PFCP Proxy Route Validation Against SIM Spoofing in 5G User Plane

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

SIM spoofing poses a significant security threat as attackers gain unauthorized access to mobile devices, compromising sensitive information by mimicking legitimate SIM cards, which existing technologies struggle to effectively prevent.

Innovation Solution

Implementing a packet forwarding control protocol (PFCP) proxy within the network architecture to snoop messages, verify user equipment addresses, and utilize BGP controllers to generate and verify session transformed routes, ensuring that only valid messages from genuine devices are forwarded, thereby preventing SIM spoofing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing network architectures are used without additional security measures, then network simplicity is maintained, but SIM spoofing security threats remain unaddressed

Engineering Contradiction:

ImproveSIM spoofing preventionVSAvoidnetwork architecture complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a PFCP proxy as an intermediary component between the SMF and UPF in the 5G core network. This proxy specifically monitors and validates PFCP messages to detect SIM spoofing attempts, acting as a security mediator that adds protection without requiring fundamental changes to the entire network architecture

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The security function is segmented by implementing separate validation mechanisms at different network layers. The PFCP proxy handles protocol-level validation while BGP controllers handle routing-level verification, dividing the security task into manageable segments that can be implemented independently

Inventive Principle:

Principle #1Segmentation

2Difficulty of detecting and measuring

If message validation and route verification mechanisms are implemented, then SIM spoofing detection capability is improved, but network processing complexity increases

Engineering Contradiction:

ImproveSIM spoofing detection capabilityVSAvoidprocessing complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The system employs self-service validation where the PFCP proxy automatically monitors and validates its own messages against stored user equipment addresses and routes. The BGP controllers independently verify routing information without requiring manual intervention, enabling automated security detection

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent performs preliminary validation actions by pre-establishing user equipment addresses, PFCP session information, and BGP routes before actual communication occurs. This advance preparation allows rapid detection during operation without adding significant processing complexity at the time of spoofing attempts

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12563398B2Prevention of subscriber identity module spoofing for mobile user plane

Publication Date: 2026.02.24 ARRCUS INC

AI summary

Prevention of SIM spoofing in mobile user plane. A method includes establishing a session for a user equipment to communicate with a session management function (SMF) and a user plane function (UPF), and then snooping a message between the SMF and the UPF to acquire one or more of an address for the user equipment, a tunnel endpoint identifier, or an address for a node within a radio access network. The method includes generating a route for carrying the one or more of the address for the user equipment, the tunnel endpoint identifier, or the address for the node within the radio access network, and then providing the route to a router.