Context-aware sase security for mobile network traffic

A method, comprising:

• receiving, at a cloud-based secure access service edge (SASE) network that includes a firewall-as-a-service (FWaaS) enforcement service, user-plane traffic comprising data-plane traffic associated with a user equipment (UE) from a user-plane function or a packet core entity of a mobile core network;
• obtaining, at the cloud-based SASE network, mobile-network contextual information associated with a mobile-core session of the UE, wherein the mobile-network contextual information includes a UE Internet Protocol (IP) address;
• correlating, at the cloud-based SASE network, the user-plane traffic with the mobile-network contextual information based at least in part on the UE IP address;
• selecting, by the FWaaS enforcement service, a security policy for the user-plane traffic based at least in part on the mobile-network contextual information correlated with the user-plane traffic;
• enforcing, by the FWaaS enforcement service, the selected security policy on the user-plane traffic to generate secured user-plane traffic;
• and
• forwarding the secured user-plane traffic from the cloud-based SASE network to an original destination of the user-plane traffic.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving, at a cloud-based secure access service edge (SASE) network that includes a firewall-as-a-service (FWaaS) enforcement service, user-plane traffic comprising data-plane traffic associated with a user equipment (UE) from a user-plane function or a packet core entity of a mobile core network;
• obtaining, at the cloud-based SASE network, mobile-network contextual information associated with a mobile-core session of the UE, wherein the mobile-network contextual information includes a UE Internet Protocol (IP) address;
• correlating, at the cloud-based SASE network, the user-plane traffic with the mobile-network contextual information based at least in part on the UE IP address;
• selecting, by the FWaaS enforcement service, a security policy for the user-plane traffic based at least in part on the mobile-network contextual information correlated with the user-plane traffic;
• enforcing, by the FWaaS enforcement service, the selected security policy on the user-plane traffic to generate secured user-plane traffic;
• and
• forwarding the secured user-plane traffic from the cloud-based SASE network to an original destination of the user-plane traffic.