Back to results
US 11,777,994 B2Granted
Dynamic per subscriber policy enablement for security platforms within service provider network environments
AssigneePalo Alto Networks, Inc.
InventorsMitchell Rappard, Leonid Burakovsky
Life of this patent
Estimating the term…
Abstract
Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.
Claims20
A system, comprising:
- a processor configured to:
- monitor network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow, wherein the security platform is configured to passively monitor one or more 3rd Generation Partnership Project (3GPP) related interfaces;
- associate the subscriber with the new IP flow at the security platform;
- determine a security policy to apply at the security platform to the new IP flow based on the subscriber, wherein the security platform is configured to infer a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- apply dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform, wherein a subscriber/IP address is mapped to a security policy to facilitate security policy enforcement per IP flow using the security platform;
- and
- enforce the security policy on the new IP flow using the security platform to allow the new IP flow to access a resource based on the security policy;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method, comprising:
- monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow, wherein the security platform is configured to passively monitor one or more 3rd Generation Partnership Project (3GPP) related interfaces;
- associating the subscriber with the new IP flow at the security platform;
- determining a security policy to apply at the security platform to the new IP flow based on the subscriber, wherein the security platform is configured to infer a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform, wherein a subscriber/IP address is mapped to a security policy to facilitate security policy enforcement per IP flow using the security platform;
- and
- enforcing the security policy on the new IP flow using the security platform to allow the new IP flow to access a resource based on the security policy.
3 more elements
A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow, wherein the security platform is configured to passively monitor one or more 3rd Generation Partnership Project (3GPP) related interfaces;
- associating the subscriber with the new IP flow at the security platform;
- determining a security policy to apply at the security platform to the new IP flow based on the subscriber, wherein the security platform is configured to infer a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform, wherein a subscriber/IP address is mapped to a security policy to facilitate security policy enforcement per IP flow using the security platform;
- and
- enforcing the security policy on the new IP flow using the security platform to allow the new IP flow to access a resource based on the security policy.
3 more elements
Dependencies are inferred from the claim text.