Context-based security over interfaces in O-RAN environments in mobile networks

A method, comprising:

• monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session;
• extracting a plurality of parameters from the GTP-U tunnel session setup message and from F1AP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from F1AP traffic to extract contextual information at the security platform further comprises:
• extracting User Plane (UP) transport layer information from a UE CONTEXT SETUP REQUEST and UE CONTEXT SETUP RESPONSE messages exchanged between gNB-DU and gNB-CU nodes during a UE Context Setup Procedure to set up the GTP-U tunnel session;
• inspecting F1AP traffic over an F1-C interface between O-RAN Distributed Unit (O-DU) and O-RAN Centralized Unit Control Plane (O-CU-CP) nodes in an O-RAN environment in the mobile network to extract contextual information;
• and
• inspecting GTP-U traffic over an F1-U interface between the O-DU and O-RAN Centralized Unit User Plane (O-CU-UP) nodes for applying layer-7 security on User Plane (UP) traffic;
• and
• enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between the O-DU and the O-CU-CP nodes and between the O-DU and the O-CU-UP nodes in the O-RAN environment in the mobile network.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session;
• extracting a plurality of parameters from the GTP-U tunnel session setup message and from F1AP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from F1AP traffic to extract contextual information at the security platform further comprises:
• extracting User Plane (UP) transport layer information from a UE CONTEXT SETUP REQUEST and UE CONTEXT SETUP RESPONSE messages exchanged between gNB-DU and gNB-CU nodes during a UE Context Setup Procedure to set up the GTP-U tunnel session;
• inspecting F1AP traffic over an F1-C interface between O-RAN Distributed Unit (O-DU) and O-RAN Centralized Unit Control Plane (O-CU-CP) nodes in an O-RAN environment in the mobile network to extract contextual information;
• and
• inspecting GTP-U traffic over an F1-U interface between the O-DU and O-RAN Centralized Unit User Plane (O-CU-UP) nodes for applying layer-7 security on User Plane (UP) traffic;
• and
• enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between the O-DU and the O-CU-CP nodes and between the O-DU and the O-CU-UP nodes in the O-RAN environment in the mobile network.