Oracle International Corporation

Shashikiran Bhalachandra Mahalank

Jay Rajput

Nitin Kumar Gupta

Virendra Singh

Venkatesh Aravamudhan

Vipin Kumar

Rajiv Krishan

Ankit Srivastava

Raghuvamshi Vasudev Singh Thakur

Kiranmayi Boyapati

Prateek Wadhwa

Srividya Aravind

Venkata Srivatsa Grandhi

Raghavendra Gopala Rao

Iyappan Chellasamy

Gokul Narayanan

Amit Jain

John Nirmal Mohan Raj

Sridhar Karuturi

Sathish Kumar Prabhakaran

Ashok Kumar Karyampudi

Ravindra Madhukar Patil

Rajul Surana

Ranganath Ashok Bodhanapati

Arjun Iddya

Koushik Das

Nitin Gupta

A method for mitigating network security attacks by linking NF discovery results to subsequent messages includes receiving, at a proxy NF, NF discovery messages. The method further includes reading, by the proxy NF, producer NF and consumer-NF-identifying parameters from the NF discovery messages. The method further includes creating, by the proxy NF, records in an NF-discovery-linked security database maintained by the proxy NF, wherein the records include the consumer NF and producer-NF-identifying parameters read from the NF discovery messages. The method further includes receiving, by the proxy NF, a service-based interface (SBI) request message. The method further includes screening, by the proxy NF and using the records in the NF-discovery-linked security database, the SBI request message. The method further includes performing, by the proxy NF, a network security action for the SBI request message based on results of the screening.

Methods, systems, and computer readable media for mitigating network security attacks by linking network function (NF) discovery results with subsequent messages at proxy NF

A method for checking end-to-end SBI message integrity includes receiving a first traffic feed from a first NF, the first traffic feed including copies of SBI messages transmitted from the first NF to an SCP. The method further includes receiving a second traffic feed from a second NF, the second traffic feed including copies of SBI messages received by the second NF from the SCP. The method further includes identifying, from the first traffic feed, a copy of a first SBI message transmitted by the first NF to the SCP. The method further includes identifying, from the second traffic feed, a copy of a second SBI message received by the second NF from the SCP and that is associated with the copy of the first SBI message. The method further includes performing, using the message copies, an end-to-end SBI message integrity check for the first SBI message.

Methods, systems, and computer readable media for providing end-to-end message integrity checking for service-based interface (SBI) messages communicated via a service communication proxy (SCP)

A method for multi-NF Retry-After header field value propagation includes receiving, by an SCP and from a consumer NF, an SBI request message and determining that the SBI request message requests a service that can be provided by first and second producer NFs. The method further includes forwarding the SBI request message to a first producer NF and receiving a response message indicating that the first producer NF failed to process the SBI request message and including a first Retry-After header field value. The method further includes forwarding the SBI request message to the second producer NF and receiving a response message from the second producer NF indicating that the second producer NF failed to process the SBI request message and including a second Retry-After header field value. The method further includes communicating, by the SCP and to the consumer NF, the first and second Retry-After header field values.

Methods, systems, and computer readable media for communicating retry-after header field values to consumer network functions (NFs) via service communication proxies (SCPs)

Methods, systems, and computer readable media for ingress message rate limiting are disclosed. One method includes, at a network node, receiving a service request message from a service consumer network function and extracting, from the received service request message, an access token that includes a consumer network function instance identifier identifying the service consumer network function. The method further includes determining, using the consumer network function instance identifier, that an allowed ingress message rate associated with the service consumer network function has been reached or exceeded and in response to determining that the allowed ingress message rate associated with the service consumer network function has been reached or exceeded, performing a message rate limiting action.

Methods, systems, and computer readable media for utilizing network function identifiers to implement ingress message rate limiting

A method for automatic key management of network access token public keys for 5GC authorization to mitigate security attacks includes providing, at the NRF, a network access token public key status update notification subscription interface that allows producer NFs to subscribe to receive notifications of updates in status of service access token public keys issued by the NRF. When the NRF determines that an update in status of a service access token public key is required, the NRF updates the status of the public key in its local database and notifies producer NFs that have subscribed to receive the updates. The producer NFs use the public keys to validate service requests from consumer NFs. In one variation, the NRF maintains and updates the status of service access token public keys associated with different service access levels.

Methods, systems, and computer readable media for automatic key management of network function (NF) repository function (NRF) access token public keys for 5G core (5GC) authorization to mitigate security attacks

Methods, systems, and computer readable media for providing a unified interface that is configured to support communication between a user equipment (UE) and application function (AF) via a network exposure function (NEF) are disclosed. One method includes receiving, by a NEF from a session management function (SMF), a protocol data unit (PDU) session event change notification message associated with a UE, establishing, by the NEF, a data delivery path between the UE and an application function (AF) via one of a plurality of data delivery planes that traverse the NEF in response to the PDU session event change notification message and processing, by the NEF, messages communicated between the UE and the AF over any of the plurality of data delivery planes using a single unified interface supported by the NEF.

Methods, systems, and computer readable media for providing a unified interface configured to support infrequent data communications via a network exposure function

A method for mitigating spoofing attacks on an SEPP inter-PLMN forwarding interface includes obtaining, by a responding SEPP, a first SEPP identifier and/or a first PLMN identifier from at least one message received over an inter-PLMN control interface. The method further includes storing the first SEPP identifier and/or the first PLMN identifier in an identity cross-validation database. The method further includes obtaining, from at least one message received over an inter-PLMN forwarding interface a second SEPP identifier and/or a second PLMN identifier and performing a lookup in the identity cross-validation database using a lookup key comprising at least one of the second SEPP identifier and the second PLMN identifier, determining that a record corresponding to the lookup key is not present in the identity cross-validation database, and, in response, preventing the at least one message received over the inter-PLMN forwarding interface from entering a PLMN protected by the responding SEPP.

Methods, systems, and computer readable media for mitigating spoofing attacks on security edge protection proxy (SEPP) inter-public land mobile network (inter-PLMN) forwarding interface

Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.

Methods, systems, and computer readable media for mitigating 5G roaming spoofing attacks

Methods, systems, and computer readable media for message validation in fifth generation (5G) communications networks are disclosed. One method occurring at a first network node of a first network comprises: obtaining, from at least one authentication and key agreement (AKA) procedure related message associated with a user device communicating via a second network, authentication information identifying the user device; storing the authentication information in a data store for validating subsequent messages; receiving a request message associated with the user device; determining, using the authentication information, that the request message is invalid; and in response to determining that the request message is invalid, performing an invalid message action.

Methods, systems, and computer readable media for message validation in fifth generation (5G) communications networks

A method for mitigating a 5G roaming attack for an Internet of things (IoT) device based on expected user equipment (UE) behavior patterns includes receiving, at a network function (NF) including at least one processor, a service request message requesting a service from a home public land mobile network (PLMN) of a UE identified in the service request message, wherein the UE comprises an IoT device and obtaining, for the UE identified in service request message, at least one parameter provisioned in the home PLMN to indicate an expected UE behavior pattern. The method further includes comparing the at least one parameter provisioned in the home PLMN to indicate the expected UE behavior pattern to at least one parameter from the service request message and that the at least one parameter from the service request message is not indicative of the expected UE behavior pattern of the UE. The method further includes dropping or rejecting the service request message.

Methods, systems, and computer readable media for mitigating 5G roaming attacks for internet of things (IoT) devices based on expected user equipment (UE) behavior patterns

A method for generating and using network function (NF) set load information, the method includes, at a service communication proxy (SCP), receiving service based interface (SBI) requests from consumer NFs. The method further includes forwarding the SBI requests to producer NF instances that are members of an NF set. The method further includes receiving responses to the SBI requests from the producer NF instances. The method further includes determining NF instance load control information (LCI) for the producer NF instances using the responses. The method further includes computing, by the SCP and from the NF instance LCI for the producer NF instances, NF set LCI for the NF set. The method further includes communicating the NF set LCI for the NF set to at least one of the consumer NFs or using the NF set LCI for the NF set to select a producer NF instance within an NF set to provide a service for one of the consumer NFs.

Methods, systems, and computer readable media for generating and using network function (NF) set overload control information (OCI) and load control information (LCI) at service communication proxy (SCP)

Methods, systems, and computer readable media for validating a session management function (SMF) registration request are disclosed. One method occurs at a network node. The method comprises: receiving, from a first SMF in a home network, a registration request indicating a first network identifier identifying a visited network where a user device is roaming; determining whether the registration request is valid by comparing the first network identifier and a second network identifier associated with an access and mobility management function (AMF) serving the user device; and performing at least one action based on the determining.

Methods, systems, and computer readable media for validating a session management function (SMF) registration request

A method for preventing subscriber identifier leakage from a telecommunications network includes receiving, by a security edge protection proxy (SEPP), an authentication response message authorizing a subscriber in a visitor network, wherein the authentication response message includes a home subscriber identifier used to identify the subscriber within a home network. The method further includes replacing, by the SEPP, the home subscriber identifier in the authentication response message with a visitor subscriber identifier. The method further includes forwarding, by the SEPP, the authentication response message with the visitor subscriber identifier to a visitor network.

Methods, systems, and computer readable media for preventing subscriber identifier leakage

A method for mitigating a 5G roaming attack using a security edge protection proxy (SEPP), includes receiving, at an SEPP, user equipment (UE) registration messages for outbound roaming subscribers. The method further includes creating, in a SEPP security database, UE roaming registration records derived from UE registration messages. The method further includes receiving, at the SEPP, a packet data unit (PDU) session establishment request message. The method further includes performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record. The method further includes determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.

Methods, systems, and computer readable media for mitigating 5G roaming security attacks using security edge protection proxy (SEPP)

Methods, systems, and computer readable media for ingress message rate limiting are disclosed. One method occurs at a first network node of a first network comprises: obtaining, from a transport layer security (TLS) message from a second network node of a second network, an identifier identifying the second network node or the second network; receiving a request message from the second network node or the second network; determining, using the identifier, that an allowed ingress message rate associated with the second network node or the second network has been reached or exceeded; and in response to determining that the allowed ingress message rate associated with the second network node or the second network has been reached or exceeded, performing a rate limiting action.

Growing community of inventors

Bengaluru, India

Shashikiran Bhalachandra Mahalank