Methods, systems, and computer readable media for performing location and velocity check at security edge protection proxy (SEPP) to avoid spoofing
A method for performing a location and velocity check at an SEPP to protect against a spoofing attack includes receiving an SBI request message relating to authentication of UE. The method further includes querying a database NF to obtain previous authentication information for the UE, the previous authentication information including a previous network identifier and a previous authentication time for the UE. The method further includes receiving a response from the database NF, the response including the previous network identifier and the previous authentication time. The method further includes reading, a current network identifier from the SBI request message, performing, using the current network identifier from the SBI request message, the previous network identifier, the previous authentication time, and a time of receipt by the SEPP of the SBI request message, a location and velocity check for the UE, and performing a network security action for the SBI request message based on results of the location and velocity check.
1. A method for performing a location and velocity check at a security edge protection proxy (SEPP) to protect against a spoofing attack, the method comprising:
receiving, at an SEPP, a service-based interface (SBI) request message relating to authentication of a user equipment (UE);
querying, by the SEPP, a database network function (NF) to obtain previous authentication information for the UE, the previous authentication information including a previous network identifier and a previous authentication time for the UE;
receiving, at the SEPP, a response from the database NF, the response including the previous network identifier and the previous authentication time;
reading, by the SEPP, a current network identifier from the SBI request message;
performing, by the SEPP and using the current network identifier from the SBI request message, the previous network identifier, the previous authentication time, and a time of receipt by the SEPP of the SBI request message, a location and velocity check for the UE; and
performing a network security action for the SBI request message based on results of the location and velocity check.
2. The method of claim 1 wherein receiving the SBI request message relating to authentication of a UE includes receiving an Nausf_UEauthentication message.
3. The method of claim 1 wherein querying the database NF includes transmitting an authentication information query message to a unified data repository (UDR) using an application programming interface (API) provided by the UDR for previous authentication information queries from the SEPP.
4. The method of claim 1 wherein querying the database NF includes transmitting an authentication information query message to a unified data management function (UDM) using an application programming interface (API) provided by the UDM for previous authentication information queries from the SEPP.
5. The method of claim 4 comprising, at the UDM, receiving the authentication information query message and querying a unified data repository (UDR) for the previous authentication information for the UE.
6. The method of claim 5 comprising, at the UDM, determining that the authentication information query message includes a subscription concealed identifier (SUCI), and, in response, prior to querying the UDR, invoking a subscription identifier de-concealing function (SIDF) to de-conceal the SUCI.
7. The method of claim 1 wherein reading the current network identifier from the SBI request message includes reading a public land mobile network (PLMN) ID from the SBI request message.
8. The method of claim 1 wherein performing the location and velocity check includes determining whether a distance between a previous network identified by the previous network identifier and a current network identified by the current network identifier could have been traveled by the UE in light of a time difference between the previous authentication time and the time of receipt of the SBI request message.
9. The method of claim 8 wherein performing the network security action includes blocking the SBI request message in response to determining that the distance could not have been traveled by the UE.
10. The method of claim 8 wherein performing the network security action includes blocking future messages from a sender of the SBI request message in response to determining that the distance could not have been traveled by the UE.
11. The method of claim 4 wherein the UDM queries a unified data repository (UDR) for the previous authentication information for the UE, the UDR provides the previous authentication information for the UE to the UDM, and the response received by the SEPP is from the UDM.
12. A system for performing a location and velocity check at a security edge protection proxy (SEPP) to protect against a spoofing attack, the system comprising:
an SEPP including at least one processor and a memory;
a user equipment (UE)-authentication-based location and velocity checker implemented by the at least one processor for receiving a service based interface (SBI) request message relating to authentication of a UE, querying a database network function (NF) to obtain previous authentication information for the UE, the previous authentication information including a previous network identifier and a previous authentication time for the UE, the UE-authentication-based location and velocity checker for receiving a response from the database NF, the response including the previous network identifier and the previous authentication time, reading, by the SEPP, a current network identifier from the SBI request message, performing, using the current network identifier from the SBI request message, the previous network identifier, the previous authentication time, and a time of receipt by the SEPP of the SBI request message, a location and velocity check for the UE, and performing a network security action for the SBI request message based on results of the location and velocity check.
13. The system of claim 12 wherein the SBI request message relating to authentication of a UE includes an Nausf_UEauthentication message.
14. The system of claim 12 wherein, in querying the database NF, the UE-authentication-based location and velocity checker is configured to transmit an authentication information query message to a unified data repository (UDR) using an application programming interface (API) provided by the UDR for previous authentication information queries from the SEPP.
15. The system of claim 12 wherein, in querying the database NF, the UE-authentication-based location and velocity checker is configured to transmit an authentication information query message to a unified data management function (UDM) using an application programming interface (API) provided by the UDM for previous authentication information queries from the SEPP.
16. The system of claim 12 wherein the current network identifier includes a public land mobile network (PLMN) ID.
17. The system of claim 12 wherein, in performing the location and velocity check, the UE-authentication-based location and velocity checker is configured to determine whether a distance between a previous network identified by the previous network identifier and a current network identified by the current network identifier could have been traveled by the UE in light of a time difference between the previous authentication time and the time of receipt of the SBI request message.
18. The system of claim 17 wherein the network security action includes blocking the SBI request message in response to determining that the distance could not have been traveled by the UE.
19. The system of claim 17 wherein the network security action includes blocking future messages from a sender of the SBI request message in response to determining that the distance could not have been traveled by the UE.
20. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
receiving, at a security edge protection proxy (SEPP), a service-based interface (SBI) request message relating to authentication of a user equipment (UE);
querying, by the SEPP, a database network function (NF) to obtain previous authentication information for the UE, the previous authentication information including a previous network identifier and a previous authentication time for the UE;
receiving, at the SEPP, a response from the database NF, the response including the previous network identifier and the previous authentication time;
reading, by the SEPP, a current network identifier from the SBI request message;
performing, by the SEPP and using the current network identifier from the SBI request message, the previous network identifier, the previous authentication time, and a time of receipt by the SEPP of the SBI request message, a location and velocity check for the UE; and
performing a network security action for the SBI request message based on results of the location and velocity check.