Network Function Re-Authorization Against Rogue 5G Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G communication networks lack a mechanism to effectively identify and prevent rogue network functions (NFs) that engage in malicious activities, posing a security risk due to the absence of a challenge mechanism to confirm suspicious behavior and take remedial actions.
Innovation Solution
A method is introduced where network entities detect suspicious activity, inform a Network Repository Function (NRF) via a Service-Based Interface (SBI) or Operations and Administration (OAM), which challenges the suspected NF using a re-authorization process with a JSON Web Token (JWT) to confirm its legitimacy, and upon failure, takes remedial actions such as blocking further access or deleting the rogue NF.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network entities operate without re-authorization mechanisms, then network efficiency and subscriber convenience are improved, but security against malicious actors deteriorates
Solution Approach 1:
The system performs preliminary re-authorization challenges before allowing network entities to operate. The NRF sends challenge requests to suspected NFs and validates their responses before granting full access, preventing malicious actors from compromising network security while maintaining efficient operations for legitimate entities
Solution Approach 2:
The system implements a feedback mechanism where network entities are continuously monitored and challenged. The NRF receives responses from challenged NFs, validates them against stored credentials, and provides feedback by either maintaining or revoking authorization status based on the validation results
2Reliability
If a re-authorization challenge mechanism is implemented, then security against rogue network functions is improved, but network complexity increases
Solution Approach 1:
The NRF acts as an intermediary between network entities and the authorization system. It receives challenge requests from suspicious NFs, validates them against stored credentials, and manages authorization status without requiring complex security implementations in every network entity, thereby simplifying overall system complexity
Solution Approach 2:
The re-authorization mechanism uses universal JWT token validation that can be applied to any network entity type. The challenge-response protocol using standard cryptographic verification provides a multi-functional security solution that works across different NF types and scenarios without requiring custom security implementations
3Measurement precision
If continuous monitoring and re-authorization is performed, then detection of malicious activity is improved, but processing overhead increases
Solution Approach 1:
The system performs re-authorization challenges selectively on network entities suspected of malicious activity rather than continuously validating all NFs. This partial action approach maintains high detection accuracy for suspicious entities while minimizing unnecessary processing overhead for legitimate network operations
Data Source
AI summary
Techniques for preventing rogue network functions in a communication network are provided. For example, a method comprises obtaining information identifying one or more network entities suspected of malicious activity operating within the communication network, causing a re-authorization of the one or more network entities suspected of malicious activity, and in response to a re-authorization failure of at least one of the one or more network entities suspected of malicious activity, causing one or more remedial actions to occur within the communication network to prevent the at least one network entity that failed re-authorization from accessing other network entities in the communication network.