SEPP Inter-PLMN Message Filtering Via Roaming PLMN Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G networks face challenges in implementing seamless roaming services due to the inability of Security Edge Protection Proxies (SEPPs) to perform fine-grained filtering of inter-Public Land Mobile Network (PLMN) messages based on complex roaming agreements, especially when messages lack serving PLMN identification information.
Innovation Solution
Implementing an originating and target network mapping database at the SEPP to store records of network identifiers, allowing or blocking message flow based on predefined roaming agreements, and using headers or DNS lookups to determine network identifiers for filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SEPP uses current filtering configurations, then basic inter-PLMN message filtering is possible, but fine-grained filtering required for complex roaming agreements cannot be performed
Solution Approach 1:
The filtering system is segmented into multiple independent components: a database storing fine-grained filtering rules with source and destination PLMN identifiers, a message inspection module that extracts PLMN IDs from incoming messages, and a rule matching engine that compares messages against the database. This segmentation allows complex roaming agreements to be implemented through configurable database entries rather than hardcoding complex logic in the SEPP itself.
Solution Approach 2:
An intermediary database is introduced between the message filtering logic and the actual filtering decision. This database stores pre-configured roaming agreement rules that map source PLMN identifiers to destination PLMN identifiers, allowing the SEPP to perform fine-grained filtering without having complex agreement logic embedded in its core filtering mechanism.
2Productivity
If SEPP attempts to filter messages without serving PLMN identification information, then all messages can be processed, but precise source identification for filtering cannot be determined
Solution Approach 1:
The system performs preliminary actions by extracting and caching source PLMN identification information from incoming messages before the filtering decision is made. When a message arrives, the SEPP first extracts the source PLMN ID from message headers or performs DNS lookups to determine the originating network, storing this information temporarily for use in the filtering rule matching process. This ensures identification is completed before filtering without blocking message processing flow.
3Reliability
If SEPP implements comprehensive roaming agreement filtering, then security and agreement compliance are enhanced, but message flow flexibility and processing speed may be reduced
Solution Approach 1:
Roaming agreement filtering rules are pre-configured and stored in a database before runtime operation. The database contains pre-validated source PLMN to destination PLMN mappings that represent approved roaming agreements. During message processing, the SEPP performs a simple lookup against this pre-configured database rather than evaluating complex agreement logic in real-time, significantly improving processing speed while maintaining comprehensive filtering coverage.
Solution Approach 2:
The system implements feedback mechanisms where the SEPP monitors message flow patterns and can dynamically adjust filtering behavior based on observed traffic characteristics and roaming agreement requirements. The filtering database can be updated with new rules or modified existing rules based on feedback from network operations, allowing the system to optimize performance while maintaining compliance.
Data Source
AI summary
A method for screening inter-PLMN messages at a SEPP to implement roaming agreements includes storing an originating and target network mapping database containing records including mappings between originating network identifiers and target network identifiers. The method further includes receiving, at the SEPP, an inter-PLMN SBI request message originating from an NF in a network served by the SEPP. The method further includes determining originating and target network identifiers from the message, locating a matching record in the database, and determining, from the record, whether the message should be allowed to flow from the originating network to the target network. The method further includes forwarding the message to the target network or preventing the forwarding of the message to the target network based on results of the determining.