Method, system, and computer-readable medium for mitigating denial-of-service (DoS) attacks on a network function (NF)

Abstract

A method for DoS attacks in NFs includes maintaining, at a first NF, an NF subscription database including rules and corresponding rule criteria that specify a maximum number of allowed subscriptions. The method further includes receiving, at the first NF, a subscription request to establish a subscription from a second NF. The method further includes the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database, and the first NF incrementing at least one count of a number of subscriptions for the at least one rule. The method further includes the first NF determining that the at least one count of a number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule. The method further includes preventing establishment of the subscription in response to determining that the at least one count of a number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule.

Description

[Technical Field]

[0001] Priority claim This application claims the benefit of priority to U.S. Patent Application Serial No. 17 / 167,319, filed February 4, 2021, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Technical Field The subject matter described herein relates to network security. More particularly, the subject matter described herein relates to methods, systems, and computer-readable media for mitigating denial of service (DoS) attacks in a 5G producer network function (NF), such as an NF. [Background technology]

[0003] background In 5G telecommunications networks, a network function that provides a service is called a producer Network Function (NF), or an NF service producer. A network function that consumes a service is called a consumer NF, or an NF service consumer. A network function may be a producer NF, a consumer NF, or both, depending on whether the network function is consuming, producing, or consuming and producing the service. The terms "producer NF" and "NF service producer" are used interchangeably herein. Similarly, the terms "consumer NF" and "NF service consumer" are used interchangeably herein.

[0004] A given producer NF may have many service endpoints. A service endpoint is a contact point for one or more NF instances hosted by the producer NF. A service endpoint is a combination of an Internet protocol (IP) address and port number or a fully qualified domain name (resolved into an IP address and port number) on the network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may contain two or more NF instances. Note that multiple NF instances can share the same service endpoint.

[0005] Producer NFs register with a network function repository function (NRF). The NRF maintains service profiles of available NF instances that identify the services supported by each NF instance. The terms "service profile" and "NF profile" are used interchangeably herein. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.

[0006] In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is the service communication proxy (SCP). The SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the service communication proxy, which either load balances traffic among producer NF service instances that offer the requested service or routes traffic directly to the destination producer NF instance.

[0007] In addition to SCPs, other examples of intermediate proxy nodes or network nodes that route traffic between producer and consumer NFs include security edge protection proxies (SEPPs), service gateways, and nodes in a 5G service mesh. SEPPs are network nodes used to protect control plane traffic exchanged between different 5G public land mobile networks (PLMNs). As such, SEPPs perform message filtering, policing, and topology hiding for all application programming interface (API) messages sent between PLMNs.

[0008] One problem in 5G communication networks occurs when a producer NF becomes overwhelmed due to a large number of subscription requests. Almost all NFs in 5G networks use a subscribe / notify mechanism for communication. In the subscribe / notify mechanism for communication, a consumer NF subscribes to a producer NF to be notified about the producer NF. For example, the NRF uses subscribe / notify communication to be notified when a consumer NF wants to know about a network topology change. The user data management node (UDM) uses subscribe / notify communication to inform consumer NFs about subscriber data changes. The network slice selection function (NSSF) uses subscribe / notify communication to inform the AMF about changes in single network slice selection assistance information (S-NSSAI). The policy control function (PCF) uses subscribe / notify communication to inform consumer NFs about policy control events. Summary of the Invention [Problem to be solved by the invention]

[0009] If the number of subscriptions at a producer NF causes the processing capacity of the producer NF to be overwhelmed, service may be denied to consumer NFs attempting to be notified about NF service profiles or other information. Currently, producer NFs do not limit the number of subscriptions that can be created by consumer NFs. An excessive number of NF subscriptions at a producer NF may be intentionally or accidentally created by a consumer NF, resulting in a denial of service to other NFs attempting to access services provided by the producer NF. Denial of service may be caused by exhaustion of storage capacity at the producer NF due to too many subscription records. Denial of service may also result when the CPU of a producer NF is exhausted due to excessive processing demands. Memory resources at a producer NF may also be exhausted if the number of subscription records being processed exceeds the memory capacity of the producer NF. Denial of service may also be caused by network resource exhaustion due to undesirable processing overhead for subscription responses. Note that other operations (e.g., NF registration with the NRF) do not suffer from the same issues as subscriptions. This is because the content of the message (the NF instance ID in the registration request) helps ensure that multiple registrations cannot be made for the same NF instance. However, there is no such protection in or about the subscribe message.

[0010] Therefore, there is a need for a method, system, and computer-readable medium for mitigating DoS attacks in an NF. [Means for solving the problem]

[0011] overview A method for mitigating denial of service (DoS) attacks in a network function (NF) is provided. The method includes maintaining, at a first NF, an NF subscription database including rules specifying a maximum number of allowable subscriptions and corresponding rule criteria. The method further includes receiving, at the first NF, a subscription request to establish a subscription from a second NF. The method further includes the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database. The method further includes the first NF incrementing at least one count of a number of subscriptions for the at least one rule. The method further includes the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule. The method further includes preventing establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowable subscriptions for the at least one rule.

[0012] According to another aspect of the subject matter described herein, the first NF comprises a producer NF.

[0013] According to another aspect of the subject matter described herein, the first NF includes a service communication proxy (SCP).

[0014] According to another aspect of the subject matter described herein, maintaining the NF subscription database includes maintaining a database having at least one rule having criteria that identifies an NF type.

[0015] According to another aspect of the subject matter described herein, accessing the NF subscription database includes extracting or inferring NF type information from the subscription request and using the NF type information extracted or inferred from the subscription request as a key to match criteria specified for rules in the database.

[0016] According to another aspect of the subject matter described herein, maintaining the NF subscription database includes maintaining a database having at least one rule specifying a public land mobile network (PLMN) criterion.

[0017] According to another aspect of the subject matter described herein, accessing the NF subscription database includes extracting or inferring PLMN information of the second NF from the subscription request and using the PLMN information of the second NF extracted or inferred from the subscription request as a key to match criteria specified for rules in the database.

[0018] According to another aspect of the subject matter described herein, maintaining the NF subscription database includes maintaining a database having at least one rule specifying criteria for an NF instance ID, and accessing the NF subscription database includes extracting the NF instance ID from the subscription request and using the NF instance ID extracted from the subscription request as a key to match the criteria specified for the rule in the database.

[0019] According to another aspect of the subject matter described herein, maintaining the NF subscription database includes maintaining a count of the number of subscriptions currently being handled by the first NF that match the criteria for each of the rules.

[0020] According to another aspect of the subject matter described in this specification, the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database includes determining that the subscription request matches criteria for a plurality of rules in the database, the first NF incrementing at least one count of the number of subscriptions for the at least one rule includes incrementing a count for each of the rules having criteria that match the subscription request, and the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule includes determining that a count of the number of subscriptions for any of the rules having criteria that match the subscription request exceeds the maximum number of allowable subscriptions for the rule.

[0021] According to another aspect of the subject matter described herein, a system for mitigating denial of service (DoS) attacks at a network function (NF) is provided. The system includes a first NF including at least one processor and a memory. The system further includes an NF subscription database embodied in the memory and including rules specifying a maximum number of allowed subscriptions and corresponding rule criteria. The system further includes an NF subscription policer for receiving a subscription request to establish a subscription from a second NF, determining that the subscription request matches criteria for at least one rule in the NF subscription database, incrementing at least one count of a number of subscriptions for the at least one rule, determining that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule, and preventing establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions for the at least one rule.

[0022] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule having criteria that identifies an NF type.

[0023] According to another aspect of the subject matter described herein, when accessing the NF subscription database, the NF subscription policer is configured to extract or infer NF type information of the second NF from the subscription request and use the NF type information of the second NF extracted or inferred from the subscription request as a key to match criteria specified for rules in the database.

[0024] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule having criteria that identify a public land mobile network (PLMN), and upon accessing the NF subscription database, the NF subscription policer is configured to extract or infer a PLMN identifier for the second NF from the subscription request and use the PLMN identifier extracted or inferred from the subscription request as a key to match the criteria specified for the rules in the database.

[0025] According to another aspect of the subject matter described herein, the NF subscription database includes at least one rule having criteria that identifies an NF instance ID, and when accessing the NF subscription database, the NF subscription policer is configured to extract the NF instance ID from the subscription request and use the NF instance ID extracted from the subscription request as a key to match the criteria specified for the rules in the database.

[0026] According to another aspect of the subject matter described herein, the NF subscription policer is configured to maintain a count of the current number of subscriptions being handled by the first NF that match the criteria for each of the rules.

[0027] According to another aspect of the subject matter described herein, when determining that the subscription request matches criteria for at least one rule in the NF subscription database, the NF subscription policer is configured to determine that the subscription request matches criteria for a plurality of rules in the database; when incrementing at least one count of the number of subscriptions for the at least one rule, the NF subscription policer is configured to increment a count for each of the rules having criteria that match the subscription request; and when determining that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule, the NF subscription policer is configured to determine that the count of the number of subscriptions for any of the rules having criteria that match the subscription request exceeds the maximum number of allowed subscriptions for the rule.

[0028] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium is provided having stored thereon executable instructions that, when executed by a processor of the computer, control the computer to perform a plurality of steps. The plurality of steps includes maintaining, at a first network function (NF), an NF subscription database including rules specifying a maximum number of allowable subscriptions and corresponding rule criteria. The plurality of steps further includes receiving, at the first NF, a subscription request to establish a subscription from a second NF. The plurality of steps further includes the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database. The plurality of steps further includes the first NF incrementing at least one count of the number of subscriptions for the at least one rule. The plurality of steps further includes the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule. The plurality of steps further includes preventing establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowable subscriptions for the at least one rule.

[0029] The subject matter described herein may be implemented in software combined with hardware and / or firmware. For example, the subject matter described herein may be implemented in software executed by a processor. In one exemplary implementation, the subject matter described herein may be implemented using a non-transitory computer-readable medium having stored thereon computer-executable instructions that, when executed by a processor of a computer, control a computer to perform a number of steps. Exemplary computer-readable media suitable for implementing the subject matter described herein include non-transitory computer-readable media such as disk memory devices, chip memory devices, programmable logic devices, and application-specific integrated circuits. In addition, computer-readable media implementing the subject matter described herein may be located on a single device or computing platform or may be distributed among multiple devices or computing platforms. [Brief explanation of the drawings]

[0030] [Figure 1] FIG. 1 is a network diagram illustrating an example 5G system network architecture. [Figure 2] FIG. 10 is a message flow diagram illustrating exemplary messages exchanged to create a subscription to a producer NF. [Figure 3] FIG. 10 is a message flow diagram illustrating exemplary messages exchanged when a producer NF sends a notification regarding a subscription to a consumer NF. [Figure 4] FIG. 10 is a message flow diagram illustrating example messages exchanged when an NF service consumer overwhelms the processing resources of an NF service producer due to excessive subscriptions. [Figure 5] FIG. 10 is a message flow diagram illustrating example messages exchanged to policy the number of subscriptions allowed for a consumer NF based on operator-configured criteria. [Figure 6] FIG. 10 is a message flow diagram illustrating example messages exchanged when policing the number of subscriptions allowed for a consumer NF based on operator-configured criteria results in preventing the establishment of a subscription in response to exceeding an operator-defined maximum limit. [Figure 7] FIG. 10 is a block diagram illustrating a consumer NF or SCP that can mitigate DoS attacks by policing the number of subscriptions from the consumer NF based on operator-configured criteria. [Figure 8] 10 is a flowchart illustrating an example process for mitigating DoS attacks by policing the number of subscriptions from consumer NFs based on operator-configured criteria. DETAILED DESCRIPTION OF THE INVENTION

[0031] Detailed Description Figure 1 is a block diagram illustrating an example 5G system network architecture. The architecture of Figure 1 includes an NRF 100 and an SCP 101, which may be located in the same home public land mobile network (HPLMN). As described above, the NRF 100 maintains profiles of available producer NF service instances and their supported services, and may enable consumer NFs or SCPs to subscribe to new / updated producer NF service instances and be notified of their registration. The SCP 101 may also support service discovery and producer NF instance selection. The SCP 101 may perform load balancing of connections between consumer NFs and producer NFs.

[0032] The NRF 100 is a repository for the NF profiles or service profiles of producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP must obtain the NF profile or service profile of the producer NF instance from the NRF 100. The NF profile or service profile is a JavaScript object notation (JSON) data structure defined in Third Generation Partnership Project (3GPP) Technical Specification (TS) 29.510. The NF profile or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0033] 1, any network function may be a consumer NF, a producer NF, or both, depending on whether it is requesting, providing, or both a service. In the illustrated example, the NFs include a PCF 102 that performs policy-related operations in the network, a UDM function 104 that manages user data, and an application function (AF) 106 that provides application services.

[0034] 1 further includes a session management function (SMF) 108 that manages sessions between an access and mobility management function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a mobility management entity (MME) in 4G networks. An authentication server function (AUSF) 112 performs authentication services for user equipment (UE), such as user equipment (UE) 114, seeking access to the network.

[0035] The Network Slice Selection Function (NSSF) 116 provides network slicing services for devices seeking access to specific network capabilities and characteristics associated with a network slice. The Network Exposure Function (NEF) 118 provides application programming interfaces (APIs) for application functions seeking information about Internet of Things (IoT) devices and other UEs connected to the network. The NEF 118 performs a function similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0036] The radio access network (RAN) 120 connects the user equipment (UE) 114 to the network via wireless links. The radio access network 120 may be accessed using a gNodeB (gNB) (not shown in FIG. 1 ) or other wireless access point. The user plane function (UPF) 122 may support various proxy functionalities for user plane services. One example of such proxy functionality is multipath transmission control protocol (MPTCP) proxy functionality. The UPF 122 may also support performance measurement functionality, which may be used by the UE 114 to obtain network performance measurements. Also shown in FIG. 1 is a data network (DN) 124, through which the UE accesses data network services, such as Internet services.

[0037] The SEPP 126 filters incoming traffic from other PLMNs and provides topology hiding for traffic leaving the home PLMN. The SEPP 126 may communicate with an SEPP in a foreign PLMN that manages security for that foreign PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions: one for the home PLMN and one for the foreign PLMN.

[0038] As mentioned above, one problem in the 3GPP network architecture for 5G communication networks is that producer NFs may become overwhelmed with processing resulting from excessive subscriptions from consumer NFs. FIG. 2 is a message flow diagram illustrating example messages exchanged between an NF service consumer and an NF service producer when creating a subscription. With reference to FIG. 2, an NF service consumer 200 may be any of the NFs shown in FIG. 1 that subscribes to other NFs. An NF service producer 202 may be any of the NFs shown in FIG. 1 that processes subscriptions. With reference to the message flow in FIG. 2, at line 1, the NF service consumer 200 sends an HTTP Post request to the NF service producer 202. The HTTP Post request includes a callback URI that includes additional criteria for filtering the set of events that trigger a notification. At line 2 of the message flow diagram, the NF service producer 202 sends a 201 Created message to the NF service consumer 200. The 201 Created message indicates that the subscription has been created.

[0039] Creating and maintaining subscriptions utilizes the processing, memory, and storage resources of the NF service producer 202. For example, a record corresponding to the subscription must be created in a subscription database maintained by the NF service producer 202. The NF service producer 202 must repeatedly check the record in its subscription database whenever a change in its status occurs so that it can determine whether notification to the NF service consumer is required. The NF service producer 202 must also maintain a timer for each subscription to determine its expiration time. Processing the next message associated with an existing subscription, such as an update or delete message, also consumes processor cycles of the producer NF 202. Because there is no check or enforcement of the number of subscriptions that match operator-defined criteria, excessive subscriptions could overwhelm the processing capacity of the NF service producer 202.

[0040] 3 shows example messages exchanged between NF service consumer 200 and NF service producer 202 when an event occurs that triggers a notification requested by a subscription. Referring to FIG. 3, at line 1 of the message flow diagram, NF service producer 202 determines that an event has occurred that matches the criteria specified by NF service consumer 200 for receiving notifications. For example, if the NF service producer is an NRF, the event may be the receipt of a message from a producer NF that the producer NF is available or unavailable to provide a particular service to which NF service consumer 200 has subscribed to receive notifications. When this event occurs, NF service producer 202 sends an HTTP Post message to NF service consumer 200 that includes the data requested by the subscription. During notification, the callback reference provided during the subscription process is used to send the Post request from NF service producer 202 to NF service consumer 200. When sending the notification, the NF service producer 202 acts as an HTTP client and the NF service consumer 200 acts as an HTTP server. At line 2 of the message flow diagram shown in Figure 3, the NF service consumer 200 responds to the notification with a 200 OK or 204 No Content message, depending on whether the Post message corresponded to an expected notification for the subscription.

[0041] Given the large number of NF service consumers and the number of subscriptions that can be created by a single NF service consumer, the resources of the NF service producer may become overwhelmed. This scenario is illustrated in Figure 4. Referring to Figure 4, at line 1, the NF service consumer 200 sends a Post message containing a subscription request 1 to the NF service producer 202. At line 2, the NF service producer 202 receives the Post message containing the subscription request, authenticates the subscribing node, and responds with a 201 Created message indicating successful creation of the subscription. Note that there is no check on the number of subscriptions by the NF service consumer 200, the PLMN of the NF service consumer 200, the total number of subscriptions, etc. Therefore, the NF service consumer 200 may continue to create N subscriptions to the NF service producer 202 until the processing resources, memory resources, or storage resources of the NF service producer 202 are exhausted. The Nth subscription is indicated by line N. At line N+1, the NF service producer 202 creates the Nth subscription and responds with a 201 Created message.

[0042] At line N+2, the NF service consumer 200 sends another subscription request to the NF service producer 202 to create subscription N+1. The processing resources of the NF service producer 202 are overwhelmed at this point. Therefore, the NF service producer 202 sends an error message at line N+3, or is unable to respond to the NF service consumer 200 because the NF service producer 202 does not have enough processing resources to generate a response.

[0043] 4 is undesirable because the NF service producer 202 may not be able to process new subscription requests or even handle existing subscriptions because it does not have enough resources due to excessive subscriptions from the NF service consumer 200. However, depending on the NF type, PLMN, or other parameters, there may be some scenarios in which an NF service consumer is allowed to create multiple subscriptions.

[0044] 5 is a message flow diagram illustrating an example exchange of messages when the NF service producer 202 limits the number of allowable subscriptions based on operator-configured criteria. Referring to FIG. 5, in step 1 of the message flow diagram, the NF service consumer 200 sends a subscription request to the NF service producer 202. The NF service producer 202 extracts parameters from the subscription request message, such as the NF service consumer's identity from an OAuth token or transport layer security (TLS) certificate in the service request message, the source PLMN, the NF type, or other suitable parameters. In step 2, the NF service producer determines whether the parameters extracted from the subscription request message match any of a plurality of rules in the subscription database 500. If the message parameters match any of the rules in the subscription database 500, the NF service producer 202 increments the subscription count for the corresponding rule(s) and determines whether the subscription count exceeds the allowable number of subscriptions for the rule. In the example subscription database shown in FIG. 5, the rule criteria include NF type, a combination of PLMN and NF type, and a wildcard rule for the maximum total number of subscriptions that the NF service producer 202 can handle. Note that in the example database, "NF type" represents the type of NF as specified by the network operator. For example, an operator may specify a maximum allowed number of subscriptions for an NF type of AMF that is different from the maximum allowed number of subscriptions from UDM. In addition, a current count of the number of subscriptions being handled by the NF service producer 202 is stored for each rule.Note that if criteria from a message match multiple rules, in one implementation, the new subscription may be rejected if it exceeds any one of the maximum allowed numbers of subscriptions for the matching rules.

[0045] If the subscription count for the matching rule does not exceed the maximum allowed number of subscriptions specified for the rule, the NF service producer 202 may respond with a subscription response message indicating successful creation of the subscription, as shown in step 4A. As described above, the subscription response may be a 201 Created message. If the subscription count for the matching rule exceeds the maximum allowed number of subscriptions for the rule, the NF service producer 202 may send a failure response message indicating failure to create the subscription, as shown in step 4B.

[0046] Table 1, shown below, provides more detail on subscription count data that may be included in subscription database 500.

[0047] [Table 1]

[0048] In Table 1, each row corresponds to a rule to compare against a new subscription request. Each rule includes the rule criteria, the corresponding maximum number of allowed subscriptions, and the current subscription count of subscriptions currently being handled by the NF that match each rule. The first rule in Table 1 indicates that for PLMN1, the maximum allowed number of subscriptions is MAX1. The second rule in Table 1 indicates that for criteria PLMN1 and NFTYPE1, the maximum allowed number of subscriptions is MAX2. The third rule in Table 1 indicates that for PLMN1 and NFTYPE2, the maximum number of allowed subscriptions is MAX3. The fourth rule in Table 1 indicates that the maximum number of allowed subscriptions for NFTYPE1 is MAX4. The fifth rule in Table 1 indicates that the maximum number of allowed subscriptions for NFINSTANCEID1 is MAX5.

[0049] A subscription count is also maintained for each rule. As mentioned above, the subscription count is the current number of subscriptions being handled by the NF that match each rule. In Table 1, if a subscription request from an NF with NFINSTANCEID1 and NFTYPE1 is received from PLMN1, the subscription counts for rules 1, 2, 4, and 5 would each be incremented because the subscription request matches the criteria specified for each of these rules. If the maximum number of subscriptions for any of the matching rules is exceeded, in one implementation, the subscription request would be rejected.

[0050]

[0033] Figure 6 is a message flow diagram illustrating the operation of NF service producer 202 when rejecting a subscription when the maximum number of allowed subscriptions for a matching rule would be exceeded. Referring to Figure 6, in step 1, NF service consumer 200 sends a Post message with a subscription request for subscription 1 to NF service producer 202. In step 2, NF service producer 202 finds a matching rule that includes only the NF instance ID for NF1 in the example of Figure 6, increments the subscription count for the matching rule, and determines whether the incremented subscription count causes the maximum number of allowed subscriptions to be exceeded. In the example rule of Figure 6, the maximum number of allowed subscriptions for the rule is N, where N > 1. Therefore, the Post message for subscription request 1 does not cause the maximum number of allowed subscriptions to be exceeded, and in step 3, NF service producer 202 creates the subscription and sends a message to NF service consumer 200 indicating that subscription 1 has been created.

[0051] The NF service producer 202 continues to accept new subscriptions from the NF service consumer 200. In step N of the message flow of Figure 6, the NF service consumer 200 sends a Post message for subscription N to the NF service producer 202. In this example, subscription N is assumed to be the Nth active subscription received from the NF service consumer 200. In step N+1, the NF service producer 202 increments the current subscription count, which results in the current count being equal to N. Therefore, because the subscription count is equal to the maximum number of allowed subscriptions, in step N+2, the NF service producer 202 creates the subscription and responds to the NF service consumer 200 with a 201 Created message indicating that subscription N has been created.

[0052] In step N+3, the NF service consumer 200 sends a Post message to the NF service producer 202 to create the (N+1)th subscription. In step N+4, the NF service producer 202 increments the current subscription count and determines whether the current subscription count exceeds the maximum number of allowed subscriptions. In this example, the maximum number of allowed subscriptions is N, which is less than the incremented current subscription count (N+1). Therefore, the NF service producer 202 does not create a new subscription and, optionally, sends a message to the NF service consumer 200 indicating that the maximum number of subscriptions has been exceeded, as indicated by step N+5.

[0053] Thus, by maintaining a maximum allowed number of subscriptions per rule using the steps of FIG. 6, the NF service producer 202 reduces the likelihood of effective denial-of-service attacks from NF service consumers. Other examples shown above may reduce the effectiveness of such attacks from PLMN, NF type, or any other operator-specific criteria. The subject matter described herein also reduces the likelihood of unintentional denial-of-service attacks, i.e., the likelihood of an NF consumer sending too many legitimate subscription requests to the NF service producer. Note that the maximum number of allowed subscriptions for each rule in database 500 may be configured to ensure the relative allocation of resources among consumer NFs in accordance with the network operator's requirements. The total number of allowed subscriptions across all rules, or as specified by a default rule with wildcard criteria, may be configured such that if the maximum total number of allowed subscriptions is reached, the NF service producer 202 may have a designed amount of reserved processing, storage, and / or memory capacity available to handle NF service producer operations.

[0054] FIG. 7 is a block diagram illustrating an example architecture for an NF 700 that performs NF subscription policing as described herein. Note that the subscription policing functionality described above with respect to the NF service producer 202 may instead be implemented in an SCP, because the SCP routes subscription request messages and may therefore be where subscription request messages are policed to ensure that the maximum number of allowed subscriptions for the producer NF is not exceeded. Thus, in FIG. 7, the NF 700 may be an NF service producer 202 or a producer NF, such as an SCP that routes messages to the producer NF and performs subscription policing on behalf of the producer NF. In FIG. 7, the NF 700 includes at least one processor 702 and a memory 704. The NF 700 may also include an NF subscription database 706 that stores data related to subscriptions when the NF 700 is an NF service producer. The NF subscription database 706 may also store the maximum allowed subscription rule described above with respect to Table 1 (when the NF 700 is an NF service producer or an SCP). If the NF is an NF service producer that receives and processes subscriptions from consumer NFs, the NF 700 further includes an NF subscription handler 708. If the NF 700 is an NF service producer or an SCP, the NF 700 may include an NF subscription policer 710 that performs the above-mentioned policing to ensure that the maximum number of allowed subscriptions for the rules provisioned in the NF subscription database 706 is not exceeded.

[0055] If the NF 700 is an SCP, the subscription database 706 may be provisioned with subscription policing rules, such as those shown in Table 1, for each NF service producer to which the SCP routes subscription request messages. Using a centralized node such as an SCP to police subscriptions on behalf of multiple NF service producers may be advantageous from the standpoint of scalability and efficiency. If the subscription request passes the subscription policing, the NF 700, acting as an SCP, may route the subscription request message to a producer NF that can create the requested subscription. If the subscription request message does not pass the subscription policing, the NF 700 may discard the message instead of routing it to the producer NF, thereby preventing the requested subscription from being established.

[0056] 8 is a flowchart illustrating an example process for mitigating denial-of-service attacks at a producer NF or SCP based on subscription rules. Referring to FIG. 8, at step 800, the process includes maintaining, at a first NF, an NF subscription database including rules specifying a maximum number of allowable subscriptions and corresponding criteria. For example, the first NF may be a producer NF or SCP. The NF subscription database may specify criteria such as an NF instance ID, a PLMN ID, an NF type, or any combination thereof, and specify a maximum number of allowable subscriptions that match each set of criteria.

[0057] At step 802, the process includes receiving, at a first NF, a subscription request from a second NF to establish a subscription. For example, a producer NF or SCP may receive the subscription request to receive notification of updates regarding the status of the producer NF that received the subscription request, or, in the case of an SCP, the status of producers to which the SCP routes messages on behalf of the consumer NF. At step 804, the process includes the first NF determining that the subscription request matches the criteria for at least one rule in an NF subscription database. For example, the producer NF or SCP may extract parameters such as the NF instance ID, NF type, PLMN ID, etc. from the subscription request message and use these parameters to perform a lookup in the NF subscription database. The first NF may compare the parameters extracted from the message with the rule criteria for each rule in the database and identify one or more matching rules.

[0058] At step 806, the process includes the first NF incrementing a subscription count for the matching rule. For example, a producer NF or SCP may maintain a subscription count for each rule that indicates the number of active subscriptions maintained by the producer NF(s) to which the SCP routes messages that match the criteria for a given rule. When a request for a new subscription is received, the producer NF or SCP may update or increment the subscription count for each matching rule.

[0059] At step 808, the process includes the first NF determining that the subscription count exceeds the maximum number of allowable subscriptions for one or more of the matching rules. For example, the producer NF or SCP may update the subscription count for each rule identified as matching parameters extracted or derived from the current subscription request to determine that the maximum count for one of the rules is exceeded.

[0060] At step 810, the process includes preventing the creation of a subscription. For example, if the producer NF or SCP determines that creating a subscription for the current subscription request would exceed the maximum allowed subscription count for any of the rules, the producer NF or SCP may prevent the first subscription from being established, filter out or discard the subscription request message, and optionally send an error message to the consumer NF that sent the subscription request.

[0061] Thus, the subject matter described herein mitigates denial-of-service attacks by reducing the likelihood of excessive subscriptions at a producer NF or SCP. As noted above, the subject matter described herein is applicable to any producer NF that utilizes subscriptions to communicate with consumer NFs or by an SCP that routes subscription request messages to a producer NF. Examples of producer NFs in which the subject matter described herein may be implemented include an NRF, PCF, BSF, NSSF, UDR, UDM, or NEF. Implementing the subject matter described herein in a centralized node such as an NRF or SCP may be particularly advantageous because such nodes may be at high risk for denial-of-service attacks due to the number of subscriptions they may handle.

[0062] The disclosure of each of the following references is incorporated herein by reference in its entirety: References 1. 3GPP TS 23.502 V16.7.0 (2020-12), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for 5G System (5GS); Stage 2 (Release 16) 2. 3GPP TS 23.501 V16.7.0 (2020-12), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System Architecture for 5G Systems (5GS); Stage 2 (Release 16) 3.3GPP TS 29.510 V17.0.0 (2020-12), 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminal; 5G System; Network Function Repository Service; Stage 3 (Release 17).

[0063] It will be understood that various details of the subject matter described herein can be changed without departing from the scope of the subject matter described herein. Moreover, since the subject matter described herein is defined by the claims as set forth below, the above description is intended to be illustrative only and not limiting.

Claims

1. 1. A method for mitigating denial of service (DoS) attacks on a network function (NF), the method comprising: maintaining, at the first NF, a NF subscription database containing rules specifying a maximum number of allowable subscriptions and corresponding rule criteria; receiving, at the first NF, a subscription request from a second NF to establish a subscription; the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database; the first NF incrementing at least one count of the number of subscriptions for the at least one rule; the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule; and preventing establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowable subscriptions for the at least one rule.

2. The method of claim 1 , wherein the first NF comprises a producer NF.

3. The method of claim 1 or 2, wherein the first NF comprises a service communication proxy (SCP).

4. 4. The method of claim 1, wherein maintaining the NF subscription database comprises maintaining the NF subscription database with at least one rule having criteria for identifying an NF type.

5. The method described in claim 4, wherein the step of determining that the subscription request matches criteria for at least one rule in the NF subscription database includes the step of extracting or inferring NF type information from the subscription request and using the NF type information extracted or inferred from the subscription request as a key for matching the criteria identified for the rule in the NF subscription database.

6. 6. The method of claim 1, wherein maintaining the NF subscription database comprises maintaining the NF subscription database with at least one rule specifying public land mobile network (PLMN) criteria.

7. The method described in claim 6, wherein the step of determining that the subscription request matches criteria for at least one rule in the NF subscription database includes the step of extracting or inferring PLMN information of the second NF from the subscription request and using the PLMN information of the second NF extracted or inferred from the subscription request as a key for matching the criteria identified for the rule in the NF subscription database.

8. 8. The method of claim 1, wherein maintaining the NF subscription database comprises maintaining the NF subscription database with at least one rule specifying criteria for an NF instance ID, and determining that the subscription request matches criteria for at least one rule in the NF subscription database comprises extracting an NF instance ID from the subscription request and using the NF instance ID extracted from the subscription request as a key for matching the criteria specified for the rule in the NF subscription database.

9. 9. The method of claim 1, wherein maintaining the NF subscription database comprises maintaining a count of the number of subscriptions currently handled by the first NF that match the criteria for each of the rules.

10. the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database comprises determining that the subscription request matches criteria for a plurality of rules in the NF subscription database; the first NF incrementing at least one count of the number of subscriptions for the at least one rule includes incrementing the count for each of the rules having criteria that match the subscription request; 10. The method of claim 9, wherein the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule comprises determining that the count of the number of subscriptions for any of the rules having criteria that match the subscription request exceeds the maximum number of allowable subscriptions for the rule.

11. 1. A system for mitigating denial of service (DoS) attacks on a network function (NF), the system comprising: a first NF including at least one processor and a memory; an NF subscription database embodied in said memory, said database including rules specifying a maximum number of allowable subscriptions and corresponding rule criteria; and a NF subscription policer, the NF subscription policer to receive a subscription request to establish a subscription from a second NF, determine that the subscription request matches criteria for at least one rule in the NF subscription database, increment at least one count of a number of subscriptions for the at least one rule, determine that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule, and prevent establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowed subscriptions for the at least one rule.

12. The system of claim 11 , wherein the first NF comprises a producer NF.

13. The system of claim 11 , wherein the first NF comprises a service communication proxy (SCP).

14. The system of any one of claims 11 to 13, wherein the NF subscription database includes at least one rule having criteria for specifying an NF type.

15. The system of claim 14, wherein when the subscription request is determined to match the criteria for at least one rule in the NF subscription database, the NF subscription policer is configured to extract or infer NF type information of the second NF from the subscription request and use the NF type information of the second NF extracted or inferred from the subscription request as a key for matching the criteria identified for the rule in the NF subscription database.

16. 16. The system of claim 11, wherein the NF subscription database includes at least one rule having criteria that specify a public land mobile network (PLMN), and wherein upon determining that the subscription request matches the criteria for at least one rule in the NF subscription database, the NF subscription policer is configured to extract or infer a PLMN identifier for the second NF from the subscription request and use the PLMN identifier extracted or inferred from the subscription request as a key for matching the criteria specified for the rules in the NF subscription database.

17. 17. The system of claim 11, wherein the NF subscription database includes at least one rule having criteria that specifies an NF instance ID, and wherein, upon determining that the subscription request matches the criteria for at least one rule in the NF subscription database, the NF subscription policer is configured to extract an NF instance ID from the subscription request and use the NF instance ID extracted from the subscription request as a key for matching the criteria specified for the rule in the NF subscription database.

18. 18. The system of claim 11, wherein the NF subscription policer is configured to maintain a count of the current number of subscriptions being handled by the first NF that match the criteria for each of the rules.

19. the NF subscription policer is configured to determine that the subscription request matches criteria for a plurality of rules in the NF subscription database upon determining that the subscription request matches criteria for at least one rule in the NF subscription database; When incrementing at least one count of the number of subscriptions for the at least one rule, the NF subscription policer is configured to increment the count for each of the rules having a criterion that matches the subscription request; 20. The system of claim 18, wherein, upon determining that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule, the NF subscription policer is configured to determine that the count of the number of subscriptions for any of the rules having criteria that match the subscription request exceeds the maximum number of allowed subscriptions for the rule.

20. 1. A computer program which, when executed by a processor of a computer, controls the computer to perform a plurality of steps, the plurality of steps comprising: maintaining, at a first network function (NF), a NF subscription database containing rules specifying a maximum number of allowable subscriptions and corresponding rule criteria; receiving, at the first NF, a subscription request from a second NF to establish a subscription; the first NF determining that the subscription request matches criteria for at least one rule in the NF subscription database; the first NF incrementing at least one count of the number of subscriptions for the at least one rule; the first NF determining that the at least one count of the number of subscriptions exceeds a maximum number of allowable subscriptions for the at least one rule; and preventing establishment of the subscription in response to determining that the at least one count of the number of subscriptions exceeds the maximum number of allowable subscriptions for the at least one rule.

Images