Methods, systems, and computer readable media for mitigating 5G roaming spoofing attacks
Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.
1. A method for mitigating 5G roaming spoofing attacks, the method comprising:
obtaining, by a security edge protection proxy (SEPP) and from a transport layer security (TLS) message from a first node, a first identifier for the first node, wherein the first identifier for the first node is a fully qualified domain name (FQDN) of the first node located in a subject alternative name field of an X.509 certificate in the TLS message;
obtaining, by the SEPP and from an N32-c security capability negotiation message from the first node, a second identifier for the first node, wherein the second identifier is an FQDN located in a sender attribute of a SecNegotiateRegData or SecNegotiateRspData information element of the N32-c security capability negotiation message;
comparing the first and second identifiers for the first node;
when the SEPP determines that first and second identifiers do not match:
determining that second identifier for the first node is invalid; and
in response to determining that the second identifier for the first node is invalid, blocking inter-public land mobile network (PLMN) communications with the first node; and
when the SEPP determines that the first and second identifiers match:
performing a lookup for either the first identifier or the second identifier for the first node in a peer SEPP database; and
if either of the first identifier or the second identifier is present in the peer SEPP database, allowing inter-public land mobile network (PLMN) communications with the first node.
2. The method of claim 1 wherein the TLS message comprises a TLS certificate message.
3. The method of claim 1 wherein the SEPP is a responding SEPP in an N32-c security capability negotiation procedure and wherein obtaining the second identifier for the first node includes extracting the second identifier for the first node from a sender attribute of the Sec NegotiateReqData information element of the N32-c security capability negotiation message.
4. The method of claim 1 wherein the SEPP is an initiating SEPP in an N32-c security capability negotiation procedure and wherein obtaining the second identifier for the first node includes extracting the second identifier for the first node from a sender attribute of the SecNegotiateRspData information element of the N32-c security capability negotiation message.
5. The method of claim 1 comprising,
in response to determining that the first and second identifiers for the first node match and that a matching identifier is not present in the peer SEPP database, blocking inter-PLMN communications from the first node.
6. A system for mitigating 5G roaming spoofing attacks, the system comprising:
a security edge protection proxy (SEPP) including at least one processor and a memory; and
a 5G roaming spoofing attack mitigation module implemented by the at least one processor and configured to:
obtain, from a transport layer security (TLS) message from a first node, a first identifier for the first node, wherein the first identifier for the first node is a fully qualified domain name (FQDN) of the first node located in a subject alternative name field of an X.509 certificate in the TLS message;
obtain, from an N32-c security capability negotiation message from the first node, a second identifier for the first node, wherein the second identifier is an FQDN located in a sender attribute of a SecNegotiateReqData or Sec NegotiateRspData information element of the N32-c security capability negotiation message;
compare the first and second identifiers for the first node;
when the 5G roaming spoofing attack mitigation module determines that first and second identifiers do not match, the 5G roaming spoofing attack mitigation module is configured to:
determine that second identifier for the first node is invalid; and
in response to determining that the second identifier for the first node is invalid, block inter-public land mobile network (PLMN) communications with the first node; and
when the 5G roaming spoofing attack mitigation module determines that first and second identifiers match, the 5G roaming spoofing attack mitigation module is configured to:
perform a lookup for either the first identifier or the second identifier for the first node in a peer SEPP database; and
if either of the first identifier or the second identifier is present in the peer SEPP database, allow inter-public land mobile network (PLMN) communications with the first node.
7. The system of claim 6 wherein the TLS message comprises a TLS certificate message.
8. The system of claim 6 wherein the SEPP is a responding SEPP in an N32-c security capability negotiation procedure and wherein 5G roaming spoofing attack mitigation module is configured to obtain the second identifier for the first node by extracting the second identifier for the first node from a sender attribute of the SecNegotiateReqData information element of the N32-c security capability negotiation message.
9. The system of claim 6 wherein the SEPP is an initiating SEPP in an N32-c security capability negotiation procedure and wherein the 5G roaming spoofing attack mitigation module is configured to obtain the second identifier for the first node by extracting the second identifier for the first node from a sender information element attribute of the SecNegotiateRspData information element of the N32-c security capability negotiation message.
10. The system of claim 6 wherein the 5G roaming spoofing attack mitigation module is configured to,
in response to determining that the first and second identifiers for the first node match and that a matching identifier is not present in the peer SEPP database, block inter-PLMN communications from the first node.
11. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
obtaining, by a security edge protection proxy (SEPP) and from a transport layer security (TLS) message from a first node, a first identifier for the first node, wherein the first identifier for the first node is a fully qualified domain name (FQDN) of the first node located in a subject alternative name field of an X.509 certificate in the TLS message;
obtaining, by the SEPP and from an N32-c security capability negotiation message from the first node, a second identifier for the first node, wherein the second identifier is an FQDN located in a sender attribute of a SecNegotiateRecpata or SecNegotiateRspData information element of the N32-c security capability negotiation message;
comparing the first and second identifiers for the first node;
when the SEPP determines that first and second identifiers do not match:
determining that second identifier for the first node is invalid; and
in response to determining that the second identifier for the first node is invalid, blocking inter-public land mobile network (PLMN) communications with the first node; and
when the SEPP determines that the first and second identifiers match:
performing a lookup for either the first identifier or the second identifier for the first node in a peer SEPP database; and
if either of the first identifier or the second identifier is present in the peer SEPP database, allowing inter-public land mobile network (PLMN) communications with the first node.
12. The non-transitory computer readable medium of claim 11 wherein the TLS message comprises a TLS certificate message.