5G Core Traffic Blocking for TEID Scanning Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G core networks are vulnerable to TEID scanning attacks, which consume network resources and enable access to data networks, with existing GTP firewalls being inefficient in protecting against such attacks.
Innovation Solution
A network traffic management system that monitors user plane status and error messages, blocking malicious sources when error message thresholds are exceeded and storing them as bad actors, without requiring knowledge of all valid TEIDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If GTP firewalls are used to protect mobile core networks from TEID scanning attacks, then network security is improved, but the solutions remain inefficient due to new 4G and 5G network architectures
Solution Approach 1:
The patent segments the protection mechanism by introducing a dedicated network traffic management system that operates independently from existing GTP firewalls. This new system specifically targets TEID scanning attacks through separate detection and response mechanisms, allowing parallel operation without interfering with existing firewall functions. The segmentation enables specialized protection that addresses the inefficiencies of general-purpose firewalls against new 4G/5G attack vectors.
Solution Approach 2:
The patent introduces an intermediary network traffic management system that sits between the user equipment and the core network. This intermediary monitors traffic patterns, detects TEID scanning attempts, and blocks malicious traffic before it reaches the core network. By positioning this specialized mediator in the traffic flow, the system provides efficient targeted protection without requiring modification of existing firewall architectures.
2Reliability
If traditional security measures are applied to 5G core networks, then some level of protection is provided, but network resources are consumed and access control is insufficient against sophisticated attacks
Solution Approach 1:
The patent implements preliminary action by proactively establishing baseline traffic patterns and user profiles before attacks occur. The system continuously learns normal network behavior and prepares detection thresholds in advance. When TEID scanning attacks occur, the pre-established baselines enable immediate identification of anomalies without requiring extensive real-time analysis, thereby reducing network resource consumption while maintaining high protection levels.
Solution Approach 2:
The patent implements feedback mechanisms where the network traffic management system continuously monitors blocked traffic patterns and adjusts its detection algorithms accordingly. The system receives feedback from successful block operations and uses this information to refine future detection accuracy. This feedback loop improves protection efficiency over time while reducing false positives that would consume unnecessary network resources.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, non-transitory computer readable media, network traffic management devices and network traffic management systems that provide protection of 5G core networks are illustrated. With this technology, the user plane status can be received from a network repository function indicating whether a user plane restarted. Then the system can determine whether an amount of error messages flowing from the user plane to a gNodeB for a source exceeds a predetermined threshold. In response to determining the amount of error messages exceeds a predetermined threshold and determining that the user plane was not restarted, all messages flowing to the gNodeB for the source can be blocked. Lastly, in response to determining the amount of echo messages from the user plane to the gNodeB is below a second predetermined threshold and that the user plane did not restart, the source can be stored as a bad actor.