Prevention of subscriber identity module spoofing for mobile user plane

1 . A system comprising:

a session management function (SMF) within a radio access network;

a user plane function (UPF) within the radio access network, wherein the UPF communicates with the SMF; and

a packet forwarding control protocol (PFCP) proxy between the SMF and the UPF, wherein the PFCP proxy snoops PFCP messages between the SMF and the UPF;

wherein the PFCP proxy is in communication with a border gateway protocol BGP) controller, and wherein the BGP controller is in communication with a router;

wherein the PFCP proxy snoops the PFCP messages between the SMF and the UPF to acquire one or more of an address of a user equipment device, a tunnel endpoint identifier, or an address for a node within the radio access network.

2 . The system of claim 1 , further comprising the node within the radio access network, wherein the node receives a data packet from the user equipment device communicating via the radio access network.

3 . The system of claim 2 , further comprising the router in communication with the node, wherein the router comprises one or more of a provider edge router of a cell site router.

4 . The system of claim 2 , further comprising an access and mobility management function (AMF), wherein the node signals to the AMF in response to receiving the data packet from the user equipment device.

5 . The system of claim 4 , wherein the AMF signals to the SMF in response to receiving the data packet from the node.

6 . The system of claim 1 , wherein the PFCP proxy snoops the PFCP messages between the SMF and the UPF to acquire each of the address of the user equipment device, the tunnel endpoint identifier, and the address for the node within the radio access network.

7 . The system of claim 6 , wherein the BGP controller generates a route for carrying each of the address of the user equipment device, the tunnel endpoint identifier, and the address for the node within the radio access network.

8 . The system of claim 7 , wherein the BGP controller provides the route to the router, and wherein the router updates a routing table with the router.

9 . The system of claim 8 , wherein the router verifies a source address for a data packet received from the user equipment device; and

wherein the router determines whether the data packet was validly generated by the user equipment device based on the route received from the BGP controller and the source address.

10 . The system of claim 9 , wherein the router drops the data packet in response to determining the data packet was not validly generated by the user equipment device; and

wherein the router forwards the data packet to its destination in response to determining the data packet was validly generated by the user equipment device.

11 . The system of claim 6 , wherein the BGP controller generates a BGP flow specification based on a range of IP addresses associated with one or more user equipment devices.

12 . The system of claim 11 , wherein the node within the radio access network receives an inner Internet Protocol (IP) packet from the user equipment device; and

wherein the node encapsulates the inner IP packet into each of a user datagram protocol packet, a general packet radio service (GPRS) tunneling protocol (GTP) packet, and an IP packet.

13 . The system of claim 12 , wherein the router verifies a source address for the inner IP packet.

14 . The system of claim 13 , wherein the router verifies the inner IP packet encapsulation based on the BGP flow specification to determine whether the source address for the inner IP packet matches the range of IP addresses associated with the one or more user equipment devices.

15 . The system of claim 14 , wherein the router discards the GTP packet in response to determining the inner IP packet does not match the BGP flow specification; and

wherein the router forwards the GTP packet to its destination in response to determining the inner IP packet matches the BGP flow specification.

16 . The system of claim 1 , wherein the node within the radio access network encapsulate an inner IP packet received from the user equipment device into:

the inner IP packet;

a user datagram protocol (UDP) packet;

a GPRS tunneling protocol (GTP) packet, and

an IP packet.

17 . The system of claim 1 , further comprising:

the user equipment device that provides data packets to the node within the radio access network; and

an attacker attempting to spoof an identity of the user equipment device.

18 . The system of claim 17 , wherein the PFCP proxy snoops the PFCP messages between the SMF and the UPF to prevent spoofing by the attacker.