BroadForward SEPP powers the world’s first live 5G standalone roaming connection
Achieving the highest GSMA recognition as the leading signaling experts
World-class signaling products: when progress matters to you
Providing network functions to the world’s leading MNOs, MVNOs, IoT, MNP and IPX providers

Diameter Firewall (DFW)

The BroadForward Diameter Firewall (BroadForward DFW) is a complete and advanced software-based solution that protects 4G networks against possible attacks, unauthorized senders, malformed messages, overload situations, and much more. The BroadForward DFW supports the relevant FS.19 GSMA guidelines for Signaling Firewalls of the Diameter protocol and can be deployed with the BroadForward SS7 Firewall (SS7FW) and the BroadForward 5G Firewall.

Latest Firewall requirements
Firewall technology has been undergoing a major shift from a limited fixed-rules (black box) function to an integrated security solution that can cover multiple access technologies and enables flexibility to adapt its firewall rules.

Many security solutions however do not offer a solution that works across 2G, 3G, 4G and 5G network technologies. They also often lack the features (and the flexibility) required to be compliant to the latest industry security recommendations. In the wake of a growing number of attacks, governments and regulators all over the world are demanding mobile operators to adopt more stringent security measures. Industry representative bodies (e.g. ENISA, GSMA) have published additional security recommendations – such as GSMA specifications FS.11 and FS.19 – which are designed to counter threats that are exposing design weaknesses in the security of legacy networks. Of these recommendations, the ability to detect implausible location changes is the single most important factor to establish mobile identity theft (MSISDN/IMSI), but also the most complex one to mitigate properly. New specifications are often open to interpretation, which requires solutions to offer flexibility to adapt security rules on the fly. And the complexity and interdependencies of security measures increase operators’ need to be able to perform non-intrusive testing of the effectiveness of security rules on a live network.

BroadForward Diameter Firewall
The BroadForward Diameter Firewall (DFW) is in use with leading mobile operators around the world. The DFW provides operators with a default set of firewall rules that implement the GSMA specifications FS.19. None of the firewall rules in the system are ‘hard-coded’ and therefore can be adapted for/by the operator as required. Also see: BroadForward again recognized by Kaleido as Champion vendor for signaling security

The DFW reduces the window of opportunity for criminals to exploit a breach on their mobile network. It detects and blocks duplicated SIM or SIM swap fraud in real-time by performing velocity tracking. This unique feature automatically determines – with a high degree of accuracy – whether roaming location changes are plausible in terms of the speed normally required to bridge that distance (‘time-distance plausibility’).

The easy-to-use Graphical User Interface provides full control of firewall rules and insight into signaling traffic. It provides extensive flexibility to configure, adapt, enable, or disable firewall rules that can be deployed across all supported access technologies. The use of readily available templates means operators do not require vendor involvement, scripting, or coding to manage or customize firewall rules.

The solution will detail how rules enforcement is reflected in Event Detail Record reporting, supporting improvements in roaming management and subsequent rules enforcement (IR.21 / IR.88 / NG.113 for 5G). The BroadForward Diameter Firewall can be deployed alongside other BroadForward functions, such as the SS7 Firewall, 5G Firewall, STP, DEA, and 5G SEPP. 


 

Transparent Mode
Each mobile network has their own specific security requirements and it is challenging for implementation teams to ensure firewall security rules are truly effective and without any negative side effects. The BroadForward Firewall has a unique feature to verify if security rules are actually effective and correctly implemented. The DFW offers a “transparent mode” feature allowing engineers to perform rule testing and fine tuning on the mobile network without impacting the live traffic. When introducing new firewall rules first in “transparent mode”, there will not be a blocking effect on traffic until they are fully tested in the live network and proven to block the fraud they are created for.

GSMA FS.19 categories
The GSMA regularly releases updates to its guidelines for “Diameter Interconnect Security” also known as the FS.19 recommendations. In general, these recommendations define the following four categories:

  • Category 0: Low-Layer Format filtering is to detect very simple spoofing attempts to relay messages into the network. It corresponds to low level (base) Diameter screening without the need to fully understand upper applications or decode specific AVPs, typically based on all lower-level information such as IP, host and realm screening as well as Diameter message format screening.
  • Category 1: corresponds to Application ID and Command Code screening without the need to decode specific AVPs. Category 1 filtering focuses on interface misuse (important to prevent external access to internal interfaces), hijacking interfaces and consistencies inside the message.
  • Category 2: corresponds to detailed AVP level screening e.g. using IMSI, MSISDN (User-Name AVPs). Such messages should not target internal subscribers from international interconnect. Receipt of these message needs to be permitted to support inbound roamers. Filtering is typically performed based on the User-Name AVP for this category, but it may extend to other AVPs. The User-Name AVP should only appear once in a message to avoid bypassing filtering.
  • Category 3: Practice for Category 3 filtering is to deny all Diameter messages except those expressly required for a given interface. Only the interface(s) required to support the MNO usage scenarios should be activated on the DRA. Messages that indicate an unusually rapid change of location (measured by consecutive Location Updates from non-bordering countries within a short period) should be filtered.

BroadForward DFW features
The BroadForward DFW will improve the operator’s effectiveness in dealing with unexpected (fraudulent) behavior and significantly increases roaming security. The BroadForward DFW offers major differentiators compared to traditional firewall products:

  • Unrivaled flexibility. Routing, screening and filtering on any message parameter. Freedom to create, adapt and deploy security rules at any time without need for coding or scripting or vendor dependency.
  • Transparent mode support. Unique, live – non-intrusive – effectiveness testing of security rules while logging Event Detail Records for off-line evaluation.
  • Velocity check support. Advanced location tracking function (GSMA FS.19 Category 3 compliant), including global neighboring country lists and velocity checks for location change plausibility checking.
  • Fully compliant with the relevant GSMA FS.19 recommendations.
  • Unified security suite – 2G/3G/4G and 5G firewall support in a single software engine running on the GSMA award wining BroadForward BFX Unified Signaling Core (USC) platform.
  • Flexible deployment models. Standalone DFW or in combination with e.g. SS7FW (and later 5GFW), using shared location tracking, common GUI interface, single capacity license.
  • Completely GUI based. All configuration, rules orchestration, monitoring and management can be done using the graphical user interface.
  • Carrier grade. Highly scalable, high available, geo-redundant solution.
  • Optional support for:

Virtualized, cloud-based and containerized deployment
The BroadForward DFW provides unmatched flexibility with various deployment options, including bare metal, virtual machines, containers, and cloud environments, all while maintaining a low resource footprint. This 100% software-based, hardware-agnostic solution eliminates the need for specialized hardware or proprietary operating systems. Deploying the BroadForward DFW on a common platform facilitates the transition for operators and vendors from proprietary appliance systems to a standardized, hardware-agnostic, software-only infrastructure.

 

 

BroadForward Newsletter

Subscribe to our Newsletter to get regular product and industry updates