Network slice-based security in mobile networks
AssigneePalo Alto Networks, Inc.
InventorsSachin Verma, Leonid Burakovsky
Life of this patent
Estimating the term…
Abstract
Techniques for providing network slice-based security in mobile networks (e.g., service provider networks for mobile subscribers) are disclosed. In some embodiments, a system/process/computer program product for network slice-based security in mobile networks in accordance with some embodiments includes monitoring network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network; extracting network slice information for user traffic associated with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the network slice information.
Claims16
A system, comprising:
- a processor configured to:
- monitor network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises to:
- identify a create context request service operation or a create service operation in the network traffic;
- extract network slice information for user traffic associated with the new session at the security platform, wherein the extracting the network slice information further comprises to:
- parse HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI);
- and
- determine a security policy to apply at the security platform to the new session based on the network slice information;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- monitoring network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises:
- identifying a create context request service operation or a create service operation in the network traffic;
- extracting network slice information for user traffic associated with the new session at the security platform, wherein the extracting the network slice information further comprises:
- parsing HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI);
- and
- determining a security policy to apply at the security platform to the new session based on the network slice information.
A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- monitoring network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises:
- identifying a create context request service operation or a create service operation in the network traffic;
- extracting network slice information for user traffic associated with the new session at the security platform, wherein the extracting the network slice information further comprises:
- parsing HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI);
- and
- determining a security policy to apply at the security platform to the new session based on the network slice information.
Dependencies are inferred from the claim text.