# US 2021/0243232 A1 · Multi-access edge computing services security in mobile networks by parsing application programming interfaces > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243232 A1 - Document ID: US20210243232A1 - Status: Published application - Kind: A1 - Application number: 16/779,253 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Sachin Verma; Leonid Burakovsky - Web page: https://patentgrep.com/patent/US20210243232A1 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04W 12/08: Access security - H04W 12/088: using filters or firewalls - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for providing multi-access edge computing (MEC) services security in mobile networks (e.g., service provider networks for mobile subscribers, such as for 5G networks) by parsing Application Programming Interfaces (APIs) are disclosed. In some embodiments, a system/process/computer program product for MEC services security in mobile networks by parsing APIs in accordance with some embodiments includes monitoring network traffic on a mobile network at a security platform to identify an API message associated with a new session, wherein the mobile network includes a 5G network or a converged 5G network that includes a multi-access edge computing (MEC) service; extracting mobile network identifier information from the API message at the security platform; and determining a security policy to apply at the security platform to the new session based on the mobile network identifier information. ## Claims ### Claim 1 A system, comprising: a processor configured to: monitor network traffic on a mobile network at a security platform to identify an application programming interface (API) message associated with a new session, wherein the mobile network includes a 5G network or a converged 5G network that includes a multi-access edge computing (MEC) service; extract mobile network identifier information from the API message at the security platform; and determine a security policy to apply at the security platform to the new session based on the mobile network identifier information; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the API message includes a MEC services related API message. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the API message includes a Network Exposure Function (NEF) northbound API message. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the API message includes a MEC services related API message or a Network Exposure Function (NEF) northbound API message. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the security platform is configured with a plurality of security policies based on the mobile network identifier information. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the mobile network identifier information includes one or more of the following: General Public Subscription Identifier (GPSI), Network Slice Selection Assistance Information (NSSAI), and Data Network Name (DNN). ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: parse the API message to extract the mobile network identifier information. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: parse the API message to extract the mobile network identifier information, wherein the mobile network identifier information includes one or more of the following: General Public Subscription Identifier (GPSI), Network Slice Selection Assistance Information (NSSAI), and Data Network Name (DNN). ### Claim 9 (depends on 1) The system recited in claim 1, wherein the security platform monitors the network traffic in a MEC host to provide MEC services security for the 5G network. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform a firewall service using the mobile network identifier information. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform threat detection using the mobile network identifier information. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform advanced threat prevention using the mobile network identifier information. ### Claim 13 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform Uniform Resource Link (URL) filtering using the mobile network identifier information. ### Claim 14 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: block the new session from accessing a resource based on the security policy. ### Claim 15 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: allow the new session to access a resource based on the security policy. ### Claim 16 A method, comprising: monitoring network traffic on a mobile network at a security platform to identify an application programming interface (API) message associated with a new session, wherein the mobile network includes a 5G network or a converged 5G network that includes a multi-access edge computing (MEC) service; extracting mobile network identifier information from the API message at the security platform; and determining a security policy to apply at the security platform to the new session based on the mobile network identifier information. ### Claim 17 (depends on 16) The method of claim 16, wherein the API message includes a MEC services related API message. ### Claim 18 (depends on 16) The method of claim 16, wherein the API message includes a Network Exposure Function (NEF) northbound API message. ### Claim 19 (depends on 16) The method of claim 16, wherein the API message includes a MEC services related API message or a Network Exposure Function (NEF) northbound API message. ### Claim 20 A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for: monitoring network traffic on a mobile network at a security platform to identify an application programming interface (API) message associated with a new session, wherein the mobile network includes a 5G network or a converged 5G network that includes a multi-access edge computing (MEC) service; extracting mobile network identifier information from the API message at the security platform; and determining a security policy to apply at the security platform to the new session based on the mobile network identifier information.