Oracle International Corporation

Shashikiran Bhalachandra Mahalank

Jay Rajput

Virendra Singh

Nitin Kumar Gupta

Venkatesh Aravamudhan

Vipin Kumar

Rajiv Krishan

Ankit Srivastava

Raghuvamshi Vasudev Singh Thakur

Kiranmayi Boyapati

Gokul Narayanan

Srividya Aravind

Raghavendra Gopala Rao

Venkata Srivatsa Grandhi

Prateek Wadhwa

Iyappan Chellasamy

Amit Jain

John Nirmal Mohan Raj

Sridhar Karuturi

Sathish Kumar Prabhakaran

Ashok Kumar Karyampudi

Ravindra Madhukar Patil

Rajul Surana

Ranganath Ashok Bodhanapati

Arjun Iddya

Koushik Das

Nitin Gupta

A method for communicating and using producer network function (NF) network slice level load information includes receiving, by a service communication proxy (SCP) and from a producer NF, a service-based interface (SBI) message including producer NF network slice level load information. The method further includes reading, by the SCP and from the SBI message, the producer NF network slice level load information. The method further includes communicating, by the SCP and to an NF repository function (NRF), the producer NF network slice level load information. The method further includes storing, by the NRF, the producer NF network slice level load information. The method further includes using, by the NRF, the producer NF network slice level load information to generate a response message to be sent to a consumer NF or the SCP.

Methods, systems, and computer readable media for communicating and using producer network function (NF) network slice level load information

A method for identifying cached NF discovery results impacted by an NF profile update to NF discovery service consumers includes receiving an NF discovery request including query parameters, generating an NF discovery response, communicating the NF discovery response to the NF discovery service consumer, and caching information associated with the NF discovery response. The method further includes receiving an NF update message for changing a value of at least one attribute of an NF profile of a producer NF, determining that the change in the value of at least one attribute of the NF profile of the producer NF would have impacted the NF discovery response, updating the cached information associated with the NF discovery response, and communicating, to the NF discovery service consumer, a notification message including the NF profile of the producer NF and identifying the NF discovery response as an impacted NF discovery response.

Methods, systems, and computer readable media for identifying, to network function (NF) discovery service consumers, NF discovery results impacted by an NF profile update

A method for offloading verification of consumer NF security certificates includes receiving, by an SCP, an SBI request message including a consumer NF security token signed by a consumer NF for authenticating the consumer NF to a producer NF. The method further includes obtaining, by the SCP and from the consumer NF security token, an identifier for a consumer NF security certificate or a copy of the consumer NF security certificate. The method further includes verifying, by the SCP and on behalf of the producer NF, the consumer NF security certificate. The method further includes performing, by the SCP and based on a verification result of the consumer NF security certificate, a network security action.

Methods, systems, and computer readable media for using service communication proxy (SCP) to offload verification of consumer network function (NF) security certificates

A method for mitigating network security attacks by linking NF discovery results to subsequent messages includes receiving, at a proxy NF, NF discovery messages. The method further includes reading, by the proxy NF, producer NF and consumer-NF-identifying parameters from the NF discovery messages. The method further includes creating, by the proxy NF, records in an NF-discovery-linked security database maintained by the proxy NF, wherein the records include the consumer NF and producer-NF-identifying parameters read from the NF discovery messages. The method further includes receiving, by the proxy NF, a service-based interface (SBI) request message. The method further includes screening, by the proxy NF and using the records in the NF-discovery-linked security database, the SBI request message. The method further includes performing, by the proxy NF, a network security action for the SBI request message based on results of the screening.

Methods, systems, and computer readable media for mitigating network security attacks by linking network function (NF) discovery results with subsequent messages at proxy NF

A method for checking end-to-end SBI message integrity includes receiving a first traffic feed from a first NF, the first traffic feed including copies of SBI messages transmitted from the first NF to an SCP. The method further includes receiving a second traffic feed from a second NF, the second traffic feed including copies of SBI messages received by the second NF from the SCP. The method further includes identifying, from the first traffic feed, a copy of a first SBI message transmitted by the first NF to the SCP. The method further includes identifying, from the second traffic feed, a copy of a second SBI message received by the second NF from the SCP and that is associated with the copy of the first SBI message. The method further includes performing, using the message copies, an end-to-end SBI message integrity check for the first SBI message.

Methods, systems, and computer readable media for providing end-to-end message integrity checking for service-based interface (SBI) messages communicated via a service communication proxy (SCP)

A method for multi-NF Retry-After header field value propagation includes receiving, by an SCP and from a consumer NF, an SBI request message and determining that the SBI request message requests a service that can be provided by first and second producer NFs. The method further includes forwarding the SBI request message to a first producer NF and receiving a response message indicating that the first producer NF failed to process the SBI request message and including a first Retry-After header field value. The method further includes forwarding the SBI request message to the second producer NF and receiving a response message from the second producer NF indicating that the second producer NF failed to process the SBI request message and including a second Retry-After header field value. The method further includes communicating, by the SCP and to the consumer NF, the first and second Retry-After header field values.

Methods, systems, and computer readable media for communicating retry-after header field values to consumer network functions (NFs) via service communication proxies (SCPs)

Methods, systems, and computer readable media for ingress message rate limiting are disclosed. One method includes, at a network node, receiving a service request message from a service consumer network function and extracting, from the received service request message, an access token that includes a consumer network function instance identifier identifying the service consumer network function. The method further includes determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded and in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded, performing a message rate limiting action.

Methods, systems, and computer readable media for utilizing network function identifiers to implement ingress message rate limiting

A method for automatic key management of network access token public keys for 5GC authorization to mitigate security attacks includes providing, at the NRF, a network access token public key status update notification subscription interface that allows producer NFs to subscribe to receive notifications of updates in status of service access token public keys issued by the NRF. When the NRF determines that an update in status of a service access token public key is required, the NRF updates the status of the public key in its local database and notifies producer NFs that have subscribed to receive the updates. The producer NFs use the public keys to validate service requests from consumer NFs. In one variation, the NRF maintains and updates the status of service access token public keys associated with different service access levels.

Methods, systems, and computer readable media for automatic key management of network function (NF) repository function (NRF) access token public keys for 5G core (5GC) authorization to mitigate security attacks

Methods, systems, and computer readable media for providing a unified interface that is configured to support communication between a user equipment (UE) and application function (AF) via a network exposure function (NEF) are disclosed. One method includes receiving, by a NEF from a session management function (SMF), a protocol data unit (PDU) session event change notification message associated with a UE, establishing, by the NEF, a data delivery path between the UE and an application function (AF) via one of a plurality of data delivery planes that traverse the NEF in response to the PDU session event change notification message and processing, by the NEF, messages communicated between the UE and the AF over any of the plurality of data delivery planes using a single unified interface supported by the NEF.

Methods, systems, and computer readable media for providing a unified interface configured to support infrequent data communications via a network exposure function

A method for mitigating spoofing attacks on an SEPP inter-PLMN forwarding interface includes obtaining, by a responding SEPP, a first SEPP identifier and/or a first PLMN identifier from at least one message received over an inter-PLMN control interface. The method further includes storing the first SEPP identifier and/or the first PLMN identifier in an identity cross-validation database. The method further includes obtaining, from at least one message received over an inter-PLMN forwarding interface a second SEPP identifier and/or a second PLMN identifier and performing a lookup in the identity cross-validation database using a lookup key comprising at least one of the second SEPP identifier and the second PLMN identifier, determining that a record corresponding to the lookup key is not present in the identity cross-validation database, and, in response, preventing the at least one message received over the inter-PLMN forwarding interface from entering a PLMN protected by the responding SEPP.

Methods, systems, and computer readable media for mitigating spoofing attacks on security edge protection proxy (SEPP) inter-public land mobile network (inter-PLMN) forwarding interface

Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.

Methods, systems, and computer readable media for mitigating 5G roaming spoofing attacks

Methods, systems, and computer readable media for message validation in fifth generation (5G) communications networks are disclosed. One method occurring at a first network node of a first network comprises: obtaining, from at least one authentication and key agreement (AKA) procedure related message associated with a user device communicating via a second network, authentication information identifying the user device; storing the authentication information in a data store for validating subsequent messages; receiving a request message associated with the user device; determining, using the authentication information, that the request message is invalid; and in response to determining that the request message is invalid, performing an invalid message action.

Methods, systems, and computer readable media for message validation in fifth generation (5G) communications networks

A method for mitigating a 5G roaming attack for an Internet of things (IoT) device based on expected user equipment (UE) behavior patterns includes receiving, at a network function (NF) including at least one processor, a service request message requesting a service from a home public land mobile network (PLMN) of a UE identified in the service request message, wherein the UE comprises an IoT device and obtaining, for the UE identified in service request message, at least one parameter provisioned in the home PLMN to indicate an expected UE behavior pattern. The method further includes comparing the at least one parameter provisioned in the home PLMN to indicate the expected UE behavior pattern to at least one parameter from the service request message and that the at least one parameter from the service request message is not indicative of the expected UE behavior pattern of the UE. The method further includes dropping or rejecting the service request message.

Methods, systems, and computer readable media for mitigating 5G roaming attacks for internet of things (IoT) devices based on expected user equipment (UE) behavior patterns

A method for generating and using network function (NF) set load information, the method includes, at a service communication proxy (SCP), receiving service based interface (SBI) requests from consumer NFs. The method further includes forwarding the SBI requests to producer NF instances that are members of an NF set. The method further includes receiving responses to the SBI requests from the producer NF instances. The method further includes determining NF instance load control information (LCI) for the producer NF instances using the responses. The method further includes computing, by the SCP and from the NF instance LCI for the producer NF instances, NF set LCI for the NF set. The method further includes communicating the NF set LCI for the NF set to at least one of the consumer NFs or using the NF set LCI for the NF set to select a producer NF instance within an NF set to provide a service for one of the consumer NFs.

Methods, systems, and computer readable media for generating and using network function (NF) set overload control information (OCI) and load control information (LCI) at service communication proxy (SCP)

Methods, systems, and computer readable media for validating a session management function (SMF) registration request are disclosed. One method occurs at a network node. The method comprises: receiving, from a first SMF in a home network, a registration request indicating a first network identifier identifying a visited network where a user device is roaming; determining whether the registration request is valid by comparing the first network identifier and a second network identifier associated with an access and mobility management function (AMF) serving the user device; and performing at least one action based on the determining.

Growing community of inventors

Bengaluru, India

Shashikiran Bhalachandra Mahalank