function identifier field can store information indicative of a network function or an associated host network node. In some embodiments, the record database 700 can include a consumer PLMN identifier field that can be used to message rate limit a particular consumer PLMN. Similarly, in some embodiments, the record database 700 can include a consumer NF group identifier field that can be used to message rate limit a particular group of consumer network functions.

[0064] The current message rate field can store information indicative of a measured or tracked message rate associated with one or more messages, types of messages, or transactions. For example, a current message rate (e.g., 50 TPS) can indicate a measured rate of 5GC service request messages or transactions received from a particular consumer network function.

[0065] The allowed message rate field can store information indicative of a predetermined allowed message rate associated with one or more messages, types of messages, or transactions. For example, an allowed message rate (e.g., 40 TPS) can indicate a rate at which a network node (e.g., a producer network node, SCP, or SEPP) is configured to allow 5GC service request messages or transactions received from a particular consumer network function, e.g., without performing a message rate limiting action.

[0066] The message throttling rate field can store information indicative of a message throttling rate associated with one or more messages, types of messages, or transactions. For example, a message throttling rate can indicate a rate at which a network node (e.g., a producer network node, SCP, or SEPP) is to throttle or discard 5GC inter-service request messages or transactions received from a particular consumer network function. In this example, the throttling rate can be based on a difference between the current message rate and the allowed message rate, e.g., 50 TPS - 40 TPS = 10 TPS.

[0067] It will also be recognized that the record database 700 is for illustration purposes and that different and / or additional data than that depicted in Figure 7 may be available to indicate default values or other information for particular data portions. Additionally, the record database 700 can be stored (e.g., in database records in a data storage 606 as shown in Figure 6 ) or managed using various data structures and / or computer readable media.

[0068] Figure 8is a diagram illustrating an example process 800 for ingress message rate limiting. In some embodiments, the example process 800 described herein, or portions thereof, can be performed at or by the network node 600, the message rate limiting engine 604, and / or another module or node.

[0069] In step 802, a 5GC service request message is received from a service consumer network function. In some embodiments, the request message is received by a network node, such as a SEPP, SCP, producer NF, or any other node in a home 5GC network that includes the message rate limiting engine 604.

[0070] In step 804, an access token including a consumer network function instance identifier is extracted from the received 5GC service request message. In some embodiments, the message rate limiting engine obtains the consumer network function instance identifier contained in a claim of the access token. Notably, the consumer network function instance identifier uniquely identifies the sending service consumer network function. In some embodiments, the network node and / or message rate limiting engine extracts a consumer PLMN identifier from a consumer PLMN claim in the access token.

[0071] At step 806, the consumer network function instance identifier can be used to determine that an allowed ingress message rate associated with the sending service consumer network function has been reached or exceeded. For example, the producer network functionality can utilize the consumer network function instance identifier obtained from the access token associated with the originating service consumer network function (see step 804) to determine whether the messages sent by the particular service consumer network function have reached or exceeded an ingress message rate. In this example, the producer network function can query a data store or database containing current ingress message rates and allowed message rates that are indexed or associated by a relevant identifier (e.g., the consumer network function instance identifier). In some embodiments, the extracted consumer PLMN identifier can be used by the network node and / or message rate limiting engine to determine whether an allowed ingress message rate associated with the sending consumer PLMN has been reached or exceeded.

[0072] In some embodiments, determining that an allowed ingress message rate associated with a particular sending service consumer network function has been reached or exceeded can include i) obtaining an allowed ingress message rate associated with the service consumer network function, ii) obtaining a current ingress message rate associated with the service consumer network function, and iii) comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate meets or exceeds the allowed ingress message rate.

[0073] In step 808, in response to determining that the allowed inbound message rate associated with the service consumer network function has been reached or exceeded, a message rate limiting action may be performed. In some embodiments, the message rate limiting action performed by the producer network function and / or the message rate limiting engine may include dropping a request message, generating or modifying a throttling rate for dropping a portion of a message, or notifying the network operator or management system. In some embodiments, the message rate limiting action may be performed by the network node and / or the message rate limiting engine in response to determining that the allowed inbound message rate associated with the sending consumer PLMN has been reached or exceeded.

[0074] It will be recognized that the treatment of 800 is for illustrative purposes and that different and / or additional actions may be used. It will also be recognized that the various actions described herein may occur in different orders or sequences.

[0075] It will be recognized that while some aspects of the topics described herein have been discussed with reference to 5G networks, various other networks can utilize aspects of the topics described herein. For example, any network utilizing certificates that identify the sender or associated network can use the features, mechanisms, and techniques described herein to implement more selective message rate limiting.

[0076] It should be noted that network node 600, message rate limiting engine 604, and / or the functions described herein (e.g., such as...) Figure 6 (As shown) can constitute a dedicated computing device. Additionally, node 600, message rate limiting engine 604, and / or the functionality described herein can improve network security and / or message rate limiting techniques at producer network functions, SEPP, SCP, or other network nodes. For example, by performing ingress message rate limiting based on consumer NF identifiers, malicious activities (e.g., signaling traffic storms) and their negative consequences (e.g., network congestion, service failures, and / or poor user experience) can be mitigated and / or prevented.

[0077] To the extent that they are inconsistent with this document or that they supplement, explain, provide background or teaching the methods, techniques and / or systems used in this document, the contents of each of the following references are incorporated herein by reference in their entirety.

[0078] References:

[0079] 1.3GPP TS33.501; 3 rd Generation Partnership Project;

[0080] Technical Specification Group Services and System Aspects;

[0081] Security Architecture and Procedures for the 5G System;

[0082] (Release 16), V16.3.0 (2020-07).

[0083] 2.3GPP TS 29.510; 3 rd Generation Partnership Project;

[0084] Technical Specification Group Core Network and Terminals;

[0085] 5G System; Network Function Repository Services; Stage 3

[0086] (Release 16), V16.4.0 (2020-07).

[0087] It will be understood that various details of the presently disclosed subject matter can change without departing from the scope of the presently disclosed subject matter. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation.

Claims

1. A method for ingress message rate limiting using network function identifiers, the method comprising: at a network node: receiving a service request message from a service consumer network function; extracting an access token from the received service request message, the access token including a consumer network function instance identifier that identifies the service consumer network function; determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded, including: obtaining an allowed ingress message rate associated with the service consumer network function; obtaining a current ingress message rate associated with the service consumer network function; and comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate has reached or exceeded the allowed ingress message rate; and performing a message rate limiting action in response to determining that the current ingress message rate associated with the service consumer network function has reached or exceeded the allowed ingress message rate associated with the service consumer network function.

2. The method of claim 1, wherein the service request message is a service-based interface (SBI) service request message.

3. The method of claim 1, wherein the consumer network function instance identifier is contained in a subject claim of the access token.

4. The method of any preceding claim, wherein the network node is further configured to extract a consumer public land mobile network (PLMN) identifier from a consumer PLMN claim in the access token.

5. The method of any of claims 1-3, wherein the network node comprises a security edge protection proxy (SEPP), a service producer network function, or a service communication proxy (SCP).

6. The method of any of claims 1-3, wherein the message rate limiting action comprises dropping the request message, generating or modifying a throttle rate for dropping a portion of ingress messages, or notifying a network operator or management system.

7. A system for ingress message rate limiting using network function identifiers, the system comprising: a network node comprising: at least one processor; and a memory, wherein the network node is configured to: receive a service request message from a service consumer network function; extract an access token from the received service request message, the access token including a consumer network function instance identifier that identifies the service consumer network function; determine, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded, including: obtaining an allowed ingress message rate associated with the service consumer network function; obtaining a current ingress message rate associated with the service consumer network function; and comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate has reached or exceeded the allowed ingress message rate; and perform a message rate limiting action in response to determining that the current ingress message rate associated with the service consumer network function has reached or exceeded the allowed ingress message rate associated with the service consumer network function.

8. The system of claim 7, wherein the service request message is a service-based interface (SBI) service request message.

9. The system of claim 7, wherein the consumer network function instance identifier is included in a subject claim of the access token.

10. The system of any of claims 7 to 9, wherein the network node is further configured to extract the consumer public land mobile network (PLMN) identifier from a consumer PLMN claim in the access token.

11. The system of any of claims 7 to 9, wherein the network node comprises a security edge protection proxy (SEPP), a service producer network function, or a service communication proxy (SCP).

12. The system of any of claims 7 to 9, wherein the message rate limiting action comprises dropping the request message, generating or modifying a throttle rate for dropping a portion of the ingress messages, or notifying a network operator or management system.

13. A non-transitory computer-readable medium having stored thereon executable instructions that, when executed by a processor of a computer, control the computer to perform steps comprising: at a network node: receiving a service request message from a service consumer network function; extracting an access token from the received service request message, the access token including a consumer network function instance identifier that identifies the service consumer network function; determining that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded using the consumer network function instance identifier, including: obtaining an allowed ingress message rate associated with the service consumer network function; obtaining a current ingress message rate associated with the service consumer network function; and comparing the current ingress message rate to the allowed ingress message rate to determine that the current ingress message rate reaches or exceeds the allowed ingress message rate; and performing a message rate limiting action in response to determining that the current ingress message rate associated with the service consumer network function reaches or exceeds the allowed ingress message rate associated with the service consumer network function.

14. The non-transitory computer-readable medium of claim 13, wherein the service request message is a service-based interface (SBI) service request message.

15. The non-transitory computer-readable medium of claim 13, wherein the consumer network function instance identifier is included in a subject claim of the access token.

16. The non-transitory computer-readable medium of any of claims 13 to 15, wherein the network node comprises a security edge protection proxy (SEPP), a service producer network function, or a service communication proxy (SCP).

17. The non-transitory computer-readable medium of any of claims 13 to 15, wherein the message rate limiting action comprises dropping the request message, generating or modifying a throttle rate for dropping a portion of the ingress messages, or notifying a network operator or management system.

Images