Ingress Message Rate Limiting Using TLS Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G networks lack effective security measures to selectively limit ingress message rates, leading to indiscriminate throttling or discarding of messages during signaling storms, which can unfairly impact innocent networks and are resource-intensive due to the lack of efficient identifiers for rate limiting.
Innovation Solution
Implementing ingress message rate limiting at network nodes by obtaining identifiers from TLS messages, such as X.509 certificates, to selectively discard excessive messages from specific networks, thereby mitigating the impact of signaling storms without additional overhead and parsing inter-PLMN messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ingress message rate limiting is implemented without efficient identifiers, then security measures can be applied, but the process becomes resource-intensive and requires parsing inter-PLMN messages
Solution Approach 1:
The patent extracts identifiers from TLS messages in advance (during the TLS handshake phase) and stores them in a cache/memory structure. This preliminary action eliminates the need to parse inter-PLMN messages during rate limiting operations, significantly reducing resource consumption while maintaining security effectiveness
Solution Approach 2:
The patent creates a copy of the identifier from the TLS message and stores it in a cache accessible by the rate limiting function. This copying approach allows the rate limiting mechanism to reference pre-extracted identifiers without repeatedly parsing the original TLS messages, reducing computational overhead
2Reliability
If indiscriminate throttling is applied during signaling storms, then network congestion is reduced, but innocent networks are unfairly impacted
Solution Approach 1:
The patent implements selective rate limiting by associating rate limit parameters with specific network identifiers extracted from TLS messages. This allows different rate limiting policies to be applied to different networks locally, enabling the system to target only malicious networks while allowing innocent networks to operate normally during signaling storms
Solution Approach 2:
The system monitors ingress message rates from different networks and applies rate limiting actions based on threshold violations. This feedback mechanism enables dynamic adjustment of rate limiting measures, ensuring that only networks exceeding acceptable thresholds are throttled while others continue operating normally
Data Source
AI summary
Methods, systems, and computer readable media for ingress message rate limiting are disclosed. One method occurs at a first network node of a first network comprises: obtaining, from a transport layer security (TLS) message from a second network node of a second network, an identifier identifying the second network node or the second network; receiving a request message from the second network node or the second network; determining, using the identifier, that an allowed ingress message rate associated with the second network node or the second network has been reached or exceeded; and in response to determining that the allowed ingress message rate associated with the second network node or the second network has been reached or exceeded, performing a rate limiting action.