NRF Hash Authentication for 5G NF Update Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

5G telecommunications networks lack sufficient security mechanisms for network function (NF) update and deregister operations, making them vulnerable to unauthorized modifications or deletions, which can disrupt service discovery and potentially lead to attacks on subscribing NFs.

Innovation Solution

Implementing a method at the NF repository function (NRF) that uses authentication strings hashed with a secure algorithm, such as SHA-256, to validate and reject NFUpdate and NFDeregister requests, ensuring only authorized NFs can perform these operations by storing and comparing hashes of authentication strings.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If NF update and deregister operations are allowed without authentication, then the ease of operation is improved, but the security is worsened making the system vulnerable to unauthorized modifications

Engineering Contradiction:

Improveease of NF update and deregister operationsVSAvoidsecurity of NF update and deregister operations

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary authentication by storing a hash of the authentication string during the NF registration phase. This pre-stored hash is then used to validate subsequent NF update and deregister requests, ensuring that authentication checks are performed before allowing critical operations to proceed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a hash-based authentication mechanism as an intermediary layer between the NF and the NF Repository Function. Instead of directly allowing update operations, the system mediates through hash validation, comparing the received authentication string against the pre-stored hash to verify authorization before permitting the operation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If authentication mechanisms are implemented for NF update and deregister operations, then the security is improved, but the device complexity is worsened

Engineering Contradiction:

Improvesecurity of NF update and deregister operationsVSAvoidcomplexity of NF repository function

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces complex multi-factor authentication systems with a simpler hash-based authentication mechanism. Instead of implementing elaborate security protocols, the system uses cryptographic hashing to store and verify authentication strings, significantly reducing computational overhead and system complexity while maintaining strong security guarantees.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes the parameter representation by storing only the hash of the authentication string rather than the authentication string itself or complex credential sets. This parameter transformation simplifies the data structure and reduces the computational burden of authentication verification while maintaining security.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If hash-based authentication is used, then the security against unauthorized attacks is improved, but the loss of information is worsened as authentication strings are hashed

Engineering Contradiction:

Improveprotection against NF update and deregister attacksVSAvoidretrievability of authentication strings

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system extracts only the essential verification element (the hash of the authentication string) from the complete authentication data. By storing only the hash rather than the full authentication string or additional verification data, the system removes unnecessary information that could be compromised while retaining sufficient data for secure verification.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The authentication string serves as a disposable credential that is transformed into a permanent hash for verification. The original authentication string can be discarded after hashing, as its sole purpose is to generate the verification hash. This approach eliminates the need to securely store or manage the original authentication string while maintaining verification capability.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS11888894B2Methods, systems, and computer readable media for mitigating network function (NF) update and deregister attacks

Publication Date: 2024.01.30 ORACLE INT CORP

AI summary

A method for mitigating network function (NF) update and deregister attacks includes, at an NF repository function (NRF) implemented by at least one processor, receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile. The method further includes storing the hash of the first authentication string. The method further includes registering the NF by storing the NF profile in an NF profile database. The method further includes receiving a first NFUpdate or NFDeregister request including the NF instance identifier. The method further includes using the stored hash of the first authentication string to validate or reject the first NFUpdate or NFDeregister request.