Shared SEPP PLMN Verification Against NF Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication systems where a security edge protection proxy (SEPP) is shared among multiple public land mobile networks (PLMNs), there is a threat of network function (NF) spoofing, allowing unauthorized access to peer PLMN services due to inadequate verification of PLMN identities.
Innovation Solution
Implement a method where security edge protection proxies determine and verify the actual PLMN identifier based on configuration information and N32-f context identifiers, ensuring that service requests are properly authenticated before forwarding, thereby preventing spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared SEPP is deployed to serve multiple PLMNs, then resource sharing and operational efficiency are improved, but security vulnerability increases due to spoofing threats
Solution Approach 1:
The patent segments the verification process into multiple independent verification stages: (1) verifying PLMN ID list in N32-c context, (2) verifying PLMN identifier in service request, and (3) verifying N32-f context identifier. This segmentation allows the system to maintain shared SEPP resources while preventing spoofing through layered verification, resolving the contradiction between resource sharing efficiency and security protection capability.
Solution Approach 2:
The patent implements preliminary verification actions before service request processing. The SEPP verifies the PLMN ID list in advance during N32-c context establishment, and verifies the N32-f context identifier before forwarding the service request. These preliminary verification actions prevent spoofing attacks while allowing efficient shared operation, addressing both productivity and reliability requirements.
2Ease of operation
If PLMN ID list verification is performed, then access control is improved, but spoofing detection capability deteriorates because only list membership is checked
Solution Approach 1:
The patent introduces the N32-f context identifier as an intermediary verification element. Instead of directly trusting the PLMN ID list membership, the system uses the N32-f context identifier as an intermediate verification step that binds the service request to a specific PLMN's authorized contexts. This intermediary mechanism maintains ease of access control while significantly improving spoofing detection accuracy by verifying the actual context identifier against authorized lists.
3Speed
If simple PLMN list verification is used, then processing speed is improved, but security protection is worsened due to insufficient verification
Solution Approach 1:
The patent implements continuous verification throughout the service request processing flow. The verification actions are performed continuously at multiple stages: during N32-c context establishment, upon receiving the service request, and before forwarding. This continuous verification approach maintains processing speed by integrating verification into the existing flow rather than adding separate verification steps, while significantly improving security protection level through comprehensive multi-stage verification.
Data Source
AI summary
A signaling protection method, apparatus, and system prevents an NF from spoofing an NF of another PLMN under a shared SEPP to access a peer PLMN service, so that system security is improved. A first SEPP serving a first PLMN receives a third service request that is from an NF of the first PLMN and that is sent to an NF of a second PLMN. A second SEPP serves the second PLMN, and a connection that is between the first SEPP and the second SEPP and is for the first PLMN and the second PLMN includes first N32-f. The first SEPP determines a first PLMN identifier based on configuration information. The first SEPP determines a first N32-f context context identifier corresponding to the first PLMN identifier, where the first N32-f context identifier corresponds to the first N32-f.