# US 12,010,148 B2 · Access point name and application identity based security enforcement in service provider networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,148 B2 - Document ID: US12010148B2 - Status: Granted - Kind: B2 - Application number: 18/064,165 - Filed: 2022-12-09 - Published: 2023-04-06 - Granted: 2024-06-11 - Earliest claimed: 2017-06-15 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Sachin Verma; Leonid Burakovsky - Web page: https://patentgrep.com/patent/US12010148B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/088: using filters or firewalls - H04L 63/0254: {Stateful filtering} - H04W 12/73: Access point logical identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for access point name and application identity based security enforcement in service provider networks (e.g., service provider networks for mobile subscribers) are disclosed. In some embodiments, a system/process/computer program product for access point name (e.g., APN) and application identity (e.g., application identifier) based security enforcement in service provider networks includes monitoring network traffic on a service provider network at a security platform to identify an access point name for a new session; determining an application identifier for user traffic associated with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the access point name and the application identifier. ## Claims ### Claim 1 A system, comprising: a processor configured to: monitor network traffic on a service provider network to identify an access point name for a new session, wherein the new session is associated with an Internet of Things (IoT) device, comprising: extract access point name information including an access point name network identifier and an operator identifier from a create Packet Data Protocol (PDP) request message or a create session request message to create the new session, wherein the create PDP request message or the create session request message are identified within the network traffic in a mobile network; determine an application identifier for user traffic associated with the new session; and perform an enforcement action based on a security policy to the new session based on the access point name and the application identifier to provide enhanced IoT device security, wherein the security policy includes a plurality of security rules for threat detection, threat prevention, Uniform Resource Location (URL) filtering, Denial of Service (DoS) detection, and/or Denial of Service (DoS) prevention; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the processor is further configured to select the security policy from a plurality of security policies based on the access point name and the application identifier. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the processor is further configured to perform the enforcement action based on the security policy based on the access point name and the application identifier, wherein the access point name (APN) is associated with a private APN for IoT devices. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the processor is further configured to perform threat detection and/or threat prevention based on the access point name (APN) and the application identifier. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the processor is further configured to perform Uniform Resource Link (URL) filtering based on the access point name (APN) and the application identifier. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the processor is further configured to monitor wireless interfaces including a plurality of interfaces for a control protocol and user data traffic in a mobile core network for a 3G, 4G, and/or 5G network. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to monitor wireless interfaces including a plurality of interfaces for a GPRS Tunneling Protocol (GTP) in a mobile core network for a 3G, 4G, and/or 5G network. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to block the new session from accessing a resource based on the security policy. ### Claim 9 A method, comprising: monitoring network traffic on a service provider network to identify an access point name for a new session, wherein the new session is associated with an Internet of Things (IoT) device, comprising: extracting access point name information including an access point name network identifier and an operator identifier from a create Packet Data Protocol (PDP) request message or a create session request message to create the new session, wherein the create PDP request message or the create session request message are identified within the network traffic in a mobile network; determining an application identifier for user traffic associated with the new session; and performing an enforcement action based on a security policy applied to the new session based on the access point name and the application identifier to provide enhanced IoT device security, wherein the security policy includes a plurality of security rules for threat detection, threat prevention, Uniform Resource Location (URL) filtering, Denial of Service (DoS) detection, and/or Denial of Service (DoS) prevention. ### Claim 10 (depends on 9) The method of claim 9, further comprising selecting the security policy from a plurality of security policies based on the access point name and the application identifier. ### Claim 11 (depends on 9) The method of claim 9, further comprising performing the enforcement action based on the security policy based on the access point name and the application identifier, wherein the access point name (APN) is associated with a private APN for IoT devices. ### Claim 12 (depends on 9) The method of claim 9, further comprising performing threat detection and/or threat prevention based on the access point name (APN) and the application identifier. ### Claim 13 (depends on 9) The method of claim 9, further comprising performing Uniform Resource Link (URL) filtering based on the access point name and the application identifier. ### Claim 14 (depends on 9) The method of claim 9, further comprising blocking the new session from accessing a resource based on the security policy. ### Claim 15 A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: monitoring network traffic on a service provider network to identify an access point name for a new session, wherein the new session is associated with an Internet of Things (IoT) device, comprising: extracting access point name information including an access point name network identifier and an operator identifier from a create Packet Data Protocol (PDP) request message or a create session request message to create the new session, wherein the create PDP request message or the create session request message are identified within the network traffic in a mobile network; determining an application identifier for user traffic associated with the new session; and performing an enforcement action based on a security policy applied to the new session based on the access point name and the application identifier to provide enhanced IoT device security, wherein the security policy includes a plurality of security rules for threat detection, threat prevention, Uniform Resource Location (URL) filtering, Denial of Service (DoS) detection, and/or Denial of Service (DoS) prevention. ### Claim 16 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for selecting the security policy from a plurality of security policies based on the access point name and the application identifier. ### Claim 17 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for performing the enforcement action based on the security policy based on the access point name and the application identifier, wherein the access point name (APN) is associated with a private APN for IoT devices. ### Claim 18 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for performing threat detection and/or threat prevention based on the access point name and the application identifier. ### Claim 19 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for performing Uniform Resource Link (URL) filtering based on the access point name and the application identifier. ### Claim 20 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for blocking the new session from accessing a resource based on the security policy.