Abstract: Methods, systems, and computer readable media for limiting network function (NF) repository function (NRF) forwarding are disclosed. One example method for limiting NRF forwarding comprises: at a first NF comprising at least one processor: receiving a request message associated with a consumer NF; determining that the request message cannot be serviced by the first NF; inserting or modifying a forwarding limit value in the request message, wherein the forwarding limit value indicates a number of times that the request message can be forwarded; and forwarding the request message including the forwarding limit value toward a second NF.

Abstract: A method for protecting against mass NF deregistration attacks can be performed at an NRF or SCP. The method includes receiving an NFDeregister request for deregistering an NF. The method further includes classifying the NFDeregister request as suspect based on application of suspect NFDeregister request classification rules. The method further includes in response to classifying the NFDeregister request as suspect, queueing the NFDeregister request. The method further includes receiving an NF heart-beat message concerning the NF. The method further includes determining that the NF heart-beat message is received within an NF heart-beat time interval for the NF. The method further includes in response to determining that the NF heart-beat message is received within the NF heart-beat time interval for the NF, preventing processing of the NF Deregister request and blacklisting a sender of the NFDeregister request.

Abstract: A method for routing inter-public land mobile network (inter-PLMN) messages relating to existing subscriptions with a network function (NF) repository functions (NRFs) includes, at a security edge protection proxy (SEPP) implemented using at least one processor, automatically populating, by the SEPP, a subscription identifier to target NRF resource identification information mapping database accessible to the SEPP with mappings between subscription identifiers and target NRF resource identification information. The method further includes receiving an inter-PLMN message for modifying or deleting a subscription. The method further includes reading a subscription identifier from the message for modifying or deleting the subscription. The method further includes using the subscription identifier from the message for modifying or deleting the subscription to access the database and obtain an identifier associated with an NRF that created the subscription.

Abstract: Methods, systems, and computer readable media for network function (NF) discovery using preferred-locality information are disclosed. One example method for NF discovery using preferred-locality information comprises: at a first NF comprising at least one processor: receiving a message relating to a transaction involving a consumer NF; identifying, from the message, an NF instance identifier (ID) corresponding to the consumer NF; determining, using the NF instance ID and a data store including NF related information and corresponding preferred-locality information, a preferred-locality value; including the preferred-locality value in a preferred-locality information element (IE) of an NF discovery request; and transmitting the NF discovery request toward a second NF.

Abstract: A method for providing for optimized service based interface (SBI) communications by performing network function (NF) fully qualified domain name (FQDN) resolution at an NF repository function (NRF) includes, at an NRF including at least one processor, receiving NF register requests including NF profiles and/or NF service profiles, at least some of which include FQDNs and do not include Internet protocol (IP) addresses. The method further includes storing the NF profiles and/or NF service profiles in an NF profiles database. The method further includes resolving the FQDNs in NF profiles and/or NF service profiles into IP addresses. The method further includes receiving NF discovery requests. The method further includes generating lists of NF profiles and/or NF service profiles that match query parameters in the NF discovery requests. The method further includes providing the lists of NF profiles and/or NF service profiles including the IP addresses to consumer NFs in NF discovery responses.

Abstract: A method for processing NF discovery requests using prioritized lists of preferred locations includes maintaining an NF profiles database including NF profiles of producer NFs registered to provide service to other NFs and a preferred locality attribute mappings database including mappings between preferred locality attributes and prioritized lists of preferred locations. The method includes receiving, from an NF, an NF discovery request including query parameters and a preferred locality attribute. The method further includes accessing the preferred locality attribute mappings database using the preferred locality attribute and obtaining a prioritized list of preferred locations corresponding to the preferred locality attribute, accessing the NF profiles database using the query parameters and identifying NF profiles of producer NFs capable of providing a service indicated by the query parameters, and prioritizing the NF profiles according to the prioritized list of preferred locations.

Abstract: A method for DoS attacks at an NF includes maintaining, at a first NF, an NF subscription database containing rules that specify maximum numbers of allowed subscriptions and corresponding rule criteria. The method further includes receiving, at the first NF and from a second NF, a subscription request for establishing a subscription. The method further includes determining, by the first NF, that the subscription request matches criteria for at least one rule in the NF subscription database and incrementing, by the first NF, at least one count of a number of subscriptions for the at least one rule. The method further includes determining, by the first NF, that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule.

Abstract: A method for providing for network function (NF) fallback to a recovered network function NF repository function (NRF) includes, at an NF including at least one processor, generating an NF register message including an indication to notify the NF of recovery of a first NRF after a failure of the first NRF. The method further includes transmitting the NF register message to the first NRF. The method further includes communicating with the first NRF and detecting failure of the first NRF. The method further includes, in response to detecting failure of the first NRF, initiating communications with a second NRF that is a geo-redundant mate of the first NRF. The method further includes receiving notification of recovery of the first NRF and falling back to communicating with the first NRF.

Abstract: Methods, systems, and computer readable media for hiding network function (NF) instance identifiers (IDs) in communications networks are disclosed. One method for hiding NF instance IDs in a communications network occurs at an NF repository function (NRF) comprising at least one processor. The method comprises: receiving, from a first NF, an NF registration request message for registering a first NF instance of the first NF, wherein the NF registration request message includes a first NF instance ID for identifying the first NF instance; storing, in a data store, a mapping between the first NF instance ID and at least one pseudo NF instance ID, wherein the data store includes mappings between NF instance IDs and related pseudo NF instance IDs; and generating and sending, to the first NF, an NF registration response message including the at least one pseudo NF instance ID for identifying the first NF instance.

Abstract: A method for optimizing network bandwidth utilization through intelligent updating of network function (NF) profiles includes, at an NF repository function (NRF), receiving, from a first NF that previously communicated with a failed geo-redundant mate of the NRF as primary, an NF heart-beat request message. The method further includes locating an NF profile for the first NF in an NF profiles database maintained by the NRF. The method further includes computing an NF profile data modification detection value for the NF profile. The method further includes transmitting the NF profile data modification detection value to the first NF.

Abstract: Methods, systems, and computer readable media for determining time related parameter values for a communications network are disclosed. One method for determining time related parameter values for a communications network occurs at network function (NF) repository function (NRF) comprising at least one processor. The method comprises: receiving, from a first network function (NF), a service request message; determining, using network information and/or NF information, a time related parameter value associated with the service request message; and generating and sending, to the first NF, a service response message indicating the time related parameter value.

Abstract: A method for protecting against mass NF deregistration attacks can be performed at an NRF or SCP. The method includes receiving an NFDeregister request for deregistering an NF. The method further includes classifying the NFDeregister request as suspect based on application of suspect NFDeregister request classification rules. The method further includes in response to classifying the NFDeregister request as suspect, queueing the NFDeregister request. The method further includes receiving an NF heart-beat message concerning the NF. The method further includes determining that the NF heart-beat message is received within an NF heart-beat time interval for the NF. The method further includes in response to determining that the NF heart-beat message is received within the NF heart-beat time interval for the NF, preventing processing of the NF Deregister request and blacklisting a sender of the NFDeregister request.

Abstract: Methods, systems, and computer readable media for hiding network function (NF) instance identifiers (IDs) in communications networks are disclosed. One method for hiding NF instance IDs in a communications network occurs at an NF repository function (NRF) comprising at least one processor. The method comprises: receiving, from a first NF, an NF registration request message for registering a first NF instance of the first NF, wherein the NF registration request message includes a first NF instance ID for identifying the first NF instance; storing, in a data store, a mapping between the first NF instance ID and at least one pseudo NF instance ID, wherein the data store includes mappings between NF instance IDs and related pseudo NF instance IDs; and generating and sending, to the first NF, an NF registration response message including the at least one pseudo NF instance ID for identifying the first NF instance.

Abstract: A method for mitigating network function (NF) update and deregister attacks includes, at an NF repository function (NRF) implemented by at least one processor, receiving, from an NF, an NFRegister request including a hash of a first authentication string, an NF instance identifier, and an NF profile. The method further includes storing the hash of the first authentication string. The method further includes registering the NF by storing the NF profile in an NF profile database. The method further includes receiving a first NFUpdate or NFDeregister request including the NF instance identifier. The method further includes using the stored hash of the first authentication string to validate or reject the first NFUpdate or NFDeregister request.

Abstract: A method for DoS attacks at an NF includes maintaining, at a first NF, an NF subscription database containing rules that specify maximum numbers of allowed subscriptions and corresponding rule criteria. The method further includes receiving, at the first NF and from a second NF, a subscription request for establishing a subscription. The method further includes determining, by the first NF, that the subscription request matches criteria for at least one rule in the NF subscription database and incrementing, by the first NF, at least one count of a number of subscriptions for the at least one rule. The method further includes determining, by the first NF, that the at least one count of the number of subscriptions exceeds a maximum number of allowed subscriptions for the at least one rule.

Abstract: There is disclosed an apparatus. The apparatus comprises means for performing: initiating restoration of the apparatus after a restart of the apparatus, the initiating restoration being in response to receipt of a session initiation message at the apparatus; sending a request to a home subscriber server for a service profile of a user equipment from which the session initiation message originated, the request comprising a wildcard public identity of the user equipment; and completing restoration of the apparatus using service profile information received from the home subscriber server in response to the request.