Methods, systems, and computer-readable media for mitigating denial of service (DoS) attacks at network functions (NFs)

Abstract

A method for DoS attacks at NFs includes maintaining, at a first NF, an NF subscription database containing rules specifying a maximum number of allowed subscriptions and corresponding rule criteria. The method further includes receiving, at the first NF from a second NF, a subscription request for establishing a subscription. The method further includes determining, by the first NF, that the subscription request matches the criteria of at least one rule in the NF subscription database, and incrementing, by the first NF, at least one count of a subscription number for the at least one rule. The method further includes determining, by the first NF, that the at least one count of the subscription number exceeds the maximum number of allowed subscriptions for the at least one rule. The method further includes preventing establishment of the subscription in response to determining that the at least one count of the subscription number exceeds the maximum number of allowed subscriptions for the at least one rule.

Description

[0001] Priority Statement

[0002] This application claims priority to U.S. Patent Application Serial No. 17 / 167,319, filed on February 4, 2021, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] This article describes topics related to cybersecurity. More specifically, it describes methods, systems, and computer-readable media for mitigating DoS attacks at network nodes (NFs), such as 5G producer NFs. Background Technology

[0004] In 5G telecommunications networks, network functions that provide services are referred to as producer network functions (NFs) or NF service producers. Network functions that consume services are referred to as consumer NFs or NF service consumers. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function consumes, produces, or both consumes and produces services. The terms "producer NF" and "NF service producer" are used interchangeably herein. Similarly, the terms "consumer NF" and "NF service consumer" are used interchangeably herein.

[0005] A given producer NF can have multiple service endpoints, where a service endpoint is a contact point used for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of Internet Protocol (IP) address and port number, or by a fully qualified domain name that resolves to an IP address and port number on the network node hosting the producer NF. An NF instance is an instance of the producer NF that provides a service. A given producer NF can include more than one NF instance. It should also be noted that multiple NF instances can share the same service endpoint.

[0006] Producer NFs register with the Network Functions Store (NRF). The NRF maintains service profiles of available NF instances that identify the services supported by each NF instance. The terms "service profile" and "NF profile" are used interchangeably herein. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.

[0007] Besides consumer NFs, another type of network node that can subscribe to receive information about NF service instances is the Service Communication Agent (SCP). The SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the Service Communication Agent, which load balances traffic between producer NF service instances providing the required services, or directly routes traffic to the destination producer NF instance.

[0008] Besides SCPs, other examples of intermediate proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include Secure Edge Protection Proxies (SEPPs), Serving Gateways, and nodes in 5G Serving Mesh. SEPPs are network nodes used to protect control plane traffic exchanged between different 5G Public Land Mobile Networks (PLMNs). Therefore, SEPPs perform message filtering, policing, and topology hiding on all Application Programming Interface (API) messages transmitted between PLMNs.

[0009] A problem arises in 5G communication networks when producer NFs become overwhelmed by a large number of subscription requests. Almost all NFs in a 5G network communicate using a subscription / notification mechanism. In this mechanism, consumer NFs subscribe to producer NFs to receive notifications about them. For example, when a consumer NF wants to know about network topology changes, the NRF uses subscription / notification communication to obtain this notification. The User Data Management Node (UDM) uses subscription / notification communication to inform consumer NFs of changes to subscriber data. The Network Slice Selection Function (NSSF) uses subscription / notification communication to inform the AMF of changes in Individual Network Slice Selection Auxiliary Information (S-NSSAI). The Policy Control Function (PCF) uses subscription / notification communication to inform consumer NFs of policy control events.

[0010] If the number of subscriptions at a producer NF overwhelms its processing capacity, it may refuse service to consumer NFs seeking information about NF service profiles or other details. Currently, the producer NF does not limit the number of subscriptions a consumer NF can create. A consumer NF may intentionally or unintentionally create too many NF subscriptions at the producer NF, leading to a denial of service to other NFs attempting to access services provided by the producer NF. Exhaustion of the producer NF's storage capacity due to excessive subscription records will result in a denial of service. Exhaustion of the producer NF's CPU due to excessive processing demands will also lead to a denial of service. Exhaustion of the producer NF's memory resources will also result if the number of subscription records being processed exceeds its storage capacity. Network resource exhaustion due to unnecessary processing overhead in subscription responses will also lead to a denial of service. Note that other operations (e.g., registering an NF with an NRF) do not encounter the same problems as subscriptions because the message content (the NF instance ID in the registration request) helps ensure that multiple registrations are not created for the same NF instance. However, there is no such protection in or for subscription messages.

[0011] Therefore, there is a need for methods, systems, and computer-readable media for mitigating DoS attacks at NF. Summary of the Invention

[0012] A method for mitigating denial-of-service (DoS) attacks at a network function (NF). The method includes maintaining an NF subscription database at a first NF containing rules specifying a maximum number of allowed subscriptions and corresponding rule criteria. The method also includes receiving a subscription request for establishing a subscription from a second NF at the first NF. The method further includes determining, by the first NF, that the subscription request matches a criterion of at least one rule in the NF subscription database. The method also includes incrementing at least one count of the subscription quantity for the at least one rule by the first NF. The method further includes determining, by the first NF, that at least one count of the subscription quantity exceeds the maximum number of allowed subscriptions for the at least one rule. The method also includes preventing the establishment of a subscription in response to determining that at least one count of the subscription quantity exceeds the maximum number of allowed subscriptions for the at least one rule.

[0013] According to another aspect of the subject matter described in this article, the first NF includes the producer NF.

[0014] According to another aspect of the subject matter described herein, the first NF includes a Service Communication Agent (SCP).

[0015] According to another aspect of the subject described herein, maintaining an NF subscription database includes maintaining a database with at least one rule having a specified NF type.

[0016] According to another aspect of the subject matter described herein, accessing an NF subscription database involves extracting or inferring NF type information from subscription requests and using the NF type information extracted or inferred from the subscription requests as a key to match against criteria specified for rules in the database.

[0017] According to another aspect of the subject matter described herein, maintaining an NF subscription database includes maintaining a database with at least one rule having criteria for a specified Public Land Mobile Network (PLMN).

[0018] According to another aspect of the subject matter described herein, accessing the NF subscription database includes extracting or inferring PLMN information of a second NF from the subscription request, and using the PLMN information of the second NF extracted or inferred from the subscription request as a key to match against criteria specified for rules in the database.

[0019] According to another aspect of the subject matter described herein, maintaining an NF subscription database includes maintaining a database of at least one rule having a criterion specifying an NF instance ID, and wherein accessing the NF subscription database includes extracting an NF instance ID from a subscription request and using the NF instance ID extracted from the subscription request as a key to match it against the criterion specified for the rule in the database.

[0020] According to another aspect of the subject described in this article, maintaining the NF subscription database includes maintaining a count of the number of subscriptions currently being processed by the first NF that match the criteria of each rule.

[0021] According to another aspect of the subject matter described herein, determining by the first NF that a subscription request matches a criterion of at least one rule in the NF subscription database includes determining that the subscription request matches a criterion of multiple rules in the database; incrementing by the first NF at least one count of the number of subscriptions for the at least one rule includes incrementing the count of each rule having a criterion that matches the subscription request; and determining by the first NF that at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions for the at least one rule includes determining that the count of the number of subscriptions for any rule having a criterion that matches the subscription request exceeds the maximum number of allowed subscriptions for that rule.

[0022] According to another aspect of the subject matter described herein, a system for mitigating denial-of-service (DoS) attacks at a network function (NF) is provided. The system includes a first NF, which includes at least one processor and memory. The system also includes an NF subscription database implemented in memory and containing rules specifying a maximum number of allowed subscriptions and corresponding rule criteria. The system further includes an NF subscription regulator for receiving a subscription request from a second NF for establishing a subscription, determining that the subscription request matches a criterion of at least one rule in the NF subscription database, incrementing at least one count of the number of subscriptions for the at least one rule, determining that at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions for the at least one rule, and blocking the establishment of a subscription in response to determining that at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions for the at least one rule.

[0023] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule with criteria specifying the NF type.

[0024] According to another aspect of the subject matter described herein, when accessing the NF subscription database, the NF subscription regulator is configured to extract or infer the NF type information of a second NF from the subscription request, and use the NF type information of the second NF extracted or inferred from the subscription request as a key to match against the criteria specified for the rules in the database.

[0025] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule having criteria for specifying a Public Land Mobile Network (PLMN), and wherein, when accessing the NF subscription database, the NF subscription regulator is configured to extract or infer the PLMN identifier of a second NF from the subscription request and use the PLMN identifier extracted or inferred from the subscription request as a key to match against the criteria specified for the rules in the database.

[0026] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule with a criterion specifying an NF instance ID, and wherein, when accessing the NF subscription database, the NF subscription regulator is configured to extract the NF instance ID from the subscription request and use the NF instance ID extracted from the subscription request as a key to match it against the criterion specified for the rule in the database.

[0027] According to another aspect of the subject described in this article, the NF subscription regulator is configured to maintain a count of the current number of subscriptions that are handled by the first NF and match the criteria of each rule.

[0028] According to another aspect of the subject matter described herein, when determining that a subscription request matches a criterion of at least one rule in the NF subscription database, the NF subscription regulator is configured to determine that the subscription request matches a criterion of multiple rules in the NF subscription database; when incrementing at least one count of the subscription quantity of at least one rule, the NF subscription regulator is configured to increment the count of each rule having a criterion that matches the subscription request; and when determining that at least one count of the subscription quantity exceeds the maximum number of allowed subscriptions for at least one rule, the NF subscription regulator is configured to determine that the count of the subscription quantity of any rule having a criterion that matches the subscription request exceeds the maximum number of allowed subscriptions for that rule.

[0029] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium having executable instructions stored thereon is provided, which, when executed by a computer's processor, control the computer to perform steps. The steps include maintaining an NF subscription database at a first network function (NF) containing rules specifying a maximum number of allowed subscriptions and corresponding rule criteria. The steps also include receiving a subscription request for establishing a subscription from a second NF at the first NF. The steps further include determining by the first NF that the subscription request matches a criterion of at least one rule in the NF subscription database. The steps also include incrementing at least one count of the subscription quantity for the at least one rule by the first NF. The steps further include determining by the first NF that at least one count of the subscription quantity exceeds the maximum number of allowed subscriptions for the at least one rule. The steps also include preventing the establishment of a subscription in response to determining that at least one count of the subscription quantity exceeds the maximum number of allowed subscriptions for the at least one rule.

[0030] The subjects described herein can be implemented using software in conjunction with hardware and / or firmware. For example, the subjects described herein can be implemented as software executed by a processor. In one exemplary embodiment, the subjects described herein can be implemented using a non-transitory computer-readable medium having computer-executable instructions stored thereon, which, when executed by a computer's processor, control the computer to perform steps. Exemplary computer-readable media suitable for implementing the subjects described herein include non-transitory computer-readable media, such as disk storage devices, on-chip memory devices, programmable logic devices, and application-specific integrated circuits (ASICs). Furthermore, computer-readable media implementing the subjects described herein can reside on a single device or computing platform, or can be distributed across multiple devices or computing platforms. Attached Figure Description

[0031] Figure 1 This is a network diagram illustrating an exemplary 5G system network architecture;

[0032] Figure 2 This is a message flow diagram illustrating the exchange of exemplary messages for creating a subscription with a producer NF;

[0033] Figure 3 This is a message flow diagram illustrating the exchange of exemplary messages when a producer NF sends a notification about a subscription to a consumer NF.

[0034] Figure 4 This is a message flow diagram illustrating an exemplary message exchange when an NF service consumer overwhelms the processing resources of an NF service producer due to excessive subscriptions.

[0035] Figure 5 This is a message flow diagram illustrating an example of messages exchanged based on operator-configured guidelines for the number of subscriptions allowed by the regulatory consumer's NF.

[0036] Figure 6 The diagram illustrates the message flow of an exemplary message exchanged, where the number of subscriptions allowed by the consumer NF based on operator-configured guidelines results in the blocking of subscription establishment in response to exceeding the maximum limit defined by the operator.

[0037] Figure 7 This is a block diagram illustrating a consumer NF or SCP that can mitigate DoS attacks by monitoring the number of subscriptions from consumer NFs based on operator-configured criteria; and

[0038] Figure 8 This is a flowchart illustrating an exemplary process for mitigating DoS attacks by regulating the number of subscriptions from consumer NFs based on operator-configured guidelines. Detailed Implementation

[0039] Figure 1This is a block diagram illustrating an exemplary 5G system network architecture. Figure 1 The architecture includes NRF 100 and SCP 101, which can reside within the same Household Public Land Mobile Network (HPLMN). As described above, NRF 100 maintains profiles of available producer NF service instances and their supported services, and allows consumer NFs or SCPs to subscribe to and be notified of new / updated producer NF service instance registrations. SCP 101 also supports service discovery and producer NF instance selection. SCP 101 can perform load balancing for connections between consumer and producer NFs.

[0040] NRF 100 is a repository of service profiles for NFs or producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP must obtain an NF or service profile or a producer NF instance from NRF 100. An NF or service profile is a JavaScript Object Notation (JSON) data structure defined in 3GPP Technical Specification (TS) 29.510. An NF or service profile definition includes at least one of a Fully Qualified Domain Name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0041] exist Figure 1 In this context, any of the network functions can be a consumer NF, a producer NF, or both, depending on whether they request a service, provide a service, or request and provide a service. In the illustrated example, the NFs include a PCF 102 that performs policy-related operations in the network, a UDM function 104 that manages user data, and an application function (AF) 106 that provides application services.

[0042] Figure 1 The NF illustrated also includes a Session Management Function (SMF) 108 that manages the session between Access and Mobility Management Function (AMF) 110 and PCF 102. AMF 110 performs mobility management operations similar to those performed by the Mobility Management Entity (MME) in a 4G network. The Authentication Server Function (AUSF) 112 performs authentication services for User Equipment (UE) seeking network access, such as User Equipment (UE) 114.

[0043] The Network Slice Selection Function (NSSF) 116 provides network slicing services for devices seeking access to specific network capabilities and features associated with a network slice. The Network Exposure Function (NEF) 118 provides an application programming interface (API) for application functions seeking information about Internet of Things (IoT) devices and other UEs attached to the network. NEF 118 performs functions similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0044] Radio Access Network (RAN) 120 connects User Equipment (UE) 114 to the network via a radio link. This can be achieved using a g-Node B (gNB). Figure 1 (Not shown in the image) or other wireless access points to access the radio access network 120. The User Plane Function (UPF) 122 can support various proxy functions for user plane services. An example of such proxy function is the Multipath Transmission Control Protocol (MPTCP) proxy function. The UPF 122 can also support performance measurement functions that can be used by the UE 114 to obtain network performance measurements. Figure 1 The diagram also illustrates data network (DN) 124, through which the UE accesses data network services, such as Internet services.

[0045] SEPP 126 filters incoming traffic from another PLMN and performs topology hiding for traffic leaving the home PLMN. SEPP 126 can communicate with the SEPP in the external PLMN that manages the security of the external PLMN. Therefore, traffic between NFs in different PLMNs may pass through two SEPP functions, one for the local PLMN and the other for the external PLMN.

[0046] As mentioned above, one problem with the 3GPP network architecture used for 5G networks is that producer NFs can become overwhelmed by excessive subscriptions from consumer NFs. Figure 2 This is a message flow diagram illustrating exemplary messages exchanged between an NF service consumer and an NF service producer during subscription creation. (Reference) Figure 2 NF service consumer 200 can be a subscriber to other NFs. Figure 1 Any NF shown. NF service producer 202 can be Figure 1 The diagram illustrates the processing of any NF that is subscribed. (See reference.) Figure 2 In the message flow diagram, in line 1, NF service consumer 200 sends an HTTP publish request to NF service producer 202. The HTTP publish request includes a callback URI, which contains additional criteria for filtering the set of events that trigger the notification. In line 2 of the message flow diagram, NF service producer 202 sends a 201 Created message to NF service consumer 200. The 201 Created message indicates that the subscription has been created.

[0047] Creating and maintaining subscriptions utilizes the processing, memory, and storage resources of the NF service producer 202. For example, a record corresponding to a subscription must be created in the subscription database maintained by the NF service producer 202. Whenever its state changes, the NF service producer 202 must repeatedly check the record in its subscription database so that it can determine whether any notification needs to be sent to the NF service consumer. The NF service producer 202 must also maintain a timer for each subscription to determine its expiration time. Processing subsequent messages associated with existing subscriptions (such as update or deletion messages) also consumes processor cycles of the producer NF 202. Because there is no check or enforcement of a subscription number matching the operator-defined guidelines, an excessive number of subscriptions can overwhelm the processing capacity of the NF service producer 202.

[0048] Figure 3 The illustration shows exemplary messages exchanged between NF service consumer 200 and NF service producer 202 when an event triggering the notification requested by the subscription occurs. (Reference) Figure 3 In line 1 of the message flow graph, NF service producer 202 determines that an event has occurred that matches the criteria specified by NF service consumer 200 for receiving notifications. For example, if the NF service producer is an NRF, the event could be receiving a message from the producer NF indicating that the producer NF is available or not available to provide a specific service that NF service consumer 200 has subscribed to receive notifications for. When this event occurs, NF service producer 202 sends an HTTP publish message to NF service consumer 200, including the data requested for the subscription. During the notification, callback references provided during the subscription process are used to send the publish request from NF service producer 202 to NF service consumer 200. When sending the notification, NF service producer 202 acts as an HTTP client, and NF service consumer 200 acts as an HTTP server. Figure 3 In the second row of the message flow diagram shown, NF service consumer 200 responds to a notification with a 200 "Yes" or 204 "No Content" message, depending on whether the published message corresponds to an expected notification about the subscription.

[0049] Given the large number of NF service consumers and the number of subscriptions that a single NF service consumer can create, NF service producers' resources will be overwhelmed. Figure 4 The image below illustrates this scenario. (Reference) Figure 4In line 1, NF service consumer 200 sends a publish message containing subscription request 1 to NF service producer 202. NF service producer 202 receives the publish message containing the subscription request, authenticates the subscribing node, and responds with a 201 Created message in line 2, indicating that the subscription has been successfully created. It should be noted that the number of subscriptions of NF service consumer 200, the PLMN of NF service consumer 200, the total number of subscriptions, etc., are not checked. Therefore, NF service consumer 200 can continue to create N subscriptions to NF service producer 202 until NF service producer 202's processing, memory, or storage resources are exhausted. The Nth subscription is indicated by line N. NF service producer 202 creates the Nth subscription and responds with a 201 Created message in line N+1.

[0050] In line N+2, NF service consumer 200 sends another subscription request to NF service producer 202 to create subscription N+1. At this point, NF service producer 202's processing resources are already overwhelmed. Therefore, NF service producer 202 either sends an error message in line N+3, or is unable to respond to NF service consumer 200 because NF service producer 202 does not have sufficient processing resources to generate a response.

[0051] Figure 4 The scenario illustrated is undesirable because the NF service producer 202 is unable to handle new subscription requests and may even be unable to manage existing subscriptions due to insufficient resources caused by the excessive number of subscriptions from the NF service consumer 200. However, some scenarios may exist that allow NF service consumers to create multiple subscriptions, depending on the NF type, PLMN, or other parameters.

[0052] Figure 5 This is a message flow diagram illustrating an exemplary message exchange, where NF service producer 202 limits the number of allowed subscriptions based on operator-configured guidelines. (Reference) Figure 5 In step 1 of the message flow graph, NF service consumer 200 sends a subscription request to NF service producer 202. NF service producer 202 extracts parameters from the subscription request message, such as the identity of the NF service consumer from the OAuth token or Transport Layer Security (TLS) certificate in the service request message, the source PLMN, the NF type, or other suitable parameters. In step 2, the NF service producer determines whether the parameters extracted from the subscription request message match any of a plurality of rules in the subscription database 500. If the message parameters match any rule in the subscription database 500, then NF service producer 202 increments the subscription count of the corresponding rule or more and determines whether the subscription count exceeds the allowed number of subscriptions for that rule. Figure 5In the example subscription database shown, the rule criteria include combinations of NF type, PLMN, and NF type, as well as wildcard rules for the maximum total number of subscriptions that the NF service producer 202 can handle. It should be noted that in the example database, "NF type" refers to the type of NF that will be specified by the network operator. For example, the operator can specify a maximum allowed number of subscriptions for the NF type of AMF, which is different from the maximum allowed number of subscriptions from the UDM. Furthermore, a current count of the number of subscriptions handled by the NF service producer 202 is stored for each rule. It should be noted that if a criterion from a message matches multiple rules, then in one implementation, if the maximum allowed number of subscriptions exceeds any of the matching rules, then a new subscription can be rejected.

[0053] If the subscription count of one or more matching rules does not exceed the maximum number of allowed subscriptions specified for that rule, then NF service producer 202 may respond with a subscription response message indicating successful subscription creation, as indicated in step 4A. As shown above, the subscription response may be a 201 Created message. If the subscription count of a matching rule exceeds the maximum number of allowed subscriptions for that rule, then NF service producer 202 may send a failure response message indicating subscription creation failure, as shown in step 4B.

[0054] Table 1 below illustrates in more detail the subscription count data that can be included in subscription database 500.

[0055]

[0056] Table 1: Example subscription rule data for NF subscription database

[0057] In Table 1, each row corresponds to a rule used for comparison with new subscription requests. Each rule includes a rule criterion, the corresponding maximum number of allowed subscriptions, and the current subscription count of the NF currently processing the subscriptions that match each rule. The first rule in Table 1 indicates that, for PLMN1, the maximum number of allowed subscriptions is MAX1. The second rule in Table 1 indicates that, for criteria PLMN1 and NFTYPE1, the maximum number of allowed subscriptions is MAX2. The third rule in Table 1 indicates that, for PLMN1 and NFTYPE2, the maximum number of allowed subscriptions is MAX3. The fourth rule in Table 1 indicates that, for NFTYPE1, the maximum number of allowed subscriptions is MAX4. The fifth rule in Table 1 indicates that the maximum number allowed for NFISTANCEID1 is MAX5.

[0058] A subscription count is also maintained for each rule. As indicated above, the subscription count is the number of subscriptions currently being processed by the NF that match each rule. In Table 1, if a subscription request is received from PLMN1 from an NF with NFISTANCEID1 and NF type NFTYPE1, the subscription counts for rules 1, 2, 4, and 5 will increment respectively, because the subscription request matches the criteria specified for each of these rules. If the maximum number of subscriptions matching any rule is exceeded, then in one implementation, the subscription request will be rejected.

[0059] Figure 6 This is a message flow diagram illustrating the operation where the NF service producer rejects subscriptions (202) if the maximum number of subscriptions allowed by the matching rule is exceeded. (Reference) Figure 6 In step 1, NF service consumer 200 sends a publish message with a subscription request for subscription 1 to NF service producer 202. In step 2, NF service producer 202 locates the matching rules. Figure 6 In the example, the matching rule only includes the NF instance ID of NF1, increments the subscription count for the matching rule, and determines whether the incremented subscription count will exceed the maximum allowed number of subscriptions. Figure 6 In the example rule, the maximum number of allowed subscriptions is N, where N > 1. Therefore, the publish message of subscription request 1 will not exceed the maximum number of allowed subscriptions, and in step 3, NF service producer 202 creates a subscription and sends a message to NF service consumer 200 indicating that subscription 1 has been created.

[0060] NF service producer 202 continues to accept new subscriptions from NF service consumer 200. Figure 6 In step N of the message flow, NF service consumer 200 sends a publish message for subscription N to NF service producer 202. In this example, assume that subscription N is the Nth active subscription received from NF service consumer 200. In step N+1, NF service producer 202 increments the current subscription count, causing the current count to equal N. Therefore, since the subscription count equals the maximum number of allowed subscriptions, in step N+2, NF service producer 202 creates the subscription and responds to NF service consumer 200 with a 201 Created message indicating that subscription N has been created.

[0061] In step N+3, NF service consumer 200 sends a publish message to NF service producer 202 to create the (N+1)th subscription. In step N+4, NF service producer 202 increments the current subscription count and determines whether the current subscription count will exceed the maximum number of allowed subscriptions. In this example, the maximum number of allowed subscriptions is N, which is less than the incremented current subscription count (N+1). Therefore, NF service producer 202 does not create a new subscription and optionally sends a message to NF service consumer 200 indicating that the maximum number of subscriptions has been exceeded, as indicated in step N+5.

[0062] Therefore, use Figure 6 By maintaining a maximum allowed number of subscriptions on a rule-by-rule basis, the NF service producer 202 reduces the likelihood of a valid denial-of-service attack from NF service consumers. In other examples shown above, the effectiveness of such attacks from PLMNs, NF types, or any other operator-specified criteria can be reduced. The topics described herein also reduce the likelihood of unintentional denial-of-service, i.e., when NF consumers send too many legitimate subscription requests to the NF service producer. It should also be noted that the maximum number of allowed subscriptions for each rule in database 500 can be set to ensure a relative allocation of resources among consumer NFs according to the network operator's requirements. The total number of allowed subscriptions specified across all rules or by a default rule with wildcard criteria is set such that when the maximum total number of allowed subscriptions is reached, the NF service producer 202 can have reserved processing, storage, and / or memory capacity available for handling the NF service producer's operations.

[0063] Figure 7 This is a block diagram illustrating an exemplary architecture of NF 700 for performing NF subscription policing as described herein. It should be noted that the subscription policing functionality described above with respect to NF service producer 202 can alternatively be implemented at the SCP, since the SCP routes subscription request messages and can therefore be the location where subscription request messages are policing to ensure that the maximum number of subscriptions does not exceed the producer NF's allowed number. Therefore, in Figure 7 In this context, NF 700 can be a producer NF (such as NF service producer 202) or an SCP that routes messages to a producer NF and performs subscription supervision on behalf of the producer NF. Figure 7In this configuration, NF 700 includes at least one processor 702 and memory 704. NF 700 may also include an NF subscription database 706, which stores subscription-related data if NF 700 is an NF service producer. NF subscription database 706 may also store (if NF 700 is an NF service producer or SCP) the maximum allowed subscription rules described above with respect to Table 1. If NF 700 is an NF service producer that receives and processes subscriptions from consumer NFs, NF 700 also includes an NF subscription handler 708. If NF 700 is an NF service producer or SCP, NF 700 may include an NF subscription regulator 710, which performs the aforementioned regulation to ensure that the maximum number of subscriptions is not exceeded according to the rules provided in NF subscription database 706.

[0064] With NF 700 acting as an SCP, the subscription database 706 can be configured with subscription censorship rules on a per-NF service producer basis, such as those shown in Table 1, for each NF service producer that the SCP routes subscription request messages to. From a scalability and efficiency perspective, it can be advantageous to use a centralized node such as an SCP to censor subscriptions on behalf of multiple NF service producers. If a subscription request passes the subscription censorship, the NF 700, acting as the SCP, can route the subscription request message to the producer NF that can create the requested subscription. If the subscription request message fails the subscription censorship, the NF 700 can discard the message instead of routing it to the producer NF, thus preventing the requested subscription from being established.

[0065] Figure 8 This is a flowchart illustrating an exemplary process for mitigating denial-of-service attacks at a producer's NF or SCP based on subscription rules. (Reference) Figure 8 In step 800, the process includes maintaining an NF subscription database at the first NF containing rules specifying the maximum number of allowed subscriptions and corresponding criteria. For example, the first NF can be a producer NF or an SCP. The NF subscription database can specify criteria such as NF instance ID, PLMN ID, NF type, or any combination thereof, and can specify the maximum number of allowed subscriptions matching each set of criteria.

[0066] In step 802, the process includes receiving a subscription request from a second NF at the first NF to establish a subscription. For example, a producer NF or SCP can receive a subscription request to receive an update notification about the state of the producer NF that received the subscription request, or, in the case of an SCP, an update notification about the state of the producer to which the SCP routes messages on behalf of the consumer NF.

[0067] In step 804, the process includes the first NF determining whether the subscription request matches the criteria of at least one rule in the NF subscription database. For example, the producer NF or SCP can extract parameters such as NF instance ID, NF type, PLMN ID from the subscription request message and use these parameters to perform a lookup in the NF subscription database. The first NF can compare the parameters extracted from the message with the rule criteria for each rule in the database and identify one or more matching rules.

[0068] In step 806, the process includes incrementing the subscription count for each matching rule by the first NF. For example, the producer NF or SCP may maintain a subscription count for each rule, indicating the number of active subscriptions maintained by the producer NF to which messages matching the criteria of a given rule are routed by the producer NF or SCP. When a request for a new subscription is received, the producer NF or SCP may update or increment the subscription count for each matching rule.

[0069] In step 808, the process includes determining, by the first NF, the maximum number of allowed subscriptions where the subscription count exceeds one or more matching rules. For example, the producer NF or SCP can update the subscription count for each rule identified as matching parameters extracted or derived from the current subscription request and determine the maximum count exceeding one of the rules.

[0070] In step 810, the process includes preventing subscription creation. For example, if the producer NF or SCP determines that creating a subscription for the current subscription request would exceed the maximum allowed subscription count of any rule, then the producer NF or SCP can prevent the establishment of the first subscription, drop, or discard the subscription request message, and optionally send an error message to the consumer NF that sent the subscription request.

[0071] Therefore, the topics described herein mitigate denial-of-service attacks by reducing the likelihood of oversubscription at a producer NF or SCP. As mentioned above, the topics described herein apply to any producer NF that utilizes subscriptions to communicate with a consumer NF, or to an SCP of a producer NF by routing subscription request messages to the producer NF. Examples of producer NFs from which the topics described herein can be implemented include NRF, PCF, BSF, NSSF, UDR, UDM, or NEF. Implementing the topics described herein at centralized nodes such as NRFs or SCPs is considered particularly advantageous because such nodes may face an increased risk of denial-of-service attacks due to the number of subscriptions they can handle.

[0072] The publicly available information in each of the following references is incorporated into this paper in its entirety through citation.

[0073] References

[0074] 1. 3GPP TS 23.502 V16.7.0 (2020-12), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS); Stage 2, (Release 16).

[0075] 2. 3GPP TS 23.501V16.7.0(2020-12), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System Architecture for the 5G System (5GS), Stage 2; (Release 16).

[0076] 3. 3GPP TS29.510V17.0.0 (2020-12), 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; NetworkFunction Repository Services; Stage 3 (Release 17).

[0077] It should be understood that various details of the subject matter described herein may be changed without departing from the scope of the subject matter described herein. Furthermore, the foregoing description is for illustrative purposes only and not for limiting purposes, as the subject matter described herein is defined by the claims set forth below.

Claims

1. A method for mitigating denial-of-service (DoS) attacks at a network function (NF), the method comprising: Maintain an NF subscription database at the first NF containing rules specifying the maximum number of allowed subscriptions and corresponding rule criteria; At the first NF, a subscription request for establishing a subscription is received from the second NF; The criteria for determining whether a subscription request matches a rule in the NF subscription database are used by the first NF. The first NF increments by at least one count of the number of subscriptions for at least one rule; The at least one count, determined by the first NF, exceeds the maximum number of subscriptions allowed by the at least one rule; as well as In response to the determination that at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions of at least one rule, the establishment of a subscription is blocked.

2. The method of claim 1, wherein the first NF includes the producer NF.

3. The method of claim 1, wherein the first NF includes a Service Communication Agent (SCP).

4. The method of any one of claims 1 to 3, wherein maintaining the NF subscription database includes maintaining a database of rules having at least one criterion having a specified NF type.

5. The method of claim 4, wherein determining whether a subscription request matches a criterion of at least one rule in the NF subscription database comprises extracting or inferring NF type information from the subscription request and using the NF type information extracted or inferred from the subscription request as a key to match the criterion specified for the rule in the database.

6. The method of any one of claims 1 to 3, wherein maintaining the NF subscription database includes maintaining a database of at least one rule having criteria for specifying a Public Land Mobile Network (PLMN).

7. The method of claim 6, wherein determining whether a subscription request matches a criterion of at least one rule in the NF subscription database comprises extracting or inferring PLMN information of a second NF from the subscription request, and using the PLMN information of the second NF extracted or inferred from the subscription request as a key to match the criterion specified for the rule in the database.

8. The method of any one of claims 1 to 3, wherein maintaining the NF subscription database includes maintaining a database of at least one rule having a criterion specifying an NF instance ID, and wherein determining that a subscription request matches a criterion of at least one rule in the NF subscription database includes extracting the NF instance ID from the subscription request and using the NF instance ID extracted from the subscription request as a key to match it with a criterion specified for a rule in the database.

9. The method of any one of claims 1 to 3, wherein maintaining the NF subscription database includes maintaining a count of the number of subscriptions currently being processed by the first NF that match the criteria of each rule.

10. The method of claim 9, wherein: Determining whether a subscription request matches a criterion in the NF subscription database includes determining whether the subscription request matches a criterion in multiple rules in the database. Incrementing the count of subscriptions for at least one rule by the first NF includes incrementing the count of each rule having a criterion that matches the subscription request; as well as The determination by the first NF that the count of at least one subscription exceeds the maximum number of allowed subscriptions of the at least one rule includes determining that the count of the subscriptions of any rule with a criterion for matching subscription requests exceeds the maximum number of allowed subscriptions of the rule.

11. A system for mitigating denial-of-service (DoS) attacks at a network function (NF), the system comprising: The first NF includes at least one processor and memory; The NF subscription database is implemented in memory and contains rules specifying the maximum number of allowed subscriptions and corresponding rule criteria; as well as An NF subscription regulator is configured to receive a subscription request from a second NF for establishing a subscription, determine that the subscription request matches a criterion of at least one rule in the NF subscription database, increment at least one count of the number of subscriptions under the at least one rule, determine that the at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions under the at least one rule, and prevent the establishment of a subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions under the at least one rule.

12. The system of claim 11, wherein the first NF includes the producer NF.

13. The system of claim 11, wherein the first NF includes a service communication agent (SCP).

14. The system of any one of claims 11 to 13, wherein the NF subscription database includes at least one rule having criteria specifying the NF type.

15. The system of claim 14, wherein, When determining that a subscription request matches a criterion of at least one rule in the NF subscription database, the NF subscription regulator is configured to extract or infer NF type information of a second NF from the subscription request and use the NF type information of the second NF extracted or inferred from the subscription request as a key to match the criterion specified for the rule in the database.

16. The system of any one of claims 11 to 13, wherein the NF subscription database includes at least one rule having criteria for specifying a Public Land Mobile Network (PLMN), and wherein, When determining that a subscription request matches a criterion of at least one rule in the NF subscription database, the NF subscription regulator is configured to extract or infer the PLMN identifier of a second NF from the subscription request and use the PLMN identifier extracted or inferred from the subscription request as a key to match against the criteria specified for the rules in the database.

17. The system of any one of claims 11 to 13, wherein the NF subscription database includes at least one rule having a criterion specifying an NF instance ID, and wherein, When determining whether a subscription request matches a criterion of at least one rule in the NF subscription database, the NF subscription regulator is configured to extract the NF instance ID from the subscription request and use the extracted NF instance ID as a key to match the criterion specified for the rule in the database.

18. The system of any one of claims 11 to 13, wherein the NF subscription regulator is configured to maintain a count of the current number of subscriptions that match the criteria of each rule and are handled by the first NF.

19. The system of claim 18, wherein: When determining whether a subscription request matches the criteria of at least one rule in the NF subscription database, the NF subscription regulator is configured to determine whether a subscription request matches the criteria of multiple rules in the NF subscription database. When incrementing at least one count of the number of subscriptions for the at least one rule, the NF subscription regulator is configured to increment the count of each rule having a criterion that matches the subscription request; as well as When the count of at least one subscription exceeds the maximum number of allowed subscriptions of the at least one rule, the NF subscription regulator is configured to determine that the count of the subscriptions of any rule with criteria matching the subscription request exceeds the maximum number of allowed subscriptions of the rule.

20. A non-transitory computer-readable medium having executable instructions stored thereon, the executable instructions controlling the computer to perform the following steps when executed by a computer's processor: Maintain an NF subscription database at the first network function (NF) containing rules specifying the maximum number of allowed subscriptions and corresponding rule criteria; At the first NF, a subscription request for establishing a subscription is received from the second NF; The criteria for determining whether a subscription request matches a rule in the NF subscription database are used by the first NF. The first NF increments by at least one count of the number of subscriptions for at least one rule; The at least one count, determined by the first NF, exceeds the maximum number of subscriptions allowed by the at least one rule; as well as In response to the determination that at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions of at least one rule, the establishment of a subscription is blocked.

Images