# US 2024/0205759 A1 · Context-based security over interfaces in ng-ran environments in mobile networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205759 A1 - Document ID: US20240205759A1 - Status: Published application - Kind: A1 - Application number: 18/589,280 - Filed: 2024-02-27 - Published: 2024-06-20 - Earliest claimed: 2022-02-25 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Sachin Verma; Leonid Burakovsky - Web page: https://patentgrep.com/patent/US20240205759A1 ## CPC - H04W 36/0038: {of security context information} - H04W 12/009: {specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks} - H04W 12/088: using filters or firewalls - H04W 12/102: Route integrity, e.g. using trusted paths - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 12/60: Context-dependent security - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04W 80/10: adapted for {application} session management, e.g. SIP [Session Initiation Protocol] {(connection management H04W76/00; arrangements for session management H04L67/14)} - H04W 80/12: Application layer protocols, e.g. WAP [Wireless Application Protocol] - H04W 84/04: Large scale networks; Deep hierarchical networks - H04W 88/16: Gateway arrangements - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for applying context-based security over interfaces in NG-RAN environments in mobile networks are disclosed. In some embodiments, a system/process/computer program product for applying context-based security over interfaces in NG-RAN environments in mobile networks includes monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session; extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform; and enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between NG-RAN nodes in an NG-RAN environment in the mobile network. ## Claims ### Claim 1 A system, comprising: a processor configured to: monitor network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session; extract a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises: inspect XnAP traffic over an Xn-C interface between NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and enforce a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between NG-RAN nodes in an NG-RAN environment in the mobile network; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the security platform extracts User Plane (UP) transport layer information extracted from a handover request message to setup the GTP-U tunnel session. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the security platform is configured with a plurality of security policies to apply the context-based security to the network traffic transported between the NG-RAN nodes in the NG-RAN environment in the mobile network. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: inspect the XnAP traffic over an Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: inspect the XnAP traffic over an Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information; and store the contextual information locally in the security platform or in a cloud-based storage. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: inspect GTP-U traffic over an Xn-U interface between a source NG-RAN node and a target NG-RAN node to apply Layer-7 security on user plane traffic; and correlate the context information with the user plane traffic to perform context-based security for inter node traffic in the NG-RAN environment. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform context-based security over an Xn-U interface in the NG-RAN environment. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform detection and prevention of known and unknown threat identification and prevention over an Xn-U interface in the NG-RAN environment. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform application identification and control over an Xn-U interface in the NG-RAN environment. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the security platform is configured to perform URL filtering over an Xn-U interface in the NG-RAN environment. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: block the new session from accessing a resource based on the security policy. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: allow the new session to access a resource based on the security policy. ### Claim 13 A method, comprising: monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session; extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises: inspecting XnAP traffic over an Xn-C interface between NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between NG-RAN nodes in an NG-RAN environment in the mobile network. ### Claim 14 (depends on 13) The method of claim 13, wherein the security platform extracts User Plane (UP) transport layer information extracted from a handover request message to set up the GTP-U tunnel session. ### Claim 15 (depends on 13) The method of claim 13, wherein the security platform is configured with a plurality of security policies to apply the context-based security to the network traffic transported between the NG-RAN nodes in the NG-RAN environment in the mobile network. ### Claim 16 (depends on 13) The method of claim 13, further comprising: inspecting the XnAP traffic over an Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information. ### Claim 17 (depends on 13) The method of claim 13, further comprising: inspecting the XnAP traffic over an Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information; and storing the contextual information locally in the security platform or in a cloud-based storage. ### Claim 18 (depends on 13) The method of claim 13, further comprising: inspecting GTP-U traffic over an Xn-U interface between a source NG-RAN node and a target NG-RAN node to apply Layer-7 security on user plane traffic; and correlating the context information with the user plane traffic to perform context-based security for inter node traffic in the NG-RAN environment. ### Claim 19 (depends on 13) The method of claim 13, further comprising: performing context-based security over an Xn-U interface in the NG-RAN environment. ### Claim 20 A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session; extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises: inspecting XnAP traffic over an Xn-C interface between NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between NG-RAN nodes in an NG-RAN environment in the mobile network.