US 11,122,435 B2Granted

Radio access technology based security in service provider networks

AssigneePalo Alto Networks, Inc.

InventorsSachin Verma, Leonid Burakovsky, Jesse C. Shu, I-Chun Chen

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for radio access technology based security in service provider networks (e.g., service provider networks for mobile subscribers) are disclosed. In some embodiments, a system/process/computer program product for radio access technology based security in service provider networks includes monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session; associating the RAT type with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the RAT type.

Claims20

Dependent claims

A system, comprising:

a processor configured to:
monitor network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network:
associate the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof;
and
determine an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to:
monitor, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic;
determine a security policy to apply at the security platform to the new session based on the application identifier and the RAT type;
and
perform an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session;
and
a memory coupled to the processor and configured to provide the processor with instructions.

8 more elements

A method, comprising:

monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network:
associating the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof;
and
determining an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to:
monitoring, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic;
determining a security policy to apply at the security platform to the new session based on the application identifier and the RAT type;
and
performing an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session.

5 more elements

A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network:
associating the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof;
and
determining an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to:
monitoring, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic;
determining a security policy to apply at the security platform to the new session based on the application identifier and the RAT type;
and
performing an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/857,121Filed 23 Apr 2020 · continuation
Priority: 15 Jun 2017
Published: US 2020/0259870 A113 Aug 2020
Granted: 14 Sep 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

H04W 12/088
Access security: using filters or firewalls
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection

Family

Application15/624,442Parent of this continuation · filed 15 Jun 2017
US 2020/0259870 A1Pre-grant publication · published 13 Aug 2020
US 10,693,918 B2Parent of this continuation
US 2018/0367578 A1Published application
US 11,122,435 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key