SNPN Reject Message Handling to Block Fake Base Station DOS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G networks lack a robust approach to prevent Denial of Service (DOS) attacks from malicious networks, particularly in standalone non-public networks (SNPNs), where unsolicited rejection messages can compromise user equipment (UE) by allowing fake base stations to intercept repeated registration requests.
Innovation Solution
Implementing a method where the UE generates a randomly selected wait time within a pre-approved range and removes network identities from forbidden lists based on counter values, enhancing security by thwarting DOS attacks in SNPNs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the UE sends repeated registration requests to the network, then the network can be ensured to receive the requests, but malicious networks can intercept the requests and perform DOS attacks
Solution Approach 1:
The UE performs preliminary actions by maintaining a forbidden network list and checking against it before sending registration requests. This prevents the UE from attempting to register with known malicious networks, thereby avoiding DOS attacks while still allowing registration with legitimate networks.
Solution Approach 2:
The system implements feedback by monitoring registration outcomes and updating the forbidden network list based on rejection messages received from networks. When a network sends a reject message, the UE adds that network's identity to the forbidden list, preventing future registration attempts to that network and thus avoiding potential DOS attacks.
2Reliability
If the UE maintains a forbidden network list, then DOS attack prevention is improved, but device complexity increases
Solution Approach 1:
The UE performs self-service by autonomously maintaining and updating its own forbidden network list without requiring external management. The device automatically processes reject messages, extracts network identities, and updates its local list, reducing the need for complex network-side management infrastructure.
3Reliability
If the UE removes networks from forbidden lists based on counter values, then false positives are reduced, but time consumption increases
Solution Approach 1:
The forbidden network list is made dynamic with networks being added and removed based on counter values and registration outcomes. This dynamic management allows the system to adapt to changing network conditions, removing networks from the forbidden list when they are no longer malicious, thus reducing false positives while maintaining security.
Data Source
AI summary
Methods and apparatus, including computer program products, are provided for handling non-integrity protected reject messages in non-public networks. In some example embodiments, there may be provided an apparatus including at least one processor and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least: receive, from a network function in a standalone non-public network (SNPN), a reject message, wherein information in the reject message indicates that the apparatus is not allowed to access the SNPN by subscription; and add the identity of the SNPN in a list of forbidden SNPNs associated with an access via which the apparatus sent a request and subsequently received the reject message.