TREA

Methods, systems, and computer readable media for mitigating 5G roaming security attacks using security edge protection proxy (SEPP)

Follow

Information

  • Patent Grant
  • 11553342
  • Patent Number
    11,553,342
  • Date Filed
    Tuesday, July 14, 2020
    3 years ago
  • Date Issued
    Tuesday, January 10, 2023
    a year ago
Information
Abstract
A method for mitigating a 5G roaming attack using a security edge protection proxy (SEPP), includes receiving, at an SEPP, user equipment (UE) registration messages for outbound roaming subscribers. The method further includes creating, in a SEPP security database, UE roaming registration records derived from UE registration messages. The method further includes receiving, at the SEPP, a packet data unit (PDU) session establishment request message. The method further includes performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record. The method further includes determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.
Description
TECHNICAL FIELD

The subject matter described herein relates to mitigating 5G roaming security attacks. More particularly, the subject matter described herein relates to methods, systems, and computer readable media for mitigating 5G roaming security attacks using an SEPP.


BACKGROUND

In 5G telecommunications networks, the network node that provides service is referred to as a producer network function (NF). A network node that consumes services is referred to as a consumer NF. A network function can be both a producer NF and a consumer NF depending on whether it is consuming or providing service.


A given producer NF may have many service endpoints, where a service endpoint is a combination of Internet protocol (IP) address and port number on a network node that hosts a producer NF. Producer NFs register with a network function repository function (NRF). The NRF maintains an NF profile of available NF instances and their supported services. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.


In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes with the NRF and obtains reachability and service profile information regarding producer NF service instances. Consumer NFs connect to the service communications proxy, and the service communication proxy load balances traffic among producer NF service instances that provide the required service or directly routes the traffic to the destination producer NF.


In addition to the SCP, other examples of intermediate proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include the security edge protection proxy (SEPP), the service gateway, and nodes in the 5G service mesh. The SEPP is the network node used to protect control plane traffic that is exchanged between different 5G public land mobile networks (PLMNs). As such, the SEPP performs message filtering, policing and topology hiding for all application programming interface (API) messages.


The service gateway is a node that sits in front of a group of producer NFs that provide a given service. The service gateway may load balance incoming service requests among the producer NF that provide the service in a manner similar to the SCP.


The service mesh is a name for a group of intermediate proxy nodes that enable communications between producer and consumer NFs. The service mesh may include one or more SCPs, SEPPs, and service gateways.


One problem with the existing Third Generation Partnership Project (3GPP) service architecture is that modes in the 5G network are subject to denial of service (DoS) attacks for messaging concerning outbound roaming subscribers. An outbound roaming subscriber is a subscriber of an operator's network that is roaming in a visited network. Normal messaging for legitimate outbound roaming subscribers involves authentication, signaling for authenticating the subscriber, followed by registration signaling for registering the subscriber to operate in the visited network. When the subscriber attempts to establish a packet data unit (PDU) session, PDU session establishment signaling is routed to the unified data management (UDM) function in the home network for authorization.


One problem with this architecture is that the home network does not authenticate PDU session establishment requests before forwarding the requests to the unified data management function and the home network. An attacker can repeatedly send fake PDU session establishment requests and overwhelm the UDM in the home network.


Accordingly, in light of these difficulties there exists a need for methods, systems, and computer readable media for mitigating 5G roaming security attacks using an SEPP.


SUMMARY

A method for mitigating a 5G roaming attack using a security edge protection proxy (SEPP), includes receiving, at an SEPP, user equipment (UE) registration messages for outbound roaming subscribers. The method further includes creating, in a SEPP security database, UE roaming registration records derived from UE registration messages. The method further includes receiving, at the SEPP, a packet data unit (PDU) session establishment request message. The method further includes performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record. The method further includes determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.


According to another aspect of the subject matter described herein, receiving the UE registration messages for the outbound roaming subscribers includes receiving Nudm_UECM_Registration messages from access management functions (AMFs) and session management functions (SMFs) serving the outbound roaming subscribers.


According to yet another aspect of the subject matter described herein, creating records in the SEPP security database includes creating records that each include a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type.


According to yet another aspect of the subject matter described herein, receiving a PDU session establishment request message includes receiving a PDU session establishment request message including a SUPI or SUCI, an PLMN ID, and an access type.


According to yet another aspect of the subject matter described herein, performing the lookup in the SEPP security database include performing the lookup using the SUPI or SUCI from the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the method for mitigating 5G roaming security attacks for outbound mobile subscribers includes failing to locate a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, where determining whether to allow or reject the PDU session establishment request message includes determining to reject the PDU session establishment request message, and further comprising rejecting the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the method for mitigating 5G roaming security attacks for outbound mobile subscribers includes locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID or an access type in the record does not match the PLMN ID or the access type in the PDU session establishment request message, where determining whether to allow or reject the PDU session establishment request message includes determining to reject the PDU session establishment request message, and the method for mitigating 5G roaming securing attacks further includes rejecting the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, rejecting the PDU session establishment request message includes discarding the PDU session establishment request message and sending a PDU session establishment error response.


According to yet another aspect of the subject matter described herein, the method for mitigating 5G roaming security attacks for outbound mobile subscribers includes locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID and an access type in the record matches the PLMN ID and the access type in the PDU session establishment request message, where determining whether to allow or reject the PDU session establishment request message includes determining to allow the PDU session establishment request message, and the method for mitigating 5G roaming security attacks further includes allowing the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the method for mitigating 5G roaming security attacks for outbound mobile subscribers includes allowing the PDU session establishment request message by forwarding the PDU session establishment request message from the SEPP to a home session management function (hSMF).


According to another aspect of the subject matter described herein, a system for mitigating a 5G roaming attack includes a security edge protection proxy (SEPP) including at least one processor and a memory. The system further includes an SEPP security database implemented in the memory. The system further includes an SEPP roaming security controller implemented by the at least one processor for receiving user equipment (UE) registration messages for outbound roaming subscribers, creating, in the SEPP security database, UE roaming registration records derived from UE registration messages, receiving a packet data unit (PDU) session establishment request, performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record, and determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to receive Nudm_UECM_Registration messages from access and mobility management functions (AMFs) and session management functions (SMFs) serving the outbound roaming subscribers.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to create the records in the SEPP security database where each includes a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type.


According to yet another aspect of the subject matter described herein, the PDU session establishment request message includes a SUPI or SUCI, an PLMN ID, and an access type.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to perform the lookup in the SEPP security database using the SUPI or SUCI from the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to, in response to failing to locate a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, reject the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to, in response to locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database and determining that a PLMN ID or an access type in the record does not match the PLMN ID or the access type in the PDU session establishment request message, reject the PDU session establishment request message.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to reject the PDU session establishment request message by discarding the PDU session establishment request message and sending a PDU session establishment error response.


According to yet another aspect of the subject matter described herein, the SEPP roaming security controller is configured to, in response to locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID and an access type in the record does match the PLMN ID and the access type in the PDU session establishment request message, allow the PDU session establishment request message, wherein allowing the PDU session establishment request message includes forwarding the PDU session establishment request message from the SEPP to a home session management function (SMF).


According to yet another aspect of the subject matter described herein, a non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps is described. The steps include, receiving, at a security edge protection proxy (SEPP), user equipment (UE) registration messages for outbound roaming subscribers. The steps further include creating, in a SEPP security database, UE roaming registration records derived from UE registration messages. The steps further include receiving, at the SEPP, a packet data unit (PDU) session establishment request message. The steps further include performing, using at least one parameter value extracted from the PDU session establishment request, a lookup in the SEPP security database for a UE roaming registration record. The steps further include determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.


The subject matter described herein may be implemented in hardware, software, firmware, or any combination thereof. As such, the terms “function” “node” or “module” as used herein refer to hardware, which may also include software and/or firmware components, for implementing the feature being described. In one exemplary implementation, the subject matter described herein may be implemented using a computer readable medium having stored thereon computer executable instructions that when executed by the processor of a computer control the computer to perform steps. Exemplary computer readable media suitable for implementing the subject matter described herein include non-transitory computer-readable media, such as disk memory devices, chip memory devices, programmable logic devices, and application specific integrated circuits. In addition, a computer readable medium that implements the subject matter described herein may be located on a single device or computing platform or may be distributed across multiple devices or computing platforms.





BRIEF DESCRIPTION OF THE DRAWINGS

The subject matter described herein will now be explained with reference to the accompanying drawings of which:



FIG. 1 is a network diagram illustrating an exemplary 5G network architecture;



FIG. 2 is a flow diagram illustrating UDM registration for an outbound roaming subscriber;



FIG. 3 is a call flow diagram illustrating PDU session establishment for an outbound roaming subscriber;



FIG. 4 is a call flow diagram illustrating a fake PDU session establishment request sent by a hacker for an outbound roaming subscriber;



FIG. 5 is a call flow diagram illustrating UDM registration and the blocking of a fake PDU session establishment message using an SEPP;



FIG. 6 is a block diagram illustrating an exemplary SEPP for mitigating 5G roaming security attacks; and



FIG. 7 is a flow chart illustrating an exemplary process for mitigating 5G roaming security attacks using an SEPP.





DETAILED DESCRIPTION

The subject matter described herein relates to methods, systems, and computer readable media for mitigating 5G roaming security attacks using an SEPP. FIG. 1 is a block diagram illustrating an exemplary 5G system network architecture. The architecture in FIG. 1 includes NRF 100 and SCP 101, which may be located in the same home public land mobile network (HPLMN). As described above, NRF 100 may maintain profiles of available producer NF service instances and their supported services and allow consumer NFs or SCPs to subscribe to and be notified of the registration of new/updated producer NF service instances. SCP 101 may also support service discovery and selection of producer NFs. In addition, SCP 101 may perform load balancing of connections between consumer and producer NFs.


NRF 100 is a repository for NF profiles. In order to communicate with a producer NF, a consumer NF or an SCP must obtain the NF profile from NRF 100. The NF profile is a JavaScript object notation (JSON) data structure defined in 3GPP TS 29.510. The NF profile definition includes at least one of a fully qualified domain name (FQDN), an Internet protocol (IP) version 4 (IPv4) address or an IP version 6 (IPv6) address.


In FIG. 1, any of the nodes (other than SCP 101 and NRF 100) can be either consumer NFs or producer NFs, depending on whether they are requesting or providing services. In the illustrated example, the nodes include a policy control function (PCF) 102 that performs policy related operations in a network, a unified data management (UDM) function 104 that manages user data, and an application function (AF) 106 that provides application services. The nodes illustrated in FIG. 1 further include a session management function (SMF) 108 that manages sessions between access and mobility management function (AMF) 110 and PCF 102. AMF 110 performs mobility management operations similar to those performed by a mobility management entity (MME) in 4G networks. An authentication server function (AUSF) 112 performs authentication services for user equipment (UEs), such as UE 114, seeking access to the network.


A network slice selection function (NSSF) 116 provides network slicing services for devices seeking to access specific network capabilities and characteristics associated with a network slice. A network exposure function (NEF) 118 provides application programming interfaces (APIs) for application functions seeking to obtain information about Internet of things (IoT) devices and other UEs attached to the network. NEF 118 performs similar functions to the service capability exposure function (SCEF) in 4G networks.


A radio access network (RAN) 120 connects UE 114 to the network via a wireless link. Radio access network 120 may be accessed using a g-Node B (gNB) (not shown in FIG. 1) or other wireless access point. A user plane function (UPF) 122 can support various proxy functionality for user plane services. One example of such proxy functionality is multipath transmission control protocol (MPTCP) proxy functionality. UPF 122 may also support performance measurement functionality, which may be used by UE 114 to obtain network performance measurements. Also illustrated in FIG. 1 is a data network (DN) 124 through which UEs access data network services, such as Internet services.


SEPP 126 filters incoming traffic from another PLMN and performs topology hiding for traffic exiting the home PLMN. SEPP 126 may communicate with an SEPP in a foreign PLMN which manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and the other for the foreign PLMN. As will be described in detail below, SEPP 126 may be used to mitigate 5G roaming security attacks for outbound roaming subscribers by performing an authorization lookup for incoming PDU session establishment requests for outbound roaming subscribers and for disallowing requests from entering the home network when the authorization lookup fails.


The interface that SEPP 126 uses to connect with SEPPs in other networks is the N32-f interface. The N32-f interface that an attacker can exploit to send fake PDU session establishment requests. However, before illustrating a fake PDU session establishment request scenario, registration and authentication signaling that is transmitted over the N32-f interface will now be described. FIG. 2 is a call flow diagram illustrating UE registration signaling for an outbound roaming subscriber that is exchanged between a home SEPP and a visited SEPP over the N32-f interface. Referring to FIG. 2, home SEPP 126A sits at the edge of a subscriber's home network and receives signaling from a visited network for an outbound roaming subscriber. Home network also includes home AUSF 112A, home UDM 104A, and home PCF 102A. A visited network includes visited SEPP 126B, visited PCF 102B, and visited AMF 110.


Referring to the signaling message flow in FIG. 2, in line 1, when a UE moves into an area served by visited AMF 110, visited AMF 110 sends an Nausf_UE_Authentication_Authenticate request message to the home AUSF 112A in the roaming subscriber's home network. The Nausf_UE_Authentication_Authenticate_Request message may contain either the subscription concealed identifier (SUCI) or the subscription permanent identifier (SUFI). The Nausf_UE_Authentication_Authenticate_Request message also includes the serving network name or VPLMN ID. The Nausf_UE_Authentication_Authenticate_Request message may also identify the access type, i.e., whether the access is 3GPP or non-3GPP. As will be described in further detail below, home SEPP 126A may use a combination of the SUPI, the serving network name or VPLMN ID, and the access type to authorize or not authorize PDU session establishment requests. However, such functionality is not specified as part of the SEPP functionality in 3GPP TS 33.501, which defines the security architecture for the 5G system.


Visited SEPP 126B receives the Nausf_UE_Authentication_Authenticate_Request message and forwards the message to home SEPP 126A over the N32-f interface. Home SEPP 126A forwards the message to home AUSF 112A.


Upon receiving the Nausf_UE_Authentication_Authenticate_Request message, home AUSF 112A determines whether the requesting AMF or security anchor function (SAF) in the serving network is entitled to using the serving network named in the Nausf_UE_Authentication_Authenticate_Request by comparing the serving network name with the expected serving network name. Home AUSF 112A stores the received serving network name temporarily. If the serving network is not authorized to use the serving network identified by the serving network name, home AUSF 112A will respond with certain “serving network not authorized” in an Nausf_UE_Authentication_Authenticate_Response message.


In the illustrated example, it is assumed that the serving network name in the Nausf_UE_Authentication_Authenticate_Request matches the expected serving network name. Accordingly, home AUSF 112A sends an Nudm_UE_Authentication_Get_Request to home UDM 104A. The home Nudm_UE_Authentication_Get_Request message includes the SUCI or SUPI and the serving network name.


Upon receipt of the Nudm_UE_Authentication_Get_Request message, home UDM 104A invokes a subscription identifier deconcealing function (SIDF) if the SUCI is included. The SIDF is used for deconcealing the SUPI from the SUCI. If the SUPI is included, home UDM 104A will choose the authentication method based on the subscription data. Home UDM 104A will respond with authentication challenge information in an Nudm_UE_Athentication_Get_Response message as indicated by line 5 of the message flow diagram.


In line 6 of the message flow diagram, home AUSF 112A sends an Nausf_UE_Authentication_Authenticate_Response message with authentication challenge information through home SEPP 126A.


In lines 7 and 8 of the message flow diagram, the authenticate response message is delivered to visited AMF 110. Visited AMF 110 may forward the authentication challenge information to the UE, which calculates an authentication response. In line 9 of the message flow diagram, visited AMF and home AUSF exchange additional authentication messages before the UE is authenticated.


Once the UE is authenticated, visited AMF 110 can register as the subscriber serving AMF in home UDM 104A. The registration procedure begins in line 10 of the message flow diagram where visited AMF 110 sends a UECM_Registration_Request to home UDM 104A. In line 11, visited SEPP 126B sends the UECM_Registration_Request to home SEPP 126A. Home SEPP 126A may determine whether the UECM_Registration_Request is associated with a recent authentication from a visited network and, if not, discard the message. In this example, it is assumed that the UECM_Registration_Request is associated with a recent authentication. Accordingly, in line 12, home SEPP 126A forwards the UECM_Registration_Request to UDM 104A.


Home UDM 104A receives the UECM_Registration_Request, updates the subscriber's subscription data to include the identity of the visited AMF, and returns subscription data in a UECM_Registration_Response message in line 14 of the message flow diagram. In lines 13 through 15, the UECM_Registration_Response message is delivered to visited AMF 110.



FIG. 3 is a message flow diagram illustrating exemplary messages exchange for PDU session establishment for an outbound roaming subscriber. Referring to FIG. 3 in line 1, when a UE initiates establishment of a new PDU session by sending an non-access stratum (NAS) message containing a PDU session establishment request to visited AMF 110B, visited AMF 110B selects a visited SMF 108B and sends an Nsmf_PDU_Session_Create_SM_Context_Request message to visited SMF 108B.


In line 2 of the message flow diagram, visited SMF 108B responds to the Nsmf_PDU_Session_Create_SM_Context_Request with an Nsmf_PDU_Session_Create_SM_Context_Response message to visited AMF 110B. In line 3 of the message flow diagram, visited SMF 108B signals with visited UPF 122B for N4 session establishment.


In line 4 of the message flow diagram, visited SMF 108B sends a PDU session establishment request to visited SEPP 126B. The PDU session establishment request includes an SUPI and a network slice selection assistance information (NSSAI) parameter. In line 5, visited SEPP 126B sends the PDU session establishment request to home SEPP 126A over the N32-f interface. Home SEPP 126A does not perform authentication for the PDU session establishment request and, in line 6, forwards the PDU session establishment request to home SMF 108A. In line 7, home SMF 108A signals with home UDM 104A to obtain subscription data and the subscriber's registration information. Again, there is no security check to between home SMF 108A and home UDM 104A. Accordingly, an attacker could send the false PDU session establishment request and overwhelm the resources at home SMF 108A and home UDM 104A. In line 8 of the message flow diagram, home SMF 108A signals with home UPF 122A to configure the user plane function and N4 session. In line 9, home SMF 108A sends a PDU session establishment response to home SEPP 126A. In line 10, home SEPP 126A sends the PDU session establishment response to visited SEPP 126B over the N32-f interface. In line 11, visited SEPP 126B sends the PDU session establishment response to visited SMF 108B. In line 12, visited SMF and visited AMF 1108 signal to finalize establishment of the PDU session.


As long as PDU session establishment is legitimate, resources in the home network are not wasted by processing the PDU session establishment request. However, there are scenarios where hackers can initiate denial of service attacks by spoofing inter-PLMN messages due to a compromise in an interconnect network or a remote PLMN network. Inter-PLMN traffic can go through multiple intermediate hops or IP exchange (IPX) providers. Some mobile network operators (MNOs) can even outsource SEPP functionality to IPX providers, leaving security gaps, which may result in attacks.


As described above, hackers can initiate signaling storms of fake PDU session establishment requests for outbound roaming subscribers towards the home network SMF. The UDM does not perform any cross-verification of subscriber UE registration status (AMF registration for 3GPP access data) stored in the UDM, even though such data is received through earlier UECM registration messages from the AMF. The UDM always responds to the home SMF for SMF registration requests. As a result, both the SMF and the UDM in the home network can be overloaded due to signaling storms of fake PDU session creation requests and SMF registration requests generated by the SMF towards the UDM based on fake PDU session creation requests, leading to denial of service attacks for legitimate subscribers.



FIG. 4 is a signaling message flow diagram illustrating fake PDU session establishment requests sent by a hacker for an outbound roaming subscriber. Referring to FIG. 4, in line 1, an attacker posing as an SMF, illustrated by fake SMF 108C, sends a PDU establishment request to home SEPP 126A. The PDU session establishment request includes the SUPI or SUCI, a serving PLMN ID, and an access type. These parameters may be fake or spoofed, since fake SMF 108C is not serving a real outbound roaming subscriber. Because there are no 3GPP defined security procedures for PDU session establishment requests, home SEPP 126A does not screen PDU session establishment requests to determine whether the request is fake by examining one or more of the parameter values present in the PDU session establishment request.


In line 2, home SEPP 126A forwards the fake PDU session establishment request to home SMF 108A. In line 3, home SMF 108A signals with home UDM 104A to obtain SMF registration and subscription data. In line 4, home SMF 108A generates and sends a PDU session establishment response to home SEPP 126A. The resources of home SMF 108A and home UDM 104A are consumed by processing the fake PDU session establishment request. In line 5, home SEPP 126A sends the PDU session establishment response to fake SMF 108C.


Fake SMF 108C may send a storm of PDU session establishment requests, such as that illustrated in FIG. 4, and will overwhelm home SMF 108A and home UDM 104A. No security check for the PDU session establishment request is performed based on prior registration data. To avoid these types of attacks, the subject matter described herein includes an SEPP that implements a stateful security countermeasure by correlating data extracted from UECM registration and PDU session creation messages for outbound roaming subscribers. The home network SEPP stores a record in a database upon receiving an Nudm_UECM_Registration_Request message from a visited network AMF during the UE registration process. In the record, the home SEPP may include the SUPI, the visited network PLMN ID, and the access type. When a PDU session establishment message is received, the home network SEPP may perform a lookup in the database based on the SUPI or SUCI. If no record is found or if there is a mismatch between the PLMN ID or access type, the SEPP will mark the PDU session creation request as an attack message and will reject or drop the message.



FIG. 5 is a message flow diagram illustrating home SEPP 126A blocking a fake PDU session establishment request from an attacker using prior UE registration data. Referring to FIG. 5, in line 1, when a real subscriber registers with visited AMF 1108, visited AMF 1108 sends an Nudm_UECM_Registration_Request message to the subscriber's home network via visited SEPP 126B. In line 2, visited SEPP 126B sends the Nudm_UECM_Registration_Request message to the home network via home SEPP 126A. Home SEPP 126A creates a record in an SEPP security database 500 including the SUPI, VPLMN ID, and access type extracted from Nudm_UECM_Registration_Request message. In line 3, home SEPP 126A forwards the Nudm_UECM_Registration_Request message to home UDM 104A. In lines 4 through 6, UDM 104A sends a Nudm_UECM_Registration_Response message to the visited AMF 1108.


In line 7 of the message flow diagram, fake SMF 108C sends a fake PDU session establishment request to the home network. Home SEPP 126A receives the fake PDU session establishment request and performs a lookup in SEPP security database 500. If no SUPI record is found or if a record is found and the VPLMN ID or access type does not match the VPLMN ID and access type for an existing record for the same SUPI, home SEPP 126A disallows the PDU session establishment request, shielding home SMF 122A and home UDM 104A from unnecessary processing caused by the attack. In line 8, home SEPP 126A sends a PDU session establishment error message to fake SMF 108C. Thus, using a registration check, home SEPP 126A can reduce the effect of a signaling storm from a fake SMF by blocking fake PDU session establishment requests at the edge of the home network, shielding home SMF 122A and home UDM 104A from attack signaling traffic.



FIG. 6 is a block diagram illustrating an exemplary home network SEPP for performing security checks for outbound roaming subscribers. Referring to FIG. 6, home SEPP 126A includes at least one processor 600 and memory 602. Home SEPP 126A further includes an SEPP roaming security controller 604 that may be implemented using computer executable instructions stored in memory 602 and executable by processor 600. Home SEPP 126A also includes SEPP security database 500, which stores records derived from registration messages for outbound roaming subscribers and used to block the fake PDU session establishment requests that may be part of a denial of service attack. SEPP roaming security controller 604 may receive registration messages relating to outbound roaming subscribers, extract registration information from the messages, and use the registration information to create outbound roaming UE registration records in SEPP security database 500. Such records may include the SUCI and/or the SUPI, VPLMN ID, and the access type. Table 1 shown below illustrates an example of a UE registration record that may be created in database 500.









TABLE 1







Outbound subscriber Roaming UE Registration Record











SUPI or SUCI
VPLMN ID
Access Type







SUPI 1
VPLMN ID xyz
3GPP










In Table 1, the outbound roaming subscriber registration record includes parameters that are usable to verify whether subsequent messages, such as PDU session establishment messages, are legitimate or not. In the illustrated example, these parameters include the SUPI or SUCI, the VPLMN ID, and the access type. It is understood that additional or alternate parameters derived from an Nudm_UECM_Registration_Request message may be used without departing from the scope of the subject matter described herein. An attacker seeking to overwhelm the resources of the home network may not have access to legitimate UE registration information. As a result, when home SEPP 126A performs a look up in database 500 and fails to locate a matching record, the PDU session establishment request for the fake subscriber will be blocked by the home SEPP and prevented from entering the home network.



FIG. 7 is a flow chart illustrating an exemplary process for mitigating 5G roaming security attacks using an SEPP. Referring to FIG. 7, in step 700, the process includes receiving, at a home SEPP, UE registration messages for outbound roaming subscribers. For example, home SEPP 126A may receive Nudm_UE_Registration_Request messages for outbound roaming subscribers. The Nudm_UE_Registration_Request messages may include the SUPI or SUCI, the serving PLMN ID, and the access type. Nudm_UE_Registration_Request messages may originate from AMF located in networks where subscribers are roaming.


In step 702, the process includes creating UE roaming registration records in SEPP security database 500 using information derived from the UE registration messages in the SEPP security database. For example, home SEPP 126A may create UE roaming registration records, such as the record illustrated above in Table 1, that contain the SUPI or SUCI, the VPLMN ID, and the access type obtained from Nudm_UE_Registration_Request messages.


In step 704, the process includes receiving a PDU session establishment request. For example, home SEPP 126A may receive PDU session establishment request from a real SMF serving a legitimate outbound roaming subscriber or from an attacker posing as a real SMF.


In step 706, the process includes performing, using one or more parameters from the PDU session establishment request, a lookup in the SEPP security database for a matching UE roaming registration record. For example, SEPP roaming security controller 604 may extract the SUPI or SUCI from the PDU session establishment request and perform a lookup in SEPP security database 500 using the SUPI or SUCI.


In step 708, the process includes determining whether a record is found. For example, SEPP roaming security controller 604 may determine whether or not a record corresponding to the SUPI or SUCI exits in roaming security database 500.


If no record is found, control proceeds to step 710 where the PDU session establishment request is rejected as fake. Rejecting the PDU session establishment request may occur at home SEPP 126A and may prevent fake PDU session establishment requests from affecting nodes, such as home UDM 104A and home SMF 122A in the home network. Rejecting fake PDU session establishment requests may include discarding the fake PDU session establishment requests and sending an error message to the sender.


Returning to step 708, if a record corresponding to the SUPI or SUCI from the PDU session establishment request is found in SEPP security database 500, control proceeds to step 712 where it is determined whether the record includes matching UE registration information. For example, roaming security controller 604 of home SEPP 126A may locate a record corresponding to the SUPI or SUCI in the PDU session establishment request. If the remaining parameters in the PDU session establishment request match the corresponding parameters in the record, control proceeds to step 714 where the PDU session establishment request is allowed to enter the home network. In such a case, home SEPP 126A may forward the PDU session establishment request to home SMF 108A. Home SMF 108A may obtain the corresponding registration information from home UDM 104A. Home SMF 108A may respond to the PDU session establishment request by sending a message to home SEPP 126A indicating successful PDU session establishment. Home SEPP 126A may forward the PDU session establishment response to the visited network. In the visited network, the PDU session establishment response is forwarded to the AMF where the subscriber is currently registered.


In step 712, if the parameters in the PDU session establishment request do not match the parameters in the corresponding record in database 500, control proceeds to step 710 where the PDU session establishment requested is rejected. The process in FIG. 7 may be performed continually to protect the home network against denial of service attacks while allowing PDU session establishment requests from legitimate outbound roaming subscribers.


The proposed solution mitigates the DoS security attacks initiated through fake PDU session establishment requests using an SEPP. The solution reduces the likelihood of overloading of the home network SMF and UDM handling PDU session establishment and SMF registration messages. The solution avoids unnecessary subsequent signaling traffic at the SMF and UDM to free resources caused by fake PDU session establishment requests.


The proposed solution allows MNOs to mitigate DoS attacks due to roaming PDU session creation signaling for outbound roaming subscribers and protect 5G core NFs (SMFs and UDMs) using a proposed security countermeasure at the SEPP by correlating UECM registration and PDU session creation signaling related to outbound roaming subscribers.


The disclosure of each of the following references is hereby incorporated herein by reference in its entirety.


REFERENCES



  • 3GPP TS 33.501, 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 16) V16.2.0, (2020-03).

  • 3GPP TS 33.517, 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 5G Security Assurance Specification (SCAS) for the Security Edge Protection Proxy (SEPP) network product class (Release 16) V16.1.0 (2019-12).

  • 3GPP TS 23.502, Technical Specification Group Services and System Aspects; Procedures for the 5G System (5Gs), Stage 2, (Release 16) V16.4.0 (2020-03).



It will be understood that various details of the presently disclosed subject matter may be changed without departing from the scope of the presently disclosed subject matter. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation.

Claims
  • 1. A method tor mitigating a 5G roaming attack using a security edge protection proxy (SEPP), the method comprising: receiving, at an SEPP, user equipment (UE) registration messages for outbound roaming subscribers, wherein receiving the UE registration messages for the outbound roaming subscribers includes receiving Nudm_UECM_Registration messages from access and mobility management functions (AMFs) and session management functions (SMFs) serving the outbound roaming subscribers;creating, in a SEPP security database, UE roaming registration records derived from UE registration messages;receiving, at the SEPP, a packet data unit (PDU) session establishment request message;performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record; anddetermining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.
  • 2. The method of claim 1 wherein creating records in the SEPP security database includes creating records that each include a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type.
  • 3. A method for mitigating a 5G roaming attack using a security edge protection proxy (SEPP), the method comprising: receiving, at an SEPP, user equipment (UE) registration messages for outbound roaming subscribers;creating, in a SEPP security database, UE roaming registration records derived from UE registration messages, wherein creating records in the SEPP security database includes creating records that each include a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type;receiving, at the SEPP, a packet data unit (PDU) session establishment request message, wherein receiving a PDU session establishment request message includes receiving a PDU session establishment request message including a SUPI or SUCI, a PLMN ID, and an access type;performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record; anddetermining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.
  • 4. The method of claim 3 wherein performing the lookup in the SEPP security database include performing the lookup using the SUPI or SUCI from the PDU session establishment request message.
  • 5. The method of claim 4 comprising failing to locate a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, wherein determining whether to allow or reject the PDU session establishment request message includes determining to reject the PDU session establishment request message, and further comprising rejecting the PDU session establishment request message.
  • 6. The method of claim 4 comprising locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID or an access type in the record does not match the PLMN ID or the access type in the PDU session establishment request message, wherein determining whether to allow or reject the PDU session establishment request message includes determining to reject the PDU session establishment request, and further comprising rejecting the PDU session establishment request message.
  • 7. The method of claim 6 wherein rejecting the PDU session establishment request message includes discarding the PDU session establishment request message and sending a PDU session establishment error response.
  • 8. The method of claim 4 comprising locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID and an access type in the record does match the PLMN ID and the access type in the PDU session establishment request message, wherein determining whether to allow or reject the PDU session establishment request message includes determining to allow the PDU session establishment request message, and further comprising allowing the PDU session establishment request message.
  • 9. The method of claim 8 wherein allowing the PDU session establishment request message includes forwarding the PDU session establishment request message from the SEPP to a home session management function (hSMF).
  • 10. A system for mitigating a 5G roaming attack, the system comprising: a security edge protection proxy (SEPP) including at least one processor and a memory;an SEPP security database implemented in the memory;an SEPP roaming security controller implemented by the at least one processor for receiving user equipment (UE) registration messages for outbound roaming subscribers;creating, in the SEPP security database, UE roaming registration records derived from UE registration messages;receiving a packet data unit (PDU) session establishment request message;performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record;determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message; andwherein the SEPP roaming security controller is configured to receive Nudm_UECM_Registration messages from access and mobility management functions (AMFs) and session management functions (SMFs) serving the outbound roaming subscribers.
  • 11. The system of claim 10 wherein the SEPP roaming security controller is configured to create the records in the SEPP security database where each includes a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type.
  • 12. A system for mitigating a 5G roaming attack, the system comprising: a security edge protection proxy (SEPP) including at least one processor and a memory;an SEPP security database implemented in the memory;an SEPP roaming security controller implemented by the at least one processor for receiving user equipment (UE) registration messages for outbound roaming subscribers;creating, in the SEPP security database, UE roaming registration records derived from UE registration messages;receiving a packet data unit (PDU) session establishment request message;performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record;determining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message;wherein the SEPP roaming security controller is configured to create the records in the SEPP security database where each includes a subscription permanent identifier (SUPI) or subscription concealed identifier (SUCI), serving public land mobile network (PLMN) ID, and access type; andwherein the PDU session establishment request message includes a SUPI or SUCI, a PLMN ID, and an access type.
  • 13. The system of claim 12 wherein the SEPP roaming security controller is configured to perform the lookup in the SEPP security database using the SUPI or SUCI from the PDU session establishment request message.
  • 14. The system of claim 13 wherein the SEPP roaming security controller is configured to, in response to failing to locate a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, reject the PDU session establishment request message.
  • 15. The system of claim 13 wherein the SEPP roaming security controller is configured to, in response to locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database and determining that a PLMN ID or an access type in the record does not match the PLMN ID or the access type in the PDU session establishment request message, reject the PDU session establishment request message.
  • 16. The system of claim 15 wherein the SEPP roaming security controller is configured to reject the PDU session establishment request message by discarding the PDU session establishment request message and sending a PDU session establishment error response.
  • 17. The system of claim 13 wherein the SEPP roaming security controller is configured to, in response to locating a record corresponding to the SUPI or SUCI from the PDU session establishment request message in the SEPP security database, determining that a PLMN ID and an access type in the record matches the PLMN ID and the access type in the PDU session establishment request message, allow the PDU session establishment request message, wherein allowing the PDU session establishment request message includes forwarding the PDU session establishment request message from the SEPP to a home session management function (hSMF).
  • 18. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising: receiving, at a security edge protection proxy (SEPP), user equipment (UE) registration messages for outbound roaming subscribers, wherein receiving the UE registration messages for the outbound roaming subscribers includes receiving Nudm_UECM_Registration messages from access and mobility management functions (AMFs) and session management functions (SMFs) serving the outbound roaming subscribers;creating, in a SEPP security database, UE roaming registration records derived from UE registration messages;receiving, at the SEPP, a packet data unit (PDU) session establishment request message;performing, using at least one parameter value extracted from the PDU session establishment request message, a lookup in the SEPP security database for a UE roaming registration record; anddetermining, by the SEPP and based on results of the lookup, whether to allow or reject the PDU session establishment request message.
US Referenced Citations (195)
Number Name Date Kind
6091958 Bergkvist et al. Jul 2000 A
6151503 Chavez Nov 2000 A
6292666 Siddiqui et al. Sep 2001 B1
6308075 Irten et al. Oct 2001 B1
6343215 Calabrese et al. Jan 2002 B1
6591101 Shimbori Jul 2003 B1
7043754 Arnouse May 2006 B2
7567661 Wood et al. Jul 2009 B1
8045956 Sun et al. Oct 2011 B2
8145234 Leonard et al. Mar 2012 B1
8509074 Roberts et al. Aug 2013 B1
8615217 Ravishankar et al. Dec 2013 B2
8879431 Ridel et al. Nov 2014 B2
9015808 Koller et al. Apr 2015 B1
9060263 Carames et al. Jun 2015 B1
9106428 Matthews et al. Aug 2015 B2
9106769 Kanode et al. Aug 2015 B2
9191803 Patel et al. Nov 2015 B2
9240946 Cai et al. Jan 2016 B2
9374840 Monedero Recuero Jun 2016 B2
9538335 Bank et al. Jan 2017 B1
9628994 Gunyel et al. Apr 2017 B1
9681360 Salyers Jun 2017 B1
9912486 Sharifi Mehr Mar 2018 B1
10009751 Gundavelli et al. Jun 2018 B2
10021738 Mehta et al. Jul 2018 B1
10212538 Russell Feb 2019 B2
10237721 Gupta et al. Mar 2019 B2
10306459 Patil et al. May 2019 B1
10470154 Chellamani et al. Nov 2019 B2
10511998 Vallur Dec 2019 B1
10616200 Kumar et al. Apr 2020 B2
10652850 Landais et al. May 2020 B2
10834045 Mahalank et al. Nov 2020 B2
10834571 Yau Nov 2020 B1
10931668 Mehta Feb 2021 B2
10952063 Mehta Mar 2021 B2
10984128 Hoffer Apr 2021 B1
20010046856 McCann Nov 2001 A1
20020080752 Johansson et al. Jun 2002 A1
20020098856 Berg et al. Jul 2002 A1
20020181448 Uskela et al. Dec 2002 A1
20020193127 Martschitsch Dec 2002 A1
20030087647 Hurst May 2003 A1
20040140908 Gladwin et al. Jul 2004 A1
20050182968 Izatt et al. Aug 2005 A1
20050232236 Allison et al. Oct 2005 A1
20060068762 Baldwin et al. Mar 2006 A1
20060193258 Ballai Aug 2006 A1
20060211406 Szucs et al. Sep 2006 A1
20060242414 Corson et al. Oct 2006 A1
20070011261 Madams et al. Jan 2007 A1
20070165527 Sultan et al. Jul 2007 A1
20070165626 Sultan et al. Jul 2007 A1
20070174082 Singh Jul 2007 A1
20070223372 Haalen et al. Sep 2007 A1
20070248032 Vasudevan et al. Oct 2007 A1
20070281718 Nooren Dec 2007 A1
20080004047 Hill et al. Jan 2008 A1
20080020704 Costa Jan 2008 A1
20080026778 Cai et al. Jan 2008 A1
20080045246 Murtagh et al. Feb 2008 A1
20080051061 Takahashi Feb 2008 A1
20080125116 Jiang May 2008 A1
20080168540 Agarwal Jul 2008 A1
20080207181 Jiang Aug 2008 A1
20080222038 Eden Sep 2008 A1
20080259798 Loh et al. Oct 2008 A1
20090045251 Jaiswal et al. Feb 2009 A1
20090168719 Mercurio Jul 2009 A1
20090191915 Abramson et al. Jul 2009 A1
20090195349 Frader-Thompson et al. Aug 2009 A1
20100062789 Agarwal et al. Mar 2010 A1
20100098414 Kramer et al. Apr 2010 A1
20100100958 Jeremiah Apr 2010 A1
20100105355 Nooren Apr 2010 A1
20100130227 Farthofer et al. May 2010 A1
20100161817 Xiao et al. Jun 2010 A1
20100223222 Zhou et al. Sep 2010 A1
20100235911 Nooren Sep 2010 A1
20100240361 Jiang Sep 2010 A1
20100313024 Weniger et al. Dec 2010 A1
20110009085 Albanes et al. Jan 2011 A1
20110014939 Ravishankar et al. Jan 2011 A1
20110029655 Forbes, Jr. et al. Feb 2011 A1
20110063126 Kennedy et al. Mar 2011 A1
20110124317 Joo May 2011 A1
20110124334 Brisebois et al. May 2011 A1
20110158090 Riley et al. Jun 2011 A1
20110173122 Singhal Jul 2011 A1
20110191835 Hawkes et al. Aug 2011 A1
20110217979 Nas Sep 2011 A1
20110225091 Plastina et al. Sep 2011 A1
20110307381 Kim et al. Dec 2011 A1
20120099715 Ravishankar et al. Apr 2012 A1
20120115512 Grainger et al. May 2012 A1
20120131121 Snyder et al. May 2012 A1
20120202481 Martin Aug 2012 A1
20120203663 Sinclair et al. Aug 2012 A1
20120207015 Marsico Aug 2012 A1
20130035118 Hamano et al. Feb 2013 A1
20130102231 Joseph et al. Apr 2013 A1
20130102310 Malonda Apr 2013 A1
20130171988 Yeung et al. Jul 2013 A1
20130331063 Cormier et al. Dec 2013 A1
20140195630 Malik et al. Jul 2014 A1
20140199961 Mohammed et al. Jul 2014 A1
20140199996 Wang et al. Jul 2014 A1
20140259012 Nandlall et al. Sep 2014 A1
20140280645 Shuman et al. Sep 2014 A1
20140378129 Jiang et al. Dec 2014 A1
20150012415 Livne et al. Jan 2015 A1
20150038156 Kilpatrick, II et al. Feb 2015 A1
20150094060 Kouridakis et al. Apr 2015 A1
20150121078 Fu et al. Apr 2015 A1
20150188979 Almeras et al. Jul 2015 A1
20150304220 Miyao Oct 2015 A1
20150304803 Chen Oct 2015 A1
20150341341 Messerges Nov 2015 A1
20150350196 Toyonaga et al. Dec 2015 A1
20160088461 Jiang Mar 2016 A1
20160119773 Xu et al. Apr 2016 A1
20160156647 Engel et al. Jun 2016 A1
20160165432 Dubesset et al. Jun 2016 A1
20160183178 Marimuthu Jun 2016 A1
20160219043 Blanke Jul 2016 A1
20160269566 Gundamaraju et al. Sep 2016 A1
20160292687 Kruglick Oct 2016 A1
20160365983 Shahabuddin et al. Dec 2016 A1
20160381699 Rubin et al. Dec 2016 A1
20170201778 Bailey et al. Jul 2017 A1
20170244676 Edwards Aug 2017 A1
20170245207 Stammers et al. Aug 2017 A1
20170257866 Chaudhuri et al. Sep 2017 A1
20170272921 Kim et al. Sep 2017 A1
20170289048 Chao et al. Oct 2017 A1
20170295201 Peylo et al. Oct 2017 A1
20170345006 Kohli Nov 2017 A1
20180020324 Beauford Jan 2018 A1
20180109632 Stammers et al. Apr 2018 A1
20180109953 He Apr 2018 A1
20180167906 Chellamani et al. Jun 2018 A1
20180205698 Gupta et al. Jul 2018 A1
20180220301 Gallagher Aug 2018 A1
20180288127 Zaidi et al. Oct 2018 A1
20180288198 Pope et al. Oct 2018 A1
20180310162 Kim et al. Oct 2018 A1
20190007788 Russell Jan 2019 A1
20190037484 Davies et al. Jan 2019 A1
20190044932 Kumar et al. Feb 2019 A1
20190074982 Hughes Mar 2019 A1
20190182875 Talebi Fard Jun 2019 A1
20190253885 Bykampadi et al. Aug 2019 A1
20190306166 Konda et al. Oct 2019 A1
20190342217 Mazurek Nov 2019 A1
20190354709 Brinskelle Nov 2019 A1
20200007538 Mehta Jan 2020 A1
20200053044 Mahalank et al. Feb 2020 A1
20200077260 Hancock et al. Mar 2020 A1
20200107291 Nayak et al. Apr 2020 A1
20200145432 Verma May 2020 A1
20200169510 Kadosh et al. May 2020 A1
20200187089 Meredith et al. Jun 2020 A1
20200221541 Yan Jul 2020 A1
20200259896 Sachs et al. Aug 2020 A1
20200329363 Mehta Oct 2020 A1
20200344604 He Oct 2020 A1
20210022070 Letor et al. Jan 2021 A1
20210111985 Mahalank et al. Apr 2021 A1
20210152494 Johnsen et al. May 2021 A1
20210168751 Stojanovski et al. Jun 2021 A1
20210176177 Kubo et al. Jun 2021 A1
20210194903 Medvedovsky et al. Jun 2021 A1
20210203636 Kumar et al. Jul 2021 A1
20210234706 Nair et al. Jul 2021 A1
20210250186 Bykampadi et al. Aug 2021 A1
20210297942 Bykampadi et al. Sep 2021 A1
20210321303 Nair et al. Oct 2021 A1
20210377212 Holtmanns et al. Dec 2021 A1
20210399988 Labonte Dec 2021 A1
20210400538 Ke Dec 2021 A1
20210406038 Fetzer et al. Dec 2021 A1
20220021586 Kazmierski Jan 2022 A1
20220022027 Xin Jan 2022 A1
20220030413 Ben Henda et al. Jan 2022 A1
20220038394 Anubolu et al. Feb 2022 A1
20220052847 Gonzalez Cervantes et al. Feb 2022 A1
20220070674 Russell Mar 2022 A1
20220104020 Rajput Mar 2022 A1
20220104112 Rajput Mar 2022 A1
20220124479 Iddya Apr 2022 A1
20220150212 Rajput May 2022 A1
20220159445 Rajavelu May 2022 A1
20220191694 Rajput Jun 2022 A1
20220201489 Mahalank Jun 2022 A1
Foreign Referenced Citations (51)
Number Date Country
101277541 Oct 2008 CN
10135561 Jan 2009 CN
101742445 Jun 2010 CN
101917698 Dec 2010 CN
102656845 Sep 2012 CN
103179504 Jun 2013 CN
103444212 Dec 2013 CN
107 800 664 Mar 2018 CN
110035433 Jul 2019 CN
110800322 May 2021 CN
201880040478.3 Apr 2022 CN
1 067 492 Jan 2001 EP
1 906 682 Apr 2008 EP
2 204 955 Jul 2010 EP
2 785 125 Aug 2018 EP
3 493 569 Jun 2019 EP
3 646 630 Aug 2021 EP
3 662 630 Aug 2021 EP
2 548 005 Oct 2015 ES
7038148 Mar 2022 JP
WO 0188790 Nov 2001 WO
WO 2005091656 Sep 2005 WO
WO 2005101872 Oct 2005 WO
WO 2007084503 Jul 2007 WO
WO 2008053808 May 2008 WO
WO-2010021886 Feb 2010 WO
WO 2010045646 Apr 2010 WO
WO 2010105099 Sep 2010 WO
WO 2011047382 Apr 2011 WO
WO 2016201990 Dec 2016 WO
WO 2017082532 May 2017 WO
WO 2018202284 Nov 2018 WO
WO 2019005287 Jan 2019 WO
WO 2019027813 Feb 2019 WO
WO 2019224157 Nov 2019 WO
WO 2020013889 Jan 2020 WO
WO 2020033113 Feb 2020 WO
WO 2020036883 Feb 2020 WO
WO 2020164763 Aug 2020 WO
WO 2020179665 Sep 2020 WO
WO 2020210015 Oct 2020 WO
WO 2020257018 Dec 2020 WO
WO 2021138072 Jul 2021 WO
WO 2022046176 Mar 2022 WO
WO 2022066227 Mar 2022 WO
WO 2022066228 Mar 2022 WO
WO 2022086596 Apr 2022 WO
WO 2022098404 May 2022 WO
WO 2022103454 May 2022 WO
WO 2022132315 Jun 2022 WO
WO 2022132316 Jun 2022 WO
Non-Patent Literature Citations (205)
Entry
Communication of European publication number and information on the application of Article 67(3) EPC for European Patent Application Serial No. 19710842.6 (dated Apr. 21, 2021).
Decision to grant a European patent pursuant to Article 97(1) EPC for European Patent Application Serial No. 18756018.0 (dated Jul. 29, 2021).
Commonly-assigned, co-pending U.S. Appl. No. 17/129,441 for “Methods, Systems, and Computer Readable Media for Mitigating Spoofing Attacks on Security Edge Protection Proxy (SEPP) Inter-Public Land Mobile Network (INTER-PLMN) Forwarding Interface,” (Unpublished, filed Dec. 21, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/129,487 for “Methods, Systems, and Computer Readable Media for Ingress Message Rate Limiting,” (Unpublished, filed Dec. 21, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/125,943 for “Methods, Systems, and Computer Readable Media for Mitigating 5G Roaming Attacks for Internet of Things (IoT) Devices Based on Expected User Equipment (UE) Behavior Patterns,” (Unpublished, filed Dec. 17, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/123,038 for “Methods, Systems, and Computer Readable Media for Message Validation in Fifth Generation (5G) Communications Networks,” (Unpublished, filed Dec. 15, 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Network Function Repository Services; Stage 3 (Release 17),” 3GPP TS 29.510, V17.0.0, pp. 1-229 (Dec. 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/099,683 for “Methods, Systems, and Computer Readable Media for Validating Location Update Messages,” (Unpublished, filed Nov. 16, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/095,420 for “Methods, Systems, and Computer Readable Media for Mitigating 5G Roaming Spoofing Attacks,” (Unpublished, filed Nov. 11, 2020).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 16/379,488 (dated Oct. 23, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/076,482 for “Methods, Systems, and Computer Readable Media for Validating a Session Management Function (SMF) Registration Request,” (Unpublished, filed Oct. 21, 2020).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 16/024,422 (dated Oct. 21, 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 16),” 3GPP TS 33.501, V16.4.0, pp. 1-249 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Public Land Mobile Network (PLMN) Interconnection; Stage 3 (Release 16),” 3GPP TS 29.573, V16.4.0, pp. 1-95 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Authentication Server Services; Stage 3 (Release 16),” 3GPP TS 29.509, V16.5.0 pp. 1-60 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Network Function Repository Services; Stage 3 (Release 16),” 3GPP TS 29.510, V16.5.0, pp. 1-208 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Numbering, addressing and identification; (Release 16),” 3GPP TS 23.003, V16.4.0, pp. 1-141 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Session Management Services; Stage 3 (Release 16),” 3GPP TS 29.502, V16.5.0, pp. 1-260 (Sep. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System architecture for the 5G System (5GS); Stage 2 (Release 16),” 3GPP TS 23.501, V16.6.0, pp. 1-447 (Sep. 2020).
3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS); Stage 2 (Release 16), 3GPP TS 23.502, V16.6.0, pp. 1-597 (Sep. 2020).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 16/100,172 (dated Sep. 14, 2020).
Commonly-assigned, co-pending U.S. Appl. No. 17/008,528 for “Methods, Systems, and Computer Readable Media for 5G User Equipment (UE) Historical Mobility Tracking and Security Screening Using Mobility Patterns,” (Unpublished, filed Aug. 31, 2020).
First Office Action for Chinese Application Serial No. 201880040477.9 (dated Aug. 5, 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System architecture for the 5G System (5GS); Stage 2 (Release 16),” 3GPP TS 23.501 V16.5.1, pp. 1-440 (Aug. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Network Function Repository Services; Stage 3 (Release 16),” 3GPP TS 29.510, V16.4.0, pp. 1-206 (Jul. 2020).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2020/024234 (dated Jul. 16, 2020).
Non-Final Office Action for U.S. Appl. No. 16/379,488 (dated Jul. 15, 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Architecture enhancements for 5G System (5GS) to support network data analytics services (Release 16),” 3GPP TS 23.288 V16.4.0, pp. 1-66 (Jul. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Public Land Mobile Network (PLMN) Interconnection; Stage 3 (Release 16),” 3GPP TS 29.573, V16.3.0, pp. 1-86 (Jul. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 16),” 3GPP TS 33.501, V16.3.0, pp. 1-248 (Jul. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Technical Realization of Service Based Architecture; Stage 3 (Release 16),” 3GPP TS 29.500 V16.4.0, pp. 1-79 (Jun. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Network Data Analytics Services; Stage 3 (Release 16),” 3GPP TS 29.520 V16.4.0, pp. 1-91 (Jun. 2020).
Communication of European publication number and information on the application of Article 67(3) EPC for European Application Serial No. 18731923.1 (dated Apr. 8, 2020).
Sahu et al., “How 5G Registration Works,” http://5gblogs.com/5g-registration/, 10 pages (Oct. 12, 2018).
Dierks et al., “The Transport Layer Security (TLS) Protocol Version 1.2,” RFC 5246, pp. 1-208 (Aug. 2008).
Housley et al., “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile,” RFC 3280, pp. 1-258 (Apr. 2002).
Commonly-Assigned, co-pending U.S. Appl. No. 17/185,934 for “Methods, Systems, and Computer Readable Media for Mitigating Location Tracking and Denial of Service (DoS) Attacks that Utilize Access and Mobility Management Function (AMF) Location Service,” (Unpublished, filed Feb. 25, 2021).
Communication under Rule 71(3) EPC Intention to grant for European Application Serial No. 18 756 018.0 (dated Feb. 24, 2021).
Commonly-Assigned, co-pending U.S. Appl. No. 17/175,260 for “Methods, Systems, and Computer Readable Media for Short Message Delivery Status Report Validation,” (Unpublished, filed Feb. 12, 2021).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Service requirements for the 5G system; Stage 1 (Release 18),” 3GPP TS 22.261, V18.1.1, pp. 1-85 (Jan. 2021).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS); Stage 2 (Release 16),” 3GPP TS 23.502, V16.7.1, pp. 1-603 (Jan. 2021).
Fajardo, V. et al., “Diameter Base Protocol, Internet Engineering Task Force (IETF),” RFC 6733, pp. 1-152 (Oct. 2012).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Numbering, addressing and identification; (Release 17),” 3GPP TS 23.003, V17.0.0, pp. 1-142 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Wireless and wireline convergence access support for the 5G System (5GS) (Release 16),” 3GPP TS 23.316, V16.6.0, pp. 1-83 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 17),” 3GPP TS 33.501, V17.0.0, pp. 1-253 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Common Data Types for Service Based Interfaces; Stage 3 (Release 17),” 3GPP TS 29.571, V17.0.0, pp. 1-128 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Public Land Mobile Network (PLMN) Interconnection; Stage 3 (Release 16),” 3GPP TS 29.573, V16.5.0, pp. 1-98 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Location Management Services; Stage 3 (Release 16),” 3GPP TS 29.572, V16.5.0, pp. 1-77 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Access and Mobility Management Services; Stage 3 (Release 17),” 3GPP TS 29.518, V17.0.0, pp. 1-298 (Dec. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; System architecture for the 5G System (5GS); Stage 2 (Release 16),” 3GPP TS 23.501, V16.7.0, pp. 1-450 (Dec. 2020).
SMS Test Numbers: SMS Fake Delivery Receipts, Fake DLR—Tel!—SMS Test Platform and SMS services, Nov. 6, 2020, pp. 1-6, https://telqtele.com/sms-fake-delivery-receipts-fake-dlr/.
Communication of European publication number and information on the application of Article 67(3) EPC for European Application Serial No. 18756018.0 (dated May 13, 2020).
3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; T8 reference point for Northbound APIs, (Release 15), 3GPP TS 29.122, V15.6.0, pp. 1-300 (Dec. 2019).
DeKok, “The Network Access Identifier,” Internet Engineering Task Force (IETF), RFC 7542, pp. 1-30 (May 2015).
Croft, N., “On Forensics: A Silent SMS Attack,” Information and Computer Security Architectures (ICSA) Research Group, Department of Computer Science, pp. 1-4, University of Pretoria, South Africa (2012).
Constantin, L., “Remote SMS attack can force mobile phones to send premium-rate text messages: Applications installed by operators on SIM cards can be exploited remotely for SMS fraud and DoS purposes,” IDG News Service, Dec. 19, 2011, pp. 1-5, IDG Communications, Inc., United States.
Non-Final Office Action for U.S. Appl. No. 16/024,422 (dated Jul. 8, 2020).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; 5G System; Network Function Repository Services; Stage 3 (Release 16),” 3GPP TS 29.510, V16.4.0, pp. 1-192 (Jul. 2020).
Applicant-Initiated Interview Summary for U.S. Appl. No. 16/100,172 (dated Jun. 9, 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 16),” 3GPP TS 33.501, V16.2.0, pp. 1-227 (Mar. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS); Stage 2 (Release 16),” 3GPP TS 23.502, V16.4.0, pp. 1-582 (Mar. 2020).
Non-Final Office Action for U.S. Appl. No. 16/100,172 (dated Mar. 6, 2020).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 15/666,300 (dated Feb. 13, 2020).
Commonly-Assigned, co-pending U.S. Appl. No. 16/732,098 for “Methods, Systems, and Computer Readable Media for Implementing Indirect General Packet Radio Service (GPRS) Tunneling Protocol (GTP) Firewall Filtering Using Diameter Agent and Signal Transfer Point (STP),” (Unpublished, filed Dec. 31, 2019).
Advisory Action and Applicant-Initiated Interview Summary for U.S. Appl. No. 16/100,172 (dated Dec. 20, 2019).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 5G Security Assurance Specification (SCAS) for the Security Edge Protection Proxy (SEPP) network product class (Release 16),” 3GPP TS 33.517, V.16.1.0, pp. 1-17 (Dec. 2019).
“FS.19 Diameter Interconnect Security,” GSMA, pp. 1-3 (Dec. 20, 2019).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application Serial No. PCT/US2019/042203 (dated Nov. 11, 2019).
Applicant-Initiated Interview Summary for U.S. Appl. No. 15/666,300 (dated Oct. 29, 2019).
Final Office Action for U.S. Appl. No. 16/100,172 (dated Oct. 3, 2019).
“Technical Specification Group Core Network and Terminals; Evolved Packet System (EPS); Mobility Management Entity (MME) and Serving GPRS Support Node (SGSN) related interfaces based on Diameter protocol (Release 16),” 3GPP TS 29.272, V16.0.0, pp. 1-180 (Sep. 2019).
“Technical Specification Group Core Network and Terminals; Policy and Charging Control (PCC); Reference points (Release 16),” 3GPP TS 29.212, V16.1.0, pp. 1-285 (Sep. 2019).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application Serial No. PCT/US2019/028814 (dated Aug. 20, 2019).
Applicant-Initiated Interview Summary for U.S. Appl. No. 16/100,172 (dated Jul. 18, 2019).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 15/376,631 (dated Jul. 2, 2019).
“Technical Specification Group Core Network and Terminals; Mobile Application Part (MAP) specification (Release 15),” 3GPP TS 29.002, V15.5.0, pp. 1-1024 (Jun. 2019).
Non-Final Office Action for U.S. Appl. No. 15/666,300 (dated Jun. 27, 2019).
Decision on Appeal for U.S. Appl. No. 13/047,287 (Jun. 18, 2019).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Patent Application No. PCT/US2019/018990 (dated May 8, 2019).
Commonly-Assigned, co-pending U.S. Appl. No. 16/379,488 for “Methods, Systems, and Computer Readable Media for Dynamically Learning and Using Foreign Telecommunications Network Mobility Management Node Information for Security Screening,” (Unpublished, filed Apr. 9, 2019).
Non-Final Office Action for U.S. Appl. No. 16/100,172 (dated Apr. 11, 2019).
Notice of Allowability for U.S. Appl. No. 16/035,008 (dated Mar. 18, 2019).
Notice of Allowance and Fee(s) Due for U.S. Appl. No. 16/035,008 (dated Jan. 18, 2019).
Advisory Action Before the Filing of an Appeal Brief and AFCP 2.0 Decision for U.S. Appl. No. 15/376,631 (dated Dec. 19, 2018).
Notice of Allowance and Fee(s) Due and Applicant-Initiated Interview Summary for U.S. Appl. No. 15/408,155 (dated Oct. 31, 2018).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Patent Application No. PCT/US2018/043985 (dated Oct. 9, 2018).
Final Office Action for U.S. Appl. No. 15/376,631 (dated Oct. 5, 2018).
Notice of Allowance and Fee(s) Due for U.S. Appl. No. 15/636,118 (dated Oct. 3, 2018).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2018/030319 (dated Aug. 20, 2018).
Final Office Action for U.S. Appl. No. 15/408,155 (dated Jul. 26, 2018).
Notice of Allowance and Fee(s) Due for U.S. Appl. No. 15/636,118 (dated Apr. 27, 2018).
Non-Final Office Action for U.S. Appl. No. 15/376,631 (dated Apr. 18, 2018).
“Signalling Security in Telecom SS7/Diameter/5G,” Enisa, pp. 1-30 (Mar. 2018).
Examiner's Answer for U.S. Appl. No. 13/047,287 (dated Feb. 26, 2018).
Advisory Action Before the Filing of an Appeal Brief and AFCP 2.0 Decision for U.S. Appl. No. 15/376,631 (dated Feb. 2, 2018).
Non-Final Office Action for U.S. Appl. No. 15/408,155 (dated Jan. 9, 2018).
Final Office Action for U.S. Appl. No. 15/376,631 (dated Nov. 28, 2017).
“GSMA Guidelines for Diameter Firewall,” NetNumber Inc., pp. 1-7 (Sep. 12, 2017).
“Oracle Communications Diameter Signaling Router Main Differentiators,” Oracle White Paper, pp. 1-10 (Jul. 2017).
“LTE and EPC Roaming Guidelines,” GSM Association, Official Document IR.88, V 16.0, pp. 1-90 (Jul. 5, 2017).
Non-Final Office Action for U.S. Appl. No. 15/376,631 (dated Jun. 16, 2017).
“LTE International Roaming Whitepaper,” http://carrier.huawei.com/en/technical-topics/core-network/lte-roaming-whitepaper, pp. 1-16 (Downloaded May 12, 2017).
“Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Universal Geographical Area Description (GAD) (3GPP TS 23.032 V 14.0.0 Release 14),” ETSI TS 123 032 V14.0.0, pp. 1-30 (May 2017).
Final Office Action for U.S. Appl. No. 13/047,287 (dated Mar. 10, 2017).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Functional stage 2 description of Location Services (LCS) (Release 14),” 3GPP TS 23.271 V14.1.0, pp. 1-181 (Mar. 2017).
“Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Cx and Dx interfaces based on the Diameter protocol; Protocol details (3GPP TS 29.229 V 13.1.0 Release 13),” ETSI TS 129 229 V13.1.0, pp. 1-42 (Jan. 2017).
“Edge Router (DEA),” http://www.mavenir.com/our-products/mobile/edge-router-dea, pp. 1-7 (Copyright 2017).
Non-Final Office Action for U.S. Appl. No. 13/047,287 (dated Aug. 25, 2016).
“Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); Numbering, addressing and identification (3GPP TS 23.003 V 12.9.0 Release 12),” ETSI TS 1 23 003 V12.9.0, pp. 1-93 (Mar. 2016).
“Syniverse Guide to LTE Roaming and Interoperability,” https://www.syniverse.com/assets/files/custom_content/lte-roaming-interoperability-guide.pdf, pp. 1-11 (Jan. 8, 2016).
“Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Location Services (LCS); LCS Application Protocol (LCS-AP) between the Mobile Management Entity (MME) and Evolved Serving Mobile Location Centre (E-SMLC); SLS interface (3GPP TS 29.171 V 11.4.0 Release 11),” ETSI TS 129 171 V11.4.0, pp. 1-52 (Jan. 2016).
“Diameter Signaling Control (DSC),” https://www.extent.com/diameter-signaling-control-dsc/, pp. 1-3 (Copyright 2016).
Kotte, “Analysis and Experimental Verification of Diameter Attacks in Long Term Evolution Networks,” http://www.diva-portal.org/smash/get/diva2:951619/FULLTEXT01.pdf, pp. 1-72 (2016).
Advisory Action Before the Filing of an Appeal Brief for U.S. Appl. No. 13/047,287 (dated Oct. 16, 2015).
“The Dialogic® Helix™ Signaling Controller,” https://www.dialogic.com/-/media/products/docs/brochures/14090-helix-br.pdf, pp. 1-5 (Aug. 2015).
Final Office Action for U.S. Appl. No. 13/047,287 (dated Jun. 4, 2015).
“Digitial cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Location Services (LCS); Evolved Packet Core (EPC) LCS Protocol (ELP) between the Gateway Mobile Location Centre (GMLC) and the Mobile Management Entity (MME); SLg interface (3GPP TS 29.172 version 9.6.0 Release 9),”ETSI TS 129 172, V9.6.0, pp. 1-27 (Apr. 2015).
“Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; Location Services (LCS); Diameter-based SLh interface for Control Plane LCS (3GPP TS 29.173 version 12.2.0 Release 12),” ETSI TS 129 173, V12.2.0., p. 1-20 (Oct. 2014).
Non-Final Office Action for U.S. Appl. No. 13/047,287 (dated Sep. 25, 2014).
Supplemental Notice of Allowance and Fee(s) Due for U.S. Appl. No. 12/823,559 (dated Aug. 23, 2013).
Notice of Allowance and Fee(s) Due for U.S. Appl. No. 12/823,559 (dated Aug. 1, 2013).
Email to U.S. Patent and Trademark Office dated Jun. 28, 2013.
Final Office Action for U.S. Appl. No. 12/823,559 (dated Apr. 11, 2013).
Final Office Action for U.S. Appl. No. 13/047,287 (dated Jan. 31, 2013).
Non-Final Office Action for U.S. Appl. No. 12/823,559 (dated Nov. 14, 2012).
“Digital cellular telecommunications system (Phase 2+); Universal Monile Telecommunications System (UMTS); LTE; Location Services (LCS); Service description; Stagel (3GPP TS 22.071 V 11.0.0 Release 11,” ETSI TS 122 071 V11.0.0, pp. 1-50 (Oct. 2012).
Restriction and/or Election Requirement for U.S. Appl. No. 12/823,559 (dated Aug. 27, 2012).
Notice of Allowance and Fee(s) due for U.S. Appl. No. 12/581,739 (dated Aug. 8, 2012).
Non-Final Office Action for U.S. Appl. No. 13/047,287 (dated Jun. 6, 2012).
Notice of Allowance and Fee(s) Due and Examiner-Initiated Interview Summary for U.S. Appl. No. 12/581,739 (dated May 15, 2012).
Non-Final Office Action for U.S. Appl. No. 12/722,460 (dated Apr. 9, 2012).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Telecommunication management; Charging management; Diameter charging applications (Release 11),” 3GPP TS 32.299, V11.3.0, pp. 1-150 (Mar. 2012).
“Net-Net Diameter Director,” http://www.oracle.com/us/industries/communications/net-net-diameter-director-ds-1985034.pdf, pp. 1-9 (Copyright 2012).
Final Office Action for U.S. Appl. No. 12/581,739 (dated Dec. 30, 2011).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Policy and Charging Control (PCC) over Gx/Sd reference point (Release 11),” 3GPP TS 29.212, V11.3.0, pp. 1-171 (Dec. 2011).
Non-Final Office Action for U.S. Appl. No. 12/581,739 (dated Aug. 26, 2011).
Press Release, “SmartSynch SmartMeters Communicate Using the Largest and Most Available Wireless Networks in the World,” http://www.smartsynch.com/SmartSynch_gprs.htm, pp. 1-2 (Downloaded from the Internet on Jul. 5, 2011).
“Solution: Itron CENTRON GPRS,” Data Sheet, http://www.smartsynch.com/SmartSynch_itron_centron.htm, pp. 1-3 (Downloaded from the Internet on Jul. 5, 2011).
Myers, “SmartSynch Introduces Innovative ‘DCX’ Smart Grid Solution at DistribuTECH,” SmartSynch News, http://www.appmesh.com/news/020309.htm, pp. 1-3 Feb. 3, 2009 (Downloaded from the Internet on Jul. 5, 2011).
“NES System Architecture,” Data Sheet, Copyright 2009, pp. 1-2 (Downloaded from the Internet on Jul. 5, 2011).
“Wireless M-Bus and ZigBee®-enabled GSM/GPRS/ EDG Gateway for Smart Metering Introduced,” Metering.com, http://www.metering.com/node/13550 Sep. 19, 2008, pp. 1-2 (Downloaded from the Internet on Jul. 5, 2011).
Notification of Transmittal of the Internatioanl Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2010/027043 (dated Oct. 19, 2010).
“Draft LS on network verification of UE provided location,” 3GPP TSG SA WG2 Meeting #81, pp. 1 (Oct. 11-15, 2010).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2009/061187 (dated May 17, 2010.
Press Release, “Echelon and T-Mobile Announce Alliance to Reduce the Cost of a Secure Smart Grid Network for Utilities,” Echelon Corp., http://www.3gamericas.org/index.cfm?fuseaction=pressreleasedisplay&pressreleaseid=2201, pp. 1-3 (Apr. 23, 2009).
“3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Evolved Packet System (EPS); Mobility Management Entity (MME) and Serving GPRS Support Node (SGSN) related interfaces based on Diameter protocol (Release 8),” 3GPP TS 29.272, V8.1.1, pp. 1-57 (Jan. 2009).
“3rd Generation Partnership Project; Technical Specification Group Core Network; Unstructured Supplementary Service Data (USSD); Stage 2 (Release 8),” 3GPP TS 23.090, V8.0.0, pp. 1-32 (Dec. 2008).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Unstructured Supplementary Service Data (USSD)—Stage 1 (Release 8),” 3GPP TS 22.090, V8.0.0, pp. 1-10 (Dec. 2008).
“Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); Circuit Switched (CS) fallback in Evolved Packet System (EPS); Stage 2 (3GPP TS 23.272 V 8.0.0 Release 8),” ETSI TS 123 272 V8.0.0, pp. 1-42 (Nov. 2008).
3rd Generation Partnership Project “Technical Specification Group Core Network and Terminals; Study into routeing of MT-SMs via the HPLMN (Release 7),” 3GPP TR 23.840 V7.1.0 (Mar. 2007).
Hakala et al., “Diameter Credit-Control Application,” RFC 4006, pp. 1-115 (Aug. 2005).
Decision to grant a European patent pursuant to Article 97(1) EPC for European Patent Application Serial No. 18731923.1 (dated Jul. 15, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/029977 (dated Jul. 9, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/029973 (dated Jul. 7, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/024002 (dated Jun. 29, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/024980 (dated Jun. 23, 2021).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security Aspects; Study on security aspects of the 5G Service based Architecture (SBA) (Release 16),” 3GPP TR 33.855, V16.0.0, pp. 1-104 (Jul. 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security Assurance Specification (SCAS) threats and critical assets in 3GPP network product classes (Release 16),” 3GPP TR 33.926, V16.3.0, pp. 1-60 (Mar. 2020).
“New Annex for the SEPP in TR 33.926,” 3GPP TSG-SA WG3 Meeting #95-BIS, pp. 1-6 (Jun. 24-28, 2019).
“N32 message anti-spoofing within the SEPP,” 3GPP TSG SA WG3 (Security), Meeting #91, pp. 1-2 (Apr. 16-20, 2018).
Communication of European publication number and information on the application of Article 67(3) EPC for European Patent Application Serial No. 19730571.7 (dated Apr. 8, 2021).
International Search Report for International Patent Application Serial No. PCT/US2020/065763 (dated Apr. 6, 2021).
First Examination Report for Indian Patent Application Serial No. 201947047367 (dated Mar. 31, 2021).
Notice of Allowance for Chinese Patent Application Serial No. 201880040477.9 (dated Mar. 29, 2021).
Communication under Rule 71 (3) EPC Intention to Grant for European Patent Application Serial No. 18 731 923.1 (dated Mar. 22, 2021).
First Examination Report for Indian Patent Application Serial No. 201947047012 (dated Mar. 18, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2022/013373 (dated Apr. 11, 2022).
Notice of Allowance for U.S. Appl. No. 16/732,098 (dated Apr. 6, 2022).
Examination Report for Indian Application Serial No. 202147030053 (dated Mar. 22, 2022).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority or the Declaration for International Application No. PCT/US2021/057156 (dated Mar. 3, 2022).
Non-Final Office Action for Chinese Application Serial No. 202080007649.X (dated Mar. 2, 2022).
Non-Final Office Action for U.S. Appl. No. 17/076,482 (dated Apr. 1, 2022).
Nokia et al., “Support of the mapping from IP addressing information provided to an AF to the user identity,” 3GPP SA WG2 Meeting #142e pp. 1-3 (Nov. 16-20, 2020).
China Telecom, “KI #13, New Sol: Trigger Procedures for Requesting Analytics,” 3GPP SA WG2 Meeting #S2-139E pp. 1-4 (Aug. 19-Sep. 2, 2020).
First Office Action for Japanese Application Serial No. 2021545918 (dated Mar. 8, 2022).
Non-Final Office Action for U.S. Appl. No. 17/129,487 (dated Mar. 21, 2022).
Decision to grant a European patent pursuant to Article 97(1) EPC for European Patent Application Serial No. 19710842.6 (dated Feb. 24, 2022).
Notice of Allowance for Chinese Application Serial No. 201880040478.3 (dated Feb. 28, 2022).
Notice of Allowance for Japanese Application Serial No. 2019572174 (dated Feb. 8, 2022).
Final Office Action for U.S. Appl. No. 17/099,683 (dated Feb. 15, 2022).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/057157 (dated Jan. 27, 2022).
Examination Report for Indian Application Serial No. 202147005810 (dated Jan. 24, 2022).
Examination Report for Indian Application Serial No. 202147001641 (dated Jan. 13, 2022).
Examination Report for Indian Application Serial No. 202047056970 (dated Jan. 13, 2022).
Commonly-Assigned, co-pending U.S. Appl. No. 17/319,023 for “Methods, Systems, and Computer Readable Media for Conducting a Velocity Check for Outbound Subscribers Roaming to Neighboring Countries,” (Unpublished, May 12, 2021).
Nokia et al., “3gpp-Sbi-Consumer-Id,” 3GPP TSG-CT WG4 Meeting #101e pp. 1-4 (Nov. 3-13, 2020).
Nokia et al., “SBA Network Function certificate profile,” 3GPTT TSG-SA WG3 Meeting #98e pp. 1-5 (Mar. 2-6, 2020).
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security Aspects; Study on security aspects of the 5G Service Based Architecture (SBA) (Release 16),” 3GPP TR 33.855, V1.3.0 pp. 1-52 (Nov. 2018).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/042660 (dated Oct. 26, 2021).
Hearing Notice of Indian Application Serial No. 201947047367 (Oct. 11, 2021).
First Office Action for Japanese Application Serial No. 2019572174 (dated Sep. 14, 2021).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration for International Application No. PCT/US2021/033030 (dated Aug. 20, 2021).
First Office Action for Chinese Application Serial No. 201880040478.3 (dated Aug. 26, 2021).
Notification Concerning Availability of the Publication of the International Application for International Application No. PCT/US2020/065763 (dated Jul. 8, 2021).
Non-Final Office Action for U.S. Appl. No. 17/099,683 (dated Sep. 20, 2021).
“KI#13, New Sol: Trigger Procedures for Request Analytics,” China Telecom, SA WG2 Meeting #S2-139E, pp. 1-4 (Aug. 19-Sep. 2, 2020).
“5G; Procedures for the 5G System (3GPP TS 23.502 version 15.3.0 Release 15),” ETSI TS 123 502, V15.3.0, pp. 1-330 (Sep. 2018).
Non-Final Office Action for U.S. Appl. No. 17/009,683 (dated Jul. 15, 2022).
Decision to grant a European patent pursuant to Article 97(1) EPC for European Patent Application Serial No. 19710842.6 (dated Jun. 30, 2022).
Notice of Allowance for Chinese Application Serial No. 202080007649.X (dated Jun. 20, 2022).
Communication under Rule 71(3) EPC Intention to Grant for European Patent Application Serial No. 19 749 059.2 (dated May 16, 2022).
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority or the Declaration for International Application No. PCT/US2021/042853 (dated Oct. 18, 2021).
Advisory Action and Applicant-Initiated Interview Summary for U.S. Appl. No. 17/099,683 (dated May 23, 2022).
“Edge Router (DEA),” Mavenir, pp. 1-7 (2017).
Press Release, “Echelon and T-Mobile Announce Alliance to Reduce the Cost of a Secure Smart Grid Network for Utilities,” Echelon Corp., https://www.tdworld.com/smart-utility/article/20956244/echelon-and-tmobile-announce-alliance-to-reduce-the-cost-of-a-secure-smart-grid-network-for-utilities, p. 1-10 (May 14, 2009).
Related Publications (1)
Number Date Country
20220022040 A1 Jan 2022 US