Proxy NF Error-Response Tracking for Producer NF DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Inter-public land mobile network (PLMN) service-based interface (SBI) request messages from trusted networks can be intentionally malformed by hackers to overwhelm producer NFs, causing denial of service (DoS) attacks by eliciting error responses, rendering the producer NFs unavailable for legitimate requests.
Innovation Solution
A proxy NF, such as a security edge protection proxy (SEPP) or service communication proxy (SCP), tracks error response message rates from consumer NFs to producer NFs, maintaining counts within a configurable time period, and performs network security actions when the error response rate exceeds a threshold, including blocking or generating fake error responses to mitigate DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the producer NF processes all incoming SBI request messages from trusted networks, then service availability is maintained for legitimate requests, but the system becomes vulnerable to DoS attacks where malformed messages overwhelm resources
Solution Approach 1:
The proxy NF performs preliminary validation and tracking of error response rates before the producer NF processes requests. By monitoring error response rates in advance and identifying malformed message patterns early, the system can block malicious traffic before it overwhelms producer NF resources, while still allowing legitimate requests through.
Solution Approach 2:
The proxy NF acts as an intermediary between consumer NFs and producer NFs. It intercepts SBI request messages, validates them, and filters out malformed messages before they reach the producer NF. This intermediary layer protects the producer NF from DoS attacks while maintaining service availability for legitimate requests.
2Adaptability or versatility
If the producer NF sends error responses to malformed requests, then protocol compliance is maintained, but resources are consumed that could be used for legitimate requests
Solution Approach 1:
The error response generation function is extracted from the producer NF and relocated to the proxy NF. The proxy NF identifies malformed requests and generates error responses independently, preventing these resource-consuming operations from consuming producer NF resources that should be dedicated to processing legitimate requests.
Solution Approach 2:
The proxy NF serves itself by handling error response generation for malformed requests, rather than burdening the producer NF with this task. This self-service approach at the proxy level protects the producer NF's resources while maintaining protocol compliance through proper error responses.
3Productivity
If the network allows messages from trusted networks without strict validation, then message throughput is maximized, but security against malicious messages is compromised
Solution Approach 1:
The proxy NF performs preliminary validation of SBI request messages before they are forwarded to the producer NF. By checking message validity in advance and tracking error response rates, the system can identify and block malicious messages early, maintaining both high throughput for legitimate messages and security against attacks.
Solution Approach 2:
The system implements feedback mechanisms by tracking error response rates and using this information to adjust message filtering behavior. When error rates exceed thresholds indicating potential DoS attacks, the proxy NF increases filtering strictness, while allowing more permissive handling when error rates are normal, thus balancing throughput and security dynamically.
Data Source
AI summary
A method for detecting and mitigating security attacks on producer NFs using error response messages includes tracking, by a proxy NF, rates of error response messages generated in response to inter-PLMN SBI request messages from consumer NFs. The method further includes receiving an inter-PLMN SBI request message, obtaining information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message, and determining that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate. The method further includes, in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF exceeds the threshold rate, performing a network security action.