PFCP Proxy for SIM Spoofing Prevention in 5G User Plane

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Subscriber identity module (SIM) spoofing poses a significant security threat as attackers can gain unauthorized access to mobile phone numbers and sensitive information by either physically stealing SIM cards or tricking cellular networks into believing data packets originate from legitimate devices.

Innovation Solution

Implementing a packet forwarding control protocol (PFCP) proxy within the 5G radio access network to snoop messages, verify addresses, and generate routes that validate the authenticity of messages from user equipment devices, thereby preventing unauthorized access by discarding packets without valid routes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a PFCP proxy is implemented to verify message authenticity and generate routes, then security against SIM spoofing is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity against SIM spoofingVSAvoidnetwork architecture complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A PFCP proxy is introduced as an intermediary component between the user equipment and the network core. The proxy intercepts, validates, and forwards packets, centralizing the security verification function. This mediator approach improves security without requiring complex modifications to existing network elements, as the proxy handles authentication and route generation centrally.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The network function is segmented into distinct components: the PFCP proxy handles security verification and route generation, while the router handles packet forwarding. This segmentation allows each component to specialize in specific tasks, improving overall system security while maintaining clear functional boundaries that simplify implementation and maintenance.

Inventive Principle:

Principle #1Segmentation

2Reliability

If packet verification and route validation are performed for each data packet, then security is improved, but processing time increases

Engineering Contradiction:

Improvepacket authentication securityVSAvoidpacket processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The PFCP proxy performs route verification and authentication in advance, before packets reach the router. By validating the source address and verifying the route existence beforehand, the system prevents unauthorized packets from entering the network core, reducing the processing burden on subsequent network elements and minimizing overall latency.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the PFCP proxy receives validation results and adjusts its forwarding decisions accordingly. When a packet fails authentication, the proxy immediately discards it without further processing. This feedback loop ensures rapid rejection of malicious packets while allowing legitimate traffic to pass through efficiently.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20240381095A1Prevention of subscriber identity module spoofing for mobile user plane

Publication Date: 2024.11.14 ARRCUS INC

AI summary

Prevention of SIM spoofing in mobile user plane. A system includes a session management function (SMF) within a radio access network and a user plane function (UPF) within the radio access network, wherein the UPF communicates with the SMF. The system includes a packet forwarding control protocol (PFCP) proxy between the SMF and the UPF, wherein the PFCP proxy snoops PFCP messages between the SMF and the UPF.