SMF-UPF Rate Limiting for DNS and DHCP DoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In edge computing scenarios, a denial-of-service (DoS) attack is triggered by high uplink peak rates of DNS queries and DHCP requests, overwhelming the mobile communication system and preventing it from serving normal user equipment (UE), which can escalate into a distributed DoS (DDoS) attack when multiple UEs collaborate.

Innovation Solution

The Session Management Function (SMF) transmits Packet Detection Rules (PDR) and Quality of Service (QoS) Enforcement Rules (QER) to the User Plane Function (UPF) to identify and limit packets that trigger the DoS attack, such as DNS queries and DHCP requests, thereby controlling their transmission and mitigating the attack.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the EASDF transmits reports to the SMF according to the reporting rule, then the DNS query processing is completed, but a signaling storm is formed resulting in a denial-of-service attack

Engineering Contradiction:

ImproveDNS query processing throughputVSAvoidsystem availability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary action by pre-configuring rate limiting rules and thresholds in the SMF before the DoS attack occurs. The SMF monitors signaling message rates from EASDF and has predetermined rules to identify when normal operation is transitioning into abnormal conditions, allowing it to proactively apply rate limiting before the system becomes overwhelmed

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary rate limiting mechanism between the EASDF and SMF. The SMF acts as a mediator that receives signaling messages from EASDF, applies rate limiting rules to filter and control the flow of messages, and only allows a controlled subset of messages to proceed to trigger PDU session modification requests, thereby protecting the system from signaling storms

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If multiple UEs transmit DNS queries at high uplink peak rates, then the network throughput increases, but the system becomes overwhelmed and cannot serve normal UEs

Engineering Contradiction:

Improvenetwork throughputVSAvoidresource overload

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by implementing granular rate limiting at the individual UE level. Each UE is monitored separately, and rate limiting rules are applied specifically to DNS query traffic from each UE based on its own threshold. This allows the system to maintain high throughput for normal UEs while preventing any single UE from overwhelming the system

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent dynamically changes the parameter of message transmission rate by applying rate limiting. When the SMF detects that a UE's DNS query rate exceeds the threshold, it modifies the parameter by limiting the rate at which PDU session modification requests are triggered, effectively controlling the uplink peak rate to prevent resource overload

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12574405B2Method and apparatus for solving denial-of-service attack, device, medium, and computer program product

Publication Date: 2026.03.10 TENCENT TECHNOLOGY (SHENZHEN) CO LTD

AI summary

A method includes: transmitting, by a session management function (SMF), a packet detection rule (PDR) and a quality of service (QoS) enforcement rule (QER) to a user plane function (UPF), the PDR being used for identifying a target packet transmitted by a terminal, and the QER being used for limiting transmission of the target packet, where the target packet is a packet that triggers a target core network element to initiate the DoS attack to the SMF.