Methods, systems, and computer readable media for mitigating network function (NF) update and deregister attacks

A method for mitigating network function (NF) update and deregister attacks, the method comprising:

• at an NF repository function (NRF) implemented by at least one processor:
• receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile;
• storing the hash of the first authentication string;
• registering the NF by storing the NF profile in an NF profile database;
• receiving a first NFDeregister request including the NF instance identifier;
• and
• using the stored hash of the first authentication string to validate or reject the first NFDeregister request, wherein receiving the first NFDeregister request includes receiving the first NFDeregister request including an authentication string that is different from the first authentication string and wherein using the stored hash of the first authentication string to validate or reject the first NFDeregister request includes computing a hash of the authentication string from the first NFDeregister request, comparing the hash of the authentication string from the first NFDeregister request to the stored hash of the first authentication string, determining that the hash of the authentication string from the first NFDeregister request does not match the stored hash of the first authentication string, and, in response, rejecting the first NFDeregister request.

A method for mitigating network function (NF) update and deregister attacks, the method comprising:

• at a network function including at least one processor:
• generating an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile;
• transmitting the NFRegister request to an NF repository function (NRF);
• receiving, from the NRF, confirmation of registration of the NF profile with the NRF;
• generating a first NFUpdate request;
• including, in the first NFUpdate request, the NF instance identifier, the first authentication string, and a hash of a second authentication string;
• transmitting the first NFUpdate request to the NRF;
• receiving, from the NRF, confirmation of successful processing of the first NFUpdate request;
• and
• generating a second NFUpdate request, including, in the second NFUpdate request, the second authentication string, and transmitting the second NFUpdate request to the NRF.

A system for mitigating network function (NF) update and deregister attacks, the system comprising:

• an NF repository function (NRF) including at least one processor and a memory;
• and
• an NFUpdate/NFDeregister operation validator implemented by the at least one processor for receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile, storing the hash of the first authentication string, registering the NF by storing the NF profile in an NF profile database, receiving a first NFUpdate request including the NF instance identifier;
• and using the stored hash of the first authentication string to validate or reject the first NFUpdate request, wherein receiving the first NFUpdate request includes receiving the first NFUpdate request including an authentication string and wherein using the stored hash of the first authentication string to validate or reject the first NFUpdate request includes computing a hash of the authentication string from the first NFUpdate request, comparing the hash of the authentication string from the first NFUpdate request to the stored hash of the first authentication string, determining that the hash of the authentication string from the first NFUpdate request matches the stored hash of the first authentication string, and, in response, validating the first NFUpdate request.

A system for mitigating network function (NF) update and deregister attacks, the system comprising:

• an NF repository function (NRF) including at least one processor and a memory;
• and
• an NFUpdate/NFDeregister operation validator implemented by the at least one processor for receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile, storing the hash of the first authentication string, registering the NF by storing the NF profile in an NF profile database, receiving a first NFDeregister request including the NF instance identifier, and using the stored hash of the first authentication string to validate or reject the first NFDeregister request, wherein receiving the first NFDeregister request includes receiving the first NFDeregister request including an authentication string that is different from the first authentication string and wherein using the stored hash of the first authentication string to validate or reject the first NFDeregister request includes computing a hash of the authentication string from the first NFDeregister request, comparing the hash of the authentication string from the first NFDeregister request to the stored hash of the first authentication string, determining that the hash of the authentication string from the first NFDeregister request does not match the stored hash of the first authentication string, and, in response, rejecting the first NFDeregister request.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

• at a network function (NF) repository function (NRF) implemented by at least one processor:
• receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile;
• storing the hash of the first authentication string;
• registering the NF by storing the NF profile in an NF profile database;
• receiving a first NFUpdate request including the NF instance identifier;
• and
• using the stored hash of the first authentication string to validate or reject the first NFUpdate request, wherein receiving the first NFUpdate request includes receiving the first NFUpdate request including an authentication string and wherein using the stored hash of the first authentication string to validate or reject the first NFUpdate request includes computing a hash of the authentication string from the first NFUpdate request, comparing the hash of the authentication string from the first NFUpdate request to the stored hash of the first authentication string, determining that the hash of the authentication string from the first NFUpdate request matches the stored hash of the first authentication string, and, in response, validating the first NFUpdate request.