Method, system and computer readable medium for platform firewall management via a network function (NF) repository function (NRF) or a service communication proxy (SCP)

Abstract

A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication agent (SCR), comprising receiving a message related to registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The method also includes determining that the registration, update, or deregistration of the NF profile requires a change to a firewall rule configuration of the platform firewall. The method also includes, in response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall, automatically updating the firewall rule configuration of the platform firewall by the NRF or SCR.

Description

[0001] Priority Claim

[0002] This application claims priority to U.S. patent application serial No. 17 / 308,018 filed on May 4, 2021, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The subject matter described herein relates to security in telecommunications networks. More specifically, the subject matter described herein relates to methods, systems, and computer-readable media for platform firewall management via NRF or SCP. Background Art

[0004] In a 5G telecommunication network, a network function that provides a service is referred to as a producer NF or NF service producer. A network function that consumes a service is referred to as a consumer NF or NF service consumer. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function consumes a service, produces a service, or consumes and produces a service. The terms "producer NF" and "NF service producer" are used interchangeably herein. Similarly, the terms "consumer NF" and "NF service consumer" are used interchangeably herein.

[0005] A given producer NF may have many service endpoints, where a service endpoint is a contact point for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of an Internet Protocol (IP) address and a port number, or a fully qualified domain name that resolves to an IP address and a port number on a network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include more than one NF instance. It should also be noted that multiple NF instances may share the same service endpoint.

[0006] The producer NF registers with the Network Function Repository Function (NRF). The NRF maintains service profiles of available NF instances that identify the services supported by each NF instance. The terms "service profile" and "NF profile" are used interchangeably in this article. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.

[0007] In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the service communication proxy, and the service communication proxy load balances traffic between producer NF service instances that provide the required service, or routes traffic directly to the destination producer NF instance.

[0008] In addition to SCP, another example of an intermediate proxy node that routes traffic between producer and consumer NFs is the Security Edge Protection Proxy (SEPP). SEPP is a network node used to protect control plane traffic exchanged between different 5G Public Land Mobile Networks (PLMNs). Thus, SEPP performs message filtering, policing, and topology hiding on all Application Programming Interface (API) messages transmitted between PLMNs.

[0009] One problem in 5G communication networks is that configuring a firewall that protects the network by filtering packets entering and / or leaving the network is a labor-intensive and error-prone task. A firewall that protects a 5G (or subsequent generation) core network by filtering packets entering and / or leaving the network is referred to herein as a platform firewall.

[0010] 5G NFs are deployed in a network protected by firewall rules that can filter packets based on source and destination IP addresses, source and destination ports, and protocols, in addition to other 5G defined security mechanisms. One of the configuration challenges that arise is to keep the firewall rules synchronized with the 5G NF topology changes made by the NRF as changes to the NF profile containing the 5G NF IP address and port details. Performing such configuration manually can be time-consuming and labor-intensive, and prone to errors. For example, as NF instances are instantiated, updated, and removed from service, NF profiles may change rapidly, especially in cloud network implementations of 5G systems. The platform firewall protecting the 5G network needs to be updated based on the changes in the network topology. However, there is no defined mechanism to keep the platform firewall rules synchronized with the NF profile changes in the 5G network.

[0011] In view of these and other difficulties, there is a need for improved methods, systems, and computer-readable media for managing platform firewalls. Summary of the invention

[0012] A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication proxy (SCP), comprising receiving a message related to registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The method also includes determining that the registration, update, or deregistration of the NF profile requires a change to a firewall rule configuration of the platform firewall. The method also includes, in response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall, automatically updating the firewall rule configuration of the platform firewall by the NRF or SCP.

[0013] According to another aspect of the subject matter described herein, receiving a message related to registering, updating, or deregistering a NF profile includes receiving a NFRegister request or response related to registering the NF profile with the NRF.

[0014] According to another aspect of the subject matter described herein, automatically updating a firewall rule configuration of a platform firewall includes adding a rule to the firewall rule configuration to filter packet traffic in and out of the NF.

[0015] According to another aspect of the subject matter described herein, receiving a message related to registering, updating, or deregistering a NF profile includes receiving a NFUpdate request or response related to updating a NF profile to an NRF.

[0016] According to another aspect of the subject matter described herein, automatically updating a configuration of a platform firewall includes updating rules of a firewall rule configuration to filter packet traffic in and out of a NF.

[0017] According to another aspect of the subject matter described herein, a method for automatically updating a rule configuration of a platform firewall includes determining that a message related to registering, updating, or deregistering a NF profile includes a fully qualified domain name (FQDN) of the NF, and wherein the method further includes querying a DNS server to resolve the FQDN of the NF into an Internet Protocol (IP) address of the NF.

[0018] According to another aspect of the subject matter described herein, receiving a message related to registering, updating, or deregistering a NF profile includes receiving a NFDeregister request or response related to deregistering a NF profile with an NRF.

[0019] According to another aspect of the subject matter described herein, automatically updating a configuration of a platform firewall includes deleting a rule of a firewall rule configuration corresponding to a NF profile.

[0020] According to another aspect of the subject matter described herein, automatically updating a configuration of a platform firewall includes calling a configuration application programming interface (API) of the platform firewall.

[0021] According to another aspect of the subject matter described herein, automatically updating a configuration of a platform firewall includes updating a plurality of platform firewalls located at different network sites.

[0022] According to another aspect of the subject matter described herein, a system for automatically managing a platform firewall is provided. The system includes a network function (NF) repository function (NRF) or a service communication agent (SCP), which includes at least one processor and a memory. The system also includes a platform firewall rule configuration manager for receiving messages related to registering, updating or deregistering NF profiles in a NF profile database separated from the platform firewall, determining that the registration, update or deregistration of the NF profile requires a change in the firewall rule configuration of the platform firewall, and automatically updating the firewall rule configuration of the platform firewall through the NRF or SCP in response to determining that the registration, update or deregistration of the NF profile requires a change in the firewall rule configuration of the platform firewall.

[0023] According to another aspect of the subject matter described herein, a message related to registering, updating, or deregistering a NF profile includes a NFRegister request or response related to registering a NF profile with an NRF.

[0024] According to another aspect of the subject matter described herein, when automatically updating a configuration of a platform firewall, a platform firewall rule configuration manager is configured to add rules to the firewall rule configuration to filter packet traffic in and out of the NF.

[0025] According to another aspect of the subject matter described herein, a message related to registering, updating or deregistering a NF profile includes a NFUpdate request or response related to updating a NF profile to an NRF.

[0026] According to another aspect of the subject matter described herein, when automatically updating a configuration of a platform firewall, a platform firewall rule configuration manager is configured to update rules of the firewall rule configuration to filter packet traffic in and out of the NF.

[0027] According to another aspect of the subject matter described herein, the platform firewall rule configuration manager is configured to determine that a message related to registering, updating, or deregistering a NF profile includes a fully qualified domain name (FQDN) of the NF, and query a DNS server to resolve the FQDN of the NF to an Internet Protocol (IP) address of the NF.

[0028] According to another aspect of the subject matter described herein, messages related to registering, updating or deregistering NF profiles include NFDeregister requests or responses related to deregistering NF profiles to NRFs, and wherein, when automatically updating the configuration of the platform firewall, the platform firewall rule configuration manager is configured to delete rules of the firewall rule configuration corresponding to the NF profile identified in the NFDeregister request or response.

[0029] According to another aspect of the subject matter described herein, when automatically updating a configuration of a platform firewall, a platform firewall rule configuration manager is configured to call a configuration application programming interface (API) of the platform firewall.

[0030] According to another aspect of the subject matter described herein, a platform firewall rule configuration manager is configured to update rule configurations of a plurality of platform firewalls located at different network sites.

[0031] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium having executable instructions stored thereon is provided, which when executed by a processor of a computer controls the computer to perform steps. The steps are performed at a network function (NF) repository function (NRF) or a service communication agent (SCP) implemented by at least one processor. The steps also include receiving a message related to registering, updating or deregistering an NF profile in an NF profile database separated from a platform firewall. The steps also include determining that the registration, update or deregistration of the NF profile requires a change in the firewall rule configuration of the platform firewall. The steps also include automatically updating the firewall rule configuration of the platform firewall by NRF or SCP in response to determining that the registration, update or deregistration of the NF profile requires a change in the firewall rule configuration of the platform firewall.

[0032] The subject matter described herein can be implemented with software combined with hardware and / or firmware. For example, the subject matter described herein can be implemented with software executed by a processor. In an exemplary embodiment, the subject matter described herein can be implemented using a non-transient computer-readable medium having computer executable instructions stored thereon, which controls the computer to perform steps when executed by the processor of the computer. Exemplary computer-readable media suitable for implementing the subject matter described herein include non-transient computer-readable media, such as disk memory devices, chip memory devices, programmable logic devices, and application-specific integrated circuits. In addition, the computer-readable medium implementing the subject matter described herein can be located on a single device or computing platform or can be distributed on multiple devices or computing platforms. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Exemplary embodiments of the subject matter described herein will now be explained with reference to the accompanying drawings, in which:

[0034] Figure 1 is a network diagram illustrating an exemplary 5G system network architecture;

[0035] Figure 2 is a network diagram illustrating a firewall positioned between a trusted network and an untrusted network;

[0036] Figure 3 is a message flow diagram illustrating exemplary messages exchanged for automatically configuring a platform firewall using NRF;

[0037] Figure 4 is a network diagram illustrating NRF managing multiple platform firewalls located at different sites;

[0038] Figure 5 is a block diagram illustrating an exemplary architecture of an NRF or SCP for automatically managing a platform firewall; and

[0039] Figure 6 is a flow chart illustrating an exemplary process for managing a platform firewall using NRF or SCP. DETAILED DESCRIPTION

[0040] Figure 1 is a block diagram illustrating an exemplary 5G system network architecture. Figure 1 The architecture in includes NRF 100 and SCP 101, which may be located in the same Home Public Land Mobile Network (HPLMN). As described above, NRF 100 may maintain profiles of available producer NF service instances and the services they support, and allow consumer NF or SCP to subscribe to new / updated producer NF service instances and be notified of registrations of these instances. SCP 101 may also support service discovery and selection of producer NF instances. SCP 101 may perform load balancing of connections between consumer NFs and producer NFs.

[0041] The NRF 100 is a repository of the NF or service profile of the producer NF instance. In order to communicate with the producer NF instance, the consumer NF or SCP must obtain the NF or service profile of the producer NF instance from the NRF 100. The NF or service profile is a JavaScript Object Notation (JSON) data structure defined in 3GPP TS29.510. The NF or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0042] exist Figure 1 In the example shown, any network function can be a consumer NF, a producer NF, or both, depending on whether they are requesting services, providing services, or requesting and providing services. In the example shown, the NFs include a policy control function (PCF) 102 that performs policy-related operations in the network, a unified data management (UDM) function 104 that manages user data, and an application function (AF) 106 that provides application services.

[0043] Figure 1The NF shown in FIG. 1 also includes a session management function (SMF) 108, which manages sessions between an access and mobility management function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a mobility management entity (MME) in a 4G network. An authentication server function (AUSF) 112 performs authentication services for user equipment (UE) such as user equipment (UE) 114 seeking to access the network.

[0044] The Network Slice Selection Function (NSSF) 116 provides network slicing services to devices seeking to access specific network capabilities and features associated with a network slice. The Network Exposure Function (NEF) 118 provides an Application Programming Interface (API) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs attached to the network. The NEF 118 performs functions similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0045] Radio access network (RAN) 120 connects user equipment (UE) 114 to the network via wireless links. gNode B (gNB) ( Figure 1 The UE 114 may use a wireless access point (not shown) or other wireless access point to access the radio access network 120. The user plane function (UPF) 122 may support various proxy functions for user plane services. An example of such a proxy function is a multipath transmission control protocol (MPTCP) proxy function. The UPF 122 may also support a performance measurement function that the UE 114 may use to obtain network performance measurements. Figure 1 Also illustrated in FIG. 1 is a data network (DN) 124 through which the UE accesses data network services, such as Internet services.

[0046] SEPP 126 filters incoming traffic from another PLMN and performs topology hiding for traffic leaving the home PLMN. SEPP 126 can communicate with a SEPP in a foreign PLMN, which manages security for that foreign PLMN. Thus, traffic between NFs in different PLMNs can traverse two SEPP functions, one for the home PLMN and the other for the foreign PLMN.

[0047] Figure 2 is a network diagram illustrating an exemplary firewall located between a trusted network and an untrusted network. In general, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically creates a barrier between a trusted network and an untrusted network. One type of network firewall is a packet filter that inspects packets transmitted between 5G entities. In some cases, packets are filtered based on source and destination IP addresses, source and destination ports, and protocols.

[0048] As mentioned above, one of the issues that will arise in 5G networks is the management of the platform firewall that protects the 5G network. Specifically, it is necessary to ensure that the firewall rules are synchronized with the changes in the NF profile that appear at the NRF. The NF profile is a data structure with attributes defined in 3GPP TS 29.510. An exemplary list of NF profile attributes is found in Table 6.2.6.2.3-1 of 3GPP TS 29.510. Updates to any of these attributes can be used to trigger automatic updates to the platform firewall rule configuration.

[0049] The following list illustrates examples of NF profile attributes that may be included in a platform firewall rule and whose updates may be used to trigger automatic updates to the platform firewall rule configuration.

[0050] The fully qualified domain name (FQDN) of the network function;

[0051] The IPv4 address of the network function;

[0052] The IPv6 address of the network function;

[0053] The FQDN of the service instance; and

[0054] IpEndPoint: The IP address and port information of the network function where the service listens for incoming service requests.

[0055] Additional or alternative attributes from Table 6.2.6.2.3-1 of 3GPP TS 29.510 may be used to configure platform firewall rules. Because the NRF stores NF profiles of NFs that have been registered for discovery by other NFs in the network, the NRF possesses most, if not all, of the information needed to configure the platform firewall. However, when NF profiles are added, updated, or deleted at the NRF, there is no defined mechanism for updating the set of firewall rules used by the platform firewall to filter packets.

[0056] Platform firewalls generally expose configuration APIs to automate the firewall configuration process. For example, some platform firewalls expose a representational state transfer (REST) ​​API to configure firewall rules. However, the subject matter described herein is not limited to using a REST API to configure firewall rules. Any suitable API for configuring firewall rules is intended to fall within the scope of the subject matter described herein. In addition, although the firewall has an API for configuration, there is no defined mechanism for synchronizing firewall rule changes with changes in the NF profile.

[0057] The platform firewall needs to be configured according to the 5G NF topology configuration, and then the firewall is kept in sync with the 5G NF topology updates. The manual configuration process is cumbersome and error-prone. The platform firewall process needs to be automated. The 5GC network can span multiple sites, which makes the manual process complex and increases the need for automated configuration.

[0058] In one exemplary embodiment, the NRF is enhanced to automatically configure platform firewall rules. The NRF monitors the creation / deletion / update of NF profiles. The NRF determines whether the change in the NF profile requires a change in the firewall rule configuration of the platform firewall rule configuration. If the change in the NF profile requires a change in the firewall rule configuration, then the NRF takes steps to update the corresponding platform firewall rule configuration. If the IP address is not already provided in the NF profile or based on the operator configuration, then one such step may be to resolve the FQDN to an IP address. The NRF may then call the appropriate platform API for firewall rule creation / deletion / update.

[0059] One example of a NF profile change that may require a change to the firewall rule configuration is NF registration. When a NF registers with an NRF, the NF provides its NF profile to the NRF. The NF profile includes an FQDN or IP address at which to contact the NF for services. Adding a new NF profile to the NRF may trigger the creation of at least one firewall rule at the platform firewall. For example, one firewall rule created in such an instance is to allow certain types of traffic to and from the IP address or FQDN of the newly registered NF.

[0060] Another example of a NF profile change that may require a change to the firewall rule configuration is an update to the contact address of the NF profile. For example, if the IP address or FQDN at which the NF is contacted for services changes, then the corresponding platform firewall rule(s) should be updated with the corresponding contact address so that packets to and from the updated contact address can pass through the firewall and be filtered.

[0061] Yet another example of a NF profile change that may require a change to the firewall rule configuration is NF profile deregistration. Deregistering an NF profile with the NRF results in the NF profile being deleted from the NF profile database maintained by the NRF. If an NF profile is deleted, the corresponding platform firewall rules for the deleted NF profile should also be deleted so that the contact address for the deregistered NF cannot send attack traffic through the firewall.

[0062] Figure 3 is a message flow diagram illustrating exemplary messages exchanged to configure a platform firewall. Figure 3 , in row 1, 5G NF 300 (which may be Figure 1100) sends a NFRegister, NFUpdate or NFDeregister request to NRF 100. The NFRegister request is a message to register an NF profile with NRF 100. The NFRegister request includes the NF profile being registered. The NFUpdate request is a message for updating one or more attributes of the NF profile registered with NRF 100. The NFDeregister message is a message for deregistering the profile currently registered with NRF 100, which causes the NF profile to be deleted. In line 2 of the message flow diagram, NRF 100 returns a response to the NFRegister, NFUpdate or NFDeregister request. If the request in line 1 is a NFRegister request and the operation is successful, the response in line 2 may be a 201 "Created" message. If the request in line 1 is a NFUpdate request and the operation is successful, the response may be a 200OK message. If the request in line 1 is a NFDeregister request, the response in line 2 may be a 201 "No Content" message.

[0063] Any of the NFRegister, NFUpdate, and NFDeregister operations, if successful, may require changes to the platform firewall rule configuration. Thus, in lines 3-6 of the message flow diagram, the NRF 100 signals the DNS server 302 and the platform firewall 304 to update one or more firewall rules. For example, in line 3, the NRF 100 sends a DNS query to the DNS server 402 to resolve the FQDN in the NF profile updated or created by one of the operations in line 1 into an IP address. In line 4, the DNS server 402 responds to the query with one or more IP addresses corresponding to the FQDN in the DNS query. It should be noted that the DNS query in line 3 is optional and can be omitted if the NF profile includes an IP address instead of an FQDN to identify the NF or NF instance.

[0064] Once the NRF 100 receives the IP address or other parameters required to update one or more firewall rules, in line 5, the NRF 100 calls the appropriate platform firewall configuration API to update one or more firewall rules used by the platform firewall 304. Calling the platform firewall configuration API may include transmitting a message formatted according to the API to the platform firewall 304 and including the updated firewall rule parameters. The platform firewall 304 receives the message, authenticates the sender, updates one or more of its packet filtering rules using the updated NF profile information received from the NRF 100, and in line 6, returns a response to the NRF 100 indicating that the NF rule update was successful.

[0065] To configure the platform firewall 304, the NRF 100 may utilize the properties in Table 1 below:

[0066] property describe API Endpoint Platform firewall configuration API endpoint, e.g. FQDN API Prefix Platform firewall configuration API prefix (optional) Security Credentials Security credentials for accessing the platform firewall configuration API

[0067] Table 1: NRF configuration properties for accessing the platform firewall configuration API

[0068] As can be seen from Table 1, the parameters required to access the platform firewall configuration API include an API endpoint, which can be the FQDN or IP address and port number of the endpoint for receiving firewall rule configuration parameters. The parameters may also include an API prefix. The configuration parameters may also include security credentials for accessing the platform firewall configuration API, such as login credentials.

[0069] An NRF configured to automatically configure a platform firewall as described above may be used to configure multiple platform firewalls located at different sites. Figure 4 This embodiment is illustrated in the figure. Figure 4 , NRF 100 is located at site 1, which may also include platform firewall 304A as well as UDM 104A, user data repository (UDR) 400A, PCF 102A, charging function (CHF) 402A, subscription locator function (SLF) 404A and SCP 101A. Site 2 includes platform firewall 304B, SMF 108B, AMF 110B, UPF 122B and SCP 101B. Site 3 includes platform firewall 304C, SMF 108C, AMF 110C, UPF 122C and SCP 101C. Site 4 includes platform firewall 304D, SMF 108D, AMF 110D, UPF 122D and SCP 101D. The NRF 100 receives NF profile updates from NFs located at sites 1-4, and updates the platform firewalls 304A-304D based on the NF profile updates. For example, if the SCP 101D located in site 4 updates its NF profile to the NRF 100, then the NRF 100 can update firewall rules to any or all platform firewalls 304A-304D with parameters affected by the NF profile update. An example of such a rule can be to allow traffic from the IP address of the SCP 101D. If the IP address of the SCP 101D changes due to the NF profile update, then the NRF 100 can update the firewall rules in each of the platform firewalls 304A-304D to allow traffic from the new IP address of the SCP 101D.

[0070] It should be noted that NRF 100 can maintain different rule configurations for each of platform firewalls 304A-304D, where the different configurations contain site-specific packet filtering rules for each firewall. For example, for platform firewall 304A located at site 1, NRF 100 can maintain and automatically update firewall rule configurations for filtering packets in and out of IP addresses associated with UDM 104A, UDR 400A, PCF 102A, SLF 404A, SCP 101A, and NRF 100. For platform firewall 304B located at site 2, NRF 100 can maintain and automatically update firewall rule configurations for filtering packets in and out of SMF 108B, AMF 110B, UPF 122B, and SCP 101B. For the platform firewall 304C located at site 3, the NRF 100 can maintain and automatically update the firewall rule configuration for filtering packets in and out of the SMF 108C, AMF 110C, UPF 122C, and SCP 101C. For the platform firewall 304D located at site 4, the NRF 100 can maintain and automatically update the firewall rule configuration for filtering packets in and out of the SMF 108D, AMF 110D, UPF 122D, and SCP 101D.

[0071] In the above example, the process for automatically managing the platform firewall is performed by NRF 100. In an alternative embodiment, the automated platform firewall management may be performed by SCP 101. Figure 5 is a block diagram illustrating an exemplary architecture of an NRF 100 or SCP 101 capable of automatically updating platform firewall rules in response to NF profile changes. Figure 5 , the NRF 100 or SCP 101 includes at least one processor 500 and a memory 502. If the automatic platform firewall database update is implemented at the NRF, the NRF 100 also includes a NF profile database 504 for storing NF profiles of NFs registered with the NRF 100 and a NF profile database manager 506 for updating the NF profile database 504 in response to NFRegister, NFUpdate and NFDeregister requests from the NFs. If the automatic platform firewall database update functionality is implemented at the SCP, the NF profile database 504 and the NF profile database manager 506 may be implemented elsewhere (i.e., at the NRF), and the automatic platform firewall rule configuration update process described herein may be triggered by receiving NFRegister, NFUpdate and NFDeregister responses from the NRF confirming successful completion of the requested service operations.

[0072] The NRF 100 or SCP 101 also includes a platform firewall rule configuration manager 508 for performing the steps described herein to update the firewall rules managed by the platform firewall in response to NF profile updates. The platform firewall rule configuration manager 508 can be implemented using computer executable instructions stored in the memory 502 and executed by the processor 500. The NRF 100 or SCP 101 may also include a local (master) copy 510 of the platform firewall rule configuration database. When the platform firewall rule configuration manager 508 receives a request or response related to the registration, update, or deregistration of an NF profile, the platform firewall rule configuration manager 508 can identify the NF profile or profile attributes affected by the requested service operation, access the database copy 510 to identify firewall rules with the same attributes or parameters being updated or deleted, perform the requested firewall rule update on the local copy 510 of the platform firewall rule configuration database, and distribute the required rule configuration updates to the platform firewalls managed by the platform firewall rule configuration manager 508. As described above with respect to Figure 4 As described, different platform firewalls may receive different rule updates because the networks or sites they protect may include different NF instances and therefore require different firewall rule configurations.

[0073] Figure 6 is a flow chart illustrating an exemplary process for managing a platform firewall by automatically provisioning platform firewall rules in response to NF profile changes. Figure 6 , in step 600, the process includes receiving a message related to registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. For example, the NRF 100 may receive a NFRegister, NFUpdate, or NFDeregister request from a NF seeking to register, update, or deregister an NF profile with the NRF 100. In the case of an SCP implementation of the subject matter described herein, the automatic platform firewall rule configuration process may be triggered by receiving a response message confirming a successful registration, update, or deregistration of the NF profile. Thus, in an SCP implementation of the subject matter described herein, step 600 may include receiving a NFRegister, NFUpdate, or NFDeregister response message.

[0074] If the process is implemented by the NRF, then control proceeds to step 602A, where the process also includes registering, updating, or deregistering the NF profile based on the type of request. For example, if the request is a NFRegister request, then the NRF 100 may register the NF by storing the NF profile in the NF profile database. If the request is a NFUpdate request, then the NRF 100 may update the NF profile based on the parameters identified in the NFUpdate request. If the request is a NFDeregister request, then the NRF 100 may delete the NF profile identified in the NFDeregister request.

[0075] If the process is implemented by an SCP, control passes from step 600 to step 602B, where the SCP routes the NFRegister, NFUpdate, or NFDeregister response to the NF that requested the requested NFRegister, NFUpdate, or NFDeregister service operation.

[0076] After step 602A or 602B, control proceeds to step 604, where the process also includes determining whether the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall. In the case of an NFRegister request or response, the platform firewall rule configuration manager 508 can determine that the rules corresponding to the NF profile being registered need to be added to the local (master) copy of the platform firewall rule configuration database at the NRF 100 or SCP 101. If the message received by the NRF 100 or SCP 101 is an NFUpdate request or response, the platform firewall rule configuration manager 508 can identify the NF profile attribute being updated by the NFUpdate service operation, and determine whether the NF profile attribute being updated is used by any rule in the local copy of the platform firewall rule configuration database at the NRF 100 or SCP 101, and update the corresponding attribute in the platform firewall rule. If the message received by the NRF 100 or SCP 101 is a NFDeregister request or response, the platform firewall rule configuration manager 508 may determine that one or more rules corresponding to the NF profile being deregistered need to be deleted from the platform firewall rule configuration database local to the NRF 100 or SCP 101.

[0077] In step 606, the process also includes automatically updating the firewall rule configuration of the platform firewall by the NRF or SCP in response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall. For example, the platform firewall rule configuration manager 508 may call or use the firewall configuration API of the platform firewall 304 to add, modify, or delete rules from the firewall rule configuration database. The platform firewall rule configuration manager 508 may first update one or more rules in the local copy of the platform firewall rule configuration database. The platform firewall rule configuration manager 508 may then formulate a message in a format specified by the platform firewall rule configuration API for performing the requested firewall rule configuration update, and then send the message to one or more platform firewalls to update their respective firewall rule configurations. It should be noted that Figure 6 The steps in may be performed continuously so that synchronization between (one or more) platform firewall rule configurations and NF profile changes to the NRF is maintained.

[0078] Tables 2 and 3 shown below illustrate examples of firewall rules that may be updated in response to an NFUpdate service operation. In this example, assume that the NFUpdate service operation has changed the IP address of UDM1 from IP1 to IP3.

[0079]

[0080] Table 2: Platform firewall rule configuration before automatic update

[0081]

[0082] Table 3: Platform firewall rule configuration after automatic update

[0083] As can be seen from Table 2, before the NF profile is updated, the platform firewall is configured to allow traffic from IP1, port 1 to IP2, port 1, and vice versa. Such a pair of rules can be configured to allow traffic from UDM on the protected side of the firewall and another node (such as AMF located on the unprotected side of the firewall). In Table 3, the IP address of UDM is changed to IP3. NRF will notify AMF of the change of UDM's NF profile through the NF discovery service. However, if there is no automatic firewall rule update, the communication between AMF and UDM will be blocked by the firewall. However, by automatically updating the firewall rule configuration when the NF profile of UDM changes, the subject matter described in this article allows communication between UDM and AMF to continue.

[0084] The subject matter described herein can achieve one or more of the following exemplary advantages:

[0085] • Automation of firewall configuration for on-demand topology changes (e.g., network slice addition / removal / update)

[0086] •The dynamic nature of frequently changing cloud-native topologies requires automation, as manual changes cannot keep pace with topology changes. By automating platform firewall configuration rule changes and synchronizing these changes with NF profile updates at the NRF, the subject matter described herein can keep firewall rule configuration updates in sync with changes in NF profiles caused by changes in cloud-native network topology.

[0087] • 5G includes the concept of network slicing, which further increases the topology changes. The automatic platform firewall configuration update method described in this article can keep the firewall rule configuration updates synchronized with the changes in the NF profile caused by the allocation and de-allocation of resources to and from network slices.

[0088] · Continuously monitor / audit changes to the platform firewall rule configuration. For example, the NRF or SCP may continuously monitor NFRegister, NFUpdate, and NFDeregister operations to discover changes that require updating the platform firewall rules, and perform the operations described herein for updating the platform firewall rules.

[0089] • Using NRF (or SCP) to automate updates to the platform firewall rule configuration provides enhanced security by ensuring that the firewall rule configuration is synchronized with NF profile updates at the NRF.

[0090] • Using NRF to automate updates to the platform firewall rule configuration is easy to implement, since NRF is already responsible for updating the parameters in the NF profile, which can also be used by the platform firewall rules.

[0091] • As mentioned above, the subject matter described herein for automatically updating firewall rules may also be implemented at the SCP instead of the NRF. For example, the SCP may receive a NFRegister, NFUpdate, or NFDeregister response confirming a successful registration, update, or deletion of an NF profile with the NRF, and perform the steps described herein for automatically updating the platform firewall rule configuration. Thus, in addition to its normal message routing functionality, the SCP may also implement automatic platform firewall rule configuration updates.

[0092] The disclosure of each of the following references is incorporated herein by reference in its entirety.

[0093] References

[0094] 1.3 rdGeneration Partnership Project; Technical Specification GroupServices and System Aspects; System architecture for the 5G System (5GS); Stage2 (version 17) 3GPP TS 23.501 V17.0.0 (2021-03).

[0095] 2.3 rd Generation Partnership Project; Technical Specification GroupCore Network and Terminals; 5G System; Network Function Repository Services; Stage 3 (Version 17) 3GPP TS 29.510 V17.1.0 (2021-03).

[0096] It will be understood that various details of the subject matter described herein can be changed without departing from the scope of the subject matter described herein. Furthermore, the foregoing description is for the purpose of illustration only and not for the purpose of limitation, as the subject matter described herein is defined by the claims set forth hereinafter.

Claims

1. A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication proxy (SCP), the method comprising: At an NRF or SCP implemented by at least one processor: receiving messages related to registering, updating or deregistering NF profiles in a NF profile database separate from the platform firewall; Determining that registration, updating, or deregistration of the NF profile requires a change to a firewall rule configuration of the platform firewall; as well as In response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall, the firewall rule configuration of the platform firewall is automatically updated by the NRF or the SCP.

2. The method of claim 1, wherein receiving a message related to registering, updating, or deregistering an NF profile comprises receiving an NFRegister request or response related to registering the NF profile with the NRF.

3. The method of claim 2, wherein automatically updating a firewall rule configuration of the platform firewall comprises adding a rule to the firewall rule configuration to filter packet traffic in and out of the NF.

4. The method of claim 1, wherein receiving a message related to registering, updating, or deregistering a NF profile comprises receiving a NFUpdate request or response related to updating a NF profile to an NRF.

5. The method of claim 4, wherein automatically updating the configuration of the platform firewall comprises updating rules of the platform firewall rule configuration to filter packet traffic in and out of the NF.

6. A method as claimed in any one of the preceding claims, comprising determining that a message related to registering, updating or deregistering a NF profile includes a fully qualified domain name (FQDN) of the NF, and wherein the method further comprises querying a DNS server to resolve the FQDN of the NF to an Internet Protocol (IP) address of the NF.

7. The method of claim 1, wherein receiving a message related to registering, updating, or deregistering an NF profile comprises receiving an NFDeregister request or response related to deregistering an NF profile from an NRF.

8. The method of claim 7, wherein automatically updating the configuration of the platform firewall comprises deleting a rule of the firewall rule configuration corresponding to the NF profile.

9. The method of any one of the preceding claims, wherein automatically updating a firewall rule configuration of a platform firewall comprises calling a configuration application programming interface (API) of the platform firewall.

10. The method of any of the preceding claims, wherein automatically updating the configuration of a platform firewall comprises updating a plurality of platform firewalls located at different network sites.

11. A system for automatically managing a platform firewall, the system comprising: a network function (NF) repository function (NRF) or a service communication proxy (SCP) comprising at least one processor and a memory; as well as A platform firewall rule configuration manager is configured to receive a message related to registering, updating or deregistering an NF profile in an NF profile database separate from the platform firewall, determine that the registration, updating or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall, and automatically update the firewall rule configuration of the platform firewall through the NRF in response to determining that the registration, updating or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall.

12. The system of claim 11, wherein the message related to registering, updating or deregistering the NF profile comprises a NFRegister request or response related to registering the NF profile with the NRF.

13. The system of claim 12, wherein: When automatically updating the firewall rule configuration of the platform firewall, the platform firewall rule configuration manager is configured to add rules to the firewall rule configuration to filter packet traffic entering and exiting the NF.

14. The system of claim 11, wherein the message related to registering, updating or deregistering the NF profile comprises an NFUpdate request or response related to updating the NF profile to the NRF.

15. The system of claim 14, wherein: When automatically updating the firewall rule configuration of the platform firewall, the platform firewall rule configuration manager is configured to update the rules of the platform firewall rule configuration to filter the packet traffic entering and exiting the NF.

16. The system of any one of claims 11 to 15, wherein the platform firewall rule configuration manager is configured to determine that a message related to registering, updating, or deregistering a NF profile includes a fully qualified domain name (FQDN) of the NF, and query a DNS server to resolve the FQDN of the NF into an Internet Protocol (IP) address of the NF.

17. The system of claim 11, wherein the message related to registering, updating or deregistering the NF profile comprises a NFDeregister request or response related to deregistering the NF profile with the NRF, and wherein, When automatically updating the configuration of the platform firewall, the platform firewall rule configuration manager is configured to delete the rules of the firewall rule configuration corresponding to the NF profile.

18. The system of any one of claims 11 to 17, wherein: When automatically updating the configuration of the platform firewall, the platform firewall rule configuration manager is configured to call a configuration application programming interface (API) of the platform firewall.

19. The system of any one of claims 11 to 18, wherein the platform firewall rule configuration manager is configured to update firewall rule configurations of a plurality of platform firewalls located at different network sites.

20. A non-transitory computer readable medium having executable instructions stored thereon, the executable instructions, when executed by a processor of a computer, controlling the computer to perform steps comprising: At a network function (NF) repository function (NRF) or a service communication proxy (SCP) implemented by at least one processor: receiving messages related to registering, updating or deregistering NF profiles in a NF profile database separate from the platform firewall; Determining that registration, updating, or deregistration of the NF profile requires a change to a firewall rule configuration of the platform firewall; as well as In response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule configuration of the platform firewall, the firewall rule configuration of the platform firewall is automatically updated by the NRF or the SCP.

Images