Method, system and computer readable medium for platform firewall management by a network function (NF) repository function (NRF) or service communication proxy (SCP)

Abstract

A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication proxy (SCR) includes receiving a message regarding registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The method further includes determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall. The method further includes automatically updating, by the NRF or SCR, a firewall rule setting of the platform firewall in response to determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall.

Description

[Technical field]

[0001] Priority claim This application claims the benefit of priority to U.S. Patent Application No. 17 / 308,018, filed May 4, 2021, the entire disclosure of which is incorporated herein by reference.

[0002] Technical Field The subject matter described herein relates to security in telecommunications networks. More particularly, the subject matter described herein relates to a method, system, and computer-readable medium for platform firewall management by an NRF or SCP. [Background technology]

[0003] background In a 5G telecommunications network, a network function that provides a service is referred to as a producer NF or an NF service producer. A network function that consumes a service is referred to as a consumer NF or an NF service consumer. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function consumes, generates, or consumes and generates a service. The terms "producer NF" and "NF service producer" are used interchangeably herein. Similarly, the terms "consumer NF" and "NF service consumer" are used interchangeably herein.

[0004] A given producer NF may have many service endpoints, which are connection points for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of an Internet Protocol (IP) address and a port number, or a fully qualified domain name that translates to an IP address and a port number on the network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include two or more NF instances. It should also be noted that multiple NF instances can share the same service endpoint.

[0005] A producer NF registers with a Network Function Repository Function (NRF). The NRF maintains service profiles of available NF instances that identify the services supported by each NF instance. The terms "service profile" and "NF profile" are used interchangeably herein. A consumer NF can subscribe to receive information about producer NF instances that are registered with the NRF.

[0006] In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is the service communication proxy (SCP). The SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the service communication proxy, which load balances traffic among producer NF service instances that offer the required service or routes traffic directly to the destination producer NF instance.

[0007] In addition to the SCP, another example of an intermediate proxy node that routes traffic between producer and consumer NFs is the Security Edge Protection Proxy (SEPP). A SEPP is a network node used to protect the control plane traffic exchanged between different 5G Public Land Mobile Networks (PLMNs). Thus, the SEPP performs message filtering, policing and topology hiding for all Application Programming Interface (API) messages sent between PLMNs.

[0008] One problem with 5G communication networks is that configuring firewalls that protect the network by filtering packets entering and / or leaving the network is labor intensive and error prone. Firewalls that protect 5G (or next generation) core networks by filtering packets entering and / or leaving the network are referred to herein as platform firewalls.

[0009] 5G NFs are deployed in networks that are protected by firewall rules that filter packets based on source and destination IP addresses, source and destination ports, and protocols, in addition to other 5G predefined security mechanisms. One of the challenges that exists for configuration is to keep firewall rules in sync with 5G NF topology changes brought about by the NRF as changes to NF profiles that contain 5G NF IP address and port details. Performing this type of configuration manually is time-consuming, labor-intensive, and error-prone. For example, especially in cloud network implementations of 5G systems, NF profiles can change at high speeds as NF instances are instantiated, updated, and removed from service. The platform firewall protecting the 5G network needs to be updated based on changes in the network topology. However, there is no predefined mechanism to keep platform firewall rules in sync with 5G network NF profile changes. Summary of the Invention [Problem to be solved by the invention]

[0010] In view of these and other considerations, a need exists for improved methods, systems and computer-readable media for managing platform firewalls. [Means for solving the problem]

[0011] overview A method for automatically managing a platform firewall with a network function (NF) repository function (NRF) or a service communication proxy (SCP) includes receiving a message regarding registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The method further includes determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall. The method further includes automatically updating, by the NRF or SCP, a firewall rule setting of the platform firewall in response to determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall.

[0012] According to other aspects of the subject matter described herein, receiving a message related to registering, updating, or deregistering an NF profile includes receiving an NF registration request or response related to registering an NF profile by the NRF.

[0013] According to other aspects of the subject matter described herein, automatically updating a firewall rule set of the platform firewall includes adding rules to the firewall rule set to filter packet traffic to or from the NF.

[0014] According to other aspects of the subject matter described herein, receiving a message related to registering, updating, or deregistering an NF profile includes receiving an NF update request or response related to updating the NF profile by the NRF.

[0015] According to other aspects of the subject matter described herein, automatically updating the platform firewall configuration includes updating rules in a firewall rule configuration to filter packet traffic to or from the NF.

[0016] According to another aspect of the subject matter described herein, a method for automatically updating rule settings of a platform firewall includes determining that a message relating to registering, updating, or deregistering an NF profile includes a fully qualified domain name (FQDN) of the NF, the method further including querying a DNS server and translating the FQDN of the NF to an Internet Protocol (IP) address of the NF.

[0017] According to other aspects of the subject matter described herein, receiving a message related to registering, updating or deregistering an NF profile includes receiving an NF deregistration request or response related to deregistering an NF profile by the NRF.

[0018] According to other aspects of the subject matter described herein, automatically updating the platform firewall configuration includes deleting a rule in the firewall rule configuration that corresponds to the NF profile.

[0019] According to other aspects of the subject matter described herein, automatically updating a configuration of the platform firewall includes invoking a configuration application programming interface (API) of the platform firewall.

[0020] According to other aspects of the subject matter described herein, automatically updating a platform firewall configuration includes updating multiple platform firewalls located at different network sites.

[0021] According to another aspect of the subject matter described herein, a system is provided for automatically managing a platform firewall. The system includes a network function (NF) repository function (NRF) or a service communication proxy (SCP) including at least one processor and a memory. The system further includes a platform firewall rule setting manager for receiving a message related to registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall, determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall, and automatically updating, by the NRF or the SCP, a firewall rule setting of the platform firewall in response to determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall.

[0022] According to other aspects of the subject matter described herein, the message related to registering, updating or deregistering an NF profile includes an NF registration request or response related to registering an NF profile with an NRF.

[0023] In accordance with other aspects of the subject matter described herein, when automatically updating a platform firewall configuration, the platform firewall rule set manager is configured to add rules to the firewall rule set to filter packet traffic to or from the NF.

[0024] According to other aspects of the subject matter described herein, the message related to registering, updating or deregistering the NF profile includes an NF update request or response related to updating the NF profile by the NRF.

[0025] In accordance with other aspects of the subject matter described herein, when automatically updating a platform firewall configuration, the platform firewall rule set manager is configured to update rules in the firewall rule set to filter packet traffic to or from the NF.

[0026] According to other aspects of the subject matter described herein, the platform firewall rule setting manager is configured to determine that a message relating to registering, updating, or deregistering an NF profile includes a fully qualified domain name (FQDN) of the NF, query a DNS server, and translate the FQDN of the NF into an Internet Protocol (IP) address of the NF.

[0027] According to other aspects of the subject matter described herein, the message relating to registering, updating or deregistering the NF profile includes an NF deregistration request or response relating to deregistering the NF profile by the NRF, and when automatically updating the platform firewall configuration, the platform firewall rule setting manager is configured to delete rules in the firewall rule setting corresponding to the NF profile identified in the NF deregistration request or response.

[0028] According to another aspect of the subject matter described herein, when automatically updating a platform firewall configuration, the platform firewall rule settings manager is configured to call a configuration application programming interface (API) of the platform firewall.

[0029] According to another aspect of the subject matter described herein, a platform firewall rule settings manager is configured to update rule settings for multiple platform firewalls located at different network sites.

[0030] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium is provided having executable instructions stored thereon that, when executed by a processor of the computer, control the computer to perform steps. The steps are performed in a Network Function (NF) Repository Function (NRF) or a Service Communication Proxy (SCP) implemented by the at least one processor. The steps further include receiving a message regarding registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The steps further include determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall. The steps further include automatically updating, by the NRF or SCP, a firewall rule setting of the platform firewall in response to determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall.

[0031] The subject matter described herein can be implemented in software, in combination with hardware and / or firmware. For example, the subject matter described herein can be implemented in software executed by a processor. In one exemplary embodiment, the subject matter described herein can be implemented using a non-transitory computer-readable medium that stores computer-executable instructions, which, when executed by a processor of a computer, control the computer to perform steps. Exemplary computer-readable media configured to implement the subject matter described herein include non-transitory computer-readable media, such as disk memory devices, chip memory devices, programmable logic circuits, and application-specific integrated circuits. In addition, the computer-readable medium implementing the subject matter described herein can be located on a single device or computing platform or distributed across multiple devices or computing platforms.

[0032] Exemplary embodiments of the subject matter described herein are described below with reference to the accompanying drawings. [Brief description of the drawings]

[0033] [Figure 1] FIG. 1 is a network diagram illustrating an example 5G system network architecture. [Diagram 2] FIG. 1 is a network diagram showing a firewall located between a trusted network and an untrusted network. [Diagram 3] FIG. 13 is a message flow diagram illustrating example messages exchanged to automatically configure a platform firewall using NRF. [Figure 4] FIG. 1 is a network diagram showing an NRF managing multiple platform firewalls located at different sites. [Diagram 5]FIG. 1 is a block diagram illustrating an example architecture for an NRF or SCP to automatically manage a platform firewall. [Figure 6] 1 is a flowchart illustrating an example process for managing a platform firewall using an NRF or an SCP. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0034] Detailed Description FIG. 1 is a block diagram illustrating an example 5G system network architecture. The architecture of FIG. 1 includes an NRF 100 and an SCP 101, which may be located in the same Home Public Land Mobile Network (HPLMN). As described above, the NRF 100 may maintain a profile of available producer NF service instances and their supported services, and enable consumer NFs or SCPs to subscribe and be notified of new / updated producer NF service instance registrations. The SCP 101 may also support service discovery and selection of producer NF instances. The SCP 101 may perform load balancing of connections between consumer NFs and producer NFs.

[0035] The NRF 100 is a repository for the service profiles of NFs or producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP must obtain the service profile of the NF or producer NF instance from the NRF 100. An NF or service profile is a JavaScript Object Notation (JSON) data structure defined in 3GPP TS 29.510. An NF or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0036] In Figure 1, any of the network functions can be a consumer NF, a producer NF, or both, depending on whether it is requesting, providing, or both, a service. In the illustrated example, the NFs include a Policy Control Function (PCF) 102 that performs policy-related operations within the network, a User Defined Manager (UDM) 104 that manages user data, and an Application Function (AF) 106 that provides application services.

[0037] 1 further includes a Session Management Function (SMF) 108 that manages sessions between an Access and Mobility Management Function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a Mobility Management Entity (MME) in 4G networks. An Authentication Server Function (AUSF) 112 performs authentication services for user equipment (UE) such as user equipment (UE) 114 seeking access to the network.

[0038] The Network Slice Selection Function (NSSF) 116 provides network slicing services for devices seeking to access specific network capabilities and characteristics associated with a network slice. The Network Exposure Function (NEF) 118 provides application programming interfaces (APIs) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs attached to the network. The NEF 118 performs functions similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0039] The Radio Access Network (RAN) 120 connects the User Equipment (UE) 114 to the network via wireless links. The Radio Access Network 120 may be accessed using a g-Node B (gNB) (not shown in FIG. 1) or other wireless access points. The User Plane Function (UPF) 122 may support various proxy functions for user plane services. One example of such a proxy function is a Multi-Path Transmission Control Protocol (MPTCP) proxy function. The UPF 122 may support a performance measurement function that may be used by the UE 114 to obtain network performance measurements. Also shown in FIG. 1 is a Data Network (DN) 124 through which the UE accesses data network services, such as Internet services.

[0040] The SEPP 126 filters traffic coming from other PLMNs and performs topology hiding for traffic going out from the home PLMN. The SEPP 126 may communicate with a SEPP in the foreign PLMN that manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and another for the foreign PLMN.

[0041] FIG. 2 is a network diagram illustrating an example firewall located between a trusted network and an untrusted network. In general, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted network. One type of network firewall is a packet filter that inspects packets transferred between 5G entities. In some cases, packets are filtered based on source and destination IP addresses, source and destination ports, and protocols.

[0042] As mentioned above, one issue that may arise in 5G networks is the management of the platform firewall that protects the 5G network. Specifically, there is a need to ensure that firewall rules are synchronized with NF profile changes that occur in the NRF. An NF profile is a data structure with attributes defined in 3GPP TS 29.510. An exemplary list of NF profile attributes can be found in Table 6.2.6.2.3-1 of 3GPP TS 29.510. Updates to any of these attributes may be used to trigger automatic updates to the platform firewall rule configuration.

[0043] The following list provides examples of NF profile attributes that may be included in a platform firewall rule, and updates to the NF profile attributes may be used to trigger automated updates to the platform firewall rule settings:

[0044] The fully qualified domain name (FQDN) of the network function, Network function IPv4 address, IPv6 address of network function, The FQDN of the service instance and IpEndPoint: The IP address and port information of the network facility where the service is listening for incoming service requests.

[0045] Additional or alternative attributes from Table 6.2.6.2.3-1 of 3GPP TS 29.510 may be used to configure platform firewall rules. The NRF has most, if not all, of the information required to configure the platform firewall because the NRF stores NF profiles of NFs that are registered to be discovered by other NFs in the network. However, there is no defined mechanism to update the firewall rule set used by the platform firewall to filter packets when NF profiles are added, updated, or deleted at the NRF.

[0046] Platform firewalls generally expose a configuration API to automate the firewall configuration process. For example, some platform firewalls expose a representative state transition (REST) ​​API to configure firewall rules. However, the subject matter described herein is not limited to configuring firewall rules using a REST API. Any suitable API for configuring firewall rules is intended to be within the scope of the subject matter described herein. Additionally, even if a firewall has an API for configuration, there is no predefined mechanism for synchronizing firewall rule changes with NF profile changes.

[0047] There is a need to configure the platform firewall according to the 5G NF topology configuration and then keep the firewall in sync with the 5G NF topology updates. The manual configuration process is cumbersome and error-prone. There is a need to automate the platform firewall process. 5GC networks span multiple sites, complicating the manual process and increasing the need for automated configuration.

[0048] In one exemplary embodiment, the NRF is enhanced to automatically configure platform firewall rules. The NRF monitors NF profiles for creation / deletion / updates. The NRF determines if a change in the NF profile requires a change to the firewall rule settings of the platform firewall rule settings. If a change in the NF profile requires a change to the firewall rule settings, the NRF takes action to update the corresponding platform firewall rule settings. Such a step may be to convert the FQDN to an IP address if the IP address is not already provided in the NF profile or is based on operator configuration. The NRF may then call the appropriate platform API for firewall rule creation / deletion / update.

[0049] One example of an NF profile change that may require changes to firewall rule settings is NF registration. When an NF registers with an NRF, it provides its NF profile to the NRF. The NF profile includes the FQDN or IP address where the NF should be contacted for services. Adding a new NF profile to the NRF may trigger the creation of at least one firewall rule in the platform firewall. For example, one firewall rule created in this type of instance may be to allow a particular type of traffic to or from the IP address or FQDN of the newly registered NF.

[0050] Another example of an NF profile change that may require a change to a firewall rule configuration is an update to a contact address in the NF profile. For example, if the IP address or FQDN at which an NF is contacted for services changes, one or more corresponding platform firewall rules should be updated with the corresponding contact address so that packets to and from the updated contact address can pass through the firewall and be filtered.

[0051] Yet another example of an NF profile change that may require changes to firewall rule settings is deregistration of an NF profile. Deregistration of an NF profile by the NRF results in the removal of the NF profile from the NF profile database maintained by the NRF. When an NF profile is deleted, the corresponding platform firewall rules for the NF profile being deleted must also be deleted so that contact addresses for the NF being deregistered cannot be used to send attack traffic through the firewall.

[0052] FIG. 3 is a message flow diagram illustrating exemplary messages exchanged to configure a platform firewall. Referring to FIG. 3, in line 1, a 5G NF 300, which may be any of the NFs shown in FIG. 1, sends an NF registration, NF update, or NF deregistration request to the NRF 100. The NF registration request is a message to register an NF profile with the NRF 100. The NF registration request includes the NF profile to be registered. The NF update request is a message to update one or more attributes of an NF profile registered with the NRF 100. The NF deregistration message is a message to deregister a profile currently registered with the NRF 100, resulting in the NF profile being deleted. In line 2 of the message flow diagram, the NRF 100 returns a response to the NF registration, NF update, or NF deregistration request. If the request in line 1 is an NF registration request and the operation is successful, the response in line 2 may be a 201 create message. If the request in line 1 is an NF update request and the operation is successful, the response may be a 200 OK message. If the request on line 1 is a NF deregistration request, the response on line 2 may be a 201 no content message.

[0053] If any of the NF registration, NF update, and NF deregistration operations are successful, the NRF 100 may request changes to the platform firewall rule settings. Thus, in lines 3-6 of the message flow diagram, the NRF 100 signals the DNS server 302 and the platform firewall 304 to update one or more firewall rules. For example, in line 3, the NRF 100 sends a DNS query to the DNS server 402 to translate the FQDN in the NF profile being updated or created by one of the operations in line 1 into an IP address. In line 4, the DNS server 402 responds to the query with one or more IP addresses that correspond to the FQDN in the DNS query. Note that the DNS query in line 3 is optional and may be omitted if the NF profile includes an IP address instead of an FQDN to identify an NF or NF instance.

[0054] At line 5, once the NRF 100 receives the IP address or other parameters necessary to update one or more firewall rules, the NRF 100 calls an appropriate platform firewall configuration API to update one or more firewall rules used by the platform firewall 304. Calling the platform firewall configuration API may include sending a message formatted according to the API to the platform firewall 304 and including the firewall rule parameters being updated. The platform firewall 304 receives the message, authenticates the sender, updates one or more of its packet filtering rules with the updated NF profile information received from the NRF 100, and returns a response to the NRF 100 indicating that the NF rule update was successful at line 6.

[0055] To configure the platform firewall 304, the NRF 100 may use the attributes in Table 1 below.

[0056] [Table 1]

[0057] From Table 1, the parameters required to access the platform firewall configuration API include an API endpoint, which may be an FQDN or IP address and port number of an endpoint for receiving firewall rule configuration parameters. The parameters may include an API prefix. The configuration parameters may further include security credentials, such as login credentials, for accessing the platform firewall configuration API.

[0058] The NRF configured as described above to automatically configure platform firewalls may be used to configure multiple platform firewalls located at different sites. FIG. 4 illustrates this type of embodiment. Referring to FIG. 4, the NRF 100 is located at Site 1, which may include a platform firewall 304A, as well as a UDM 104A, a user data repository (UDR) 400A, a PCF 102A, a charging function (CHF) 402A, a subscription locator function (SLF) 404A, and an SCP 101A. Site 2 includes a platform firewall 304B, an SMF 108B, an AMF 110B, a UPF 122B, and an SCP 101B. Site 3 includes a platform firewall 304C, an SMF 108C, an AMF 110C, a UPF 122C, and an SCP 101C. Site 4 includes a platform firewall 304D, an SMF 108D, an AMF 110D, a UPF 122D, and an SCP 101D. The NRF 100 receives NF profile updates from NFs located in sites 1-4 and updates the platform firewalls 304A-304D based on the NF profile updates. For example, if SCP 101D located in site 4 updates its NF profile with the NRF 100, the NRF 100 may update firewall rules with some or all of the platform firewalls 304A-304D with parameters affected by the NF profile update. One example of such a rule may be to allow traffic from the IP address of SCP 101D. If the IP address of SCP 101D changes due to an NF profile update, the NRF 100 may update the firewall rules in each platform firewall 304A-304D to allow traffic from the new IP address of SCP 101D.

[0059] It should be noted that the NRF 100 may maintain a different rule configuration for each platform firewall 304A-304D, the different configuration including site-specific packet filtering rules for each firewall. For example, for the platform firewall 304A located at site 1, the NRF 100 may maintain and automatically update firewall rule configurations for filtering packets to or from IP addresses associated with UDM 104A, UDR 400A, PCF 102A, SLF 404A, SCP 101A, and the NRF 100. For the platform firewall 304B located at site 2, the NRF 100 may maintain and automatically update firewall rule configurations for filtering packets to or from SMF 108B, AMF 110B, UPF 122B, and SCP 101B. For platform firewall 304C located at site 3, NRF 100 may maintain and automatically update firewall rule settings for filtering packets to or from SMF 108C, AMF 110C, UPF 122C, and SCP 101C. For platform firewall 304D located at site 4, NRF 100 may maintain and automatically update firewall rule settings for filtering packets to or from SMF 108D, AMF 110D, UPF 122D, and SCP 101D.

[0060] In the above example, the process for automatically managing the platform firewall is performed by the NRF 100. In an alternative embodiment, the automated platform firewall management may be performed by the SCP 101. FIG. 5 is a block diagram illustrating an example architecture for the NRF 100 or SCP 101 that can automatically update platform firewall rules in response to NF profile changes. With reference to FIG. 5, the NRF 100 or SCP 101 includes at least one processor 500 and a memory 502. When the automatic platform firewall database update is implemented in the NRF, the NRF 100 further includes an NF profile database 504 for storing NF profiles of NFs registered to the NRF 100, and an NF profile database manager 506 for updating the NF profile database 504 in response to NF registration, NF update, and NF deregistration requests from the NF. If the automatic platform firewall database update function is implemented in an SCP, the NF profile database 504 and NF profile database manager 506 may be implemented elsewhere (i.e., in the NRF) and the automatic platform firewall rule configuration update procedures described herein may be triggered by receiving NF registration, NF update and NF deregistration responses from the NRF confirming successful completion of the requested service operation.

[0061] The NRF 100 or SCP 101 also includes a platform firewall rule set manager 508 for performing the steps described herein to update firewall rules managed by the platform firewall in response to an NF profile update. The platform firewall rule set manager 508 may be implemented using computer-executable instructions stored in the memory 502 and executed by the processor 500. The NRF 100 or SCP 101 may further include a local (master) copy 510 of a platform firewall rule set database. When the platform firewall rule set manager 508 receives a request or response for registration, update, or deregistration of an NF profile, the platform firewall rule set manager 508 may identify the NF profile or profile attributes affected by the requested service operation, access the database copy 510, identify firewall rules with the same attributes or parameters being updated or deleted, perform the requested firewall rule updates against the local copy 510 of the platform firewall rule set database, and distribute the required rule set updates to platform firewalls managed by the platform firewall rule set manager 508. As described above with reference to FIG. 4, different platform firewalls may receive different rule updates because the networks or sites they protect may contain different NF instances and therefore require different firewall rule configurations.

[0062] FIG. 6 is a flow chart illustrating an example process for managing a platform firewall by automatically provisioning platform firewall rules in response to an NF profile change. Referring to FIG. 6, in step 600, the process includes receiving a message regarding registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. For example, the NRF 100 may receive an NF registration, NF update, or NF deregistration request from an NF that seeks to register, update, or deregister an NF profile with the NRF 100. In the case of an embodiment of the SCP of the subject matter described herein, the automatic platform firewall rule configuration process may be triggered by receiving a response message confirming successful registration, update, or deregistration of the NF profile. Thus, in an embodiment of the SCP of the subject matter described herein, step 600 may include receiving an NF registration, NF update, or NF deregistration response message.

[0063] If the process is being performed by an NRF, control proceeds to step 602A, where the process further includes registering, updating, or deregistering an NF profile based on a type of request. For example, if the request is an NF registration request, the NRF 100 may register the NF by storing the NF profile in an NF profile database. If the request is an NF update request, the NRF 100 may update the NF profile based on parameters identified in the NF update request. If the request is an NF deregistration request, the NRF 100 may delete the NF profile identified in the NF deregistration request.

[0064] If the process is being performed by an SCP, control proceeds from step 600 to step 602B, where the SCP routes the NF registration, NF update or NF deregistration response to the NF that requested the requested NF registration, NF update or NF deregistration service operation.

[0065] After step 602A or 602B, control proceeds to step 604, where the process further includes determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule settings of the platform firewall. In the case of an NF registration request or response, the platform firewall rule setting manager 508 may determine that a rule corresponding to the NF profile being registered needs to be added to a local (master) copy of the platform firewall rule setting database at the NRF 100 or SCP 101. If the message being received by the NRF 100 or SCP 101 is an NF update request or response, the platform firewall rule setting manager 508 may identify the NF profile attribute being updated by the NF update service operation, determine whether the NF profile attribute being updated is used by any of the rules in the local copy of the platform firewall rule setting database at the NRF 100 or SCP 101, and update the corresponding attribute in the platform firewall rule. If the message being received by the NRF 100 or SCP 101 is a NF deregistration request or response, the platform firewall rule setting manager 508 may determine that one or more rules corresponding to the NF profile being deregistered need to be deleted from a platform firewall rule setting database local to the NRF 100 or SCP 101.

[0066] In step 606, in response to determining that the registration, update, or deregistration of the NF profile requires a change to the firewall rule settings of the platform firewall, the process further includes automatically updating the firewall rule settings of the platform firewall by the NRF or SCP. For example, the platform firewall rule setting manager 508 may call or use a firewall setting API of the platform firewall 304 to add, modify, or delete rules from the firewall rule setting database. The platform firewall rule setting manager 508 may first update one or more rules in a local copy in the platform firewall rule setting database. The platform firewall rule setting manager 508 may then create a message in a format specified by the platform firewall rule setting API to perform the requested firewall rule setting update, and then send the message to one or more platform firewalls to update their respective firewall rule settings. It should be noted that the steps in FIG. 6 may be performed continuously such that one or more platform firewall rule settings are kept synchronized with the NF profile changes made by the NRF.

[0067] Tables 2 and 3 shown below provide an example of firewall rules that may be updated in response to an NF update service operation. In this example, it is assumed that the IP address of UDM1 has changed from IP1 to IP3 due to an NF update service operation.

[0068] [Table 2]

[0069] [Table 3]

[0070] From Table 2, before the NF profile update, the platform firewall is configured to allow traffic from IP1, port 1 to IP2, port 1, and vice versa. A pair of rules of this kind may be configured to allow traffic from the UDM on the protected side of the firewall and other nodes, such as the AMF, located on the unprotected side of the firewall. In Table 3, the IP address of the UDM changes to IP3. The AMF is informed of the change in the NF profile of the UDM by the NRF through the NF discovery service. However, without the automated firewall rule update, communication between the AMF and the UDM is blocked by the firewall. However, by automatically updating the firewall rule settings when the NF profile of the UDM changes, the subject matter described herein allows communication between the UDM and the AMF to continue.

[0071] The subject matter described herein may achieve one or more of the following exemplary advantages.

[0072] Automate firewall configuration for on-demand topology changes (e.g., adding / removing / updating network slices) The dynamic nature of frequently changing cloud-native topologies demands automation as manual changes cannot keep up with the pace of topology changes. By automating platform firewall configuration rule changes and synchronizing the changes with NF profile updates in the NRF, the subject matter described herein can keep firewall rule configuration updates synchronized with NF profile changes caused by cloud-native network topology changes.

[0073] 5G includes the concept of network slices that further add changes to the topology. The automated platform firewall configuration update method described herein can keep firewall rule configuration updates synchronized with NF profile changes caused by allocation and de-allocation of resources to and from network slices.

[0074] Platform firewall rule configurations are continuously monitored / audited for changes. For example, the NRF or SCP may continuously monitor NF registration, NF update, and NF deregistration operations for changes requiring updates to the platform firewall rules and perform the operations described herein to update the platform firewall rules.

[0075] Automating updates to platform firewall rule settings using the NRF (or SCP) provides enhanced security by ensuring that firewall rule settings are synchronized with NF profile updates in the NRF.

[0076] Automating updates to platform firewall rule settings with the NRF is easy to implement because the NRF already has the task of updating parameters in the NF profile that may be used by the platform firewall rules.

[0077] As mentioned above, the subject matter described herein for automatically updating firewall rules can also be implemented in an SCP instead of an NRF. For example, the SCP may receive an NF registration, NF update or NF deregistration response confirming successful registration, update or deletion of an NF profile by the NRF and perform the steps described herein for automatically updating platform firewall rule settings. Thus, the SCP may implement automatic platform firewall rule setting updates in addition to its normal message routing functions.

[0078] The disclosure of each of the following references is incorporated herein by reference in its entirety.

[0079] References 1. 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System Architecture for 5G Systems (5GS); Stage 2 (Release 17) 3GPP TS 23.501 V17.0.0 (2021-03) 2. 3rd Generation Partnership Project; Technical Specifications Group Core Network and Terminal; 5G System; Network Function Repository Service; Stage 3 (Release 17) 3GPP TS 29.510 V17.1.0 (2021-03) It should be understood that various details of the subject matter described herein may be changed without departing from the spirit and scope of the subject matter described herein. Moreover, the above description is illustrative only and not limiting of the subject matter described herein, as defined by the claims below.

Claims

1. 1. A method for automatically managing a platform firewall using a Network Function (NF) Repository Function (NRF) or a Service Communication Proxy (SCP), the method comprising: In an NRF or SCP implemented by at least one processor, receiving a message regarding registering, updating or deregistering a NF profile in a NF profile database separate from the platform firewall; determining that the registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall; in response to determining that the registering, updating, or deregistering the NF profile requires a change to the firewall rule settings of the platform firewall, the NRF or SCP automatically updates the firewall rule settings of the platform firewall; The method includes:

2. The method of claim 1 , wherein receiving a message related to registering, updating, or deregistering the NF profile includes receiving a NF registration request or response related to registering the NF profile by the NRF.

3. The method of claim 2 , wherein automatically updating the firewall rule set of the platform firewall includes adding rules to the firewall rule set to filter packet traffic to or from the NF.

4. The method of claim 1 , wherein receiving a message related to registering, updating, or deregistering the NF profile includes receiving an NF update request or response related to updating the NF profile by the NRF.

5. The method of claim 4 , wherein automatically updating the firewall rule set of the platform firewall includes updating rules of the firewall rule set to filter packet traffic to or from the NF.

6. 6. The method of claim 1, wherein the method includes determining that the message regarding registering, updating or deregistering the NF profile includes a fully qualified domain name (FQDN) of the NF, and the method further includes querying a DNS server and translating the FQDN of the NF into an Internet Protocol (IP) address of the NF.

7. The method of claim 1 , wherein receiving a message related to registering, updating, or deregistering the NF profile includes receiving a NF deregistration request or response related to deregistering the NF profile by the NRF.

8. The method of claim 7 , wherein automatically updating the firewall rule set of the platform firewall includes removing a rule of the firewall rule set that corresponds to the NF profile.

9. The method of any of claims 1 to 5, wherein automatically updating the firewall rule configuration of the platform firewall comprises invoking a configuration application programming interface (API) of the platform firewall.

10. The method of any of claims 1 to 5, wherein automatically updating the firewall rule settings of the platform firewall comprises updating firewall rule settings of multiple platform firewalls located at different network sites.

11. 1. A system for automatically managing a platform firewall, the system comprising: a Network Function (NF) Repository Function (NRF) or Service Communication Proxy (SCP) including at least one processor and a memory; a platform firewall rule setting manager for receiving a message regarding registering, updating or deregistering an NF profile in an NF profile database separate from a platform firewall, determining that the registering, updating or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall, and for automatically updating, by the NRF, the firewall rule setting of the platform firewall in response to determining that the registering, updating or deregistering the NF profile requires a change to the firewall rule setting of the platform firewall; A system comprising:

12. The system of claim 11 , wherein the message relating to registering, updating, or deregistering the NF profile comprises an NF registration request or response relating to registering the NF profile with the NRF.

13. 13. The system of claim 12, wherein when automatically updating the firewall rule set of the platform firewall, the platform firewall rule set manager is configured to add rules to the firewall rule set to filter packet traffic to or from the NF.

14. The system of claim 11 , wherein the message relating to registering, updating, or deregistering the NF profile comprises an NF update request or response relating to updating the NF profile by the NRF.

15. 15. The system of claim 14, wherein when automatically updating the firewall rule set of the platform firewall, the platform firewall rule set manager is configured to update rules of the firewall rule set to filter packet traffic to or from the NF.

16. The system of any one of claims 11 to 15, wherein the platform firewall rule setting manager is configured to determine that the message regarding registering, updating or deregistering the NF profile includes a fully qualified domain name (FQDN) of the NF, and to query a DNS server and convert the FQDN of the NF to an Internet Protocol (IP) address of the NF.

17. The message regarding registering, updating or deregistering the NF profile 12. The system of claim 11, further comprising an NF deregistration request or response regarding deregistering the NF profile by the NRF, wherein when automatically updating the firewall rule settings of the platform firewall, the platform firewall rule setting manager is configured to delete a rule of the firewall rule setting corresponding to the NF profile.

18. 16. The system of claim 11, wherein when automatically updating the firewall rule settings of the platform firewall, the platform firewall rule settings manager is configured to call a settings application programming interface (API) of the platform firewall.

19. The system of any of claims 11 to 15, wherein the platform firewall rule settings manager is configured to update firewall rule settings of multiple platform firewalls located at different network sites.

20. A program for causing a computer processor to execute the method according to any one of claims 1 to 5, 7 and 8.

Images