Mobile network information sharing via EBPF for zero trust security

A method, comprising:

• monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications;
• extracting meta information associated with the session using the agent executed on the network element in the core mobile network, wherein the meta information includes subscriber information, equipment information, network slice information, and other meta data, wherein the subscriber information includes subscriber-ID, wherein the equipment information includes equipment-ID, wherein the network slice information includes network slice-ID, and wherein the other meta data includes two or more of the following:
• Radio Access Technology (RAT) Type, Access Point Name (APN), Data Network Name (DNN), Tracking Area Information (TAI), user-ID, a syslog message, Mobility Restrictions, Protocol Data Unit (PDU) Session ID, Subscription Concealed Identifier (SUCI), UE (Aggregate Maximum Bit Rate) AMBR, Subscription Permanent Identifier (SUPI), and/or Globally Unique Temporary Identity (GUTI);
• and
• sending the extracted meta information to a security platform located outside of the core mobile network, wherein the security platform is configured to:
• enforce a security policy on the session at the security platform based on the extracted meta information to apply granular security in the core mobile network based on the security policy.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications;
• extracting meta information associated with the session using the agent executed on the network element in the core mobile network, wherein the meta information includes subscriber information, equipment information, network slice information, and other meta data, wherein the subscriber information includes subscriber-ID, wherein the equipment information includes equipment-ID, wherein the network slice information includes network slice-ID, and wherein the other meta data includes two or more of the following:
• Radio Access Technology (RAT) Type, Access Point Name (APN), Data Network Name (DNN), Tracking Area Information (TAI), user-ID, a syslog message, Mobility Restrictions, Protocol Data Unit (PDU) Session ID, Subscription Concealed Identifier (SUCI), UE (Aggregate Maximum Bit Rate) AMBR, Subscription Permanent Identifier (SUPI), and/or Globally Unique Temporary Identity (GUTI);
• and
• sending the extracted meta information to a security platform located outside of the core mobile network, wherein the security platform is configured to:
• enforce a security policy on the session at the security platform based on the extracted meta information to apply granular security in the core mobile network based on the security policy.