Using a Message Bus Controller to Protect 5G Core Elements

Abstract

Using a message bus controller to protect 5G core elements can include accessing, by a computing device that executes a message bus controller, a message in a message bus of a packet core of a cellular network. The message can be generated by a first network function and transmitted to a second network function via the message bus, wherein the second network function can subscribe to messages from the first network function. The computing device can determine if delivery of the message to the second network function should be restricted. If so, the computing device can drop the message, and if not, the computing device can allow a message flow associated with the message to resume.

1 . A system comprising:
 a processor; and   a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising
 accessing, by a computing device that executes a message bus controller, a message in a message bus of a packet core of a cellular network, wherein the message is generated by a first network function and transmitted to a second network function via the message bus, and wherein the second network function subscribes to messages from the first network function, 
 in response to a determination based on accessing a contextual message that describes abnormal activity in the cellular network that delivery of the message to the second network function should be restricted, dropping, by the computing device, the message, and 
 in response to a determination based on accessing the contextual message that describes the abnormal activity in the cellular network that the delivery of the message to the second network function should not be restricted, resuming, by the computing device, a message flow associated with the message. 
   
     
     
         2 . The system of  claim 1 , wherein determining that the delivery of the message to the second network function should not be restricted further comprises determining, by the processor, that the message is not directed to a sensitive element comprising a network element that is susceptible to overflow attacks or distributed denial of service attacks. 
     
     
         3 . The system of  claim 1 , wherein determining that the delivery of the message to the second network function should not be restricted further comprises determining, by the computing device, that the message is directed to a sensitive element comprising a network element that is susceptible to overflow or distributed denial of service attacks; and
 in response to a determination that the message is directed to the sensitive element,
 determining, by the computing device, a capacity of the sensitive element, 
 defining, by the computing device, a message threshold for the sensitive element based on the capacity determined, when a determination is made that the message threshold is exceeded, dropping, by the computing device, the message, and 
 when a determination is made that the message threshold is not exceeded, determining, by the computing device, that the delivery of the message to the second network function should not be restricted. 
   
     
     
         4 . The system of  claim 1 , wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is associated with the abnormal activity, and wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is not associated with the abnormal activity. 
     
     
         5 . The system of  claim 1 , wherein accessing the contextual message comprises obtaining the contextual message from the message bus, wherein the contextual message is generated by a network data analytic function operating in the packet core. 
     
     
         6 . The system of  claim 1 , wherein accessing the contextual message comprises receiving the contextual message from a threat monitor via a separate interface of the message bus controller, wherein the contextual message is generated by the threat monitor. 
     
     
         7 . A method comprising:
 accessing, by a computing device comprising a processor that executes a message bus controller, a message in a message bus of a packet core of a cellular network, wherein the message is generated by a first network function and transmitted to a second network function via the message bus, and wherein the second network function subscribes to messages from the first network function;   in response to a determination based on accessing a contextual message that describes abnormal activity in the cellular network that delivery of the message to the second network function should be restricted, dropping, by the computing device, the message; and   in response to a determination based on accessing the contextual message that describes the abnormal activity in the cellular network that the delivery of the message to the second network function should not be restricted, resuming, by the computing device, a message flow associated with the message.   
     
     
         8 . The method of  claim 7 , wherein determining that the delivery of the message to the second network function should not be restricted further comprises determining, by the processor, that the message is not directed to a sensitive element comprising a network element that is susceptible to overflow attacks or distributed denial of service attacks. 
     
     
         9 . The method of  claim 7 , wherein determining that the delivery of the message to the second network function should not be restricted further comprises:
 determining, by the processor, that the message is directed to a sensitive element comprising a network element that is susceptible to overflow or distributed denial of service attacks; and   in response to a determination that the message is directed to the sensitive element,
 determining, by the processor, a capacity of the sensitive element, 
 defining, by the processor, a message threshold for the sensitive element based on the capacity determined, when a determination is made that the message threshold is exceeded, dropping, by the processor, the message, and 
 when a determination is made that the message threshold is not exceeded, determining, by the processor, that the delivery of the message to the second network function should not be restricted. 
   
     
     
         10 . The method of  claim 9 , wherein the cellular network comprises a fifth generation cellular network, wherein the sensitive element comprises a core element of the fifth generation cellular network, and wherein the capacity of the sensitive element is determined by the computing device querying the sensitive element to determine the capacity of the sensitive element. 
     
     
         11 . The method of  claim 9 , wherein the cellular network comprises a fifth generation cellular network, wherein the sensitive element comprises a core element of the fifth generation cellular network, and wherein the message threshold is defined by the processor as seventy percent of the capacity of the sensitive element determined. 
     
     
         12 . The method of  claim 7 , wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is associated with the abnormal activity, and wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is not associated with the abnormal activity. 
     
     
         13 . The method of  claim 7 , wherein accessing the contextual message comprises obtaining the contextual message from the message bus, wherein the contextual message is generated by a network data analytic function operating in the packet core. 
     
     
         14 . The method of  claim 7 , wherein accessing the contextual message comprises receiving the contextual message from a threat monitor via a separate interface of the message bus controller, wherein the contextual message is generated by the threat monitor. 
     
     
         15 . A computer storage medium having computer-executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:
 accessing, by a computing device that executes a message bus controller, a message in a message bus of a packet core of a cellular network, wherein the message is generated by a first network function and transmitted to a second network function via the message bus, and wherein the second network function subscribes to messages from the first network function;   in response to a determination based on accessing a contextual message that describes abnormal activity in the cellular network that delivery of the message to the second network function should be restricted, dropping, by the computing device, the message; and   in response to a determination based on accessing the contextual message that describes the abnormal activity in the cellular network that the delivery of the message to the second network function should not be restricted, resuming, by the computing device, a message flow associated with the message.   
     
     
         16 . The computer storage medium of  claim 15 , wherein determining that the delivery of the message to the second network function should not be restricted further comprises determining, by the processor, that the message is not directed to a sensitive element comprising a network element that is susceptible to overflow attacks or distributed denial of service attacks. 
     
     
         17 . The computer storage medium of  claim 15 , wherein determining that the delivery of the message to the second network function should not be restricted comprises:
 determining, by the computing device, that the message is directed to a sensitive element comprising a network element that is susceptible to overflow or distributed denial of service attacks; and   in response to a determination that the message is directed to the sensitive element,
 determining, by the computing device, a capacity of the sensitive element, 
 defining, by the computing device, a message threshold for the sensitive element based on the capacity determined, when a determination is made that the message threshold is exceeded, dropping, by the computing device, the message, and 
 when a determination is made that the message threshold is not exceeded, determining, by the computing device, that the delivery of the message to the second network function should not be restricted. 
   
     
     
         18 . The computer storage medium of  claim 15 , wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is associated with the abnormal activity, and wherein determining that the delivery of the message to the second network function should be restricted comprises determining that the message is not associated with the abnormal activity. 
     
     
         19 . The computer storage medium of  claim 15 , wherein accessing the contextual message comprises obtaining the contextual message from the message bus, wherein the contextual message is generated by a network data analytic function operating in the packet core. 
     
     
         20 . The computer storage medium of  claim 15 , wherein accessing the contextual message comprises receiving the contextual message from a threat monitor via a separate interface of the message bus controller, wherein the contextual message is generated by the threat monitor.