Ingress Message Rate Limiting via Network Function Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G communication networks, existing security measures fail to effectively differentiate between legitimate and malicious consumer network functions, leading to unfair throttling of legitimate traffic during signaling storms, as global message rate limiting discards messages from both culprit and innocent consumer network functions at an equal rate.
Innovation Solution
Implementing ingress message rate limiting using network function identifiers, where a network node extracts consumer network function instance identifiers from access tokens to determine if the allowed message rate has been exceeded, and performs rate limiting actions such as discarding requests or throttling only excessive messages from malicious sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If global message rate limiting is implemented to protect the network during signaling storms, then network security and stability are improved, but legitimate traffic from innocent consumer network functions is unfairly throttled along with malicious traffic
Solution Approach 1:
The patent segments the message rate limiting by introducing a PLMN identifier extraction mechanism that divides traffic into different groups based on the consumer network function's network affiliation. Instead of applying a single global rate limit to all messages, the system extracts the PLMN identifier from the access token and applies rate limiting separately for each PLMN, allowing legitimate traffic from one PLMN to continue flowing while throttling malicious traffic from another PLMN.
Solution Approach 2:
The patent applies different rate limiting policies to different local contexts (PLMNs). By extracting the PLMN identifier and creating PLMN-specific rate limits, the system implements local quality control where each PLMN's traffic is evaluated and limited independently. This allows the network to maintain high throughput for legitimate PLMNs while applying strict limits only to PLMNs generating malicious traffic.
2Object-affected harmful factors
If message rate limiting is applied to all incoming traffic to prevent signaling storms, then harmful factors from malicious sources are reduced, but discrimination between legitimate and malicious consumer network functions deteriorates
Solution Approach 1:
The patent performs preliminary action by extracting the PLMN identifier from the access token before applying rate limiting. This early extraction and identification of the traffic source's network affiliation allows the system to pre-categorize incoming messages by their originating PLMN, enabling precise tracking and differentiation of traffic sources before the rate limiting decision is made.
Solution Approach 2:
The patent implements feedback mechanisms by monitoring message rates per PLMN and adjusting rate limiting actions based on observed traffic patterns. The system continuously tracks the number of messages received from each PLMN and compares this against allowed rate thresholds, using this feedback to dynamically apply or relax rate limiting for specific PLMNs, thereby improving discrimination between legitimate and malicious sources.
Data Source
AI summary
Methods, systems, and computer readable media for ingress message rate limiting are disclosed. One method includes, at a network node, receiving a service request message from a service consumer network function and extracting, from the received service request message, an access token that includes a consumer network function instance identifier identifying the service consumer network function. The method further includes determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded and in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded, performing a message rate limiting action.