Proxy NF Token Correlation for Inter-PLMN SBI DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G telecommunications networks, inter-public land mobile network (PLMN) SBI request messages from trusted networks can be exploited by hackers to overwhelm the processing and memory resources of producer NFs, leading to denial of service (DoS) attacks, which existing security measures using access tokens are inadequate to prevent.
Innovation Solution
A proxy NF, such as a security edge protection proxy (SEPP) or service communication proxy (SCP), performs access token to non-access-token parameter correlation and SBI request message rate checking to validate the authenticity of SBI requests by comparing network- or service-identifying parameters from the access token with those externally obtained, and takes network security actions when mismatches or excessive request rates are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are used for security validation, then authentication is improved, but security against DoS attacks deteriorates
Solution Approach 1:
The patent performs preliminary validation of SBI request messages by comparing access token parameters with corresponding parameters in the request message before forwarding to the producer NF. This preliminary action prevents malicious requests from reaching the producer NF, thereby addressing DoS vulnerability while maintaining authentication reliability.
Solution Approach 2:
The proxy NF acts as an intermediary between the consumer NF and producer NF, validating requests by comparing access token parameters with request message parameters. This intermediary function enhances security without compromising authentication, as the proxy NF filters malicious requests before they reach the producer NF.
2Reliability
If parameter correlation validation is performed, then security is improved, but processing complexity increases
Solution Approach 1:
The patent segments the validation process into distinct steps: extracting parameters from the access token, extracting corresponding parameters from the request message, comparing the parameters, and determining whether to forward the request. This segmentation simplifies the overall validation complexity while maintaining security.
Solution Approach 2:
The patent changes the approach from comprehensive message validation to specific parameter correlation validation. By focusing only on relevant parameters (such as service instance ID, destination network identifier, etc.), the validation process becomes less complex while maintaining effective security against DoS attacks.
3Object-affected harmful factors
If request message filtering is performed, then DoS protection is improved, but message processing time increases
Solution Approach 1:
The patent performs partial validation by comparing only specific critical parameters from the access token with corresponding parameters in the request message, rather than validating the entire message. This partial action provides sufficient DoS protection while minimizing the time penalty associated with comprehensive validation.
Data Source
AI summary
A method for detecting and mitigating security attacks on producer network NFs using access token to non-access-token parameter correlation at a proxy NF includes receiving an inter-PLMN SBI request message. The method further includes obtaining, from an access token transmitted with the inter-PLMN SBI request message, at least one network- or service-identifying parameter and obtaining, externally from the access token, at least one network- or service-identifying parameter. The method further includes comparing the at least one network- or service-identifying parameter obtained from the access token and the at least one network- or service-identifying parameter obtained externally from the access token and performing a network security action when the at least one network- or service-identifying parameter obtained from the access token does not match the at least one network- or service-identifying parameter obtained externally from the access token.