Back to results
US 12,120,092 B2Granted
Security platform for service provider network environments
AssigneePalo Alto Networks, Inc.
InventorsLeonid Burakovsky, Mitchell Rappard
Life of this patent
Estimating the term…
Abstract
Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.
Claims20
A system, comprising:
- a processor of a security platform configured to:
- monitor network traffic on a service provider network to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network;
- communicate with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber;
- associate the subscriber from the plurality of subscribers with the new IP flow at the security platform and select the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising to:
- select the security policy based on the first subscriber or the second subscriber;
- apply dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- and
- enforce the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
7 more elements
A method, comprising:
- monitoring network traffic on a service provider network using a security platform to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network;
- communicating with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, and wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber;
- associating the subscriber from the plurality of subscribers with the new IP flow at the security platform and selecting the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising:
- selecting the security policy based on the first subscriber or the second subscriber;
- applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- and
- enforcing the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy.
4 more elements
A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- monitoring network traffic on a service provider network using a security platform to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network;
- communicating with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, and wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber;
- associating the subscriber from the plurality of subscribers with the new IP flow at the security platform and selecting the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising:
- selecting the security policy based on the first subscriber or the second subscriber;
- applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform;
- and
- enforcing the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy.
4 more elements
Dependencies are inferred from the claim text.