# US 12,120,092 B2 · Security platform for service provider network environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,092 B2 - Document ID: US12120092B2 - Status: Granted - Kind: B2 - Application number: 17/983,254 - Filed: 2022-11-08 - Published: 2023-03-09 - Granted: 2024-10-15 - Earliest claimed: 2017-04-21 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Leonid Burakovsky; Mitchell Rappard - Web page: https://patentgrep.com/patent/US12120092B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04W 12/088: using filters or firewalls - H04L 61/4523: using lightweight directory access protocol [LDAP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber. ## Claims ### Claim 1 A system, comprising: a processor of a security platform configured to: monitor network traffic on a service provider network to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network; communicate with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber; associate the subscriber from the plurality of subscribers with the new IP flow at the security platform and select the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising to: select the security policy based on the first subscriber or the second subscriber; apply dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform; and enforce the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the security platform includes a firewall, wherein the firewall is configured with a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network, and wherein the security platform applies dynamic policy per IP flow for wireless and wired devices. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the security platform includes a plurality of firewalls and a firewall manager for managing the plurality of firewalls. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow to apply a plurality of security policies in real-time as data calls are setup and modified on the service provider network. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the security platform includes a firewall, and wherein the firewall communicates with one or more of a Policy Control and Charging Rules Function (PCRF) entity, an Authentication, Authorization, and Accounting (AAA) server, Lightweight Directory Access Protocol (LDAP) server, or Traffic Detection Function (TDF) entity using an Application Programming Interface (API) to identify the subscriber associated with the new IP flow. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the security platform includes a firewall, and wherein the firewall communicates with one or more of a Policy Control and Charging Rules Function (PCRF) entity, an Authentication, Authorization, and Accounting (AAA) server, Lightweight Directory Access Protocol (LDAP) server, or Traffic Detection Function (TDF) entity using a network protocol to identify the subscriber associated with the new IP flow. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor of the security platform is further configured to: allow another new IP flow to access another resource based on the security policy. ### Claim 9 A method, comprising: monitoring network traffic on a service provider network using a security platform to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network; communicating with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, and wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber; associating the subscriber from the plurality of subscribers with the new IP flow at the security platform and selecting the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising: selecting the security policy based on the first subscriber or the second subscriber; applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform; and enforcing the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy. ### Claim 10 (depends on 9) The method of claim 9, wherein the security platform includes a firewall, wherein the firewall is configured with a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network, and wherein the security platform applies dynamic policy per IP flow for wireless and wired devices. ### Claim 11 (depends on 9) The method of claim 9, wherein the security platform includes a plurality of firewalls and a firewall manager for managing the plurality of firewalls. ### Claim 12 (depends on 9) The method of claim 9, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow. ### Claim 13 (depends on 9) The method of claim 9, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow to apply a plurality of security policies in real-time as data calls are setup and modified on the service provider network. ### Claim 14 (depends on 9) The method of claim 9, further comprising: allowing another new IP flow to access another resource based on the security policy. ### Claim 15 A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for: monitoring network traffic on a service provider network using a security platform to identify a new Internet Protocol (IP) flow, wherein the security platform is configured to monitor and/or communicate on one or more 3rd Generation Partnership Project (3GPP) related interfaces, and wherein the service provider network comprises a 3GPP/Long Term Evolution (LTE) Evolved Packet Core (EPC) network; communicating with an orchestrator or another network element on the service provider network using an Application Programming Interface (API) to identify a subscriber from a plurality of subscribers with the new IP flow, wherein the plurality of subscribers include a first subscriber and a second subscriber, and wherein the orchestrator actively communicates with one or more network elements of the 3GPP/LTE EPC network to facilitate mapping a security policy of a plurality of security policies associated with the plurality of subscribers to at least one IP address assigned to the subscriber; associating the subscriber from the plurality of subscribers with the new IP flow at the security platform and selecting the security policy to apply at the security platform to the new IP flow based on the subscriber, comprising: selecting the security policy based on the first subscriber or the second subscriber; applying dynamic policy per the new IP flow with the security policy for IP addresses associated with the subscriber on the service provider network based on one or more messages intercepted during monitoring of the network traffic on the service provider network at the security platform; and enforcing the security policy on the new IP flow using the security platform to block the new IP flow to access a resource based on the security policy. ### Claim 16 (depends on 15) The computer program product recited in claim 15, wherein the security platform includes a firewall, wherein the firewall is configured with a plurality of security policies for IP addresses associated with a plurality of subscribers using the service provider network, and wherein the security platform applies dynamic policy per IP flow for wireless and wired devices. ### Claim 17 (depends on 15) The computer program product recited in claim 15, wherein the security platform includes a plurality of firewalls and a firewall manager for managing the plurality of firewalls. ### Claim 18 (depends on 15) The computer program product recited in claim 15, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow. ### Claim 19 (depends on 15) The computer program product recited in claim 15, wherein the security platform includes a firewall, and wherein the firewall communicates with the orchestrator or the another network element using the Application Programming Interface (API) to identify the subscriber associated with the new IP flow to apply a plurality of security policies in real-time as data calls are setup and modified on the service provider network. ### Claim 20 (depends on 15) The computer program product recited in claim 15, further comprising: allowing another new IP flow to access another resource based on the security policy.