5G Network Traffic Analysis for Revoked TLS Certificate Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current certificate revocation check mechanisms, such as CRL and OCSP, are not effective in preventing malicious access over long-lived network connections in 5G communication networks, as they do not check TLS certificates after the initial handshake.
Innovation Solution
A network traffic analysis system that receives messages from 5G network functions over long-lived connections, compares the TLS certificate details against a list of revoked certificates, and sends notifications to the network functions to close the connections if the certificates are revoked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate revocation checks are performed only during TLS handshake, then the complexity of the security system is reduced, but security reliability deteriorates because revoked certificates can continue to be used over long-lived connections
Solution Approach 1:
The system performs certificate revocation checks in advance by establishing a monitoring mechanism that continuously checks the revocation status of certificates used in long-lived connections. When a certificate is revoked, the system proactively notifies the network function to close the connection before malicious access can occur, rather than waiting for the next handshake.
Solution Approach 2:
The invention implements a feedback loop where the network traffic analysis system continuously monitors certificate status and provides real-time notifications to network functions. When a certificate revocation is detected, the system sends a notification message to the network function, which then closes the long-lived connection, creating a closed-loop security mechanism.
2Reliability
If certificate revocation checks are performed continuously over long-lived connections, then security reliability is improved, but the use of energy and computational resources increases
Solution Approach 1:
The system applies partial checking by focusing certificate revocation monitoring only on long-lived connections where the security gap exists, rather than re-checking all connections. The monitoring is triggered selectively based on connection type and certificate status changes, performing just enough verification to close the security gap without excessive resource consumption.
3Reliability
If TLS certificate verification is performed only during initial handshake, then the ease of operation is improved, but security reliability deteriorates as revoked certificates remain valid for the duration of long-lived connections
Solution Approach 1:
The network traffic analysis system acts as an intermediary between the certificate authority and the network functions. It monitors certificate revocation status and mediates the security enforcement by notifying network functions to close connections when revocation is detected, rather than requiring complex changes to the TLS implementation in each network function.
Data Source
AI summary
Various embodiments of the present technology generally relate to systems and methods for preventing malicious service access over long-lived connections. In certain embodiments, a network traffic analysis system may comprise one or more processors, and a memory having stored thereon instructions. The instructions, upon execution, may cause the one or more processors to receive, from a first network function (NF) on a 5G network, a copy of a message sent over a long-lived connection between the first NF and a second NF on the 5G network, the copy of the message including details for a transport layer security (TLS) certificate involved in the long-lived connection. The network traffic analysis system may compare the details against a list of revoked certificates to determine whether the TLS certificate has been revoked, and when the TLS certificate has been revoked, send a notification directing the first NF to close the long-lived connection.