NRF Profile Versioning for 5G Network Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In 5G telecommunications networks, hackers can modify network function (NF) profiles maintained by the Network Function Repository Function (NRF), leading to service disruptions, as existing authentication mechanisms are not foolproof and lack effective detection and remediation methods for unauthorized profile modifications.

Innovation Solution

Implementing a method where the NRF generates and manages an NF profile version number, which is communicated to consumer NFs, allowing them to detect version mismatches and initiate corrective actions, thereby protecting against unauthorized profile modifications by incrementing the version number with each valid update or heart-beat operation and using custom headers for communication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authentication mechanisms are implemented between NRF and NF instances, then unauthorized access is reduced, but hackers can still modify NF profiles through impersonation and service operation exploitation

Engineering Contradiction:

Improveprofile integrityVSAvoidunauthorized modification

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements a feedback mechanism where the NRF sends profile version numbers to NF instances, and NF instances report back their local version numbers. This feedback loop enables the NRF to detect when profiles have been unauthorizedly modified by comparing version numbers, allowing the system to identify and remediate hacking attempts through continuous verification.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent applies preliminary action by having the NRF proactively send profile version numbers to NF instances before any modification occurs. This allows NF instances to have the correct version information in advance, enabling them to detect unauthorized modifications when their local version doesn't match the expected version from the NRF.

Inventive Principle:

Principle #10Preliminary action

2Ease of operation

If NF instances can update their own profiles using NF update or NF heart-beat service operations, then profile management is simplified, but hackers can impersonate NF instances to modify profiles

Engineering Contradiction:

Improveprofile updateVSAvoidimpersonation attack

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The version number feedback mechanism allows the NRF to verify that profile updates come from legitimate NF instances. By comparing the version number sent by the NRF with the version number reported by the NF instance, the system can detect impersonation attacks where hackers try to modify profiles using stolen or forged service operation requests.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent introduces version numbers as an intermediary verification element between the NRF and NF instances. This intermediary mechanism adds a layer of security to the profile update process, allowing the NRF to mediate and verify the authenticity of profile modifications without complicating the ease of operation for legitimate NF instances.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If the NRF maintains all NF profile parameters, then centralized management is achieved, but detection of unauthorized modifications becomes difficult

Engineering Contradiction:

Improvecentralized managementVSAvoidunauthorized modification detection

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements feedback by having NF instances report their local profile version numbers back to the NRF. This feedback mechanism enables the NRF to detect unauthorized modifications in the centralized profile repository by comparing the reported version with the expected version, solving the detection difficulty while maintaining centralized management.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent segments the profile information into two parts: the main profile data stored centrally in the NRF, and the version number distributed to NF instances. This segmentation allows the NRF to maintain centralized control while enabling distributed detection of unauthorized modifications through version number verification at each NF instance.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12192768B2Methods, systems, and computer readable media for handling hacker intrusion in profile management at network function (NF) repository function (NRF)

Publication Date: 2025.01.07 ORACLE INT CORP

AI summary

A method for handling hacker intrusion in NF profile management at an NRF includes receiving, at the NRF and from a consumer NF, an NF register request message including an NF profile of the consumer NF, setting and storing an NF profile version number for the NF profile, and communicating the NF profile version number to the consumer NF. The consumer NF stores the NF profile version number and transmits a request for initiating an NF update or NF heart-beat service operation to the NRF. The NRF receives the request for initiating the NF update or NF heart-beat service operation, increments the NF profile version number, and communicates the incremented NF profile version number to the consumer NF. The consumer NF receives the incremented NF profile version number, determines that an NF profile version mismatch has occurred, and, in response, initiates an NF profile corrective action with the NRF.