Methods, systems, and computer readable media for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope against network function (NF) profile information obtained using target resource identification information

The subject matter described herein includes a method for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information. The method includes receiving a service based interface (SBI) request message, obtaining, from the SBI request message, target resource identification information, obtaining NF profile information using the target resource identification information and storing the NF profile information, receiving an SBI response message including overload control information and scope information for the overload control information, using the stored NF profile information to determine whether the scope information for the overload control information is valid, and, in response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

TECHNICAL FIELD

The subject matter described herein relates to reducing the likelihood of successful DoS attacks. More particularly, the subject matter described herein relates to methods, systems, and computer readable media for reducing the likelihood of successful DoS attacks by validating OCI scope information against NF profile information obtained using target resource identification information.

BACKGROUND

In 5G telecommunications networks, a network function that provides service is referred to as a producer network function (NF) or NF service producer. A network function that consumes services is referred to as a consumer NF or NF service consumer. A network function can be a producer NF, a consumer NF, or both, depending on whether the network function is consuming, producing, or consuming and producing a service. The terms “producer NF” and “NF service producer” are used interchangeably herein. Similarly, the terms “consumer NF” and “NF service consumer” are used interchangeably herein.

A given producer NF may have many service endpoints, where a service endpoint is the point of contact for one or more NF instances hosted by the producer NF. The service endpoint is identified by a combination of Internet protocol (IP) address and port number or a fully qualified domain name that resolves to an IP address and port number on a network node that hosts a producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include more than one NF instance. It should also be noted that multiple NF instances can share the same service endpoint.

Producer NFs register with a network function repository function (NRF). The NRF maintains service profiles of available NF instances identifying the services supported by each NF instance. The terms “service profiles” and “NF profiles” are used interchangeably herein. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.

In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes with the NRF and obtains reachability and service profile information regarding producer NF service instances. Consumer NFs connect to the SCP, and the SCP load balances traffic among producer NF service instances that provide the required service or directly routes the traffic to the destination producer NF instance.

In addition to the SCP, other examples of intermediate proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include the security edge protection proxy (SEPP), the service gateway, and nodes in the 5G service mesh. The SEPP is the network node used to protect control plane traffic that is exchanged between different 5G public land mobile networks (PLMNs). As such, the SEPP performs message filtering, policing and topology hiding for all application programming interface (API) messages that are transmitted between PLMNs.

One problem in 5G communications networks can occur when a hacker sends overload control information with false overload control information scope to cause peer NFs to stop sending traffic to another NF. Overload control information is transmitted by an NF to a peer NF when the sending NF is overloaded to cause the NF to throttle traffic to the sending NF and allow the sending NF to shed load. The overload control information is communicated in an OCI header, which includes a scope component, the value of which identifies a scope (i.e., the peer network function identity or identities) to which the overload control information pertains. There is no validation of the information in the OCI header to confirm that the sending node is authorized to send the OCI information with the specified scope. Accordingly, there exists a need for improved methods, systems, and computer readable media for validating OCI scope information in a network.

SUMMARY

A method for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information includes steps performed at an NF including at least one processor. The steps include receiving a service based interface (SBI) request message. The steps further include obtaining, from the SBI request message, target resource identification information. The steps further include obtaining, using the target resource identification information, NF profile information and storing the NF profile information in memory of the NF. The steps further include receiving an SBI response message including overload control information and scope information for the overload control information. The steps further include using the stored NF profile information to determine whether the scope information for the overload control information is valid. The steps further include, in response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

According to another aspect of the subject matter described herein, obtaining the target resource identification information includes reading values of one or more components of a 3gpp-Sbi-Target-apiRoot header of the SBI request message.

According to another aspect of the subject matter described herein, reading values of one or more attributes of the 3gpp-Sbi-Target-apiRoot header includes reading values of one or more components that correspond to attributes of an NF profile of a producer NF that hosts a target resource identified by the target resource identification information.

According to another aspect of the subject matter described herein, obtaining the NF profile information includes using the one or more of the values of the components of the 3gpp-Sbi-Target-ApiRoot header to perform a lookup in an NF profiles database and locate the NF profile of the NF that hosts the target resource.

According to another aspect of the subject matter described herein, reading the values of the one or more components of the 3gpp-Sbi-Target-apiRoot header that correspond to attributes of the NF profile of the producer NF that hosts the target resource includes reading the values of one or more of a scheme component, a fully qualified domain name (FQDN) component, a transport layer port component, an apiPrefix component, an apiName component, and an apiVersion component.

According to another aspect of the subject matter described herein, using the NF profile information to determine whether the scope information for the overload control information is valid includes comparing one or more of an NF-Instance ID, an NF-Set ID, an NF-Service-Instance-ID, an NF-Service-Set ID, a single network slice selection assistance information (S-NSSAI), a destination network name (DNN), a Callback uniform resource identifier (URI), and a service communications proxy (SCP) fully qualified domain name (FQDN) with values of corresponding components of a scope component of a 3gpp-Sbi-Oci header.

According to another aspect of the subject matter described herein, using the NF profile information to determine whether the scope information for the overload control information is valid includes determining that the scope information for the overload control information is invalid in response to determining that the NF profile information does not match the scope information for the overload control information.

According to another aspect of the subject matter described herein, using the NF profile information to determine whether the scope information for the overload control information is valid includes determining that the scope information for the overload control information is valid in response to determining that the NF profile information matches the scope information for the overload control information.

According to another aspect of the subject matter described herein, the NF comprises a service communications proxy (SCP).

According to another aspect of the subject matter described herein, the NF comprises a security edge protection proxy (SEPP) or a consumer NF.

According to another aspect of the subject matter described herein, a system for reducing the likelihood of successful denial of service (DoS) attacks by validating overload control information (OCI) scope information against network function (NF) profile information obtained using target resource identification information is provided. The system includes an NF including at least one processor and a memory. The system further includes an olcScope validator for receiving a service based interface (SBI) request message, obtaining, from the SBI request message, target resource identification information, obtaining, using the target resource identification information, NF profile information, storing the NF profile information in the memory, receiving an SBI response message including overload control information and scope information for the overload control information, using the stored NF profile information to determine whether the scope information for the overload control information is valid, and, in response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

According to another aspect of the subject matter described herein, the olcScope validator is configured to obtain the target resource identification information by reading values of one or more components from a 3gpp-Sbi-Target-apiRoot header of the SBI request message.

According to another aspect of the subject matter described herein, the values of the one or more components of the 3gpp-Sbi-Target-apiRoot header comprise values that correspond to attributes of an NF profile of a producer NF that hosts a target resource identified by the target resource identification information.

According to another aspect of the subject matter described herein, the olcScope validator is configured to obtain the NF profile information by performing perform a lookup in an NF profiles database using values of one or more of the values of the attributes of the 3gpp-Sbi-Target-apiRoot header and locate the NF profile of the NF that hosts the target resource.

According to another aspect of the subject matter described herein, the values of the one or more components of the 3gpp-Sbi-Target-apiRoot header that correspond to attributes of the NF profile of the producer NF that hosts the target resource include values of one or more of a scheme component, a fully qualified domain name (FQDN) component, a transport layer port component, an apiPrefix component, an apiName component, and an apiVersion component.

According to another aspect of the subject matter described herein, the olcScope validator is configured to determine whether the scope information for the overload control information is valid by comparing the NF profile information with the scope information for the overload control information.

According to another aspect of the subject matter described herein, the olcScope validator is configured to determine that the scope information for the overload control information is invalid in response to determining that the NF profile information does not match the scope information for the overload control information.

According to another aspect of the subject matter described herein, the olcScope validator is configured to determine that the scope information for the overload control information is valid in response to determining that the NF profile information matches the scope information for the overload control information. According to another aspect of the subject matter described herein, the network function comprises a service communications proxy (SCP), a security edge protection proxy (SEPP), or a consumer NF.

According to another aspect of the subject matter described herein, a non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps is provided. The steps include receiving a service based interface (SBI) request message. The steps further include obtaining, from the SBI request message, target resource identification information. The steps further include obtaining, using the target resource identification information, NF profile information and storing the NF profile information in memory of the NF. The steps further include receiving an SBI response message including overload control information and scope information for the overload control information. The steps further include using the stored NF profile information to determine whether the scope information for the overload control information is valid. The steps further include, in response to determining that the scope information for the overload control information is invalid, rejecting the SBI response message.

DETAILED DESCRIPTION

FIG.1is a block diagram illustrating an exemplary 5G system network architecture. The architecture inFIG.1includes NRF100and SCP101, which may be located in the same home public land mobile network (HPLMN). As described above, NRF100may maintain profiles of available producer NF service instances and their supported services and allow consumer NFs or SCPs to subscribe to and be notified of the registration of new/updated producer NF service instances. SCP101may also support service discovery and selection of producer NF instances. SCP101may perform load balancing of connections between consumer and producer NFs.

NRF100is a repository for NF or service profiles of producer NF instances. In order to communicate with a producer NF instance, a consumer NF or an SCP must obtain the NF or service profile of the producer NF instance from NRF100. The NF or service profile is a JavaScript object notation (JSON) data structure defined in Third Generation Partnership Project (3GPP) Technical Specification (TS) 29.510. The NF or service profile definition includes at least one of a fully qualified domain name (FQDN), an Internet protocol (IP) version 4 (IPv4) address or an IP version 6 (IPv6) address.

InFIG.1, any of the network functions can be consumer NFs producer NFs, or both, depending on whether they are requesting, providing, or requesting and providing services. In the illustrated example, the NFs include a policy control function (PCF)102that performs policy related operations in a network, a unified data management (UDM) function104that manages user data, and an application function (AF)106that provides application services.

The NFs illustrated inFIG.1further include a session management function (SMF)108that manages sessions between access and mobility management function (AMF)110and PCF102. AMF110performs mobility management operations similar to those performed by a mobility management entity (MME) in 4G networks. An authentication server function (AUSF)112performs authentication services for user equipment (UEs), such as user equipment (UE)114, seeking access to the network.

A network slice selection function (NSSF)116provides network slicing services for devices seeking to access specific network capabilities and characteristics associated with a network slice. A network exposure function (NEF)118provides application programming interfaces (APIs) for application functions seeking to obtain information about Internet of things (IoT) devices and other UEs attached to the network. NEF118performs similar functions to the service capability exposure function (SCEF) in 4G networks.

A radio access network (RAN)120connects user equipment (UE)114to the network via a wireless link. Radio access network120may be accessed using a g-Node B (gNB) (not shown inFIG.1) or other wireless access point. A user plane function (UPF)122can support various proxy functionality for user plane services. One example of such proxy functionality is multipath transmission control protocol (MPTCP) proxy functionality. UPF122may also support performance measurement functionality, which may be used by UE114to obtain network performance measurements. Also illustrated inFIG.1is a data network (DN)124through which UEs access data network services, such as Internet services.

SEPP126filters incoming traffic from another PLMN and performs topology hiding for traffic exiting the home PLMN. SEPP126may communicate with an SEPP in a foreign PLMN which manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and the other for the foreign PLMN.

As stated above, one problem that can occur in 5G network is a DoS attack initiated by a hacker using false OCI information. 3GPP standards recommend overload control using an OCI header. When an NF service producer or consumer reaches an implementation-dependent overload threshold, the NF service producer or consumer conveys the OCI to its peer entity (consumer or producer, respectively). Based on the received OCI, the peer adjusts the signaling it sends to the overloaded entity according to the OCI. One issue with the OCI communication is that there is no validation if the OCI is from authorized entity. A hacker NF can send indication of overload for another NF, NF set, NF service, NF service set, S-NSSAI, DNN, callback URI, etc. Conveying false OCI information to an SBI message sender will shut the entity falsely identified by the OCI information out of the network. There is a need to make sure that the OCI header is not misused by a hacker and that only an authorized NF is able to indicate overload information in the OCI header for a given scope. The subject matter described herein includes a process by which an NF, such as an SCP, can mitigate this issue by performing validation that the peer entity sending the information in the OCI header is authorized to send the OCI header with the scope specified in the OCI header.

Table 1 shown below illustrates exemplary 3GPP terminology that will be used in describing the subject matter described herein.

TABLE 13GPP TerminologyTermDefinitionNF InstanceAn identifiable instance of the NF. AnNF Instance may provide servicesoffered by one or more NF serviceinstances.NF ServiceAn identifiable instance of the NFInstanceservice.NF ServiceA group of interchangeable NF serviceSetinstances of the same service typewithin an NF instance. The NF serviceinstances in the same NF service sethave access to the same context data.NF SetA group of interchangeable NFinstances of the same type, supportingthe same services and the samenetwork slice(s). The NF instances inthe same NF set may begeographically distributed but haveaccess to the same context data.S-NSSAISingle network slice selectionassistance information.DNNData network name.
In Table 1, the terms in the left-hand column are the names of parameters that can be specified in the OlcScope component of the OCI header. For example, an OlcScope that specifies an NF set is communicating overload control information for an entire NF set. If such a parameter is falsified, the OCI information could cause the receiving NF to cease communications with all NF instances in the NF set.

Section 6.4 of 3GPP TS 29.500 recommends overload control using the OCI header. Overload control is a reactive mechanism to let the peer NF know to shed load when the sending NF is in an overloaded state. Section 5.2.3.2.9 of 3GPP TS 29.500 explains the OCI header. One mandatory component of the OCI header that is of interest to the subject matter described herein is the olcScope, the value of which can specify NF producer scope, NF consumer scope, or SCP scope. Each of the NF producer scope, NF consumer scope, and SCP scope is replaced by sub-parameters in the actual OCI header. For example, each of NF consumer, NF producer, and NF SCP scopes can be specified using the following sub-parameters:

From the specification above, each of the defined NF service consumer and NF service producer scopes can identify an NF instance, an NF service instance, an NF set, or an NF service set. The SCP scope parameter can specify an FQDN. An S-NSSAI can also be specified in the olcScope. Any of these parameters can be used to identify the corresponding entity as overloaded.

The following are three of the examples of olcScope specified in Section 5.2.3.2.9 of 3GPP TS 29.500:

Example 1: Overload Control Information for an NF Instance

Example 2: Overload Control Information for an NF Service Set

Example 3: Overload Control Information for an SMF Instance Related to a Particular DNN of an S-NSSAI

In Example 1, 54804518-4191-46b3-955c-ac631f953ed8 is the value of the olcScope component that identifies the NF instance to which the overload control information applies. In Example 2, setxyz.snnsmf-pdusession.nfi54804518-4191-46b3-955c-ac631f953ed8.5gc.mnc012.mcc345 is the value of the olcScope component that identifies the NF service set to which the overload control information applies. In Example 3, internet.mnc012.mcc345.gprs is the value of the olcScope component that identifies the DNN to which the overload control information applies.

Table 2 shown below illustrates examples of olcScope defined in Section 6.4.3.4.5 of 3GPP TS 29.500.

TABLE 2OlcScope Parameters Defined in 3GPP TS 29.500ScopeOlcScope (i.e., OCIParameterapplies to)CommentsNF instanceAll services of the NFSupported by producer,instance identified by theconsumerNF Instance ID.NF setAll services of all NFSupported by producer,instances of the NF setconsumeridentified by the NF SetID.NF serviceThe service instanceSupported by producer,instanceidentified by the NFconsumerService Instance ID.NF serviceAll service instances ofSupported by producer,setthe NF service setconsumeridentified by the NFservice set ID.S-NSSAIThe network sliceAdditional scope foridentified by the NSSAI.SMF ProducerDNNThe destination networkAdditional scope foridentified by the DNN.SMF ProducerCallbackCallback URI of the NFSupported by consumerURIservice consumerSCP FQDNThe SCP identified bySupported by SCPthe FQDN

Another header defined in 3GPP TS 29.500 is the 3gpp-Sbi-Target-apiRoot header. According to Section 6.10.2.5 of 3GPP TS 29.500, for indirect communications with or without delegated discovery, the HTTP client shall include a 3gpp-Sbi-Target-apiRoot header set to the apiRoot of an authority server for the target resource, if available, in requests it sends to the SCP. In particular the client will include the 3gpp-Sbi-Target-apiRoot header in SBI requests transmitted using indirect communications without delegated discovery, after a resource has been created, in subsequent service requests sent to the SCP, and in notifications or callbacks sent via the SCP.

An SCP will also include a 3gpp-Sbi-Target-apiRoot header set to the apiRoot of an authority server for the target resource, if available, in requests it sends to the next hop SCP. The point to highlight is that the SCP can either find the target resource itself or deduce the target resource from the 3gpp-Sbi-Target-apiRoot header.

As will be described in detail below, the 3gpp-Sbi-Target-apiRoot header includes components that correspond to one or more attributes of the NF profile of the producer NF on which the target resource exists. The components of the 3gpp-Sbi-Target-apiRoot header that are common to the NF profile of the producer NF on which the target resource exists can be used to validate scope specified in the 3gpp-Sbi-Oci header.FIG.2is a block diagram illustrating exemplary parameters of an NF profile that can be used to validate scope information contained in the 3gpp-Sbi-Oci header. InFIG.2, the NF profile includes an smfinfo attribute, which includes details of the destination network name (DNN) and single network slice selection assistance information (S-NSSAI) of the session management function (SMF). If the target resource identified by the 3gpp-Sbi-Target-apiRoot header is an SMF, the 3gpp-Sbi-Target-apiRoot header may be used to obtain the NF profile for the SMF, and the smfInfo attribute of the NF profile may be compared with the DNN and S-NSSAI in the scope component of the 3gpp-Sbi-Oci header.

Another NF profile attribute that may be used to validate the scope of component of the 3gpp-Sbi-Oci header is the defaultNoficationSubscriptions attribute, which contains the callback URI. The 3gpp-Sbi-Target-apiRoot header may be used to obtain the NF profile of the target resource, the callback URI may be read from the defaultNotificationSubscriptions attribute of the NF profile, and the callback URI obtained from the NF profile may be compared with the callback URI obtained from the scope component of the 3gpp-Sbi-Oci header. If the attribute values match, the OCI may be determined to be valid. If the attribute values do not match, the OCI may be determined to be invalid.

Other components of the OCI scope that can be compared with NF profile attributes obtained using the 3gpp-Sbi-Target-apiRoot header include the NF-Instance ID, the NF-Set ID, the NF-Service-Instance-ID, and NF-Service-SetID. Any one or more of the NF profile attributes listed in the table with the heading “OCI Scope” inFIG.2may be compared with corresponding attribute values from the scope component of the 3gpp-Sbi-Oci header to validate the OCI.

FIG.3is a message flow diagram illustrating exemplary messages exchanged between a consumer NF, a producer NF, an SCP, and a hacker, where the hacker uses OCI to launch a denial of service attack. Referring toFIG.3, in line1, a consumer NF300sends an SBI request message to SCP101. In line2, SCP101forwards the SBI request message to producer NF302. In line3, producer NF302sends an SBI response message to SCP101. In line4, SCP101forwards the SBI response message to consumer NF300. The communications model illustrated in lines1-4is called the indirect communications model because communications between consumer NF300and producer NF302occur via SCP101.

In line5, consumer NF300sends an SBI request message to SCP101. In line6, SCP101forwards the SBI request message to hacker304. In this example, hacker304may be a producer NF or a node impersonating a producer NF that provides service in the network. In line7of the message flow diagram, hacker304sends an SBI response to SCP101. The SBI response includes a 3gpp-Sbi-Oci header that identifies producer NF302in its scope component, indicating that producer NF302is overloaded. In line8, SCP101sends an SBI response message to consumer NF300with the 3gpp-Sbi-Oci header identifying producer NF302has being overloaded. Consumer NF300, in response to receiving the SBI response with the 3gpp-Sbi-Oci header indicating that producer NF302is overloaded, will cease communicating with producer NF302. If producer NF302provides essential services in the network and is the only provider of such services, a network outage may occur. For example, if producer NF302is the only AMF providing access and mobility management services in the network and is rendered unavailable to consumer NF300based on the OCI sent by hacker304, UEs seeking to access the network may be unable to do so.

To avoid or reduce the likelihood of a successful DoS attack, such as that illustrated inFIG.3, the SCP or other NF described herein may use information from an SBI request message to obtain NF profile information that identifies the SBI producer that is the target of the SBI request and may use the stored information to validate scope information in the OCI header received in an SBI response.FIG.4is a message flow diagram illustrating exemplary messages exchanged when the SCP uses NF profile information obtained using target resource identification information from an SBI request to validate scope information in an OCI header of an SBI response. Referring toFIG.4, in line1, consumer NF300sends an SBI request message to SCP101. In line2, SCP101forwards the SBI request message to producer NF302. In line3, producer NF302sends an SBI response message to SCP101. In line4, SCP101forwards the SBI response message to consumer NF300.

In line5, consumer NF300sends an SBI request message to SCP101. SCP101stores peer identity information from the SBI request. In this case, the peer identity information is one or more NF profile attributes of hacker304determined from the 3gpp-Sbi-Target-apiRoot header of the SBI request message. In line6, SCP101forwards the SBI request message to hacker304. In line7of the message flow diagram, hacker304sends an SBI response to SCP101. The SBI response includes a 3gpp-Sbi-Oci header that identifies producer NF302in its scope component, indicating that producer NF302is overloaded. Rather than forwarding the SBI response message to consumer NF300, SCP101validates the entity identified in the olcScope component of the 3gpp-Sbi-Oci header against NF profile information obtained or determined from the 3gpp-Sbi-Target-apiRoot header of the SBI request. In this example, the stored NF profile information determined from the 3gpp-Sbi-Target-apiRoot header is an identity of hacker304. However, the peer identity from the OlcScope parameter identifies producer NF302. Because the identities do not match, SCP101rejects the SBI response message because hacker304is not authorized to send OCI information for the scope specified in the 3gpp-Sbi-Oci header. Because SCP101rejects the SBI request response message with unauthorized OlcScope, the likelihood of a successful DoS attack on producer NF302is reduced.

FIG.5is a block diagram illustrating exemplary mappings between NF profile attributes and 3gpp-Sbi-Target-apiRoot header components. The SCP may utilize any one of more of the components from the 3gpp-Sbi-Target-apiRoot header to identify the NF profile of the target resource and obtain the parameters illustrated inFIG.2to validate overload control information scope. For example, SCP101may use values of one or more of scheme, FQDN, port, apiPrefix, apiName, and apiVersion from the 3gpp-Sbi-Target-apiRoot header to perform a lookup in an NF profiles database and obtain the NF profile of the NF on which the target resource reside. The SCP may then read the NF profile attributes illustrated inFIG.2, compare these attributes to values of corresponding attributes from the scope component of the 3gpp-Sbi-Target-apiRoot header, and determine, based on results of the comparison, whether the OCI is valid.FIG.6is a block diagram illustrating an exemplary architecture of an NF, such as an SCP, SEPP, or other NF, for validating olcScope information in SBI response messages. Referring toFIG.6, NF600includes at least one processor602and a memory604. SCP101further includes an olcScope validator606for receiving SBI request messages, obtaining, from the SBI request messages, target resource identification information, using the target resource identification information to obtain NF profile information from an NF profiles database608, which may be in memory604, and using the NF profile information to validate olcScope information transmitted in SBI response messages. In an alternate implementation, olcScope validator606may query an NF profiles database external to NF600to obtain the NF profile information. olcScope validator606may be implemented using computer executable instructions stored in memory604and executed by processor602.

FIG.7is a flow chart illustrating an exemplary process performed by an NF in validating olcScope information against peer NF identity information. Referring toFIG.7, in step700, the process includes receiving, at the NF, an SBI request message. For example, in an indirect communications model, NF600, which may be an SCP or SEPP, may receive an SBI request message from a consumer NF for forwarding to a producer NF.

In step702, the process includes obtaining, from the SBI request message, target resource identification information. For example, NF600may read values of one or more components the 3gpp-Sbi-Target-apiRoot header of the SBI request message. Examples of such components are illustrated inFIG.5.

In step704, NF600obtains, using the target resource identification information, NF profile information and stores the NF profile information in memory. For example, NF600may utilize one or more of the attribute values from the 3gpp-Sbi-Target-apiRoot header to obtain the NF profile of the NF on which the target resource resides, read attribute values from the NF profile that correspond to any of the OCI scope attributes illustrated in the table inFIG.2, and store the values of the NF profile attributes in memory.

In step706, the process includes receiving an SBI response message including a 3gpp-Sbi-Oci header including olcScope information. For example, NF600may receive an SBI response message from a legitimate producer NF or from a hacker and including a 3gpp-Sbi-Oci header. The header may include an olcScope component.

In steps708and710, the process includes determining whether the olcScope information is valid using the NF profile information. For example, NF600may read one or more values from the olcScope component of the 3gpp-Sbi-Oci header and compare the values read from the olcScope component to one or more stored components of the NF profile obtained using the 3gpp-Sbi-Target-apiRoot header.

In step710, if the olcScope is determined not to be valid, i.e., if the olcScope information doesn't match the stored NF profile information, control proceeds to step712where the SBI response is rejected. If the olcScope information is determined to be valid, i.e., if the olcScope information matches the stored NF profile information, control proceeds to step714where the SCP forwards the SBI response to the consumer NF that sent the corresponding SBI request. It should be noted that the forwarding in step714is implemented if the node performing the olcScope validation is an SCP or an SEPP. If the node performing the validation is a consumer NF, step714may include processing, rather than forwarding, the SBI response.

Advantages of the subject matter described herein include reducing the likelihood of a successful denial of service attack implemented by spoofing the 3gpp-Sbi-Oci header or other similar headers. The subject matter described herein is extensible to other headers similar to the 3gpp-Sbi-Oci header. The subject matter described herein is applicable to both inter-public land mobile network (PLMN) and intra-PLMN signaling. The subject matter described herein can be implemented at the SCP or at other NFs, such as an SEPP or a consumer NF to validate olcScope.

The disclosure of each of the following references is hereby incorporated herein by reference in its entirety.

REFERENCES

Technical Specification Group Services and System Aspects; System Architecture for the 5G System (5GS), Stage 2; (Release 17).3. 3GPP TS 29.510 V17.2.0 (2021-06), 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System;