Oracle International Corporation

Jay Rajput

Virendra Singh

Shashikiran Bhalachandra Mahalank

Ankit Srivastava

Amarnath Jayaramachar

John Nirmal Mohan Raj

Ashish Jyoti Sharma

Venkata Srivatsa Grandhi

Prateek Wadhwa

Iyappan Chellasamy

Rajiv Krishan

Amit Jain

Kawal Sapra

Doki Satish Kumar Patro

Sairam Sudhir Pokkunuri

Srividya Aravind

Nikita Satish Nair

Koushik Das

Sonia Kadyan

A method for offloading verification of consumer NF security certificates includes receiving, by an SCP, an SBI request message including a consumer NF security token signed by a consumer NF for authenticating the consumer NF to a producer NF. The method further includes obtaining, by the SCP and from the consumer NF security token, an identifier for a consumer NF security certificate or a copy of the consumer NF security certificate. The method further includes verifying, by the SCP and on behalf of the producer NF, the consumer NF security certificate. The method further includes performing, by the SCP and based on a verification result of the consumer NF security certificate, a network security action.

Methods, systems, and computer readable media for using service communication proxy (SCP) to offload verification of consumer network function (NF) security certificates

A method for mitigating network security attacks by linking NF discovery results to subsequent messages includes receiving, at a proxy NF, NF discovery messages. The method further includes reading, by the proxy NF, producer NF and consumer-NF-identifying parameters from the NF discovery messages. The method further includes creating, by the proxy NF, records in an NF-discovery-linked security database maintained by the proxy NF, wherein the records include the consumer NF and producer-NF-identifying parameters read from the NF discovery messages. The method further includes receiving, by the proxy NF, a service-based interface (SBI) request message. The method further includes screening, by the proxy NF and using the records in the NF-discovery-linked security database, the SBI request message. The method further includes performing, by the proxy NF, a network security action for the SBI request message based on results of the screening.

Methods, systems, and computer readable media for mitigating network security attacks by linking network function (NF) discovery results with subsequent messages at proxy NF

A method for checking end-to-end SBI message integrity includes receiving a first traffic feed from a first NF, the first traffic feed including copies of SBI messages transmitted from the first NF to an SCP. The method further includes receiving a second traffic feed from a second NF, the second traffic feed including copies of SBI messages received by the second NF from the SCP. The method further includes identifying, from the first traffic feed, a copy of a first SBI message transmitted by the first NF to the SCP. The method further includes identifying, from the second traffic feed, a copy of a second SBI message received by the second NF from the SCP and that is associated with the copy of the first SBI message. The method further includes performing, using the message copies, an end-to-end SBI message integrity check for the first SBI message.

Methods, systems, and computer readable media for providing end-to-end message integrity checking for service-based interface (SBI) messages communicated via a service communication proxy (SCP)

A method for detecting and mitigating security attacks on producer NFs using error response messages includes tracking, by a proxy NF, rates of error response messages generated in response to inter-PLMN SBI request messages from consumer NFs. The method further includes receiving an inter-PLMN SBI request message, obtaining information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message, and determining that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate. The method further includes, in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF exceeds the threshold rate, performing a network security action.

Methods, systems, and computer readable media for detecting and mitigating security attacks on producer network functions (NFs) using error response messages

A method for multi-NF Retry-After header field value propagation includes receiving, by an SCP and from a consumer NF, an SBI request message and determining that the SBI request message requests a service that can be provided by first and second producer NFs. The method further includes forwarding the SBI request message to a first producer NF and receiving a response message indicating that the first producer NF failed to process the SBI request message and including a first Retry-After header field value. The method further includes forwarding the SBI request message to the second producer NF and receiving a response message from the second producer NF indicating that the second producer NF failed to process the SBI request message and including a second Retry-After header field value. The method further includes communicating, by the SCP and to the consumer NF, the first and second Retry-After header field values.

Methods, systems, and computer readable media for communicating retry-after header field values to consumer network functions (NFs) via service communication proxies (SCPs)

A method for automatically generating and distributing firewall rules to filter service-based interface (SBI) messages relating to new or updated services includes maintaining a repository of firewall rules for updating a ruleset used by a core network firewall to filter SBI messages transmitted in a core network. The method further includes automatically retrieving, from an online archive of Third Generation Partnership Project (3GPP) standards documents, definitions of service operations performed on SBI interfaces in the core network. The method further includes automatically generating firewall rules based on the definitions of the service operations. The method further includes storing the firewall rules in the repository of firewall rules. The method further includes automatically distributing the firewall rules in the repository of firewall rules to the core network firewall.

Methods, systems, and computer readable media for automatically updating firewall rules to filter service-based interface (SBI) messages relating to new or updated services

A method for improving inter-PLMN routing by implementing health checks for remote SEPPs includes storing a target SEPP database including records corresponding to remote SEPPs to which SBI request messages can be routed. The method further includes receiving SBI request messages destined for NFs in PLMNs protected by the remote SEPPs, using the target SEPP database to select and route messages to the remote SEPPs. The method further includes, for each of the remote SEPPs, sending a health check message to the remote SEPP, determining, based on a response or lack of a response to the health check message that the remote SEPP is unhealthy or unreachable, and, in response, removing a record for the remote SEPP from the target SEPP database or marking the record for the remote SEPP to indicate that the remote SEPP is unhealthy or unreachable.

Methods, systems, and computer readable media for improving inter-public land mobile network (PLMN) routing across security edge protection proxies (SEPPs) by implementing health checks for remote SEPPs

A method for prioritizing among alternate network function (NF) instances includes registering a first NF profile of a first NF instance with a first NF repository function (NRF), and defining, as part of the first NF profile, alternate NF instance information identifying a plurality of individual alternate NF instances to function as backups in response to unavailability of the first NF instance and specifying, for each alternate NF instance, a priority attribute value indicating a relative priority of the alternate NF instance with respect to the other alternate NF instances. The method further includes, at a first consumer NF or SCP, discovering, from the first NRF, the first NF profile of the first NF instance, detecting unavailability of the first NF instance, and, using the alternate NF instance information in the first NF profile to select and contact one of the alternate NF instances identified by the alternate NF instance information.

Methods, systems, and computer readable media for prioritizing among alternate network function (NF) instances

A method for providing a shared SEPP for roaming aggregators includes, at a shared SEPP that functions as a single point of ingress and egress between an MVNO PLMN and an MNO PLMN and between the MVNO PLMN and MNO PLMNs and external networks, receiving a first service-based interface (SBI) request message from the MVNO PLMN. The method further includes determining, by the shared SEPP, that the first SBI request message is destined for the MNO PLMN, and, in response, routing the first SBI request message to the MNO PLMN. The method further includes receiving a second SBI request message from the MVNO PLMN and determining that the second SBI request message is destined for one of the external networks, and, in response, routing the second SBI request message to the one external network. The shared SEPP may apply security measures for messages transmitted to and from the MNO PLMN and the MVNO PLMN.

Methods, systems, and computer readable media for providing shared security edge protection proxy (SEPP) for roaming aggregators

A method for performing a location and velocity check at an SEPP to protect against a spoofing attack includes receiving an SBI request message relating to authentication of UE. The method further includes querying a database NF to obtain previous authentication information for the UE, the previous authentication information including a previous network identifier and a previous authentication time for the UE. The method further includes receiving a response from the database NF, the response including the previous network identifier and the previous authentication time. The method further includes reading, a current network identifier from the SBI request message, performing, using the current network identifier from the SBI request message, the previous network identifier, the previous authentication time, and a time of receipt by the SEPP of the SBI request message, a location and velocity check for the UE, and performing a network security action for the SBI request message based on results of the location and velocity check.

Methods, systems, and computer readable media for performing location and velocity check at security edge protection proxy (SEPP) to avoid spoofing

A method for error information propagation from an SCP to a NF to support a circuit breaker design at the consumer NF includes receiving, at the SCP and from the consumer NF, a first SBI service request message. The method further includes attempting, by the SCP, to forward the first SBI service request to N producer NF instances. The method further includes detecting, by the SCP, an error involving the N producer NF instances. The method further includes performing, by the SCP, successful alternate routing of the first SBI service request message to an (N+1) th producer NF instance. The method further includes receiving, by the SCP, a success response message from the (N+1) th producer NF instance. The method further includes propagating, by the SCP, with the success response message and to the consumer NF, error information regarding the N producer NF instances.

Methods, systems, and computer readable media for supporting circuit breaker design pattern at consumer network function (NF)

A method for selective inter-PLMN security handshake validation includes receiving, at a SEPP, a first inter-PLMN security handshake request message. The method further includes performing, by the SEPP and in an SEPP trust relationship database, a lookup to determine whether the first inter-PLMN security handshake request message originates from a trusted SEPP. The method further includes determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, and, in response, performing, by the SEPP, an inter-PLMN security handshake validation procedure on the first inter-PLMN security handshake request message. The method further includes determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, and, in response, performing a network protective operation.

Methods, systems, and computer readable media for selective inter-public land mobile network (PLMN) security handshake validation

A method for delegated authorization at a security edge protection proxy (SEPP) includes intercepting, from a consumer network function (NF) that does not support access token based authorization, a service based interface (SBI) service request for accessing a service provided by a producer NF that requires access token based authorization. The method further includes operating as an access token authorization client to obtain a first access token on behalf of the consumer NF. The method further includes using the first access token to enable the consumer NF to access the service provided by the first producer NF. The SEPP may also operate as an access token authorization server on behalf of an NRF that does not support access-token-based authorization.

Methods, systems, and computer readable media for delegated authorization at security edge protection proxy (SEPP)

The subject matter described herein includes a method for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information. The method includes receiving a service based interface (SBI) request message, obtaining, from the SBI request message, target resource identification information, obtaining NF profile information using the target resource identification information and storing the NF profile information, receiving an SBI response message including overload control information and scope information for the overload control information, using the stored NF profile information to determine whether the scope information for the overload control information is valid, and, in response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

Methods, systems, and computer readable media for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope against network function (NF) profile information obtained using target resource identification information

A method for providing for optimized service based interface (SBI) communications by performing network function (NF) fully qualified domain name (FQDN) resolution at an NF repository function (NRF) includes, at an NRF including at least one processor, receiving NF register requests including NF profiles and/or NF service profiles, at least some of which include FQDNs and do not include Internet protocol (IP) addresses. The method further includes storing the NF profiles and/or NF service profiles in an NF profiles database. The method further includes resolving the FQDNs in NF profiles and/or NF service profiles into IP addresses. The method further includes receiving NF discovery requests. The method further includes generating lists of NF profiles and/or NF service profiles that match query parameters in the NF discovery requests. The method further includes providing the lists of NF profiles and/or NF service profiles including the IP addresses to consumer NFs in NF discovery responses.

Methods, systems, and computer readable media for providing for optimized service-based interface (SBI) communications by performing network function (NF) fully qualified domain name (FQDN) resolution at NF repository function (NRF)

Growing community of inventors

Bengaluru, India

Jay Rajput