5G Core Network Protection Against TEID Scanning Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 4G and 5G mobile networks are vulnerable to TEID scanning attacks due to the introduction of Control and User Plane Separation (CUPS) architecture, making current GTP firewalls inefficient in protecting mobile core networks.
Innovation Solution
A network traffic management system that monitors user plane status and error messages to detect and prevent TEID scanning attacks by blocking messages from malicious sources without needing to know all valid TEIDs, using a network repository function to determine error and echo message thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If GTP firewalls are used to protect mobile core networks, then network security is improved, but the solution becomes inefficient due to the introduction of Control and User Plane Separation architecture
Solution Approach 1:
The patent segments the network protection function by separating control plane and user plane operations. The system monitors user plane restart events and error messages independently from control plane TEID management, allowing efficient detection of scanning attacks without requiring complete knowledge of valid TEIDs. This segmentation enables the network to protect against TEID scanning attacks by focusing monitoring on user plane behavior patterns rather than maintaining comprehensive TEID databases.
2Difficulty of detecting and measuring
If the system monitors all error messages to detect scanning attacks, then attack detection capability is improved, but network resource consumption increases
Solution Approach 1:
The patent applies partial monitoring by focusing only on error messages generated during user plane restart events rather than monitoring all network traffic continuously. The system sets a threshold for error message counts and only triggers blocking actions when the threshold is exceeded, avoiding the need to process every single message. This selective monitoring approach maintains effective attack detection while significantly reducing network resource consumption compared to comprehensive monitoring.
3Reliability
If the system blocks all messages from suspected malicious sources, then protection effectiveness is improved, but legitimate traffic may be affected
Solution Approach 1:
The patent implements feedback mechanisms by continuously monitoring user plane restart events and error message patterns to refine blocking decisions. The system adjusts blocking actions based on feedback from observed behavior patterns, blocking only when error message thresholds are exceeded and user plane restarts are detected. This feedback-driven approach maintains protection effectiveness while minimizing impact on legitimate traffic by adapting blocking decisions to actual attack patterns rather than using static blocking rules.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic management devices and network traffic management systems that provide protection of 5G core networks are illustrated. With this technology, the user plane status can be received from a network repository function indicating whether a user plane restarted. Then the system can determine whether an amount of error messages flowing from the user plane to a gNodeB for a source exceeds a predetermined threshold. In response to determining the amount of error messages exceeds a predetermined threshold and determining that the user plane was not restarted, all messages flowing to the gNodeB for the source can be blocked. Lastly, in response to determining the amount of echo messages from the user plane to the gNodeB is below a second predetermined threshold and that the user plane did not restart, the source can be stored as a bad actor.