# US 12,114,165 B2 · Methods and systems for mitigating denial of service (DOS) attack in a wireless network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,114,165 B2
- Document ID: US12114165B2
- Status: Granted
- Kind: B2
- Application number: 18/353,752
- Filed: 2023-07-17
- Published: 2023-11-09
- Granted: 2024-10-08
- Earliest claimed: 2019-02-27
- Assignees: Samsung Electronics Co., Ltd.
- Applicants: Samsung Electronics Co., Ltd.
- Inventors: Narendranath Durga Tangudu; Rajavelsamy Rajadurai
- Web page: https://patentgrep.com/patent/US12114165B2

## CPC

- H04W 12/06: Authentication
- H04W 12/122: Counter-measures against attacks; Protection against rogue devices
- H04L 63/1458: {Denial of Service}
- H04W 8/06: Registration at serving network Location Register, VLR or user mobility server
- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- H04W 12/08: Access security
- H04B 7/0413: MIMO systems
- H04L 2463/141: Denial of service attacks against endpoints in a network
- H04W 84/042: {Public Land Mobile systems, e.g. cellular systems}
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04B: TRANSMISSION

## Abstract

The present disclosure relates to a pre-5th-Generation (5G) or 5G communication system to be provided for supporting higher data rates Beyond 4th-Generation (4G) communication system such as Long Term Evolution. Methods and systems for mitigating Denial of Service (DOS) attacks in wireless networks, by performing admission control by verifying a User Equipment's (UE's) registration request via a Closed Access Group (CAG) cell without performing a primary authentication are provided. Embodiments herein disclose methods and system for verifying permissions of the UE to access a CAG cell based on the UE's Subscription identifier, before performing the primary authentication. The method for mitigating DOS attacks in wireless networks includes requesting a public land mobile network for accessing a non-public network (NPN) through a CAG cell, verifying the permissions of a UE to access the requested NPN through the CAG cell, and performing a primary authentication.

## Claims

### Claim 1

A method performed by a security anchor function (SEAF), the method comprising:
receiving, from a user equipment (UE) via a base station, a registration request message including a subscription concealed identifier (SUCI) of the UE;
receiving, from the base station, a closed access group (CAG) identifier of a CAG cell via an access and mobility function (AMF);
transmitting, to a unified data management (UDM) via an authentication server function (AUSF), a request message including:
the SUCI of the UE, and
the CAG identifier of the CAG cell;
in case that the UE is not allowed to access the CAG Cell, receiving, from the UDM via the AUSF, a reject message for indicating a rejection of the CAG Cell; and
in case that the UE is allowed to access the CAG Cell, performing an authentication procedure of the UE.

### Claim 2 (depends on 1)

The method of claim 1, wherein the SUCI is used to obtain a subscription permanent identifier (SUPI) of the UE for verifying if the UE is allowed to access the CAG cell or not in the UDM.

### Claim 3 (depends on 1)

The method of claim 1, wherein the authentication procedure is performed by using an authentication vector generated by the UDM.

### Claim 4 (depends on 1)

The method of claim 1, wherein an authentication method for the authentication procedure is selected by the UDM.

### Claim 5 (depends on 1)

The method of claim 1, wherein the request message further includes a serving network (SN) name.

### Claim 6

A method performed by a user equipment (UE), the method comprising:
transmitting, to a security anchor function (SEAF) entity via a base station, a registration request to access a closed access group (CAG) Cell, the registration request includes a subscription concealed identifier (SUCI) of the UE, wherein the SEAF is associated with an access and mobility function (AMF) which receives a CAG identifier of the CAG Cell from a base station;
in case that the UE is not allowed to access the CAG Cell, receiving, from a unified data management (UDM) via an authentication server function (AUSF) and the SEAF entity, a reject message for indicating a rejection of the CAG Cell; and
in case that the UE is allowed to access the CAG Cell, performing an authentication procedure between a network and the UE, the authentication procedure using an authentication vector.

### Claim 7 (depends on 6)

The method of claim 6, wherein the SUCI is used to obtain a subscription permanent identifier (SUPI) of the UE for verifying if the UE is allowed to access the CAG cell or not in the UDM.

### Claim 8 (depends on 6)

The method of claim 6, wherein the authentication vector is generated by the UDM.

### Claim 9 (depends on 6)

The method of claim 6, wherein an authentication method for the authentication procedure is selected by the UDM.

### Claim 10

An apparatus of a security anchor function (SEAF), comprising:
at least one transceiver; and
at least one processor operably coupled to the at least one transceiver, configured to:
receive, from a user equipment (UE) via a base station, a registration request message including a subscription concealed identifier (SUCI) of the UE;
receive, from the base station, a closed access group (CAG) identifier of a CAG cell via an access and mobility function (AMF);
transmit, to a unified data management (UDM) via an authentication server function (AUSF), a request message including:
the SUCI of the UE, and
the CAG identifier of the CAG cell;
in case that the UE is not allowed to access the CAG Cell, receive, from the UDM via the AUSF, a reject message for indicating a rejection of the CAG Cell; and
in case that the UE is allowed to access the CAG Cell, perform an authentication procedure of the UE.

### Claim 11 (depends on 10)

The apparatus of claim 10, wherein the SUCI is used to obtain a subscription permanent identifier (SUPI) of the UE for verifying if the UE is allowed to access the CAG cell or not in the UDM.

### Claim 12 (depends on 10)

The apparatus of claim 10, wherein the authentication procedure is performed by using an authentication vector generated by the UDM.

### Claim 13 (depends on 10)

The apparatus of claim 10, wherein an authentication method for the authentication procedure is selected by the UDM.

### Claim 14 (depends on 10)

The apparatus of claim 10, wherein the request message further includes a serving network (SN) name.

### Claim 15

A user equipment (UE), comprising:
at least one transceiver; and
at least one processor operably coupled to the at least one transceiver, configured to:
transmit, to a security anchor function (SEAF) entity via a base station, a registration request to access a closed access group (CAG) Cell, the registration request includes a subscription concealed identifier (SUCI) of the UE, wherein the SEAF is associated with an access and mobility function (AMF) which receives a CAG identifier of the CAG Cell from a base station;
in case that the UE is not allowed to access the CAG Cell, receive, from a unified data management (UDM) via an authentication server function (AUSF) and the SEAF entity, a reject message for indicating a rejection of the CAG Cell; and
in case that the UE is allowed to access the CAG Cell, perform an authentication procedure between a network and the UE, the authentication procedure using an authentication vector.

### Claim 16 (depends on 15)

The UE of claim 15, wherein the SUCI is used to obtain a subscription permanent identifier (SUPI) of the UE for verifying if the UE is allowed to access the CAG cell or not in the UDM.

### Claim 17 (depends on 15)

The UE of claim 15, wherein the authentication vector is generated by the UDM.

### Claim 18 (depends on 15)

The UE of claim 15, wherein an authentication method for the authentication procedure is selected by the UDM.