Shared SEPP N32-f Context Verification Against PLMN Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication systems where a security edge protection proxy (SEPP) is shared among multiple public land mobile networks (PLMNs), there is a threat of network functions (NFs) spoofing each other, leading to poor security as the verification mechanism fails to detect malicious access.
Innovation Solution
Implement a method where the first SEPP determines a real PLMN identifier based on configuration information and sends a service request with an N32-f context identifier to prevent spoofing, and the second SEPP verifies the PLMN using the received identifier to ensure valid access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a shared SEPP is deployed to serve multiple PLMNs, then resource sharing and cost reduction are improved, but security protection deteriorates due to spoofing vulnerability
Solution Approach 1:
The patent segments the verification process into two independent stages: (1) N32-c link verification to confirm the PLMN identity and establish a dedicated verification path, and (2) N32-f service request verification to process the actual service. This segmentation ensures that even though multiple PLMNs share the SEPP infrastructure, each PLMN has its own verified communication path, preventing spoofing while maintaining resource sharing.
Solution Approach 2:
The patent performs preliminary verification of PLMN identity and establishment of secure N32-c link before allowing service requests to proceed. The SEPP verifies the PLMN ID from the service request against the previously established N32-c link configuration, ensuring that only authorized PLMNs can access services. This preliminary action prevents spoofing attempts from succeeding.
2Ease of operation
If PLMN ID list verification is performed, then access control is improved, but detection capability for spoofing deteriorates
Solution Approach 1:
The patent implements feedback mechanisms at both SEPPs: the first SEPP verifies the PLMN ID and returns verification information to the network function, and the second SEPP performs similar verification before forwarding service requests. This feedback loop ensures that any spoofing attempt is detected and rejected, as the verification process continuously checks the authenticity of the PLMN identifier against the established N32-c link.
Solution Approach 2:
The patent introduces the N32-c link as an intermediary verification mechanism between the service request and the PLMN identity. Instead of directly trusting the PLMN ID in the service request, the system uses the N32-c link (established through prior authentication) as an intermediary to verify the authenticity of the request. This intermediary layer enables both access control and spoofing detection.
Data Source
AI summary
A signaling protection method, apparatus, and system prevents an NF from spoofing an NF of another PLMN under a shared SEPP to access a peer PLMN service, so that system security is improved. A first SEPP serving a first PLMN receives a third service request that is from an NF of the first PLMN and that is sent to an NF of a second PLMN. A second SEPP serves the second PLMN, and a connection that is between the first SEPP and the second SEPP and is for the first PLMN and the second PLMN includes first N32-f. The first SEPP determines a first PLMN identifier based on configuration information. The first SEPP determines a first N32-f context context identifier corresponding to the first PLMN identifier, where the first N32-f context identifier corresponds to the first N32-f.