Methods, systems, and computer readable media for mitigating 5g roaming spoofing attacks
AssigneeOracle International Corporation
InventorsJay Rajput, Shashikiran Bhalachandra Mahalank
Life of this patent
Estimating the term…
Abstract
Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.
Claims20
A method for mitigating 5G roaming spoofing attacks, the method comprising:
- obtaining, by a security edge protection proxy (SEPP) and from a transport layer security (TLS) message from a first node, a first identifier for the first node;
- obtaining, by the SEPP and from an N32-c security capability negotiation message from the first node, a second identifier for the first node;
- comparing the first and second identifiers for the first node;
- determining that first and second identifiers do not match and, in response, that second identifier for the first node is invalid;
- and
- in response to determining that the second identifier for the first node is invalid, blocking inter-public land mobile network (PLMN) communications with the first node.
A system for mitigating 5G roaming spoofing attacks, the system comprising:
- a security edge protection proxy (SEPP) including at least one processor and a memory;
- and
- a 5G roaming spoofing attack mitigation module implemented by the at least one processor and configured to:
- obtain, from a transport layer security (TLS) message from a first node, a first identifier for the first node;
- obtain, from an N32-c security capability negotiation message from the first node, a second identifier for the first node;
- compare the first and second identifiers for the first node;
- determine that first and second identifiers do not match and, in response, that second identifier for the first node is invalid;
- and
- in response to determining that the second identifier for the first node is invalid, block inter-public land mobile network (PLMN) communications with the first node.
A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
- obtaining, by a security edge protection proxy (SEPP) and from a transport layer security (TLS) message from a first node, a first identifier for the first node;
- obtaining, by the SEPP and from an N32-c security capability negotiation message from the first node, a second identifier for the first node;
- comparing the first and second identifiers for the first node;
- determining that first and second identifiers do not match and, in response, that second identifier for the first node is invalid;
- and
- in response to determining that the second identifier for the first node is invalid, blocking inter-public land mobile network (PLMN) communications with the first node.
Dependencies are inferred from the claim text.