Methods, systems, and computer-readable media for platform firewall management using Network Function (NF), Repository Function (NRF), or Service Communication Proxy (SCP).

Abstract

A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication proxy (SCR) includes receiving a message regarding registering, updating, or deregistering an NF profile in an NF profile database separate from the platform firewall. The method further includes determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall. The method further includes automatically updating, by the NRF or SCR, a firewall rule setting of the platform firewall in response to determining that registering, updating, or deregistering the NF profile requires a change to a firewall rule setting of the platform firewall.

Description

Technical Field

[0001] Priority Claim This application claims the benefit of priority of U.S. Patent Application No. 17 / 308,018, filed on May 4, 2021, the entire disclosure of which is incorporated herein by reference.

[0002] Technical Field The subject matter described herein relates to security in telecommunications networks. More particularly, the subject matter described herein relates to methods, systems, and computer-readable media for platform firewall management by an NRF or SCP.

Background Art

[0003] Background In a 5G telecommunications network, network functions that provide services are referred to as producer NFs or NF service producers. Network functions that consume services are referred to as consumer NFs or NF service consumers. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function is consuming, producing, or consuming and producing services. The terms "producer NF" and "NF service producer" are used synonymously herein. Similarly, the terms "consumer NF" and "NF service consumer" are used synonymously herein.

[0004] A given producer NF may have many service endpoints, where a service endpoint is a connection point for one or more NF instances hosted by the producer NF. Service endpoints are identified by a combination of Internet Protocol (IP) address and port number, or by a fully qualified domain name which translates to an IP address and port number on the network node hosting the producer NF. An NF instance is an instance of the producer NF that provides a service. A given producer NF may contain two or more NF instances. It should also be noted that multiple NF instances can share the same service endpoint.

[0005] Producer NFs register with the Network Functionality Repository (NRF). The NRF maintains service profiles of available NF instances, identifying the services supported by each NF instance. The terms "service profile" and "NF profile" are used synonymously in this specification. Consumer NFs can subscribe to receive information about producer NF instances registered with the NRF.

[0006] In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a Service Communication Proxy (SCP). An SCP subscribes to the NRF and obtains reachability and service profile information about producer NF service instances. Consumer NFs connect to the Service Communication Proxy, and the Service Communication Proxy load balances traffic among producer NF service instances that provide the required services, or routes traffic directly to the destination producer NF instance.

[0007] In addition to SCPs, another example of an intermediate proxy node that routes traffic between producer and consumer NFs is a Security Edge Protected Proxy (SEPP). A SEPP is a network node used to protect control plane traffic exchanged between different 5G public terrestrial mobile networks (PLMNs). Therefore, a SEPP performs message filtering, policing, and topology concealment for all application programming interface (API) messages sent between PLMNs.

[0008] One problem with 5G communication networks is that setting up firewalls to protect the network by filtering packets entering and / or leaving the network is labor-intensive and error-prone. Firewalls that protect the 5G (or next-generation) core network by filtering packets entering and / or leaving the network are referred to in this specification as platform firewalls.

[0009] 5G NFs are deployed in networks protected by firewall rules that filter packets based on source and destination IP addresses, source and destination ports, and protocols, in addition to other predefined 5G security mechanisms. One of the challenges in configuration is maintaining firewall rules in synchronization with 5G NF topology changes brought about by NRFs as changes to the NF profile, which includes 5G NF IP address and port details. Performing this type of configuration manually is time-consuming, labor-intensive, and error-prone. For example, in cloud network embodiments of 5G systems, NF profiles can change rapidly as NF instances are instantiated, updated, and removed from service. The platform firewall protecting the 5G network needs to be updated based on changes in the network topology. However, there is no predefined mechanism for maintaining platform firewall rules in synchronization with NF profile changes in the 5G network. [Overview of the Initiative] [Problems that the invention aims to solve]

[0010] Considering these and other issues, there is a need for improved methods, systems, and computer-readable media for managing platform firewalls. [Means for solving the problem]

[0011] overview A method for automatically managing a platform firewall using a Network Function (NF) Repository Function (NRF) or a Service Communication Proxy (SCP) includes the step of receiving messages regarding the registration, updating, or unregistration of an NF profile in an NF profile database separate from that of the platform firewall. The method further includes determining that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall. In response to determining that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall, the method further includes automatically updating the firewall rule settings of the platform firewall by the NRF or SCP.

[0012] According to other aspects of the subject matter described herein, receiving a message relating to registering, updating, or deregistering an NF profile includes receiving an NF registration request or response relating to registering an NF profile by the NRF.

[0013] According to other aspects of the subject matter described herein, automatically updating the firewall rule settings of a platform firewall includes adding rules to the firewall rule settings and filtering packet traffic to or from the NF.

[0014] According to other aspects of the subject matter described herein, receiving a message relating to registering, updating, or deregistering an NF profile includes receiving an NF update request or response relating to updating an NF profile by the NRF.

[0015] According to other aspects of the subject matter described herein, automatically updating the platform firewall configuration includes updating the rules in the firewall rule configuration and filtering packet traffic to or from the NF.

[0016] According to other aspects of the subject matter described herein, a method for automatically updating the rule settings of a platform firewall includes determining that a message relating to registering, updating, or unregistering an NF profile includes the fully qualified domain name (FQDN) of the NF, and the method further includes querying a DNS server and translating the FQDN of the NF to the Internet Protocol (IP) address of the NF.

[0017] According to other aspects of the subject matter described herein, receiving a message relating to registering, updating, or deregistering an NF profile includes receiving an NF deregistration request or response from the NRF relating to deregistering an NF profile.

[0018] According to other aspects of the subject matter described herein, automatically updating the platform firewall settings includes deleting rules in the firewall rule settings corresponding to the NF profile.

[0019] According to other aspects of the subject matter described herein, automatically updating the platform firewall settings includes calling the platform firewall's configuration application programming interface (API).

[0020] According to other aspects of the subject matter described herein, automatically updating the settings of a platform firewall includes updating multiple platform firewalls located at different network sites.

[0021] According to other aspects of the subject matter described herein, a system for automatically managing a platform firewall is provided. The system includes a network function (NF) repository function (NRF) or service communication proxy (SCP) including at least one processor and memory. The system receives messages regarding the registration, updating, or unregistration of NF profiles in an NF profile database separate from the platform firewall, determines that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall, and further includes a platform firewall rule setting manager for automatically updating the firewall rule settings of the platform firewall by the NRF or SCP in response to the determination that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall.

[0022] According to other aspects of the subject matter described herein, a message relating to registering, updating, or deregistering an NF profile includes an NF registration request or response relating to registering an NF profile by the NRF.

[0023] According to other aspects of the subject matter described herein, when automatically updating the platform firewall configuration, the platform firewall rule configuration manager is configured to add rules to the firewall rule configuration and filter packet traffic to or from the NF.

[0024] According to other aspects of the subject matter described herein, a message relating to registering, updating, or deregistering an NF profile includes an NF update request or response relating to updating an NF profile by the NRF.

[0025] According to other aspects of the subject matter described herein, when automatically updating the settings of the platform firewall, the platform firewall rule setting manager updates the rules of the firewall rule settings and is configured to filter packet traffic to or from the NF.

[0026] According to other aspects of the subject matter described herein, when a message regarding registering, updating, or deregistering an NF profile is determined to include the fully qualified domain name (FQDN) of the NF, the platform firewall rule setting manager queries a DNS server and is configured to convert the FQDN of the NF to the Internet Protocol (IP) address of the NF.

[0027] According to other aspects of the subject matter described herein, a message regarding registering, updating, or deregistering an NF profile includes an NF deregistration request or response for deregistering the NF profile by the NRF. When automatically updating the settings of the platform firewall, the platform firewall rule setting manager is configured to delete the rules of the firewall rule settings corresponding to the NF profile identified within the NF deregistration request or response.

[0028] According to other aspects of the subject matter described herein, when automatically updating the settings of the platform firewall, the platform firewall rule setting manager is configured to call the settings application programming interface (API) of the platform firewall.

[0029] According to other aspects of the subject matter described herein, the platform firewall rule setting manager is configured to update the rule settings of multiple platform firewalls located at different network sites.

[0030] According to other aspects of the subject matter described herein, a non-temporary computer-readable medium is provided which stores executable instructions, and when executed by a computer processor, controls the computer to perform steps. Steps are performed in a Network Function (NF) Repository Function (NRF) or Service Communication Proxy (SCP) which is performed by at least one processor. Steps further include receiving a message relating to registering, updating, or unregistering an NF profile in an NF profile database separate from the platform firewall. Steps further include determining that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall. Steps further include automatically updating the firewall rule settings of the platform firewall by the NRF or SCP in response to determining that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall.

[0031] The subject matter described in this specification is implementable in software and in combination with hardware and / or firmware. For example, the subject matter described in this specification is implementable in software executed by a processor. In one exemplary embodiment, the subject matter described in this specification is implementable using a non-temporary computer-readable medium storing computer-executable instructions, which, when executed by a computer processor, control the computer to execute steps. Exemplary computer-readable mediums configured to implement the subject matter described in this specification include non-temporary computer-readable media such as disk memory devices, chip memory devices, programmable logic circuits, and application-specific integrated circuits. In addition, computer-readable media that implement the subject matter described in this specification may reside on a single device or computing platform or may be distributed across multiple devices or computing platforms.

[0032] Exemplary embodiments of the subject matter described herein will be described below with reference to the accompanying drawings. [Brief explanation of the drawing]

[0033] [Figure 1] This is a network diagram illustrating an exemplary 5G system network architecture. [Figure 2] This network diagram shows a firewall positioned between a trusted network and an untrusted network. [Figure 3] This message flow diagram shows an example of messages exchanged to automatically configure the platform firewall using NRF. [Figure 4] This is a network diagram showing an NRF (Network Firewall) that manages multiple platform firewalls located at different sites. [Figure 5]This block diagram shows an exemplary architecture for an NRF or SCP for automatically managing a platform firewall. [Figure 6] This flowchart shows an exemplary process for managing a platform firewall using NRF or SCP. [Modes for carrying out the invention]

[0034] Detailed explanation Figure 1 is a block diagram illustrating an exemplary 5G system network architecture. The architecture in Figure 1 includes an NRF100 and an SCP101, which may be located within the same Home Public Terrestrial Mobile Network (HPLMN). As described above, the NRF100 may maintain a profile of available producer NF service instances and their supported services, and may allow consumer NFs or SCPs to subscribe to and be notified of new / updated producer NF service instances. The SCP101 may also support service discovery and selection of producer NF instances. The SCP101 may perform load balancing of connections between consumer NFs and producer NFs.

[0035] NRF100 is a repository for service profiles of NFs or producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP must obtain the NF or producer NF instance's service profile from NRF100. An NF or service profile is a JavaScript object notation (JSON) data structure as defined in 3GPP® TS 29.510. An NF or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet Protocol (IP) version 4 (IPv4) address, or an IP version 6 (IPv6) address.

[0036] In Figure 1, any of the network functions can be a consumer NF, a producer NF, or both, depending on whether they are requesting, providing, or requesting and providing a service. In the illustrated example, the NF is a policy control function (PCF) 102 that performs policy-related actions within the network and manages user data. Integrated data management function Includes (UDM)104 and application function (AF)106 that provides application services.

[0037] The NF shown in Figure 1 further includes a Session Management Function (SMF) 108 that manages the session between the Access and Mobility Management Function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a Mobility Management Entity (MME) in a 4G network. The Authentication Server Function (AUSF) 112 performs authentication services for user devices (UEs), such as user devices (UEs) 114 that request access to the network.

[0038] The Network Slice Selection Function (NSSF) 116 provides network slicing services for devices seeking to access specific network capabilities and characteristics associated with a network slice. The Network Exposure Function (NEF) 118 provides an application programming interface (API) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs attached to the network. The NEF 118 performs a function similar to the Service Capability Exposure Function (SCEF) in 4G networks.

[0039] The Wireless Access Network (RAN) 120 connects the User Equipment (UE) 114 to the network via a wireless link. The Wireless Access Network 120 may be accessed using a g-Node B (gNB) (not shown in Figure 1) or other wireless access points. The User Plane Function (UPF) 122 can support various proxy functions for user plane services. One example of this type of proxy function is the Multipath Transmit Control Protocol (MPTCP) proxy function. The UPF 122 may also support performance measurement functions that may be used by the UE 114 to obtain network performance measurements. Figure 1 also shows the Data Network (DN) 124, which the UE uses to access data network services such as Internet services.

[0040] SEPP126 filters incoming traffic from other PLMNs and performs topology concealment for outgoing traffic from the home PLMN. SEPP126 may also communicate with SEPP in the external PLMN to manage the security of the external PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and the other for the external PLMN.

[0041] Figure 2 is a network diagram showing an exemplary firewall positioned between a trusted network and an untrusted network. Generally, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Firewalls typically establish a barrier between trusted and untrusted networks. One type of network firewall is a packet filter that inspects packets being forwarded between 5G entities. In some cases, packets are filtered based on source and destination IP addresses, source and destination ports, and protocols.

[0042] As mentioned above, one potential issue with 5G networks is managing the platform firewall protecting the 5G network. Specifically, it is necessary to ensure that firewall rules are synchronized with changes to the NF profile occurring in the NRF. An NF profile is a data structure with attributes defined in 3GPP TS 29.510. An illustrative list of NF profile attributes can be found in Table 6.2.6.2.3-1 of 3GPP TS 29.510. Updates to any of these attributes may trigger automatic updates to the platform firewall rule settings.

[0043] The following list shows examples of NF profile attributes that may be included in platform firewall rules, and updates to NF profile attributes may be used to trigger automated updates to platform firewall rule configurations.

[0044] Fully Qualified Domain Name (FQDN) of network functions, Network function IPv4 address, IPv6 address for network functions, Service instance FQDN and IpEndPoint: This is the IP address and port information of a network function, where the service listens for incoming service requests.

[0045] Platform firewall rules may be configured using additional or alternative attributes from Table 6.2.6.2.3-1 of 3GPP TS 29.510. Since the NRF stores NF profiles of NFs that are registered to be discovered by other NFs in the network, the NRF contains most, if not all, of the information needed to configure the platform firewall. However, when NF profiles are added, updated, or deleted in the NRF, there is no predefined mechanism for updating the firewall rule set used by the platform firewall to filter packets.

[0046] Platform firewalls generally expose configuration APIs to automate the firewall configuration process. For example, some platform firewalls expose representative state transition (REST) ​​APIs to configure firewall rules. However, the subject matter described herein is not limited to configuring firewall rules using REST APIs. Any suitable API for configuring firewall rules is intended to fall within the scope of the subject matter described herein. In addition, even if a firewall has an API for configuration, there is no predefined mechanism for synchronizing changes to firewall rules with changes to the NF profile.

[0047] The platform firewall needs to be configured according to the 5G NF topology configuration, and then kept synchronized with 5G NF topology updates. The manual configuration process is cumbersome and prone to errors. The platform firewall process needs to be automated. 5GC networks span multiple sites, complicating the manual process and increasing the need for automated configuration.

[0048] In one exemplary embodiment, the NRF is enhanced to automatically configure platform firewall rules. The NRF monitors NF profiles for creation / deletion / update. The NRF determines whether a change in the NF profile requires a change to the firewall rule settings in the platform firewall rule configuration. If a change in the NF profile requires a change to the firewall rule settings, the NRF takes action to update the corresponding platform firewall rule settings. Such a step may also involve translating FQDNs to IP addresses if the IP addresses are not yet provided in the NF profile or are based on operator configuration. The NRF may then call the appropriate platform API for firewall rule creation / deletion / update.

[0049] One example of an NF profile change that may require changes to firewall rule settings is NF registration. When an NF registers with the NRF, it provides the NRF with its NF profile. The NF profile contains the FQDN or IP address to which the NF should be contacted for service. Adding a new NF profile to the NRF may trigger the creation of at least one firewall rule in the platform firewall. For example, one firewall rule created in this instance might allow a specific type of traffic to or from the IP address or FQDN of the newly registered NF.

[0050] Another example of an NF profile change that may require changes to firewall rule settings is an update to the contact address in the NF profile. For example, if the IP address or FQDN to which an NF is contacted for service changes, one or more corresponding platform firewall rules should be updated with the corresponding contact address so that packets to and from the updated contact address can pass through the firewall and be filtered.

[0051] Another example of an NF profile modification that may require changes to firewall rule settings is the deregistration of an NF profile. Deregistration of an NF profile by the NRF results in the removal of the NF profile from the NF profile database maintained by the NRF. When an NF profile is removed, the corresponding platform firewall rule for the deregistered NF profile must also be removed so that the contact address for the deregistered NF cannot be used to send attack traffic through the firewall.

[0052] Figure 3 is a message flow diagram showing exemplary messages exchanged to configure the platform firewall. Referring to Figure 3, on line 1, a 5G NF300, which may be any of the NFs shown in Figure 1, sends an NF registration, NF update, or NF deregistration request to the NRF100. An NF registration request is a message to register an NF profile with the NRF100. The NF registration request includes the registration of the NF profile. An NF update request is a message to update one or more attributes of an NF profile registered with the NRF100. An NF deregistration message is a message to deregister a profile currently registered with the NRF100, resulting in the deletion of the NF profile. On line 2 of the message flow diagram, the NRF100 returns a response to the NF registration, NF update, or NF deregistration request. If the request on line 1 is an NF registration request and the operation is successful, the response on line 2 may be a 201 Create message. If the request on line 1 is an NF update request and the operation is successful, the response may be a 200 OK message. If the request on line 1 is an NF unregistration request, the response on line 2 may be a 201 no-content message.

[0053] If any of the NF registration, NF update, or NF unregistration operations are successful, a change to the platform firewall rule settings may be requested. Therefore, in lines 3-6 of the message flow diagram, NRF100 signals DNS server 302 and platform firewall 304 to update one or more firewall rules. For example, in line 3, NRF100 sends a DNS query to DNS server 402, translating the FQDN in the NF profile being updated or created by one of the operations in line 1 to an IP address. In line 4, DNS server 402 responds to the query with one or more IP addresses corresponding to the FQDN in the DNS query. Note that if the NF profile includes IP addresses instead of FQDNs to identify the NF or NF instance, the DNS query in line 3 is optional and may be omitted.

[0054] On line 5, once NRF100 receives an IP address or other parameters necessary to update one or more firewall rules, NRF100 calls the appropriate platform firewall configuration API to update one or more firewall rules used by platform firewall 304. Calling the platform firewall configuration API may include sending a message to platform firewall 304 formatted according to the API, and including the updated firewall rule parameters. Platform firewall 304 receives the message, authenticates the sender, updates one or more of its packet filtering rules using the updated NF profile information received from NRF100, and returns a response to NRF100 on line 6 indicating that the NF rule update was successful.

[0055] To configure the platform firewall 304, the NRF100 may use the attributes listed in Table 1 below.

[0056] [Table 1]

[0057] Table 1 shows that the parameters required to access the Platform Firewall Configuration API include the API endpoint, which may be the FQDN or IP address and port number of the endpoint for receiving firewall rule configuration parameters. The parameters may also include the API prefix. The configuration parameters may further include security credentials, such as login credentials, for accessing the Platform Firewall Configuration API.

[0058] Multiple platform firewalls located at different sites may be configured using the NRF configured as described above to automatically configure the platform firewall. Figure 4 shows this type of embodiment. Referring to Figure 4, the NRF 100 is located at Site 1, and Site 1 has platform firewall 304A, as well as UDM 104A, IntegratedSite 2 may include a data repository (UDR) 400A, PCF 102A, charging function (CHF) 402A, subscription locator function (SLF) 404A, and SCP 101A. Site 2 includes platform firewalls 304B, SMF 108B, AMF 110B, UPF 122B, and SCP 101B. Site 3 includes platform firewalls 304C, SMF 108C, AMF 110C, UPF 122C, and SCP 101C. Site 4 includes platform firewalls 304D, SMF 108D, AMF 110D, UPF 122D, and SCP 101D. NRF 100 receives NF profile updates from NFs located at sites 1-4 and updates platform firewalls 304A-304D based on the NF profile updates. For example, if SCP101D, located within Site 4, has its NF profile updated by NRF100, NRF100 may update firewall rules in some or all of the platform firewalls 304A-304D that have parameters affected by the NF profile update. One example of this type of rule might be to allow traffic from SCP101D's IP address. If SCP101D's IP address changes due to the NF profile update, NRF100 may update firewall rules in each of the platform firewalls 304A-304D to allow traffic from SCP101D's new IP address.

[0059] The NRF100 may maintain different rule settings for each platform firewall 304A-304D, and it should be noted that these different settings include site-specific packet filtering rules for each firewall. For example, for platform firewall 304A located at site 1, the NRF100 may maintain and automatically update firewall rule settings for filtering packets to or from IP addresses associated with UDM104A, UDR400A, PCF102A, SLF404A, SCP101A, and the NRF100. For platform firewall 304B located at site 2, the NRF100 may maintain and automatically update firewall rule settings for filtering packets to or from SMF108B, AMF110B, UPF122B, and SCP101B. For platform firewall 304C located at site 3, NRF100 may maintain and automatically update firewall rule settings for filtering packets to or from SMF108C, AMF110C, UPF122C, and SCP101C. For platform firewall 304D located at site 4, NRF100 may maintain and automatically update firewall rule settings for filtering packets to or from SMF108D, AMF110D, UPF122D, and SCP101D.

[0060] In the example described above, the process for automatically managing the platform firewall is performed by the NRF100. In an alternative embodiment, the automated platform firewall management may be performed by the SCP101. Figure 5 is a block diagram illustrating an exemplary architecture for the NRF100 or SCP101 that can automatically update platform firewall rules in response to NF profile changes. Referring to Figure 5, the NRF100 or SCP101 includes at least one processor 500 and memory 502. When automated platform firewall database updates are performed by the NRF, the NRF100 further includes an NF profile database 504 for storing NF profiles of NFs registered with the NRF100, and an NF profile database manager 506 for updating the NF profile database 504 in response to NF registration, NF update, and NF unregistration requests from NFs. If the automated platform firewall database update function is performed by the SCP, the NF profile database 504 and the NF profile database manager 506 may be performed elsewhere (i.e., by the NRF), and the automated platform firewall rule setting update procedure described herein may be triggered by receiving NF registration, NF update, and NF unregistration responses from the NRF, which has confirmed the successful completion of the requested service operation.

[0061] NRF100 or SCP101 also includes a platform firewall rule configuration manager 508 for performing the steps described herein to update firewall rules managed by the platform firewall in response to an NF profile update. The platform firewall rule configuration manager 508 may be implemented using computer executable instructions stored in memory 502 and executed by the processor 500. NRF100 or SCP101 may further include a local (master) copy 510 of the platform firewall rule configuration database. When the platform firewall rule configuration manager 508 receives a request or response regarding the registration, update, or unregistration of an NF profile, the platform firewall rule configuration manager 508 may identify the NF profile or profile attribute affected by the requested service operation, access the database copy 510, identify the firewall rule having the same attribute or parameter being updated or deleted, perform the requested firewall rule update on the local copy 510 of the platform firewall rule configuration database, and distribute the required rule configuration update to the platform firewall managed by the platform firewall rule configuration manager 508. As described above with reference to Figure 4, different platform firewalls may receive different rule updates because the networks or sites they protect may include different NF instances and therefore may require different firewall rule configurations.

[0062] Figure 6 is a flowchart illustrating an exemplary process for managing a platform firewall by automatically provisioning platform firewall rules in response to changes in NF profiles. Referring to Figure 6, in step 600, the process includes receiving a message regarding registering, updating, or unregistering an NF profile in an NF profile database separate from the platform firewall. For example, NRF100 may receive an NF registration, NF update, or NF unregistration request from an NF that NRF100 intends to register, update, or unregister an NF profile. In embodiments of the SCP of the subject matter described herein, the automated platform firewall rule setting process may be triggered by receiving a response message confirming the success of registering, updating, or unregistering an NF profile. Thus, in embodiments of the SCP of the subject matter described herein, step 600 may include receiving an NF registration, NF update, or NF unregistration response message.

[0063] If the process is being performed by the NRF, control proceeds to step 602A, in which the process further includes registering, updating, or deregistering an NF profile based on the type of request. For example, if the request is an NF registration request, the NRF100 may register the NF by storing the NF profile in the NF profile database. If the request is an NF update request, the NRF100 may update the NF profile based on the parameters identified in the NF update request. If the request is an NF deregistration request, the NRF100 may delete the NF profile identified in the NF deregistration request.

[0064] If the process is being carried out by an SCP, control proceeds from step 600 to step 602B, in which step 602B, the SCP routes the NF registration, NF update, or NF deregistration response to the NF that requested the requested NF registration, NF update, or NF deregistration service operation.

[0065] Following step 602A or 602B, control proceeds to step 604, in which the process further includes determining that the registration, update, or unregistration of an NF profile requires a change to the firewall rule settings of the platform firewall. In the case of an NF registration request or response, the platform firewall rule setting manager 508 may determine that a rule corresponding to the registered NF profile needs to be added to the local (master) copy of the platform firewall rule setting database in NRF100 or SCP101. If the message received by NRF100 or SCP101 is an NF update request or response, the platform firewall rule setting manager 508 may identify the NF profile attributes being updated by the NF update service operation, determine whether the updated NF profile attributes are used by any of the rules in the local copy of the platform firewall rule setting database in NRF100 or SCP101, and update the corresponding attributes in the platform firewall rules. If the message received by NRF100 or SCP101 is an NF unregistration request or response, the platform firewall rule configuration manager 508 may determine that one or more rules corresponding to the unregistered NF profile need to be removed from the platform firewall rule configuration database local to NRF100 or SCP101.

[0066] In step 606, in response to determining that registering, updating, or unregistering an NF profile requires a change to the firewall rule settings of the platform firewall, the process further includes automatically updating the firewall rule settings of the platform firewall by NRF or SCP. For example, the platform firewall rule setting manager 508 may add, modify, or delete rules from the firewall rule setting database by calling or using the firewall setting API of the platform firewall 304. The platform firewall rule setting manager 508 may first update one or more rules in its local copy within the platform firewall rule setting database. The platform firewall rule setting manager 508 may then compose a message in the format specified by the platform firewall rule setting API to perform the requested firewall rule setting update, and then send the message to one or more platform firewalls to update their respective firewall rule settings. Note that the steps in Figure 6 may be performed continuously to maintain synchronization between one or more platform firewall rule settings and NF profile changes by NRF.

[0067] Tables 2 and 3 below show examples of firewall rules that may be updated in response to NF update service operations. In these examples, it is assumed that the IP address of UDM1 has changed from IP1 to IP3 due to the NF update service operation.

[0068] [Table 2]

[0069] [Table 3]

[0070] Table 2 shows that, prior to the NF profile update, the platform firewall is configured to allow traffic from IP1, port 1 to IP2, port 1, and vice versa. This type of pair of rules may also be configured to allow traffic from the UDM and other nodes on the protected side of the firewall, such as the AMF located on the unprotected side of the firewall. In Table 3, the UDM's IP address is changed to IP3. The AMF is notified of the change in the UDM's NF profile by the NRF through the NF discovery service. However, without automated firewall rule updates, communication between the AMF and the UDM would be blocked by the firewall. However, by automatically updating the firewall rule settings when the UDM's NF profile changes, communication between the UDM and the AMF can continue as described in this specification.

[0071] The subject matter described in this specification may achieve one or more of the following exemplary advantages:

[0072] • Automation of firewall configuration for on-demand topology changes (e.g., adding / removing / updating network slices) Manual changes cannot keep pace with topology changes, and the dynamic nature of frequently changing cloud-native topologies necessitates automation. By automating platform firewall configuration rule changes and synchronizing the changes with NF profile updates in the NRF, the subject matter described herein can be kept synchronized with NF profile changes resulting from cloud-native network topology changes.

[0073] 5G includes the concept of network slices, which further adds changes to the topology. The automated platform firewall configuration update method described herein can keep firewall rule configuration updates synchronized with changes in the NF profile resulting from the allocation and deallocation of resources to and from network slices.

[0074] Platform firewall rule settings are continuously monitored / audited for changes. For example, the NRF or SCP may continuously monitor NF registration, NF update, and NF deregistration operations for changes requiring updates to platform firewall rules, and may perform the operations described herein to update the platform firewall rules.

[0075] Automating updates to platform firewall rule settings using NRF (or SCP) provides enhanced security by ensuring that firewall rule settings are synchronized with NF profile updates in NRF.

[0076] Automating updates to platform firewall rule settings using NRF is straightforward because NRF already has the task of updating parameters within NF profiles that may be used by platform firewall rules.

[0077] As described above, the subject matter described in this specification for automatically updating firewall rules can also be performed by the SCP instead of the NRF. For example, the SCP may receive an NF registration, NF update, or NF unregistration response confirming the success of the registration, update, or deletion of an NF profile by the NRF, and perform the steps described in this specification for automatically updating the platform firewall rule settings. Thus, the SCP may perform automatic platform firewall rule setting updates in addition to its normal message routing functions.

[0078] Each of the following references is incorporated by reference in its entirety into this specification.

[0079] References 1. Third Generation Partnership Project; Technical Specifications Group Services and Systems Phase; System Architecture for 5G Systems (5GS); Stage 2 (Release 17) 3GPP TS 23.501 V17.0.0 (2021-03) 2. Third Generation Partnership Project; Technical Specifications Group Core Network and Terminals; 5G System; Network Function Repository Service; Stage 3 (Release 17) 3GPP TS 29.510 V17.1.0 (2021-03) It should be understood that various details of the subject matter described herein may be altered without departing from the scope and essence of the subject matter described herein. Furthermore, the above explanation is for illustrative purposes only and not to limit the subject matter described herein, as defined by the claims below.

Claims

1. A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or a service communication proxy (SCP), wherein the method is: In an NRF or SCP implemented by at least one processor, This includes receiving messages regarding registering, updating, or unregistering NF profiles in an NF profile database separate from the platform firewall, The aforementioned NF profile includes a contact address indicating the address to which the NF should be contacted for service, Updating an NF profile in the NF profile database includes changing the contact address of the NF profile. The above method further, It is determined that registering, updating, or unregistering the NF profile requires a change to the firewall rule settings of the platform firewall, The NRF or SCP automatically updates the firewall rule settings of the platform firewall in response to determining that registering, updating, or unregistering the NF profile requires a change to the firewall rule settings of the platform firewall, The firewall rule configuration includes one or more rules for filtering packet traffic to or from the NF, Each of the one or more rules includes a pair consisting of an action for packet traffic from the first address to the second address and an action for packet traffic from the second address to the first address. Automatically updating the firewall rule settings of the platform firewall means With respect to a pair including the first address that indicates the contact address before the change in the one or more of the aforementioned rules, update the first address in that pair to indicate the contact address after the change, and A method comprising updating a pair of the aforementioned rules, including the second address which indicates the contact address before the change in the one or more rules, to indicate the contact address after the change.

2. The method according to claim 1, wherein receiving a message relating to registering, updating, or unregistering the NF profile includes receiving an NF registration request or response relating to registering the NF profile by the NRF.

3. The method according to claim 2, wherein automatically updating the firewall rule settings of the platform firewall includes adding the rules to the firewall rule settings.

4. The method according to claim 1, wherein receiving a message relating to registering, updating, or unregistering the NF profile includes receiving an NF update request or response relating to updating the NF profile by the NRF.

5. The contact address includes a fully qualified domain name (FQDN), The method according to any one of claims 1 to 4, wherein the method comprises determining that the message relating to registering, updating, or unregistering the NF profile includes the FQDN of the NF, and the method further comprises querying a DNS server and translating the FQDN of the NF to an Internet Protocol (IP) address of the NF.

6. The method according to claim 1, wherein receiving a message relating to registering, updating, or unregistering the NF profile includes receiving an NF unregistration request or response relating to unregistering the NF profile by the NRF.

7. The method according to claim 6, wherein automatically updating the firewall rule settings of the platform firewall includes deleting the rules of the firewall rule settings corresponding to the NF profile.

8. The method according to any one of claims 1 to 4, wherein automatically updating the firewall rule settings of the platform firewall includes calling the configuration application programming interface (API) of the platform firewall.

9. The method according to any one of claims 1 to 4, wherein automatically updating the firewall rule settings of the platform firewall includes updating the firewall rule settings of multiple platform firewalls located at different network sites.

10. A system for automatically managing a platform firewall, wherein the system is It comprises a network function (NF) repository function (NRF) or service communication proxy (SCP) including at least one processor and memory, and a platform firewall rule configuration manager, The aforementioned platform firewall rule configuration manager is The NRF receives a message regarding the registration, updating, or unregistration of an NF profile in an NF profile database separate from the platform firewall, determines that registering, updating, or unregistering the NF profile requires a change to the firewall rule settings of the platform firewall, and in response to this determination, the NRF automatically updates the firewall rule settings of the platform firewall. The NF profile includes a contact address indicating the address to which the NF should be contacted for service, and an update to the NF profile in the NF profile database includes a change to the contact address in the NF profile. The firewall rule configuration includes one or more rules for filtering packet traffic to or from the NF, Each of the one or more rules includes a pair consisting of an action for packet traffic from the first address to the second address and an action for packet traffic from the second address to the first address. Automatically updating the firewall rule settings of the platform firewall means With respect to a pair including the first address that indicates the contact address before the change in the one or more of the aforementioned rules, update the first address in that pair to indicate the contact address after the change, and A system that includes updating a pair of the aforementioned two addresses, which include the aforementioned two addresses that indicate the aforementioned contact address before the change in one or more of the aforementioned rules, so that the aforementioned two addresses in the pair indicate the aforementioned contact address after the change.

11. The system according to claim 10, wherein the message relating to registering, updating, or unregistering the NF profile includes an NF registration request or response relating to registering the NF profile by the NRF.

12. The system according to claim 11, wherein when the platform firewall automatically updates the firewall rule settings of the platform firewall, the platform firewall rule setting manager is configured to add the rules to the firewall rule settings.

13. The system according to claim 10, wherein the message relating to registering, updating, or unregistering the NF profile includes an NF update request or response relating to updating the NF profile by the NRF.

14. The contact address includes a fully qualified domain name (FQDN), The system according to any one of claims 10 to 13, wherein the platform firewall rule setting manager is configured to determine that the message relating to registering, updating, or unregistering the NF profile includes the FQDN of the NF, to query a DNS server, and to translate the FQDN of the NF into an Internet Protocol (IP) address of the NF.

15. The system according to claim 10, wherein the message relating to registering, updating, or unregistering the NF profile includes an NF unregistration request or response relating to unregistering the NF profile by the NRF, and when the platform firewall automatically updates the firewall rule settings, the platform firewall rule settings manager is configured to delete the rules of the firewall rule settings corresponding to the NF profile.

16. The system according to any one of claims 10 to 13, wherein when the platform firewall automatically updates the firewall rule settings of the platform firewall, the platform firewall rule setting manager is configured to call the platform firewall's configuration application programming interface (API).

17. The system according to any one of claims 10 to 13, wherein the platform firewall rule setting manager is configured to update the firewall rule settings of multiple platform firewalls located at different network sites.

18. A program for causing a computer processor to perform the method according to any one of claims 1 to 4, 6, and 7.

Images