Methods, systems, and computer readable media for detecting and mitigating security attacks on producer network functions (NFs) using error response messages

Patent metadata

Field	Value
Publication number	US-12425863-B2
Application number	US-202318523322-A
Country	US
Kind code	B2
Filing date	Nov 29, 2023
Priority date	Nov 29, 2023
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

A method for detecting and mitigating security attacks on producer NFs using error response messages includes tracking, by a proxy NF, rates of error response messages generated in response to inter-PLMN SBI request messages from consumer NFs. The method further includes receiving an inter-PLMN SBI request message, obtaining information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message, and determining that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate. The method further includes, in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF exceeds the threshold rate, performing a network security action.

First claim

What is claimed is:

1. A method for detecting and mitigating security attacks on producer network functions (NFs) using error response messages, the method comprising:
tracking, by a proxy NF, rates of error response messages generated in response to inter-public land mobile network (PLMN) service-based interface (SBI) request messages from consumer NFs;
receiving, by the proxy NF, an inter-PLMN SBI request message;
obtaining, by the proxy NF, information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message;
determining, by the proxy NF, using the information identifying the consumer NF and the producer NF, and from the tracked rates of error response messages, that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate; and
in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF to the producer NF exceeds the threshold rate, performing, by the proxy NF, a network security action.

2. The method of claim 1 wherein tracking rates of error response messages includes maintaining, for each combination of consumer NF and producer NF, a count of error response messages received by the proxy NF within a configurable time period.

3. The method of claim 2 wherein maintaining the counts of error response messages includes maintaining counts of 4xx or 5xx error response messages.

4. The method of claim 1 wherein obtaining the information identifying the consumer NF and the producer NF includes obtaining the information identifying the consumer NF and the information identifying the producer NF from an OAuth 2.0 access token claim transmitted with the inter-PLMN SBI request message.

5. The method of claim 1 wherein obtaining the information identifying the consumer NF and the producer NF includes obtaining the information identifying the consumer NF from an OAuth 2.0 access token claim or a User-Agent header transmitted with the inter-PLMN SBI request message and obtaining the information identifying the producer NF from a 3gpp-Sbi-Target-apiRoot header transmitted with the inter-PLMN SBI request message.

6. The method of claim 1 wherein performing the network security action includes blocking the SBI request message.

7. The method of claim 1 wherein performing the network security action includes marking the consumer NF as suspect and blocking or throttling SBI request messages from the consumer NF or a network of the consumer NF for a configurable time period.

8. The method of claim 1 wherein performing the network security action includes transmitting a fake error response generated by the proxy NF in response to the inter-PLMN SBI request message.

9. The method of claim 1 wherein the proxy NF comprises a security edge protection proxy (SEPP).

10. The method of claim 1 wherein the proxy NF comprises a service communication proxy (SCP).

11. A system for detecting and mitigating security attacks on producer network functions (NFs) using error response messages, the system comprising:
a proxy NF including at least one processor and a memory; and
an inter-public land mobile network (PLMN) service-based interface (SBI) request security controller implemented by the at least one processor for tracking rates of error response messages generated in response to inter-PLMN SBI request messages from consumer NFs, receiving an inter-PLMN SBI request message, obtaining information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message, determining, using the information identifying the consumer NF and the producer NF and from the tracked rates of error response messages, that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate, and, in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF exceeds the threshold rate, performing a network security action.

12. The system of claim 11 wherein the inter-PLMN SBI request security controller is configured to track rates of error response messages by maintaining, for each combination of consumer NF and producer NF, a count of error response messages received by the proxy NF within a configurable time period.

13. The system of claim 12 wherein the counts of error response messages include counts of 4xx or 5xx error response messages.

14. The system of claim 11 wherein the inter-PLMN SBI request security controller is configured to obtain the information identifying the consumer NF and the producer NF from an OAuth 2.0 access token claim transmitted with the inter-PLMN SBI request message.

15. The system of claim 11 wherein the inter-PLMN SBI request security controller is configured to obtain the information identifying the consumer from an OAuth 2.0 access token claim transmitted with the inter-PLMN SBI request message or a User-Agent header and the information from a 3gpp-Sbi-Target-apiRoot header transmitted with the inter-PLMN SBI request message.

16. The system of claim 11 wherein the network security action includes blocking the SBI request message.

17. The system of claim 11 wherein the network security action includes marking the consumer NF as suspect and blocking or throttling SBI request messages from the consumer NF or a network of the consumer NF for a configurable time period.

18. The system of claim 11 wherein the network security action includes transmitting a fake error response generated by the proxy NF in response to the inter-PLMN SBI request message.

19. The system of claim 11 wherein the proxy NF comprises a security edge protection proxy (SEPP) or a service communication proxy (SCP).

20. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
tracking, by a proxy NF, rates of error response messages generated in response to inter-public land mobile network (PLMN) service-based interface (SBI) request messages from consumer NFs;
receiving, by the proxy NF, an inter-PLMN SBI request message;
obtaining, by the proxy NF, information for identifying a consumer NF and a producer NF from the inter-PLMN SBI request message;
determining, by the proxy NF, using the information identifying the consumer NF and the producer NF, and from the tracked rates of error response messages, that a rate of error response messages generated in response to inter-PLMN SBI request messages from the consumer NF to the producer NF exceeds a threshold rate; and
in response to determining that the rate of error response messages generated in response to SBI request messages from the consumer NF to the producer NF exceeds the threshold rate, performing, by the proxy NF, a network security action.

Assignees

• Oracle Int Corp

Inventors

• Kadyan Sonia
• Rajput Jay
• Mohan Raj John Nirmal
• Sharma Ashish Jyoti

Classifications

• H04W12/06 Primary

  Authentication · CPC title

• H04W12/088

  using filters or firewalls · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title