Methods, systems, and computer readable media for automatic category 1 message filtering rules configuration by learning topology information from network function (NF) repository function (NRF)

Patent metadata

Field	Value
Publication number	US-12556512-B2
Application number	US-202217902531-A
Country	US
Kind code	B2
Filing date	Sep 2, 2022
Priority date	Sep 2, 2022
Publication date	Feb 17, 2026
Grant date	Feb 17, 2026

Abstract

A method for automatic configuration and use of Category 1 message filtering rules includes, at a network function (NF), subscribing, with an NF repository function (NRF), to receive notification of NF profile changes. The method further includes receiving, from the NRF and as a result of the subscribing, notification of an NF profile change. The method further includes automatically configuring, based on the notification of the NF profile change, at least one Category 1 message filtering rule implemented. The method further includes using the at least one Category 1 message filtering rule to filter service based interface (SBI) messages.

First claim

What is claimed is:

1 . A method for automatic configuration and use of Category 1 message filtering rules, the method comprising:
at a security edge protection proxy (SEPP) or a service communication proxy (SCP): subscribing, with an NF repository function (NRF), to receive notification of NF profile changes; receiving, from the NRF and as a result of the subscribing, notification of an NF profile change; automatically configuring, based on the notification of the NF profile change, at least one Category 1 message filtering rule, wherein the NF profile includes an authorization attribute and wherein automatically configuring the at least one Category 1 message filtering rule includes adding or updating a Category 1 message filtering rule to allow service based interface (SBI) messages containing hypertext transfer protocol (HTTP) methods corresponding to allowed scopes for an entity defined in the authorization attribute; and using, at the NF, the at least one Category 1 message filtering rule to filter the SBI messages, wherein using the at least one Category 1 message filtering rule to filter SBI messages includes receiving, from the entity, an SBI message containing an HTTP method that does not correspond to one of the allowed scopes for the entity, and, in response to determining that the HTTP method in the SBI message does not correspond to one of the allowed scopes for the entity, blocking the SBI message.

2 . The method of claim 1 wherein the SEPP or SCP comprises the SEPP.

3 . The method of claim 1 wherein the SEPP or SCP comprises the SCP.

4 . The method of claim 1 wherein subscribing with the NRF includes transmitting an nfStatusSubscribe message to the NRF.

5 . The method of claim 1 wherein receiving notification of the NF profile change includes receiving an nfStatusNotify message containing an NF profile.

6 . The method of claim 1 wherein receiving notification of the NF profile change includes receiving the notification in response to an NFRegister, NFUpdate, or NFDeregister service operation.

7 . The method of claim 1 wherein the scopes define allowed operations for the entity.

8 . The method of claim 1 wherein automatically configuring the at least one Category 1 message filtering rule includes automatically adding a Category 1 message filtering rule to a Category 1 message filtering rules database maintained by the NF.

9 . The method of claim 1 wherein using the Category 1 message filtering rule to filter SBI messages includes allowing or blocking messages arriving in a public land mobile network (PLMN) based on hypertext transfer protocol (HTTP) method type and resource uniform resource identifier (URI) parameters in the messages.

10 . A system for automatic configuration and use of Category 1 message filtering rules, the system comprising:
a security edge protection proxy (SEPP) or a service communication proxy (SCP) including at least one processor and a memory; a Category 1 message filtering rules database stored in the memory; and a Category 1 message filtering rules manager executable by the at least one processor for subscribing, with an NF repository function (NRF), to receive notification of NF profile changes, receiving, from the NRF and as a result of the subscribing, notification of an NF profile change, automatically configuring, based on the notification of the NF profile change, at least one Category 1 message filtering rule in the Category 1 message filtering rules database; and using the at least one Category 1 message filtering rule to filter service based interface (SBI) messages, wherein the NF profile includes an authorization attribute, wherein automatically configuring the at least one Category 1 message filtering rule includes adding or updating a Category 1 message filtering rule to allow SBI messages containing hypertext transfer protocol (HTTP) methods corresponding to allowed scopes for an entity defined in the authorization attribute, and wherein using the at least one Category 1 message filtering rule to filter SBI messages includes receiving, from the entity, an SBI message containing an HTTP method that does not correspond to one of the allowed scopes for the entity, and, in response to determining that the HTTP method in the SBI message does not correspond to one of the allowed scopes for the entity, blocking the SBI message.

11 . The system of claim 10 wherein the SEPP or SCP comprises the SEPP.

12 . The system of claim 10 wherein SEPP or SCP comprises the SCP.

13 . The system of claim 10 wherein the Category 1 message filtering rules manager is configured to subscribe with the NRF by transmitting an nfStatusSubscribe message to the NRF.

14 . The system of claim 10 wherein the Category 1 message filtering rules manager is configured to receive the notification of the NF profile change in an nfStatusNotify message containing an NF profile.

15 . The system of claim 11 the Category 1 message filtering rules manager is configured to receive the notification of the NF profile change in response to an NFRegister, NFUpdate, or NFDeregister service operation.

16 . The system of claim 1 wherein the scopes define allowed operations for the entity.

17 . The system of claim 10 wherein the Category 1 message filtering rules manager is configured to allow or block messages arriving in a public land mobile network (PLMN) based on hypertext transfer protocol (HTTP) method type and resource uniform resource identifier (URI) parameters in the messages.

18 . A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
at a security edge protection proxy (SEPP) or a service communication proxy (SCP): subscribing, with an NF repository function (NRF), to receive notification of NF profile changes; receiving, from the NRF and as a result of the subscribing, notification of an NF profile change; automatically configuring, based on the notification of the NF profile change, at least one Category 1 message filtering rule, wherein the NF profile includes an authorization attribute and wherein automatically configuring the at least one Category 1 message filtering rule includes adding or updating a Category 1 message filtering rule to allow service based interface (SBI) messages containing hypertext transfer protocol (HTTP) methods corresponding to allowed scopes for an entity defined in the authorization attribute; and using, at the NF, the at least one Category 1 message filtering rule to filter the SBI messages, wherein using the at least one Category 1 message filtering rule to filter SBI messages includes receiving, from the entity, an SBI message containing an HTTP method that does not correspond to one of the allowed scopes for the entity, and, in response to determining that the HTTP method in the SBI message does not correspond to one of the allowed scopes for the entity, blocking the SBI message.

Assignees

• Oracle Int Corp

Inventors

• Rajput Jay
• Singh Virendra
• Mohan Raj John Nirmal

Classifications

• H04L63/0281

  Proxies · CPC title

• H04W12/088

  using filters or firewalls · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title