Reduce the likelihood of a successful DoS attack by verifying overload control information

Abstract

The subject matter described herein includes a method for reducing the likelihood of a successful denial of service (DoS) attack by verifying overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information. The method includes receiving a service-based interface (SBI) request message, obtaining target resource identification information from the SBI request message, obtaining NF profile information using the target resource identification information and storing the NF profile information, receiving an SBI response message including overload control information and scope information for the overload control information, using the stored NF profile information to determine whether the scope information for the overload control information is valid, and rejecting the SBI response message in response to determining that the scope information for the overload control information is invalid.

Description

[0001] Priority declaration

[0002] This application claims priority to U.S. patent application serial number 17 / 468,117 filed on September 7, 2021, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The subject matter described herein relates to reducing the likelihood of a successful DoS attack. More specifically, the subject matter described herein relates to methods, systems, and computer-readable media for reducing the likelihood of a successful DoS attack by validating OCI scope information against NF profile information obtained using target resource identification information. Background Art

[0004] In 5G telecommunication networks, a network function that provides a service is called a producer network function (NF) or NF service producer. A network function that consumes a service is called a consumer NF or NF service consumer. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function is consuming, producing, or consuming and producing a service. The terms "producer NF" and "NF service producer" are used interchangeably in this article. Similarly, the terms "consumer NF" and "NF service consumer" are used interchangeably in this article.

[0005] A given NF producer may have many service endpoints, where a service endpoint is a point of contact for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of an Internet Protocol (IP) address and a port number or a fully qualified domain name that resolves to an IP address on a network node hosting the producer NF and a port number. An NF instance is an instance of a producer NF that provides a service. A given NF producer may include more than one NF instance. It should also be noted that multiple NF instances may share the same service endpoint.

[0006] Producer NFs register with the Network Function Repository Function (NRF). NRF maintains service profiles of available NF instances, which identify the services supported by each NF instance. The terms "service profile" and "NF profile" are used interchangeably in this article. Consumer NFs can subscribe to receive information about producer NF instances that have registered with NRF.

[0007] In addition to consumer NFs, another network node that can subscribe to receive information about NF service instances is the Service Communication Proxy (SCP). The SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the Service Communication Proxy, and the Service Communication Proxy load balances traffic among producer NF service instances that provide the required service or routes traffic directly to the destination producer NF instance.

[0008] In addition to SCP, other examples of intermediate proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include Security Edge Protection Proxy (SEPP), Serving Gateway, and nodes in the 5G Service Mesh. SEPP is a network node used to protect control plane traffic exchanged between different 5G Public Land Mobile Networks (PLMNs). Therefore, SEPP performs message filtering, policing, and topology hiding for all Application Programming Interface (API) messages sent between PLMNs.

[0009] A problem in a 5G communication network may occur when a hacker sends an overload control message with a false overload control message scope to cause a peer NF to stop sending traffic to another NF. When the transmitting NF is overloaded, the overload control message is sent by the NF to the peer NF to cause the NF to throttle the traffic going to the transmitting NF and allow the transmitting NF to unload the load. The overload control message is transmitted in an OCI header, which includes a scope component, the value of which identifies the scope (i.e., one or more peer network function identities) to which the overload control message relates. There is no verification of this information in the OCI header to confirm that the transmitting node is authorized to send OCI information with the specified scope.

[0010] Therefore, a need exists for improved methods, systems, and computer-readable media for validating OCI scope information in a network. Summary of the invention

[0011] A method for reducing the possibility of a successful denial of service (DoS) attack by verifying overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information includes steps performed at a NF including at least one processor. The steps include receiving a service-based interface (SBI) request message. The steps also include obtaining target resource identification information from the SBI request message. The steps also include obtaining NF profile information using the target resource identification information and storing the NF profile information in a memory of the NF. The steps also include receiving an SBI response message, the SBI response message including overload control information and scope information for the overload control information. The steps also include using the stored NF profile information to determine whether the scope information for the overload control information is valid. The steps also include rejecting the SBI response message in response to determining that the scope information for the overload control information is invalid.

[0012] According to another aspect of the subject matter described herein, obtaining target resource identification information includes reading values ​​of one or more elements of a 3gpp-Sbi-Target-apiRoot header of an SBI request message.

[0013] According to another aspect of the subject matter described herein, reading the values ​​of one or more attributes of the 3gpp-Sbi-Target-apiRoot header includes reading the values ​​of one or more components corresponding to attributes of the NF profile of the producer NF hosting the target resource identified by the target resource identification information.

[0014] According to another aspect of the subject matter described herein, obtaining NF profile information includes using one or more of the values ​​of these elements of the 3gpp-Sbi-Target-ApiRoot header to perform a lookup in a NF profile database and locate the NF profile of the NF hosting the target resource.

[0015] According to another aspect of the subject matter described herein, reading the values ​​of one or more elements of the 3gpp-Sbi-Target-apiRoot header corresponding to attributes of the NF profile of the producer NF hosting the target resource includes: reading the values ​​of one or more of a scheme element, a fully qualified domain name (FQDN) element, a transport layer port element, an apiPrefix element, an apiName element, and an apiVersion element.

[0016] According to another aspect of the subject matter described herein, using NF profile information to determine whether scope information for overload control information is valid includes: comparing one or more of NF instance ID, NF set ID, NF service instance ID, NF service set ID, single network slice selection assistance information (S-NSSAI), destination network name (DNN), callback uniform resource identifier (URI), and service communication proxy (SCP) fully qualified domain name (FQDN) with the value of the corresponding element of the scope element of the 3gpp-Sbi-Oci header.

[0017] According to another aspect of the subject matter described herein, using NF profile information to determine whether scope information for overload control information is valid includes: in response to determining that the NF profile information does not match the scope information for overload control information, determining that the scope information for overload control information is invalid.

[0018] According to another aspect of the subject matter described herein, using NF profile information to determine whether scope information for overload control information is valid includes: in response to determining that the NF profile information matches the scope information for overload control information, determining that the scope information for overload control information is valid.

[0019] According to another aspect of the subject matter described herein, the NF includes a Service Communication Proxy (SCP).

[0020] According to another aspect of the subject matter described herein, the NF includes a Security Edge Protection Proxy (SEPP) or a consumer NF.

[0021] According to another aspect of the subject matter described herein, there is provided a system for reducing successful denial of service (DoS) attacks by verifying overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information. The system includes a NF including at least one processor and a memory. The system also includes an olcScope verifier for: receiving a service-based interface (SBI) request message, obtaining target resource identification information from the SBI request message, obtaining NF profile information using the target resource identification information and storing the NF profile information in a memory of the NF, receiving an SBI response message (the SBI response message including overload control information and scope information for the overload control information), using the stored NF profile information to determine whether the scope information for the overload control information is valid, and rejecting the SBI response message in response to determining that the scope information for the overload control information is invalid.

[0022] According to another aspect of the subject matter described herein, the olcScope validator is configured to obtain target resource identification information by reading values ​​of one or more elements from a 3gpp-Sbi-Target-apiRoot header of an SBI request message.

[0023] According to another aspect of the subject matter described herein, values ​​of one or more elements of the 3gpp-Sbi-Target-apiRoot header include values ​​corresponding to attributes of an NF profile of a producer NF hosting a target resource identified by the target resource identification information.

[0024] According to another aspect of the subject matter described herein, the olcScope validator is configured to obtain NF profile information by performing a lookup in a NF profile database using one or more of the values ​​of attributes of the 3gpp-Sbi-Target-apiRoot header and locating the NF profile of the NF hosting the target resource.

[0025] According to another aspect of the subject matter described herein, the values ​​of one or more elements of the 3gpp-Sbi-Target-apiRoot header corresponding to the attributes of the NF profile of the producer NF hosting the target resource include the values ​​of one or more of a scheme element, a fully qualified domain name (FQDN) element, a transport layer port element, an apiPrefix element, an apiName element, and an apiVersion element.

[0026] According to another aspect of the subject matter described herein, the olcScope validator is configured to determine whether the scope information for the overload control information is valid by comparing the NF profile information with the scope information for the overload control information.

[0027] According to another aspect of the subject matter described herein, the olcScope validator is configured to determine that the scope information for the overload control information is invalid in response to determining that the NF profile information does not match the scope information for the overload control information.

[0028] According to another aspect of the subject matter described herein, the olcScope validator is configured to determine that the scope information for the overload control information is valid in response to determining that the NF profile information matches the scope information for the overload control information.

[0029] According to another aspect of the subject matter described herein, a network function includes a service communication proxy (SCP), a security edge protection proxy (SEPP), or a consumer NF.

[0030] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium having executable instructions stored thereon is provided, which control the computer to perform steps when executed by a processor of a computer. These steps include receiving a service-based interface (SBI) request message. These steps also include obtaining target resource identification information from the SBI request message. These steps also include obtaining NF profile information using the target resource identification information and storing the NF profile information in a memory of the NF. These steps also include receiving an SBI response message, which includes overload control information and scope information for the overload control information. These steps also include using the stored NF profile information to determine whether the scope information for the overload control information is valid. These steps also include rejecting the SBI response message in response to determining that the scope information for the overload control information is invalid. The subject matter described herein can be implemented in software combined with hardware and / or firmware. For example, the subject matter described herein can be implemented in software executed by a processor. In an exemplary implementation, the subject matter described herein can be implemented using a non-transitory computer-readable medium having executable instructions stored thereon, which control the computer to perform steps when executed by a processor of a computer. Exemplary computer-readable media suitable for implementing the subject matter described herein include non-transitory computer-readable media, such as disk memory devices, chip memory devices, programmable logic devices, and application-specific integrated circuits. In addition, the computer-readable media that implement the subject matter described herein can be located on a single device or computing platform or can be distributed across multiple devices or computing platforms. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Exemplary implementations of the subject matter described herein will now be described with reference to the accompanying drawings, in which:

[0032] Figure 1 is a network diagram illustrating an exemplary 5G network architecture;

[0033] Figure 2 is a block diagram illustrating exemplary attributes of an NF profile that may be used to validate OCI scope information;

[0034] Figure 3 is a message flow diagram illustrating exemplary messages exchanged when a hacker launches a DoS attack using an SBI message with false OCI scope information;

[0035] Figure 4 is a message flow diagram illustrating exemplary messages exchanged for reducing the likelihood of a successful DoS attack by validating OCI scope information against NF profile information obtained using target resource identification information;

[0036] Figure 5is a block diagram illustrating an exemplary mapping between a 3gpp-Sbi-Target-apiRoot header component and an NF profile attribute that may be used by an SCP or other NF to validate OCI scope information;

[0037] Figure 6 is a block diagram illustrating an exemplary architecture of a NF for validating OCI scope information to reduce the likelihood of a successful DoS attack; and

[0038] Figure 7 is a flow chart illustrating an exemplary process performed by a NF to reduce the likelihood of a successful DoS attack by validating OCI scope information against NF profile information obtained using target resource identification information. DETAILED DESCRIPTION

[0039] Figure 1 is a block diagram illustrating an exemplary 5G system network architecture. Figure 1 The architecture in includes NRF 100 and SCP 101, which may be located in the same home public land mobile network (HPLMN). As described above, NRF 100 may maintain profiles of available producer NF service instances and the services they support, and allow consumer NF or SCP to subscribe to new / updated producer NF service instances and be notified of registrations of new / updated producer NF service instances. SCP 101 may also support service discovery and selection of producer NF instances. SCP 101 may perform load balancing on connections between consumer and producer NFs.

[0040] The NRF 100 is a repository for NF or service profiles of producer NF instances. In order to communicate with a producer NF instance, a consumer NF or SCP must obtain the NF or service profile of the producer NF instance from the NRF 100. The NF or service profile is a JavaScript Object Notation (JSON) data structure defined in the Third Generation Partnership Project (3GPP) Technical Specification (TS) 29.510. The NF or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0041] exist Figure 1 In the example shown, any of the network functions can be a consumer NF, a producer NF, or both, depending on whether they are requesting, providing, or requesting and providing services. In the example shown, the NFs include a PCF 102 that performs policy-related operations in the network, a unified data management (UDM) function 104 that manages user data, and an application function (AF) 106 that provides application services.

[0042] Figure 1 The NF shown also includes a session management function (SMF) 108, which manages sessions between an access and mobility management function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a mobility management entity (MME) in a 4G network. An authentication server function (AUSF) 112 performs authentication services for user equipment (UE) such as user equipment (UE) 114 seeking to access the network.

[0043] The Network Slice Selection Function (NSSF) 116 provides network slicing services for devices seeking to access specific network capabilities and features associated with a network slice. The Network Exposure Function (NEF) 118 provides an Application Programming Interface (API) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs attached to the network. The NEF 118 performs functions similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0044] The radio access network (RAN) 120 connects the user equipment (UE) 114 to the network via a wireless link. The radio access network 120 may use a g-NodeB (gNB) ( Figure 1 The UE 114 may be configured to access the wireless network by using a wireless access point (not shown) or other wireless access point. The user plane function (UPF) 122 may support various proxy functions for user plane services. An example of such a proxy function is a multipath transmission control protocol (MPTCP) proxy function. The UPF 122 may also support a performance measurement function, which may be used by the UE 114 to obtain network performance measurements. Figure 1 Also shown is a data network (DN) 124 through which the UE accesses data network services, such as Internet services.

[0045] SEPP 126 filters incoming traffic from another PLMN and performs topology hiding for traffic leaving the home PLMN. SEPP 126 may communicate with a SEPP in a foreign PLMN that manages foreign PLMN security. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and another for the foreign PLMN.

[0046] As mentioned above, one problem that occurs in 5G networks is DoS attacks launched by hackers using false OCI information. The 3GPP standard recommends overload control using the OCI header. When an NF service producer or consumer reaches an overload threshold that depends on the implementation scheme, the NF service producer or consumer passes the OCI to its peer entity (consumer or producer, respectively). Based on the received OCI, the peer adjusts the signaling it sends to the overloaded entity according to the OCI. One problem with OCI communication is that there is no verification whether the OCI comes from an authorized entity. A hacker NF may send an overload indication of another NF, NF set, NF service, NF service set, S-NSSAI, DNN, callback URI, etc. The entity that is incorrectly identified by the OCI information is excluded from the network by passing false OCI information to the sender of the SBI message. It is necessary to ensure that the OCI header is not abused by hackers and that only authorized NFs can indicate overload information in the OCI header for a given scope. The subject matter described herein includes a process by which a NF, such as an SCP, can mitigate this problem by performing verification that the peer entity sending the information in the OCI header is authorized to send the OCI header with the scope specified by the header in the OCI.

[0047] Table 1 shown below illustrates exemplary 3GPP terminology that will be used to describe the subject matter described herein.

[0048]

[0049] Table 1: 3GPP terminology

[0050] In Table 1, the terms in the left column are the names of parameters that can be specified in the olcScope element of the OCI header. For example, the olcScope that specifies the NF set is transmitting overload control information for the entire NF set. If such a parameter is forged, the OCI information may cause the receiving NF to stop communicating with all NF instances in the NF set.

[0051] Section 6.4 of 3GPP TS 29.500 recommends overload control using the OCI header. Overload control is a reactive mechanism that lets the peer NF know to shed load when the transmitting NF is in an overloaded state. Section 5.2.3.2.9 of 3GPP TS 29.500 explains the OCI header. A mandatory component of the OCI header of interest to the subject matter described herein is olcScope, the value of which can specify an NF producer scope, NF consumer scope, or SCP scope. Each of the NF producer scope, NF consumer scope, and SCP scope is replaced by a sub-parameter in the actual OCI header. For example, each of the NF consumer, NF producer, and NF SCP scope can be specified using the following sub-parameters:

[0052] nfProducerScope=((″NF-lnstance:″RWS nfinst)

[0053] / ("NF-Set:"RWS nfset)

[0054] / ″(NF-Service-Instance:″RWS nfservinst)

[0055] / (″NF-Service-Set:″RWS nfserviceset))[″;″RWS sNssai″;″RWS dnn]

[0056] nfConsumerScope=(″NF-Instance:″RWS nfinst[″;″RWS″Service-Name:″RWSservname])

[0057] / (″NF-Set:″RWS nfset[″;″RWS″Service-Name:″RWSservname])

[0058] / ″(NF-Service-Instance:″RWS nfservinst)

[0059] / (″NF-Service-Set:″RWS nfserviceset)

[0060] / (″Callback-Uri:″RWS URI*(RWS″&″RWS URI))

[0061] scpScope=(″SCP-FQDN:″RWS fqdn)

[0062] From the above specification, each of the defined NF Service Consumer and NF Service Producer scopes can identify an NF Instance, NF Service Instance, NF Set, or NF Service Set. The SCP scope parameter can specify an FQDN. The S-NSSAI can also be specified in the olcScope. Any of these parameters can be used to identify the corresponding entity as overloaded.

[0063] Here are three examples of olcScope as specified in 3GPP TS 29.500 section 5.2.3.2.9:

[0064] Example 1: Overload control information for NF instance:

[0065] 3gpp-Sbi-Oci: Timestamp: "Tue, 04 Feb 2020 08:49:37GMT"; Period-of-Validity: 75s; Overload-Reduction-Metric: 50%; NF-Instance: 54804518-4191-46b3-955c-ac631f953ed8

[0066] Example 2: Overload control information for NF service set:

[0067] 3gpp-Sbi-Oci: Timestamp: "Tue, 04 Feb 2020 08:49:37GMT″; Period-of-Validity: 120s; Overload-Reduction-Metric: 50%; NF-Service-Set: setxyz.snnsmf-pdusession.nfi54804518-4191-46b3-955c-ac631f953ed8.5gc.mnc012.mcc345

[0068] Example 3: Overload control information for an SMF instance associated with a specific DNN of S-NSSAI:

[0069] 3gpp-Sbi-Oci: Timestamp: "Tue, 04 Feb 2020 08:49:37GMT″; Period-of-Validity: 600s; Overload-Reduction-Metric: 50%; NF-Instance: 54804518-4 191-46b3-955c-ac631f953ed8; S-NSSAI: {"sst": 1, "sd": "A08923"}; DNN: internet.mnc012.mcc345.gprs

[0070] In Example 1, 54804518-4191-46b3-955c-ac631f953ed8 is the following value of the olcScope element, which identifies the NF instance to which the overload control information applies. In Example 2, setxyz.snnsmf-pdusession.nfi54804518-4191-46b3-955c-ac631f953ed8.5gc.mnc012.mcc345 is the following value of the olcScope element, which identifies the NF service set to which the overload control information applies. In Example 3, internet.mnc012.mcc345.gprs is the following value of the olcScope element, which identifies the DNN to which the overload control information applies.

[0071] Table 2 shown below illustrates an example of olcScope defined in Section 6.4.3.4.5 of 3GPP TS29.500.

[0072]

[0073] Table 2: OlcScope parameters defined in 3GPP TS29.500

[0074] Another header defined in 3GPP TS29.500 is the 3gpp-Sbi-Target-apiRoot header. According to Section 6.10.2.5 of 3GPPTS 29.500, for indirect communication with or without delegated discovery, the HTTP client should include the 3gpp-Sbi-Target-apiRoot header in the request sent by the client to the SCP, which is set to the apiRoot of the authorization server of the target resource (if available). Specifically, after the resource has been created, the client will include the 3gpp-Sbi-Target-apiRoot header in the SBI request sent using indirect communication without delegated discovery, in subsequent service requests sent to the SCP, and in notifications or callbacks sent via the SCP.

[0075] The SCP will also include a 3gpp-Sbi-Target-apiRoot header in the request it sends to the next-hop SCP, which is set to the apiRoot of the authoritative server for the target resource (if available). The point to emphasize is that the SCP can find the target resource on its own, or it can infer the target resource from the 3gpp-Sbi-Target-apiRoot header.

[0076] As will be described in detail below, the 3gpp-Sbi-Target-apiRoot header includes components corresponding to one or more attributes of the NF profile of the producer NF on which the target resource exists. The components in the 3gpp-Sbi-Target-apiRoot header that are common to the NF profile of the producer NF on which the target resource exists can be used to verify the scope specified in the 3gpp-Sbi-Oci header. Figure 2 is a block diagram illustrating exemplary parameters of an NF profile that may be used to validate the scope information contained in the 3gpp-Sbi-Oci header. Figure 2 In the 3gpp-Sbi-Target-apiRoot header, the NF profile includes the smfinfo attribute, which includes the details of the single network slice selection assistance information (S-NSSAI) and the destination network name (DNN) of the session management function (SMF). If the target resource identified by the 3gpp-Sbi-Target-apiRoot header is an SMF, then the 3gpp-Sbi-Target-apiRoot header can be used to obtain the NF profile of the SMF, and the smfInfo attribute of the NF profile can be compared with the DNN and S-NSSAI in the scope element of the 3gpp-Sbi-Oci header.

[0077] Another NF profile attribute that can be used to verify the scope of the component of the 3gpp-Sbi-Oci header is the defaultNotificationSubscriptions attribute, which contains the callback URI. The 3gpp-Sbi-Target-apiRoot header can be used to obtain the NF profile of the target resource, the callback URI can be read from the defaultNotificationSubscriptions attribute of the NF profile, and the callback URI obtained from the NF profile can be compared with the callback URI obtained from the scope component of the 3gpp-Sbi-Oci header. If these attribute values ​​match, the OCI can be determined to be valid. If the attribute values ​​do not match, the OCI can be determined to be invalid.

[0078] Other elements of the OCI scope that can be compared with the NF profile attributes obtained using the 3gpp-Sbi-Target-apiRoot header include NF Instance ID, NF Set ID, NF Service Instance ID, and NF Service Set ID. Figure 2 Any one or more of the NF profile attributes listed in the table with the title "OCI Scope" in the 3gpp-Sbi-Oci header may be compared with the corresponding attribute values ​​from the scope element of the 3gpp-Sbi-Oci header to validate the OCI. Figure 3is a message flow diagram illustrating exemplary messages exchanged between a consumer NF, a producer NF, an SCP, and a hacker, where the hacker uses OCI to launch a denial of service attack. Figure 3 , in row 1, the consumer NF 300 sends an SBI request message to the SCP 101. In row 2, the SCP 101 forwards the SBI request message to the producer NF 302. In row 3, the producer NF 302 sends an SBI response message to the SCP 101. In row 4, the SCP 101 forwards the SBI response message to the consumer NF 300. The communication model shown in rows 1-4 is called an indirect communication model because the communication between the consumer NF 300 and the producer NF 302 occurs via the SCP 101.

[0079] In row 5, consumer NF 300 sends an SBI request message to SCP 101. In row 6, SCP 101 forwards the SBI request message to hacker 304. In this example, hacker 304 can be a producer NF or a node that imitates a producer NF providing a service in the network. In row 7 of the message flow diagram, hacker 304 sends an SBI response to SCP 101. The SBI response includes a 3gpp-Sbi-Oci header that identifies producer NF 302 in its scope component, thereby indicating that producer NF 302 is overloaded. In row 8, SCP 101 sends an SBI response message to consumer NF 300, wherein the 3gpp-Sbi-Oci header identifies that producer NF 302 is overloaded. In response to receiving an SBI response with a 3gpp-Sbi-Oci header indicating that producer NF 302 is overloaded, consumer NF 300 will stop communicating with producer NF 302. If the producer NF 302 provides basic services in the network and is the only provider of such services, network outages may occur. For example, if the producer NF 302 is the only AMF providing access and mobility management services in the network and becomes unavailable to the consumer NF 300 based on the OCI sent by the hacker 304, UEs seeking to access the network may not be able to do so. In order to avoid or reduce successful DoS attacks (such as Figure 3 As shown in the example above, an SCP or other NF described in this document can use information from the SBI request message to obtain NF profile information (which identifies the SBI producer that is the target of the SBI request), and can use the stored information to verify the scope information in the OCI header received in the SBI response. Figure 4 is a message flow diagram illustrating exemplary messages exchanged when an SCP uses NF profile information obtained using target resource identification information from an SBI request to verify scope information in an OCI header of an SBI response. Figure 4, in line 1, the consumer NF 300 sends an SBI request message to the SCP 101. In line 2, the SCP 101 forwards the SBI request message to the producer NF 302. In line 3, the producer NF 302 sends an SBI response message to the SCP 101. In line 4, the SCP 101 forwards the SBI response message to the consumer NF 300.

[0080] In row 5, consumer NF 300 sends an SBI request message to SCP 101. SCP 101 stores the peer identity information from the SBI request. In this case, the peer identity information is one or more NF profile attributes of hacker 304 determined from the 3gpp-Sbi-Target-apiRoot header of the SBI request message. In row 6, SCP 101 forwards the SBI request message to hacker 304. In row 7 of the message flow diagram, hacker 304 sends an SBI response to SCP 101. The SBI response includes the following 3gpp-Sbi-Oci header, which identifies producer NF 302 in its scope component, indicating that producer NF 302 is overloaded. SCP 101 does not forward the SBI response message to consumer NF 300, but verifies the entity identified in the olcScope element of the 3gpp-Sbi-Oci header against the NF profile information obtained or determined from the 3gpp-Sbi-Target-apiRoot header of the SBI request. In this example, the stored NF profile information determined from the 3gpp-Sbi-Target-apiRoot header is the identity of the hacker 304. However, the peer identity from the olcScope parameter identifies the producer NF 302. Because these identities do not match, SCP 101 rejects the SBI response message because the hacker 304 is not authorized to send OCI information for the scope specified in the 3gpp-Sbi-Oci header. Because SCP 101 rejects the SBI response message with an unauthorized olcScope, the possibility of a successful DoS attack on the producer NF 302 is reduced.

[0081] Figure 5 is a block diagram illustrating an exemplary mapping between NF profile attributes and 3gpp-Sbi-Target-apiRoot header elements. The SCP may utilize any one or more of these elements from the 3gpp-Sbi-Target-apiRoot header to identify the NF profile of the target resource and obtain Figure 2. For example, SCP 101 may use the value of one or more of the scheme, FQDN, port, apiPrefix, apiName, and apiVersion from the 3gpp-Sbi-Target-apiRoot header to perform a lookup in the NF profile database and obtain the NF profile of the NF where the target resource is located. Then, SCP may read Figure 2 The NF profile attributes shown in the , compare these attributes with the values ​​of the corresponding attributes of the scope element from the 3gpp-Sbi-Target-apiRoot header, and determine whether the OCI is valid based on the result of the comparison. Figure 6 is a block diagram illustrating an exemplary architecture of a NF (such as an SCP, SEPP, or other NF) for verifying olcScope information in an SBI response message. Figure 6 , NF 600 includes at least one processor 602 and a memory 604. SCP 101 also includes an olcScope verifier 606 for receiving an SBI request message, obtaining target resource identification information from the SBI request message, obtaining NF profile information from a NF profile database 608 that may be located in the memory 604 using the target resource identification information, and verifying the olcScope information sent in the SBI response message using the NF profile information. In an alternative implementation, the olcScope verifier 606 may query a NF profile database external to NF 600 to obtain the NF profile information. The olcScope verifier 606 may be implemented using computer executable instructions stored in the memory 604 and executed by the processor 602.

[0082] Figure 7 is a flow chart illustrating an exemplary process performed by a NF to verify olcScope information against peer NF identity information. Figure 7 , the process includes receiving an SBI request message at the NF in step 700. For example, in an indirect communication model, the NF 600 (which may be an SCP or a SEPP) may receive an SBI request message from a consumer NF to forward to a producer NF.

[0083] In step 702, the process includes obtaining target resource identification information from the SBI request message. For example, NF 600 may read the value of one or more elements of the 3gpp-Sbi-Target-apiRoot header of the SBI request message. Examples of such elements are Figure 5 Shown in.

[0084] In step 704, NF 600 obtains NF profile information using the target resource identification information and stores the NF profile information in a memory. For example, NF 600 may obtain the NF profile of the NF where the target resource is located by using one or more of the attribute values ​​from the 3gpp-Sbi-Target-apiRoot header, read the NF profile information related to the target resource from the NF profile, and store the NF profile information in a memory. Figure 2 The attribute value corresponding to any one of the OCI scope attributes shown in the table in the NF profile attribute is stored in the memory.

[0085] In step 706, the process includes receiving an SBI response message including a 3gpp-Sbi-Oci header including olcScope information. For example, NF 600 may receive an SBI response message including a 3gpp-Sbi-Oci header from a legitimate producer NF or from a hacker. The header may include an olcScope component.

[0086] In steps 708 and 710, the process includes determining whether the olcScope information is valid using the NF profile information. For example, the NF 600 may read one or more values ​​from the olcScope element of the 3gpp-Sbi-Oci header and compare the values ​​read from the olcScope element with one or more stored elements of the NF profile obtained using the 3gpp-Sbi-Target-apiRoot header.

[0087] In step 710, if the olcScope is determined to be invalid, that is, if the olcScope information does not match the stored NF profile information, control proceeds to step 712, where the SBI response is rejected. If the olcScope information is determined to be valid, that is, if the olcScope information matches the stored NF profile information, control proceeds to step 714, where the SCP forwards the SBI response to the consumer NF that sent the corresponding SBI request. It should be noted that the forwarding in step 714 is implemented in the case where the node performing the olcScope verification is an SCP or SEPP. If the node performing the verification is a consumer NF, step 714 may include processing rather than forwarding the SBI response.

[0088] The advantages of the subject matter described herein include reducing the possibility of successful denial of service attacks achieved by spoofing 3gpp-Sbi-Oci headers or other similar headers. The subject matter described herein can be extended to other headers similar to the 3gpp-Sbi-Oci header. The subject matter described herein is applicable to both inter-PLMN signaling and intra-PLMN signaling. The subject matter described herein can be implemented at SCP or other NF (such as SEPP or consumer NF) to verify olcScope.

[0089] The disclosures of each of the following references are incorporated herein by reference in their entirety.

[0090] References

[0091] 1.3GPP TS29.500V17.3.0(2021-06), 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; TechnicalRealization of Service Base Architecture; Stage3; (Release 17).

[0092] 2.3GPP TS29.501V17.2.0 (2021-06), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System Architecture for the 5G System (5GS), Stage 2; (Release 17).

[0093] 3.3GPP TS29.510V17.2.0(2021-06), 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; NetworkFunction Repository Services; Stage 3; (Release17).

[0094] It should be understood that various details of the subject matter described herein may be changed without departing from the scope of the subject matter described herein. Furthermore, the foregoing description is for illustrative purposes only and not for limiting purposes, as the subject matter described herein is defined by the claims set forth below.

Claims

1. A method for reducing the likelihood of a successful denial of service (DoS) attack by validating overload control information (OCI) scope information against network function NF profile information obtained using target resource identification information, the method comprising: At a first NF including at least one processor: Receive a service-based interface SBI request message; Obtain target resource identification information from the SBI request message; obtaining NF profile information using the target resource identification information, and storing the NF profile information in a memory of the first NF, wherein the NF profile information is associated with a second NF hosting a target resource identified by the target resource identification information; receiving an SBI response message, the SBI response message including overload control information and scope information for the overload control information; using the stored NF profile information to determine whether the scope information for the overload control information is valid; as well as In response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

2. The method of claim 1, wherein: Obtaining the target resource identification information includes: reading the value of one or more components of the 3gpp-Sbi-Target-apiRoot header of the SBI request message.

3. The method of claim 2, wherein: Reading the value of one or more components of the 3gpp-Sbi-Target-apiRoot header includes: reading the value of the component corresponding to the attribute of the NF profile of the producer NF hosting the target resource identified by the target resource identification information, the second NF including the producer NF.

4. The method of claim 3, wherein: Obtaining the NF profile information includes: using one or more of the values ​​of the components of the 3gpp-Sbi-Target-ApiRoot header to perform a lookup in a NF profile database and locate the NF profile of the producer NF hosting the target resource.

5. The method of claim 3, wherein: Reading the values ​​of the one or more elements of the 3gpp-Sbi-Target-apiRoot header corresponding to the attributes of the NF profile of the producer NF hosting the target resource includes: reading the values ​​of one or more of the scheme element, the fully qualified domain name (FQDN) element, the transport layer port element, the apiPrefix element, the apiName element and the apiVersion element.

6. The method according to any one of claims 1 to 5, wherein: Using the NF profile information to determine whether the scope information used for the overload control information is valid includes: comparing one or more of the NF instance ID, NF set ID, NF service instance ID, NF service set ID, single network slice selection assistance information (S-NSSAI), destination network name (DNN), callback uniform resource identifier (URI), and service communication proxy (SCP) fully qualified domain name (FQDN) with the value of the corresponding element in the scope element of the 3gpp-Sbi-Oci header.

7. The method according to any one of claims 1 to 5, wherein: Using the NF profile information to determine whether the scope information for the overload control information is valid includes: in response to determining that the NF profile information does not match the scope information for the overload control information, determining that the scope information for the overload control information is invalid.

8. The method according to any one of claims 1 to 5, wherein: Using the NF profile information to determine whether the scope information for the overload control information is valid includes: in response to determining that the NF profile information matches the scope information for the overload control information, determining that the scope information for the overload control information is valid.

9. The method according to any one of claims 1 to 5, wherein: The first NF includes a service communication proxy (SCP).

10. The method according to any one of claims 1 to 5, wherein: The first NF includes a Security Edge Protection Proxy (SEPP) or a Consumer NF.

11. A system for reducing the likelihood of a successful Denial of Service (DoS) attack by validating Overload Control Information (OCI) scope information against Network Function NF profile information obtained using target resource identification information, the system comprising: A first NF, wherein the first NF includes at least one processor and a memory; as well as An olcScope validator is used to: receive a service-based interface SBI request message, obtain target resource identification information from the SBI request message, obtain NF profile information using the target resource identification information, store the NF profile information in the memory, receive an SBI response message including overload control information and scope information for the overload control information, use the stored NF profile information to determine whether the scope information for the overload control information is valid, and reject the SBI response message in response to determining that the scope information for the overload control information is invalid, wherein the NF profile information is associated with a second NF that hosts the target resource identified by the target resource identification information.

12. The system of claim 11, wherein: The olcScope validator is configured to obtain the target resource identification information by reading the value of one or more components from a 3gpp-Sbi-Target-apiRoot header of the SBI request message.

13. The system of claim 12, wherein: The values ​​of the one or more elements of the 3gpp-Sbi-Target-apiRoot header include values ​​corresponding to attributes of an NF profile of a producer NF hosting a target resource identified by the target resource identification information, the second NF including the producer NF.

14. The system of claim 13, wherein: The olcScope validator is configured to obtain the NF profile information by performing a lookup in a NF profile database using one or more of the values ​​of the attributes of the 3gpp-Sbi-Target-apiRoot header and locating the NF profile of the producer NF hosting the target resource.

15. The system of claim 13, wherein: The values ​​of the one or more components of the 3gpp-Sbi-Target-apiRoot header corresponding to the attributes of the NF profile of the producer NF hosting the target resource include values ​​of one or more of a scheme component, a fully qualified domain name (FQDN) component, a transport layer port component, an apiPrefix component, an apiName component, and an apiVersion component.

16. The system of any one of claims 11 to 15, wherein: The olcScope verifier is configured to determine whether the scope information for the overload control information is valid by comparing the NF profile information with the scope information for the overload control information.

17. The system of any one of claims 11 to 15, wherein: The olcScope validator is configured to determine that the scope information for the overload control information is invalid in response to determining that the NF profile information does not match the scope information for the overload control information.

18. The system of any one of claims 11 to 15, wherein: The olcScope validator is configured to determine that the scope information for the overload control information is valid in response to determining that the NF profile information matches the scope information for the overload control information.

19. The system of any one of claims 11 to 15, wherein: The first NF includes a service communication proxy (SCP), a security edge protection proxy (SEPP), or a consumer NF.

20. A non-transitory computer-readable medium having executable instructions stored thereon, the executable instructions, when executed by a processor of a computer, controlling the computer to perform steps comprising: At the first network function NF: Receive a service-based interface SBI request message; Obtain target resource identification information from the SBI request message; obtaining NF profile information using the target resource identification information, and storing the NF profile information in a memory of the first NF, wherein the NF profile information is associated with a second NF hosting a target resource identified by the target resource identification information; receiving an SBI response message, the SBI response message including overload control information and scope information for the overload control information; using the stored NF profile information to determine whether the scope information for the overload control information is valid; as well as In response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

Images