Proxy NF SBI Message ID Mapping for Inter-PLMN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G telecommunications networks face security attacks, such as denial-of-service (DOS) attacks, where inter-public land mobile network (PLMN) SBI request messages are used to overwhelm producer NFs, causing them to become unavailable.
Innovation Solution
A method and system for detecting and mitigating security attacks on producer NFs by using mappings between dynamically assigned SBI message IDs and proxy NF IDs. This involves receiving SBI request messages, obtaining proxy NF IDs, forwarding messages to producer NFs, creating mappings in a database, and validating subsequent messages using these mappings to perform network security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-generated harmful factors
If the producer NF processes a high volume of SBI request messages from compromised consumer NFs, then the attacker can steal subscriber and network information, but the producer NF becomes unavailable to process messages from legitimate consumer NFs
Solution Approach 1:
The patent introduces a security gateway as an intermediary component positioned between the consumer NF and the producer NF. This gateway validates SBI request messages by checking for valid consumer NF identifiers and authorized service access before forwarding messages to the producer NF. The intermediary filters out malicious requests from compromised consumer NFs while allowing legitimate traffic to pass through, thus preventing information theft without blocking legitimate consumer NF communications.
2Productivity
If the producer NF processes SBI request messages without validation, then message processing is simple and fast, but the producer NF can be overwhelmed by DOS attacks and become unavailable
Solution Approach 1:
The patent implements preliminary validation of SBI request messages at the security gateway before messages reach the producer NF. The gateway checks for the presence of valid consumer NF identifiers and verifies authorized service access in advance. This preliminary action filters out malicious DOS attack traffic before it can overwhelm the producer NF, while maintaining fast message processing for legitimate requests by avoiding validation overhead for authorized traffic.
3Reliability
If the network implements strict validation of SBI request messages, then security against DOS attacks is improved, but the complexity of the network architecture increases
Solution Approach 1:
The security gateway serves as a dedicated intermediary component that handles all validation logic separately from the producer NF architecture. By isolating validation functionality in this intermediate layer, the producer NF maintains its simplicity and focuses only on processing authorized messages, while the gateway handles the complexity of security validation. This separation of concerns improves security without significantly increasing overall network architecture complexity.
Data Source
AI summary
A method for detecting and mitigating security attacks on producer network NF using mappings between dynamically assigned SBI message IDs and proxy NF IDs includes, at a proxy NF, automatically creating a database of mappings between proxy NF IDs and SBI message IDs comprising resource IDs dynamically assigned by producer NFs in response to request messages from consumer NFs. The method further includes using the mappings to validate received inter-PLMN SBI request messages and performing network security actions for the received inter-PLMN SBI request messages for which validation fails.