Sase cloud network security policy enforcement using mobile network context attributes

A method, comprising:

• obtaining, by a Secure Access Service Edge (SASE) cloud network from a mobile network, contextual information associated with a User Equipment (UE), wherein the contextual information is obtained from a context source that is external to a payload of data-plane traffic associated with the UE, wherein the contextual information comprises a UE Internet Protocol (IP) address and a mobile-network context attribute associated with the UE;
• storing, by the SASE cloud network, a mapping between the UE IP address and the mobile-network context attribute associated with the UE;
• receiving, by a SASE security processing node of the SASE cloud network from the mobile network, the data-plane traffic associated with the UE;
• correlating, by the SASE cloud network, the data-plane traffic associated with the UE with the mobile-network context attribute by using a UE IP address included in a packet header of the data-plane traffic to access the mapping;
• selecting, by the SASE cloud network, a security policy from a plurality of security policies based on the mobile-network context attribute accessed from the mapping;
• and
• enforcing, by the SASE security processing node, the security policy on the data-plane traffic associated with the UE to provide secured data-plane traffic.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• obtaining, by a Secure Access Service Edge (SASE) cloud network from a mobile network, contextual information associated with a User Equipment (UE), wherein the contextual information is obtained from a context source that is external to a payload of data-plane traffic associated with the UE, wherein the contextual information comprises a UE Internet Protocol (IP) address and a mobile-network context attribute associated with the UE;
• storing, by the SASE cloud network, a mapping between the UE IP address and the mobile-network context attribute associated with the UE;
• receiving, by a SASE security processing node of the SASE cloud network from the mobile network, the data-plane traffic associated with the UE;
• correlating, by the SASE cloud network, the data-plane traffic associated with the UE with the mobile-network context attribute by using a UE IP address included in a packet header of the data-plane traffic to access the mapping;
• selecting, by the SASE cloud network, a security policy from a plurality of security policies based on the mobile-network context attribute accessed from the mapping;
• and
• enforcing, by the SASE security processing node, the security policy on the data-plane traffic associated with the UE to provide secured data-plane traffic.