Methods, systems, and computer readable media for automatically updating firewall rules to filter service-based interface (SBI) messages relating to new or updated services

Patent metadata

Field	Value
Publication number	US-12363075-B2
Application number	US-202318236921-A
Country	US
Kind code	B2
Filing date	Aug 22, 2023
Priority date	Aug 22, 2023
Publication date	Jul 15, 2025
Grant date	Jul 15, 2025

Abstract

A method for automatically generating and distributing firewall rules to filter service-based interface (SBI) messages relating to new or updated services includes maintaining a repository of firewall rules for updating a ruleset used by a core network firewall to filter SBI messages transmitted in a core network. The method further includes automatically retrieving, from an online archive of Third Generation Partnership Project (3GPP) standards documents, definitions of service operations performed on SBI interfaces in the core network. The method further includes automatically generating firewall rules based on the definitions of the service operations. The method further includes storing the firewall rules in the repository of firewall rules. The method further includes automatically distributing the firewall rules in the repository of firewall rules to the core network firewall.

First claim

What is claimed is:

1. A method for automatically generating and distributing firewall rules to filter service-based interface (SBI) message relating to new or updated services, the method comprising:
maintaining a repository of firewall rules for updating a ruleset used by a core network firewall to filter service-based interface (SBI) messages transmitted in a core network;
automatically retrieving, from an online archive of Third Generation Partnership Project (3GPP) standards documents, definitions of service operations performed on SBI interfaces in the core network;
automatically generating firewall rules based on the definitions of the service operations;
storing the firewall rules in the repository of firewall rules; and
automatically distributing the firewall rules in the repository of firewall rules to the core network firewall.

2. The method of claim 1 wherein maintaining the repository of firewall rules includes maintaining the repository on a stand-alone network node dedicated to updating firewall rulesets.

3. The method of claim 1 wherein maintaining the repository of firewall rules includes maintaining the repository on a network node comprising an element management system (EMS) used to configure 5G network functions.

4. The method of claim 1 wherein automatically generating the firewall rules includes reading the definitions of the service operations in YAML files published in the archive and extracting firewall rule criteria from the YAML files.

5. The method of claim 4 wherein extracting the firewall rule criteria from the YAML files includes extracting SBI message attributes from the YAML files and using the SBI message attributes as the firewall rule criteria.

6. The method of claim 1 wherein automatically retrieving the definitions of the service operations includes periodically checking the archive for new or updated definitions of the service operations.

7. The method of claim 1 wherein automatically generating the firewall rules includes generating firewall rules to allow messages corresponding to new or updated service operations defined in the definitions of the service operations.

8. The method of claim 1 wherein the core network firewall comprises a security edge protection proxy (SEPP) and wherein automatically distributing the firewall rules includes automatically updating firewall rules used by the SEPP to filter ingress and egress inter-public land mobile network (PLMN) traffic.

9. The method of claim 8 comprising, at the SEPP, using the firewall rules to filter the ingress and egress inter-PLMN traffic.

10. The method of claim 1 wherein the core network firewall comprises a 5G core network firewall separate from a security edge protection proxy (SEPP) and wherein automatically distributing the firewall rules includes automatically updating the firewall rules used by the 5G core network firewall to filter the SBI messages.

11. A system for automatically generating and distributing firewall rules to filter service-based interface (SBI) message relating to new or updated services, the system comprising:
a network node including at least one processor and a memory;
a repository of firewall rules stored in the memory for updating a ruleset used by a core network firewall to filter service-based interface (SBI) messages transmitted in a core network; and
an automated firewall rules generator/distributor implemented by the at least one processor for automatically retrieving, from an online archive of Third Generation Partnership Project (3GPP) standards documents, definitions of service operations performed on SBI interfaces in the core network, automatically generating firewall rules based on the definitions of the service operations, storing the firewall rules in the repository of firewall rules, and automatically distributing the firewall rules in the repository of firewall rules to the core network firewall.

12. The system of claim 11 wherein the network node comprises a stand-alone network node dedicated to updating firewall rules.

13. The system of claim 11 wherein the network node comprises an element management system (EMS) used to configure 5G network functions.

14. The system of claim 11 wherein, in generating the firewall rules, the automated firewall rules generator/distributor is configured to read the definitions of the service operations in YAML files published in the archive and extracting firewall rule criteria from the YAML files.

15. The system of claim 14 wherein, in extracting the firewall rule criteria from the YAML files, the automated firewall rules generator/distributor is configured to extract SBI message attributes from the YAML files and use the SBI message attributes as the firewall rule criteria.

16. The system of claim 11 wherein, in automatically retrieving the definitions of the service operations, the automated firewall rules generator/distributor is configured to periodically check the archive for new or updated definitions of the service operations.

17. The system of claim 11 wherein, in automatically generating the firewall rules, the automated firewall rules generator/distributor is configured to generate firewall rules to allow messages corresponding to new or updated service operations defined in the definitions of the service operations.

18. The system of claim 11 wherein the core network firewall comprises a security edge protection proxy (SEPP) and wherein, in automatically distributing the firewall rules, the automated firewall rules generator/distributor is configured to automatically update firewall rules used by the SEPP to filter ingress and egress inter-public land mobile network (PLMN) traffic.

19. The system of claim 11 wherein the core network firewall comprises a 5G core network firewall separate from a security edge protection proxy (SEPP) and, in automatically distributing the firewall rules, the automated firewall rules generator/distributor is configured to automatically update the firewall rules used by the 5G core network firewall to filter the SBI messages.

20. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
maintaining a repository of firewall rules for updating a ruleset used by a core network firewall to filter service-based interface (SBI) messages transmitted in a core network;
automatically retrieving, from an online archive of Third Generation Partnership Project (3GPP) standards documents, definitions of service operations performed on SBI interfaces in the core network;
automatically generating firewall rules based on the definitions of the service operations;
storing the firewall rules in the repository of firewall rules; and
automatically distributing the firewall rules in the repository of firewall rules to the core network firewall.

Assignees

• Oracle Int Corp

Inventors

• Rajput Jay
• Mohan Raj John Nirmal
• Sharma Ashish Jyoti

Classifications

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/0263 Primary

  Rule management · CPC title