# US 11,122,435 B2 · Radio access technology based security in service provider networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,435 B2 - Document ID: US11122435B2 - Status: Granted - Kind: B2 - Application number: 16/857,121 - Filed: 2020-04-23 - Published: 2020-08-13 - Granted: 2021-09-14 - Earliest claimed: 2017-06-15 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Sachin Verma; Leonid Burakovsky; Jesse C. Shu; I-Chun Chen - Web page: https://patentgrep.com/patent/US11122435B2 ## CPC - H04W 12/088: using filters or firewalls - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/08: Access security - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04W 76/10: Connection setup - H04W 76/12: Setup of transport tunnels - H04W 84/042: {Public Land Mobile systems, e.g. cellular systems} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for radio access technology based security in service provider networks (e.g., service provider networks for mobile subscribers) are disclosed. In some embodiments, a system/process/computer program product for radio access technology based security in service provider networks includes monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session; associating the RAT type with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the RAT type. ## Claims ### Claim 1 A system, comprising: a processor configured to: monitor network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network: associate the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof; and determine an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to: monitor, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic; determine a security policy to apply at the security platform to the new session based on the application identifier and the RAT type; and perform an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform threat detection based on the application identifier and the RAT type. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform threat prevention based on the application identifier and the RAT type. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform Uniform Resource Link (URL) filtering based on the application identifier and the RAT type. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the security platform is configured with a plurality of security policies based on the application identifier, a location, and the RAT type. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform security policy enforcement based on the application identifier, a location, and the RAT type. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the monitoring of the network traffic on the service provider network at the security platform comprises to: identify a create session request message or a create PDP context request message from the network traffic; and extract location from the create session request message or the create PDP context request message, the location including one or more of the following: CGI (Cell Global Identifier), SAI (Service Area Identifier), RAI (Routing Area Identifier), TAI (Tracking Area Identifier), ECGI (E-UTRAN Cell Global Identifier), or LAC (Location Area Identifier), and wherein the security platform is configured with a plurality of security policies based on the application identifier, a location, and the RAT type. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: block the new session from accessing a resource based on the security policy. ### Claim 9 A method, comprising: monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network: associating the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof; and determining an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to: monitoring, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic; determining a security policy to apply at the security platform to the new session based on the application identifier and the RAT type; and performing an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session. ### Claim 10 (depends on 9) The method of claim 9, wherein the security platform is configured to perform threat detection based on the application identifier and the RAT type. ### Claim 11 (depends on 9) The method of claim 9, wherein the security platform is configured to perform threat prevention based on the application identifier and the RAT type. ### Claim 12 (depends on 9) The method of claim 9, wherein the security platform is configured to perform Uniform Resource Link (URL) filtering based on the application identifier and the RAT type. ### Claim 13 (depends on 9) The method of claim 9, wherein the security platform is configured to perform security policy enforcement based on the application identifier, a location, and the RAT type. ### Claim 14 (depends on 9) The method of claim 9, wherein the monitoring of the network traffic on the service provider network at the security platform comprises to: identifying a create session request message or a create PDP context request message from the network traffic; and extracting location from the create session request message or the create PDP context request message, the location including one or more of the following: CGI (Cell Global Identifier), SAI (Service Area Identifier), RAI (Routing Area Identifier), TAI (Tracking Area Identifier), ECGI (E-UTRAN Cell Global Identifier), or LAC (Location Area Identifier), and wherein the security platform is configured with a plurality of security policies based on the application identifier, a location, and the RAT type. ### Claim 15 (depends on 9) The method of claim 9, further comprising: blocking the new session from accessing a resource based on the security policy. ### Claim 16 A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for: monitoring network traffic on a service provider network at a security platform to identify a Radio Access Technology (RAT) type for a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a mobile network, or a control protocol and user data traffic in a mobile core network for a mobile network: associating the RAT type with the new session at the security platform, wherein the RAT type includes UTRAN, GERAN, WLAN, GAN, HSPA Evolution, EUTRAN (WB-E-UTRAN), Virtual, and EUTRAN-NB-IoT, or any combination thereof; and determining an application identifier for user traffic associated with the new session at the security platform, wherein determining the application identifier for user traffic associated with the new session at the security platform comprises to: monitoring, via deep packet inspection, tunneled user traffic after the new session has been created to obtain the application identifier, wherein the application identifier relates to web browsing using HyperText Transfer Protocol (HTTP), a Domain Name System (DNS) request, a file transfer using File Transfer Protocol (FTP), Telnet, Dynamic Host Configuration Protocol (DHCP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Trivial File Transfer Protocol (TFTP), or any combination thereof, and wherein the tunneled user traffic includes GPRS Tunneling Protocol User Plane (GTP-U) traffic; determining a security policy to apply at the security platform to the new session based on the application identifier and the RAT type; and performing an enforcement action based on the security policy, wherein the security policy includes allowing or passing the new session, blocking or dropping the new session, or restricting access of the new session. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the security platform is configured to perform threat detection based on the application identifier and the RAT type. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein the security platform is configured to perform threat prevention based on the application identifier and the RAT type. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the security platform is configured to perform Uniform Resource Link (URL) filtering based on the application identifier and the RAT type. ### Claim 20 (depends on 16) The computer program product recited in claim 16, wherein the monitoring of the network traffic on the service provider network at the security platform comprises to: identifying a create session request message or a create PDP context request message from the network traffic; and extracting location from the create session request message or the create PDP context request message, the location including one or more of the following: CGI (Cell Global Identifier), SAI (Service Area Identifier), RAI (Routing Area Identifier), TAI (Tracking Area Identifier), ECGI (E-UTRAN Cell Global Identifier), or LAC (Location Area Identifier), and wherein the security platform is configured with a plurality of security policies based on the application identifier, a location, and the RAT type.