Methods, systems, and computer readable media for selective inter-public land mobile network (PLMN) security handshake validation
A method for selective inter-PLMN security handshake validation includes receiving, at a SEPP, a first inter-PLMN security handshake request message. The method further includes performing, by the SEPP and in an SEPP trust relationship database, a lookup to determine whether the first inter-PLMN security handshake request message originates from a trusted SEPP. The method further includes determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, and, in response, performing, by the SEPP, an inter-PLMN security handshake validation procedure on the first inter-PLMN security handshake request message. The method further includes determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, and, in response, performing a network protective operation.
1. A method for selective inter-public land mobile network (inter-PLMN) security handshake validation, the method comprising:
receiving, at a security edge protection proxy (SEPP), a first inter-PLMN security handshake request message, wherein receiving the first inter-PLMN security handshake request message includes receiving an Hypertext Transfer Protocol (HTTP) POST message for initiating an N32-c security capability negotiation procedure;
performing, by the SEPP and in an SEPP trust relationship database, a lookup to determine whether the first inter-PLMN security handshake request message originates from a trusted SEPP, wherein performing the lookup in the SEPP trust relationship database includes reading SEPP-identifying information from N32-c security negotiation request data carried in the HTTP POST message and using the SEPP-identifying information read from the N32-c security negotiation request data to perform the lookup in the SEPP trust relationship database and wherein using the SEPP-identifying information read from the N32-c security negotiation request data to perform the lookup includes using a sender fully qualified domain name (FQDN) from the N32-c security negotiation request data to perform the lookup;
determining, by the SEPP and based on the lookup, that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, wherein determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP includes determining that the sender FQDN is not present or is identified as untrusted in the SEPP trust relationship database;
in response to determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, performing, by the SEPP, an inter-PLMN security handshake validation procedure on the first inter-PLMN security handshake request message;
determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure; and
in response to determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, performing a network protective operation.
2. The method of claim 1 wherein performing the inter-PLMN security handshake validation procedure includes determining whether one or more PLMN identifiers registered with the SEPP for an originator of the first inter-PLMN security handshake request message matches one or more PLMN identifiers in the first inter-PLMN security handshake request message.
3. The method of claim 1 wherein performing the network protective operation includes rejecting the first inter-PLMN security handshake request message.
4. The method of claim 1 comprising:
receiving, at the SEPP, a second inter-PLMN security handshake request message;
performing, by the SEPP and in the SEPP trust relationship database, a lookup to determine whether the second inter-PLMN security handshake request message originates from a trusted SEPP;
determining, by the SEPP and based on the lookup, that the second inter-PLMN security handshake request message originates from a trusted SEPP; and
in response to determining that the second inter-PLMN security handshake request message originates from a trusted SEPP, processing the second inter-PLMN security handshake request message without performing the inter-PLMN security handshake validation procedure.
5. The method of claim 4 wherein receiving the second inter-PLMN security handshake request message includes receiving an HTTP POST message for initiating an N32-c security capability negotiation procedure.
6. The method of claim 4 wherein processing the second inter-PLMN security handshake request message includes registering, by the SEPP, a PLMN identifier obtained from the second inter-PLMN security handshake request as being associated with an originator of the second inter-PLMN security handshake request.
7. A system for selective inter-public land mobile network (inter-PLMN) security handshake validation, the system comprising:
a security edge protection proxy (SEPP) including at least one processor and a memory;
an inter-PLMN security handshake validation database located in the memory;
an SEPP trust relationship database located in the memory; and
a selective inter-PLMN security handshake validator executable by the at least one processor for receiving a first inter-PLMN security handshake request message, wherein the first inter-PLMN security handshake request message includes an Hypertext Transfer Protocol (HTTP) POST message for initiating an N32-c security capability negotiation procedure, the selective inter-PLMN security handshake validator for performing, in the SEPP trust relationship database, a lookup to determine whether the first inter-PLMN security handshake request message originates from a trusted SEPP, wherein, in performing the lookup in the SEPP trust relationship database, the selective inter-PLMN security handshake validator is configured to read SEPP-identifying information from N32-c security negotiation request data carried in the HTTP POST message and use the SEPP-identifying information read from the N32-c security negotiation request data to perform the lookup in the SEPP trust relationship database and wherein the SEPP-identifying information read from the N32-c security negotiation request data comprises a sender fully qualified domain name (FQDN), the selective inter-PLMN security handshake validator for determining, based on the lookup, that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, wherein the selective inter-PLMN security handshake validator is configured to determine that the first inter-PLMN security handshake request message does not originate from a trusted SEPP by determining that the sender FQDN is not present or is identified as untrusted in the SEPP trust relationship database, the selective inter-PLMN security handshake validator for, in response to determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, performing, using data in the inter-PLMN security handshake validation database, an inter-PLMN security handshake validation procedure on the first inter-PLMN security handshake request message, determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, and in response to determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, performing a network protective operation.
8. The system of claim 7 wherein the selective inter-PLMN security handshake validator is configured to perform the inter-PLMN security handshake validation procedure by determining whether one or more PLMN identifiers registered in the inter-PLMN security handshake validation database for an originator of the first inter-PLMN security handshake request message matches one or more PLMN identifiers in the first inter-PLMN security handshake request message.
9. The system of claim 7 wherein the selective inter-PLMN security handshake validator is configured to perform the network protective operation by rejecting the first inter-PLMN security handshake request message.
10. The system of claim 7 wherein the selective inter-PLMN security handshake validator is configured to:
receive a second inter-PLMN security handshake request message;
perform a lookup in the SEPP trust relationship database to determine whether the second inter-PLMN security handshake request message originates from a trusted SEPP;
determine, based on the lookup, that the second inter-PLMN security handshake request message originates from a trusted SEPP; and
in response to determining that the second inter-PLMN security handshake request message originates from a trusted SEPP, process the second inter-PLMN security handshake request message without performing the inter-PLMN security handshake validation procedure.
11. The system of claim 10 wherein the selective inter-PLMN security handshake validator is configured to process the second inter-PLMN security handshake request message by registering, by the SEPP, a PLMN identifier obtained from the second inter-PLMN security handshake request as being associated with an originator of the second inter-PLMN security handshake request.
12. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:
receiving, at a security edge protection proxy (SEPP), a first inter-public land mobile network (inter-PLMN) security handshake request message, wherein receiving the first inter-PLMN security handshake request message includes receiving an Hypertext Transfer Protocol (HTTP) POST message for initiating an N32-c security capability negotiation procedure;
performing, by the SEPP and in an SEPP trust relationship database, a lookup to determine whether the first inter-PLMN security handshake request message originates from a trusted SEPP, wherein performing the lookup in the SEPP trust relationship database includes reading SEPP-identifying information from N32-c security negotiation request data carried in the HTTP POST message and using the SEPP-identifying information read from the N32-c security negotiation request data to perform the lookup in the SEPP trust relationship database and wherein using the SEPP-identifying information read from the N32-c security negotiation request data to perform the lookup includes using a sender fully qualified domain name (FQDN) from the N32-c security negotiation request data to perform the lookup;
determining, by the SEPP and based on the lookup, that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, wherein determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP includes determining that the sender FQDN is not present or is identified as untrusted in the SEPP trust relationship database;
in response to determining that the first inter-PLMN security handshake request message does not originate from a trusted SEPP, performing, by the SEPP, an inter-PLMN security handshake validation procedure on the first inter-PLMN security handshake request message;
determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure; and
in response to determining that the first inter-PLMN security handshake request message fails the inter-PLMN security handshake validation procedure, performing a network protective operation.