CAG Admission Control for Wireless DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless networks face Denial of Service (DoS) attacks due to registration procedures from User Equipments (UEs) attempting to access Non-Public Networks (NPNs) without valid permissions, leading to network overhead and inefficiencies.
Innovation Solution
Implementing admission control by verifying UE permissions to access Closed Access Group (CAG) cells before performing primary authentication, using subscription permanent identifiers (SUPI) and CAG Identifiers to mitigate DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the serving network performs primary authentication procedure for every UE registration request, then authentication security is improved, but network overhead increases and productivity decreases
Solution Approach 1:
The patent applies preliminary action by performing permission verification based on CAG ID and SUPI before initiating the primary authentication procedure. This preliminary check filters out unauthorized UEs early in the registration process, preventing unnecessary authentication attempts and reducing network overhead while maintaining security for authorized users.
2Ease of operation
If permission verification is performed after primary authentication, then authentication flow is simplified, but DoS attacks increase and network overhead increases
Solution Approach 1:
The patent applies preliminary anti-action by implementing permission verification as a preliminary defensive measure before complete authentication. This verification uses CAG ID and SUPI to preemptively identify and block unauthorized access attempts, countering potential DoS attacks before they can consume significant network resources.
3Measurement precision
If CAG ID and SUPI are used for permission verification, then access control precision is improved, but device complexity increases
Solution Approach 1:
The patent applies copying by using the CAG ID (a copy or representation of network access rights) and SUPI (a concealed identifier copy) for permission verification instead of requiring full authentication credentials. This approach achieves precise access control using simplified identifier copies, reducing the complexity of the verification system while maintaining security precision.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The present disclosure relates to a pre-5th-Generation (5G) or 5G communication system to be provided for supporting higher data rates Beyond 4th-Generation (4G) communication system such as Long Term Evolution (LTE). Methods, network entities, and systems for mitigating Denial of Service (DoS) attack in a wireless network (e.g., access network (AN), core network (CN)). Embodiments herein disclose methods and systems for mitigating Denial of Service (DOS) attacks in wireless networks, by performing admission control by verifying a User Equipment's (UE's) registration request via a Closed Access Group (CAG) cell without performing a primary authentication. Embodiments herein disclose methods and system for verifying permissions of the UE to access a CAG cell based on the UE's Subscription identifier, before performing the primary authentication. Methods and systems for mitigating Denial of Service (DoS) attack in a wireless network. A method for mitigating Denial of Service (DOS) attacks in wireless networks includes requesting a public land mobile network (PLMN) for accessing a non-public network (NPN) through a Closed Access Group (CAG) cell, verifying the permissions of a user equipment (UE) to access the requested NPN through the CAG cell, and performing a primary authentication.