Prevention of subscriber identity module spoofing for mobile user plane
Prevention of SIM spoofing in mobile user plane. A method includes establishing a session for a user equipment to communicate with a session management function (SMF) and a user plane function (UPF), and then snooping a message between the SMF and the UPF to acquire one or more of an address for the user equipment, a tunnel endpoint identifier, or an address for a node within a radio access network. The method includes generating a route for carrying the one or more of the address for the user equipment, the tunnel endpoint identifier, or the address for the node within the radio access network, and then providing the route to a router.
1 . A method comprising:
establishing a session for a user equipment to communicate with a session management function (SMF) and a user plane function (UPF);
snooping a message between the SMF and the UPF to acquire one or more of an address for the user equipment, a tunnel endpoint identifier, or an address for a node within a radio access network;
generating a route for carrying the one or more of the address for the user equipment, the tunnel endpoint identifier, or the address for the node within the radio access network;
providing the route to a router;
receiving an inner Internet Protocol (IP) packet from the user equipment to the node within the radio access network;
encapsulating the inner IP packet into each of a user datagram protocol packet, a general packet radio service (GPRS) tunneling protocol (GTP) packet, and an IP packet; and
causing the router to verify a source address for the inner IP packet.
2 . The method of claim 1 , further comprising attaching the user equipment to the node within the radio access network.
3 . The method of claim 1 , further comprising, in response to the node within the radio access network receiving a packet from the user equipment, causing the node within the radio access network to signal to an access and mobility management function (AMF).
4 . The method of claim 3 , further comprising causing the AMF to signal to the SMF, wherein the AMF signals to the SMF prior to establishing the session for the user equipment to communicate with the SMF and the UPF.
5 . The method of claim 1 , wherein snooping the message between the SMF and the UPF comprises a packet forwarding control protocol (PFCP) proxy snooping a PFCP message between the SMF and the UPF.
6 . The method of claim 1 , wherein generating the route comprises generating the route with a border gateway protocol (BGP) controller, and wherein the controller is further configured to update a corresponding Type1 Session Transformed (ST) route with the one or more of the address for the user equipment, the tunnel endpoint identifier, or the address for the node within the radio access network.
7 . The method of claim 1 , further comprising:
determining whether the inner IP packet was generated by the user equipment by determining whether a corresponding route for the user equipment has been announced by a BGP controller; and
in response to determining the corresponding route for the user equipment was announced by the BGP controller, forwarding the GTP packet to a mobile backhaul.
8 . The method of claim 7 , wherein the mobile backhaul is a transport network configured to connect a core network to the radio access network.
9 . The method of claim 1 , further comprising:
determining whether the inner IP packet was generated by the user equipment by determining whether a corresponding route for the user equipment has been announced by a BGP controller; and
in response to determining the corresponding route for the user equipment was not announced by the BGP controller, discarding the GTP packet.
10 . The method of claim 9 , wherein discarding the GTP packet is performed to prevent subscriber identity module (SIM) spoofing.
11 . The method of claim 1 , wherein the user equipment is communicating with a 5G radio access network.
12 . The method of claim 1 , wherein the user equipment is a cellular device capable of communicate with the node within the radio access network.
13 . The method of claim 1 , wherein the node within the radio access network is a gNodeB within a 5G radio access network.
14 . The method of claim 1 , wherein the user equipment is associated with a unique IMSI (International Mobile Subscriber Identity), and wherein establishing the session for the user equipment comprises establishing a session for receiving packets from the unique IMSI.
15 . The method of claim 1 , wherein the route is a Type1 Session Transformed (ST) route.
16 . The method of claim 1 , wherein the router is a provider edge router.
17 . The method of claim 1 , wherein the router is a cell site router.
18 . The method of claim 1 , further comprising instructing the router to store the route within a corresponding routing table.