SEPP Security Database Lookup for 5G Roaming DoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

5G roaming security is vulnerable to denial of service (DoS) attacks due to the lack of authentication of PDU session establishment requests before forwarding them to the user data management (UDM) function in the home network, allowing attackers to overwhelm resources with fake requests.

Innovation Solution

Implementing a Security Edge Protection Proxy (SEPP) that receives user equipment registration messages, creates UE roaming registration records, and performs lookups to determine whether to allow or reject PDU session establishment requests based on matching SUPI or SUCI, PLMN ID, and access type, thereby blocking fake requests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the home network forwards PDU session establishment requests without authentication, then the network operates with simple processing flow, but the system becomes vulnerable to DoS attacks with fake requests overwhelming resources

Engineering Contradiction:

Improverequest processing speedVSAvoidsecurity against DoS attacks

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The SEPP performs preliminary authentication and validation of PDU session establishment requests by checking them against the UE roaming registration records in the security database before forwarding to the home network. This advance verification prevents fake requests from overwhelming home network resources while maintaining efficient processing for legitimate requests.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The SEPP acts as an intermediary node between the visited network and the home network, inserting itself into the signaling path to perform security functions. It validates requests using UE roaming registration records and only forwards authenticated requests to the home network, thereby protecting against DoS attacks without affecting the normal processing flow for legitimate traffic.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the SEPP performs lookup validation for every PDU session establishment request, then security against fake requests is improved, but the processing time and complexity increase

Engineering Contradiction:

Improveauthentication accuracyVSAvoidrequest processing delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The SEPP performs partial validation by checking only critical parameters (SUPI/SUCI, PLMN ID, access type) against the UE roaming registration records in the security database, rather than complete authentication. This selective validation provides sufficient security against fake requests while minimizing processing time and avoiding excessive complexity.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentEP4183154B1Methods, systems, and computer readable media for mitigating 5g roaming security attacks using security edge protection proxy (SEPP)

Publication Date: 2024.08.28 ORACLE INT CORP

Figure 1
Figure 2
Figure 3

AI summary

A method for mitigating a 5G roaming attack using a security edge protection proxy (SERF), includes receiving, at an SERF, user equipment (UE) registration messages for outbound roaming subscribers. The method further includes creating, in a SERF security database, UE roaming registration records derived from UE registration messages. The method further includes receiving, at the SERF, a packet data unit (PDU) session establishment request message. The method further includes performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record. The method further includes determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.