Method and system for location-based security in a service provider network

Abstract

The present application relates to methods and systems for location-based security in a service provider network. Techniques for location-based security in a service provider network (e.g., a service provider network for mobile subscribers) are disclosed. In some embodiments, a system / process / computer program product for location-based security in a service provider network includes: monitoring network traffic on the service provider network at a security platform to identify a location of a new session; associating the location with the new session at the security platform; and determining a security policy to be applied to the new session at the security platform based on the location.

Description

Background Art

[0001] This application is a divisional application of application number: 201880050446.1, invention name "Method and system for location-based security in service provider networks". A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is generally a device or a collection of devices that provide firewall functionality for network access or software executed on a device (such as a computer). For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smart phone, or other type of network communication capable device). The firewall can also be integrated into a computer server, a gateway, a network / routing device (e.g., a network router), or a data equipment (e.g., a security equipment or other type of dedicated device) or executed as software on a computer server, a gateway, a network / routing device (e.g., a network router), or a data equipment (e.g., a security equipment or other type of dedicated device).

[0002] Firewalls typically deny or allow network traffic based on a set of rules. These sets of rules are often referred to as policies. For example, a firewall can filter inbound traffic by applying a set of rules or policies. A firewall can also filter outbound traffic by applying a set of rules or policies. Firewalls may also be able to perform basic routing functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Various embodiments of the invention are disclosed in the following detailed description and accompanying drawings.

[0004] Figure 1A is a block diagram of a 3G wireless network with a security platform for providing enhanced security according to some embodiments.

[0005] Figure 1B is a block diagram of a 4G / LTE wireless network with a security platform for providing enhanced security according to some embodiments.

[0006] Figure 2A is an example of GTPv1-C messages exchanged between an SGSN and a GGSN in a 3G network according to some embodiments.

[0007] Figure 2B is an example of GTPv2-C messages exchanged between entities including MME, SGW and PGW in a 4G / LTE network according to some embodiments.

[0008] Figure 3A is another example of a GTPv1-C message flow between an SGSN and a GGSN in a 3G network according to some embodiments.

[0009] Figure 3Bis another example of GTPv2-C message flow between MME, SGW and PGW in a 4G / LTE network according to some embodiments.

[0010] Figure 4A is an example use case of providing enhanced security for roaming access in a 3G network according to some embodiments.

[0011] Figure 4B is an example use case for providing enhanced security for roaming access in 4G / LTE networks according to some embodiments.

[0012] Figure 4C is an example use case for providing enhanced security for roaming access in a mixed 3G and 4G / LTE network in accordance with some embodiments.

[0013] Figure 4D is an example use case for providing enhanced security for mobile access in 4G / LTE networks according to some embodiments.

[0014] Figure 4E is an example use case for providing enhanced security for non-3GPP access in 4G / LTE networks according to some embodiments.

[0015] Figure 4F is an example use case for providing enhanced security for mobile access using a core firewall in a 4G / LTE network according to some embodiments.

[0016] Figure 4G is an example use case of using a core firewall in a 3G network to provide enhanced security for mobile access according to some embodiments.

[0017] Figure 5 is a functional diagram of hardware components of a network device for performing security policy enforcement on a mobile / service provider network environment, according to some embodiments.

[0018] Figure 6 is a functional diagram of logical components of a network device for performing security policy enforcement on a mobile / service provider network environment, according to some embodiments.

[0019] Figure 7 is a flow chart of a process for performing location-based security in a service provider's mobile network in accordance with some embodiments.

[0020] Figure 8 is a flow chart of a process for performing security enforcement based on mobile device identification and / or IoT device identification and application identification for a service provider in a mobile network according to some embodiments.

[0021] Fig. 9is a flow chart of a process for performing mobile subscriber identity based and / or SIM based IoT identity and application identity security enforcement for a service provider in a mobile network according to some embodiments.

[0022] Fig.10 is a flow chart of a process for performing radio access technology (RAT) based security in a service provider's mobile network in accordance with some embodiments. DETAILED DESCRIPTION

[0023] The present invention may be implemented in a variety of ways, including as a process; an apparatus; a system; a composition of matter; a computer program product implemented on a computer-readable storage medium; and / or a processor, such as a processor configured to execute instructions stored on and / or provided by a memory coupled to the processor. In this specification, these implementations or any other form that the present invention may take may be referred to as techniques. In general, the order of the steps of the disclosed processes may be changed within the scope of the present invention. Unless otherwise stated, a component such as a processor or memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform a task at a given time or as a specific component that is manufactured to perform a task. As used herein, the term 'processor' refers to one or more devices, circuits, and / or processing cores that are configured to process data such as computer program instructions.

[0024] A detailed description of one or more embodiments of the present invention is provided below together with the accompanying drawings that illustrate the principles of the present invention. The present invention is described in conjunction with such embodiments, but the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention includes multiple substitutions, modifications and equivalents. In the following description, a number of specific details are set forth in order to provide a thorough understanding of the present invention. These details are provided for illustrative purposes, and the present invention can be implemented according to the claims without some or all of these specific details. For the purpose of clarity, technical materials known in the technical field related to the present invention have not yet been described in detail so that the present invention will not be unnecessarily obscured.

[0025] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is generally a device, a collection of devices, or software executed on a device that provides firewall functionality for network access. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smart phone, or other type of network communication capability device). A firewall can also be integrated into or executed as a software application on various types of devices or security devices, such as computer servers, gateways, network / routing devices (e.g., network routers), or data equipment (e.g., security equipment or other types of specialized equipment).

[0026] Firewalls typically deny or allow network transmissions based on a set of rules. These sets of rules are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching the protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allow, block, monitor, notify, or log, and / or other actions can be specified in a firewall / security rule or firewall / security policy, which can be triggered based on various criteria, such as described herein). A firewall can also apply antivirus protection, malware detection / prevention, or intrusion protection by applying a set of rules or policies.

[0027] Security devices (e.g., security equipment, security gateways, security services, and / or other security devices) may include various security functions (e.g., firewalls, anti-malware, intrusion prevention / detection, proxies, and / or other security functions), networking functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other networking functions), and / or other functions. For example, routing functions may be based on source information (e.g., source IP address and port), destination information (e.g., destination IP address and port), and protocol information.

[0028] Basic packet filtering firewalls filter network communication traffic by inspecting individual packets transmitted through the network (e.g., packet filtering firewalls or first generation firewalls, which are stateless packet filtering firewalls). Stateless packet filtering firewalls typically inspect each packet itself and apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port numbers).

[0029] Application firewalls can also perform application layer filtering (e.g., using an application layer filtering firewall or second generation firewall, which works at the application layer of the TCP / IP stack). Application layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using File Transfer Protocol (FTP), and various other types of applications and other protocols such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate over standard ports (e.g., an application firewall can generally be used to identify unauthorized / out-of-policy protocols that attempt to sneak through by using non-standard ports for that protocol).

[0030] A stateful firewall may also perform state-based packet inspection, where each packet is inspected in the context of a series of packets associated with a flow of packets transmitted over the network (e.g., a stateful firewall or third generation firewall). This firewall technology is often referred to as stateful packet inspection because it maintains a record of all connections passing through the firewall and is able to determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the state of a connection may itself be one of the criteria for triggering a rule in a policy.

[0031] Advanced or next-generation firewalls can perform stateless and stateful packet filtering and application layer filtering, as discussed above. Next-generation firewalls can also perform additional firewall technologies. For example, some newer firewalls, sometimes referred to as advanced or next-generation firewalls, can also identify users and content. In particular, some next-generation firewalls are expanding the list of applications that these firewalls can automatically identify to thousands of applications. Examples of such next-generation firewalls are commercially available from Palo Alto Networks (e.g., Palo Alto Networks' PA Series Next-Generation Firewalls and Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls).

[0032] For example, Palo Alto Networks' next-generation firewalls enable enterprises and service providers to identify and control applications, users, and content using a variety of identification technologies—not just ports, IP addresses, and packets—such as the following: App-ID for accurate application identification TM (e.g., App ID), (e.g., User ID) User-ID for user identification (e.g., by user or user group) TM and Content-ID for real-time content scanning (e.g., to control web surfing and restrict data and file transfers) TM(e.g., content ID). These identification technologies allow enterprises to securely enable application usage using business-relevant concepts rather than following the traditional approach provided by traditional port-blocking firewalls. In addition, dedicated hardware for next-generation firewalls implemented as, for example, dedicated appliances typically provide higher performance levels for application inspection than software executed on general-purpose hardware (e.g., security appliances such as those provided by Palo Alto Networks, which utilize dedicated function-specific processing tightly integrated with a single-pass software engine to maximize network throughput while minimizing latency for Palo Alto Networks' PA Series Next-Generation Firewalls).

[0033] Technical and security challenges in today's service provider mobile networks

[0034] In today's service provider network environment, service providers are typically only able to implement static security policies for wireless devices communicating through the service provider's wireless network (e.g., the service provider is unable to define security / firewall policies on a per-endpoint basis and / or per-flow basis for wireless devices communicating through the service provider's wireless network), and any changes typically require network infrastructure updates. Additionally, in today's service provider network environment, service providers are typically unable to implement security policies based on hardware attributes or location information associated with the wireless devices for wireless devices communicating through the service provider's wireless network (e.g., the service provider is unable to implement security policies based on various other relevant parameters associated with the wireless devices, such as unique hardware identifiers and / or physical locations of devices communicating through the wireless network).

[0035] Therefore, there are technical and security challenges for service provider networks. Thus, what is needed is new and improved security technology for such service provider network environments. Specifically, what is needed is new and improved solutions for monitoring service provider network traffic and applying security policies (e.g., firewall policies) on the service provider network.

[0036] Overview of technologies for enhancing security in mobile networks for service providers

[0037] Thus, technologies for an enhanced security platform in a service provider network environment are disclosed. Specifically, various system architectures for implementation and various processes for providing a security platform that can monitor GPRS Tunneling Protocol (GTP) in a service provider network environment are disclosed. More specifically, various system architectures for implementation and various processes for providing a security platform that can monitor GPRS Tunneling Protocol (GTP) in a service provider network environment are disclosed, and the GPRS Tunneling Protocol (GTP) includes, for example, GTP-C for signaling between a Gateway GPRS Support Node (GGSN) and a Serving GPRS Support Node (SGSN), and GTP-U for user data within a GPRS / mobile core network and between a Radio Access Network (RAN) and a GPRS / mobile core network. For example, the disclosed technology uses a next-generation firewall on a service provider network to facilitate application of security policies based on an application, IP address, content ID, subscriber location, a unique device identifier (e.g., an International Mobile Equipment Identifier (IMEI) for a generally unique 3GPP device identifier, such as a mobile phone for a Global System for Mobile Communications (GSM) network), a unique subscriber identifier (e.g., an International Mobile Subscriber Identity (IMSI) for uniquely identifying a GSM subscriber), a Radio Access Technology (RAT) (e.g., an associated RAT for identifying a mobile device), and / or any combination thereof, such as further described below.

[0038] When a mobile device attaches to a network (e.g., a 3GPP / LTE EPC network), an anchor gateway (e.g., a packet data network (PDN) gateway or PGW in a 3GPP / LTE EPC network) will typically query a policy charging function and control (PCRF) entity over a Gx interface to determine the policy for the subscriber. The PCRF entity will send information back to the PGW about, for example, QoS, filtering, and / or other policy related information stored in the PCRF entity for the subscriber, which will be applied for the subscriber (e.g., a PCRF entity is typically used to manage / control bandwidth and QoS on a wireless network; and an AAA server is typically used for authentication purposes on a wireless network).

[0039] In one embodiment, a security platform is configured to monitor GTP communications between SGSN and GGSN in a mobile core network (e.g., a next-generation firewall that can monitor the creation of PDP requests and / or various other GTP-C messages exchanged to activate, update, and / or deactivate GTP sessions in a service provider's network, as further described below), and a security platform (e.g., a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can implement security policies using the disclosed techniques) is configured to apply security policies using one or more parameters extracted from GTP-C messages, as further described below. Thus, service providers, IoT device providers, and / or system integrators can use the disclosed techniques to configure and implement enhanced security policies using one or more parameters extracted from GTP-C messages, as further described below.

[0040] In one embodiment, a security platform is configured to monitor GTP communications between SGSN and GGSN in a mobile core network (e.g., a next-generation firewall that can monitor GTP-U traffic during a GTP session in a service provider's network, as further described below), and a security platform (e.g., a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can implement security policies using the disclosed techniques) is configured to apply security policies using one or more parameters extracted from GTP-C messages and based on user session traffic monitored by the security platform during the GTP session (e.g., APP ID, content ID, URL filtering, and / or other stateful packet inspection extracted from user traffic during the GTP session), as further described below. Thus, service providers, IoT device providers, and / or system integrators can use the disclosed techniques to configure and implement enhanced security policies using one or more parameters extracted from GTP-C messages and information extracted from user traffic in a GTP session, as further described below.

[0041] For example, a service provider, IoT device provider, and / or system integrator may apply different security policies based on IMEI, IMSI, location, and / or RAT. As another example, a service provider, IoT device provider, and / or system integrator may apply different security policies based on IMEI, IMSI, location, and / or RAT based on user traffic monitored during a GTP session.

[0042] In one embodiment, a security platform (e.g., a firewall, a network sensor acting on behalf of a firewall, or another device / component that can implement security policies) is configured to dynamically apply security policies (e.g., granular security policies that can be applied in real time based on subscriber (e.g., IMSI) / IP, in real time based on mobile device (e.g., IMEI) / IP, in real time based on subscriber location / IP, in real time based on RAT / IP, and / or any combination thereof) using existing 3GPP when a data call is established and / or modified / updated using the disclosed techniques, such as further described below. For example, the security platform can be configured to dynamically apply security policies based on IP flows for wireless devices.

[0043] In one embodiment, signaling messages in the mobile core / service provider's core network (e.g., messages exchanged for activating, updating, and deactivating tunnel sessions) are existing and / or standard messages as used in current 3GPP EPC (e.g., GTP-C messages, such as GTPv1-C for 3G networks and GTPv2-C for 4G networks) and / or other wireless network environments, and the security platform is configured to monitor such messages to extract one or more parameters from these messages that can be used to apply security policies, as will be further described below.

[0044] In one embodiment, the security platform is configured to monitor GTP-C messages (e.g., Create PDP Request messages and Create PDP Responses, Update PDP Requests and Update PDP Responses, and / or Delete PDP Requests and Delete PDP Responses) to / from various network elements (such as SGSNs and GGSNs) on the service provider network, such as described further below.

[0045] In one embodiment, the security platform is configured to monitor user session traffic (e.g., GTP-U traffic) in tunnel sessions in a mobile core / service provider's core network to perform deep packet inspection (DPI) security monitoring techniques, which can be used to apply security policies based on the user session traffic, as will be further described below.

[0046] In one embodiment, the security platform is configured to monitor GTP-U sessions to / from various network elements in the service provider network, as will be further described below.

[0047] In one embodiment, the security platform is configured to monitor signaling messages (e.g., messages exchanged to activate, update, and deactivate GTP tunnels, such as GTP-C messages) to / from various network elements (such as SGSN and GGSN) on the service provider network (e.g., Create PDP Request message and Create PDP Response, Update PDP Request and Update PDP Response and / or Delete PDP Request and Delete PDP Response), and is also configured to monitor user session traffic (e.g., GTP-U traffic) in tunnel sessions in the mobile core / service provider's core network to perform deep packet inspection (DPI) security monitoring techniques, which can be used to apply security policies based on information extracted from signaling messages and / or user session traffic, as will be further described below.

[0048] In one embodiment, subscribers / IP addresses are associated with security policies (e.g., mapped to security policies) to facilitate security policy enforcement based on IP flows using a security platform (e.g., a next generation firewall (NGFW)). For example, the security platform can apply granular security policies based on information extracted from signaling messages and / or user session traffic, as will be further described below.

[0049] Example system architecture for implementing enhanced security in a service provider's mobile network

[0050] Figure 1A is a block diagram of a 3G wireless network with a security platform for providing enhanced security according to some embodiments.

[0051] Figure 1A is an example service provider network environment for a 3G network architecture, which includes a 3G network (for example, and may also include wired, Wi-Fi, 4G, 5G, and / or other networks ( Figure 1A (not shown)) to facilitate data communications for subscribers via the Internet and / or other networks. Figure 1A As shown in FIG. 1 , a radio access network (RAN) 130 is in communication with a mobile core network 120. The RAN 130 may include (one or more) macro cells 142 in a wireless network, as well as small cells in a wireless network, such as (one or more) 3G micro cells 144, (one or more) 3G pico cells 146, and 3G femto cells 148. As shown, various user equipment (UE) 132, 134, and 136 may communicate using the various cells in the RAN 130.

[0052] Also like Figure 1AAs shown in , the small cells shown as (one or more) 3G micro cells 144, (one or more) 3G pico cells 146 and (one or more) 3G femto cells 148 are in network communication with a home node B gateway (HNB GW) 108 via an IP broadband wireless network 140, and in this example, a security platform 102 configured to perform the disclosed security technology (e.g., a (virtual) device / equipment including a firewall (FW), a network sensor acting on behalf of the network, or another device / component that can use the disclosed technology to implement a security policy) is used to monitor / filter traffic, as further described below. As also shown, (one or more) macro cells (NodeB) 142 are in network communication with a radio network controller (RNC) 110, and a security platform 102 configured to perform the disclosed security technology (e.g., a firewall (FW), a network sensor acting on behalf of the firewall, or another device / component that can use the disclosed technology to implement a security policy) is used to monitor / filter traffic, as further described below.

[0053] Also like Figure 1A As shown in FIG. 1 , the HNB GW 108 and the RNC 110 each communicate with a packet data network (PDN) 122 via a serving GPRS support node (SGSN) 112 and a gateway GPRS support node (GGSN) 114 of a mobile (3G) core network 120, and communicate with a public switched telephone network (PSTN) 124 via a mobile switching center (MSC) 116 of the mobile core network 120. As shown, a security platform 102 (e.g., a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can implement security policies using the disclosed techniques) configured to perform the disclosed security techniques is used to monitor / filter traffic through the mobile core network between the SGSN 112 and the GGSN 114 of the mobile core network 120, as described further below.

[0054] For example, various UEs, such as those shown at 132, 134, and 136, may include mobile and / or fixed wireless network enabled devices, such as security cameras (e.g., which may be in a fixed location), watches, mobile / smart phones, tablet computers, laptop computers, computers / PCs or other computing devices (which may be mobile or at a fixed location), cars, baby monitors, thermostats, and / or various other network enabled computing devices (e.g., any device associated with the Internet of Things (IoT)) that may communicate through the RAN 130 to access the PDN 122. Various use case scenarios for applying the disclosed security techniques to wireless network enabled devices to facilitate new and enhanced security will be further described below.

[0055] Thus, in this example, a network architecture for executing the disclosed security techniques for 3G network implementation is provided, wherein (one or more) security platforms may be provided to perform traffic monitoring and filtering to provide new and enhanced security techniques based on signaling and DPI information, as further described below. In view of the disclosed embodiments, as will now be apparent to one of ordinary skill in the art, (one or more) security platforms may be similarly provided in various other locations within the network architecture (e.g., inline, pass-through NGFWs, such as shown by FW 102, and / or implemented as agents or virtual machine (VM) instances, which may be executed on existing equipment in a service provider's network (such as SGSN 112 and / or GGSN 114)) and in various wireless network environments (such as 3G, 4G, 5G and / or other wireless network environments) to execute the disclosed security techniques, as further described below. Also as further described below, the disclosed security techniques may be similarly applied to roaming devices connected to a mobile core of a wireless network environment.

[0056] Figure 1B is a block diagram of a 4G / LTE wireless network with a security platform for providing enhanced security according to some embodiments. Figure 1B is an example service provider network environment for a 4G / Long Term Evolution (LTE) Evolved Packet Core (EPC) network architecture that includes a 4G / LTE network (e.g., and may also include wired, Wi-Fi, 3G, 5G, and / or other networks) to facilitate data communications for subscribers over the Internet and / or other networks. Figure 1B As shown in FIG. 1 , a radio access network (RAN) 180 is in communication with an evolved packet core (EPC) network 170. The RAN 180 may include (one or more) LTE macro cells 192 in the wireless network, as well as small cells in the wireless network, such as (one or more) LTE micro cells 194, (one or more) LTE pico cells 196, and LTE femto cells 198. As shown, various user equipment (UE) 182, 184, and 186 may communicate using the various cells in the RAN 180.

[0057] Also like Figure 1BAs shown in , (one or more) femtocells 198 are in network communication with a home node B gateway (HeNB GW) 158 via an IP broadband wireless network 190, and in this example, a security platform 156E configured to perform the disclosed security techniques (e.g., a (virtual) device / equipment including a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can use the disclosed techniques to implement security policies) is used to monitor / filter traffic, as further described below. As also shown, (one or more) macrocells 192 are in network communication with a mobility management entity (MME) 160 and a serving gateway (SGW) 162, and FW 156D is used to monitor / filter traffic, and in this example, a security platform configured to perform the disclosed security techniques (e.g., a (virtual) device / equipment including a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can use the disclosed techniques to implement security policies) is used to monitor / filter traffic, as further described below.

[0058] Also like Figure 1B As shown in FIG. 1 , HeNB GW 158 communicates with a packet data network (PDN) 172 via an SGW 162 and a PDN gateway (PGW) 164 of an evolved packet core (EPC) network 170. As shown, a security platform 152 configured to perform the disclosed security techniques (e.g., a (virtual) device / appliance including a firewall (FW), a network sensor acting on behalf of a firewall, or another device / component that can implement security policies using the disclosed techniques) is used to monitor / filter traffic through the mobile core network between the SGW 162 and the GGSN / PGW 164 of the EPC 170, as described further below.

[0059] For example, various UEs, such as those shown at 174, 176, 182, 184, and 186, may include mobile and / or fixed wireless network enabled devices that may access PDN 172 via EPC 170 via RAN 180, untrusted non-3GPP Wi-Fi access 177, and / or trusted 3GPP Wi-Fi access 178, where such communications may be monitored using security platforms 152, 156A, 156B, 156C, 156D, 156E, 156F, and / or 156G, as described herein. Figure 1B As shown in (for example, the secure platform can be located at Figure 1B) and as further described below. Example UEs may include security cameras (e.g., which may be in a fixed location), watches, mobile / smart phones, tablet computers, laptop computers, computers / PCs or other computing devices (which may be mobile or in a fixed location), cars, baby monitors, thermostats, and / or various other network-enabled computing devices (e.g., any device associated with the Internet of Things (IoT)). Various use case scenarios for applying the disclosed security techniques to wireless network-enabled devices to facilitate new and enhanced security will be further described below.

[0060] Thus, in this example, a network architecture for executing the disclosed security techniques for 4G / LTE EPC network implementations is provided, wherein (one or more) security platforms may be provided to perform traffic monitoring and filtering to provide new and enhanced security techniques based on signaling and DPI information, as further described below. In view of the disclosed embodiments, as will now be apparent to one of ordinary skill in the art, (one or more) security platforms may be similarly provided in various other locations within the network architecture (e.g., inline, pass-through NGFWs, such as shown by FW 152, and / or implemented as agents or virtual machine (VM) instances that may be executed on existing equipment in a service provider's network (such as SGW 162 and / or PGW 164)) and in various wireless network environments (such as 3G, 4G, 5G and / or other wireless network environments) to execute the disclosed security techniques, as further described below. Also as further described below, the disclosed security techniques may be similarly applied to roaming devices connected to a mobile core of a wireless network environment.

[0061] Figure 2A is an example of a GTPv1-C message exchanged between an SGSN and a GGSN in a 3G network according to some embodiments. Specifically, Figure 2A GTPv1-C messages are shown exchanged between SGSN 212 and GGSN 214 in a 3G network using the Gn / Gp interface for activation, update, and deactivation of GTP sessions. GTP is a standardized protocol based on the User Datagram Protocol (UDP).

[0062] refer to Figure 2A, the first message sent from SGSN 212 to GGSN 214 is a Create PDP Context Request message, as shown at 220. The Create PDP Context Request message is a message used to allocate control and data channels for a new network communication access request for a mobile device in a 3G network (e.g., a tunnel for user IP packets will be provided for network communication through the network of a mobile service provider). For example, the Create PDP Context Request message may include location, hardware identification (e.g., IMEI), subscriber identification (e.g., IMSI), and / or radio access technology (RAT) information in a new network communication access request for a mobile device.

[0063] In one embodiment, the security platform monitors GTP-C messages in the mobile core to extract certain information included in the GTP-C messages based on the security policy (e.g., using a location such as Figure 1A between the SGSN and GGSN in the mobile core shown in and / or such as Figure 1B , or using a firewall / NGFW implemented as a VM instance or agent executing on the SGSN, GGSN, SGW, PGW, and / or other entities in the mobile core network / EPC to monitor GTPv1-C messages). For example, the security platform can monitor GTP-C messages and extract location, hardware identity (e.g., IMEI), subscriber identity (e.g., IMSI), and / or radio access technology (RAT) from the Create PDP Request message, such as described further below.

[0064] like Figure 2A As shown in , GGSN 214 sends a Create PDP Context Response message as shown at 222 to SGSN 212 to indicate whether the Create PDP Context Request is granted for the mobile device (e.g., whether tunneled user data traffic in the mobile core network is allowed for the mobile device). The Create PDP Context Request and Create PDP Context Response messages sent using UDP communication on port 2123 are used to create a PDP context, as shown in FIG. Figure 2A as shown in .

[0065] Also like Figure 2A As shown in , an Update PDP Context Request message shown at 224 and an Update PDP Context Response message shown at 226 are exchanged between the SGSN and the GGSN. For example, an Update PDP Context Request / Response message sent using UDP communication on port 2123 may be used to update one or more parameters for a connection / session.

[0066] refer to Figure 2A, in this example, the request for network communication access to the mobile device on the mobile service provider's network is allowed, and the SGSN sends (one or more) T-PDU messages shown at 228. For example, (one or more) TPDU messages can be used for mobile user network communications (e.g., IP packets) within the tunnel (e.g., control / signaling messages are typically transmitted using the GTP-C protocol on port 2123, while user data messages are typically transmitted using the GTP-U protocol on port 2152). As shown at 230, the T-PDU message typically includes a GTP header, an IP header, a TCP header, and an HTTP payload.

[0067] Also like Figure 2A As shown in , after the user data session is completed, the PDP context is deleted. Specifically, after the transmission of the user data is completed, the PDP context is deleted, and the SGSN and the GGSN exchange a delete PDP context request message as shown at 232 and a delete PDP context response message as shown at 234. The delete PDP context request and delete PDP context response messages sent using UDP communication on port 2123 are used to delete the PDP context, and are also shown in FIG. Figure 2A as shown in .

[0068] In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network, and inspection of tunneled user traffic (such as GTP-U traffic) in a service provider network (e.g., implemented using a security platform, such as an NGFW that can perform DPI to identify APP IDs, user IDs, content IDs, perform URL filtering and / or other firewall / security policies for security / threat detection / prevention). In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network to extract information exchanged in the GTP-C traffic (e.g., parameters, such as location information associated with a subscriber / mobile device, device ID / IMEI, subscriber information / IMSI and / or RAT, such as described further below). In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network to extract information exchanged in the GTP-C traffic (e.g., parameters, such as described above and further described below), and monitors tunneled user traffic in a service provider network (e.g., using DPI, such as described above and further described below).

[0069] In an example implementation, the security platform is configured to monitor the corresponding interfaces of the SGSN and the GGSN to monitor control / signaling traffic (e.g., GTP-C messages) and tunneled user traffic (GTP-U) to implement a security platform with GTP monitoring capabilities, which implements a security policy that can use, for example, location information associated with a subscriber / mobile device, device ID / IMEI, subscriber information / IMSI and / or RAT, such as further described below, which can be extracted from the control / signaling traffic (e.g., GTP-C messages), and perform DPI on IP packets (e.g., TPDUs) within the tunnel, as further described below. As described above, location information / parameters, hardware identification (e.g., IMEI), subscriber identification (e.g., IMSI) and / or radio access technology (RAT), such as further described below, can be extracted by the security platform from the Create PDP Request message, which can be stored (e.g., cached as associated with the IP flow) for use in applying a security policy based on the extracted information and / or in conjunction with DPI, such as further described below.

[0070] Figure 2B is an example of a GTPv2-C message exchanged between entities including an MME, SGW, and PGW in a 4G / LTE network according to some embodiments. Specifically, Figure 2B 2 shows GTPv2-C messages exchanged for an LTE attach procedure in a 4G / LTE network with GTPv2-C messages between MME 252, SGW 254, and PDN-GW (PGW) 256 (e.g., Figure 1B The details of the GTPv2-C messages exchanged between GGSN / PGW are shown in FIG. As discussed above, GTP is a standardized protocol based on the User Datagram Protocol (UDP).

[0071] refer to Figure 2B , a create session request message is sent from MME 252 to SGW 254, as shown at 260, and then sent from SGW 254 to PGW 256, as shown at 262. The create session request message is a message used to request allocation of control and data channels for a new network communication access for a mobile device in a 4G / LTE network (e.g., a tunnel for user IP packets will be provided for network communication through the network of a mobile service provider). For example, the GTP create session request message may include location, hardware identification (e.g., IMEI), subscriber identification (e.g., IMSI), and / or radio access technology (RAT) information in a new network communication access request for a mobile device.

[0072] In one embodiment, the security platform monitors GTP-C messages between the MME, SGW, and PGW to extract certain information included in the GTP-C messages based on security policies (e.g., using a pass-through firewall / NGFW located between the MME, SGW, and PGW to monitor GTPv2-C messages, or using a firewall / NGFW implemented as a VM instance or agent executed on the MME, SGW, and PGW and / or other entities in the mobile core network). For example, the security platform can monitor the GTP-C messages and extract the location, hardware identity (e.g., IMEI), subscriber identity (e.g., IMSI), and / or radio access technology (RAT) from the create session request message, such as described further below.

[0073] like Figure 2B As shown in , after the session is established as shown at 264, the PGW 256 sends a create session response message to the SGW 254 as shown at 266, and then a create session response message is sent from the SGW 254 to the MME 252 as shown at 268 to indicate whether the create session request is granted for the mobile device (e.g., whether tunnel user data traffic in the mobile core network is allowed for the mobile device). The create session request and create session response messages sent using UDP communication on port 2123 are used to create the initial setup context of the session, as shown in FIG. Figure 2B as shown in .

[0074] Also like Figure 2B As shown in , a modify bearer request message shown at 270 and a modify bearer response message shown at 272 are exchanged between the SGW and the MME. For example, the modify bearer request / response message sent using UDP communication on port 2123 can be used to update one or more parameters of the connection / session.

[0075] In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network, and inspection of tunneled user traffic (such as GTP-U traffic) in a service provider network (e.g., implemented using a security platform, such as an NGFW that can perform DPI to identify APP IDs, user IDs, content IDs, perform URL filtering and / or other firewall / security policies for security / threat detection / prevention). In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network to extract information exchanged in the GTP-C traffic (e.g., parameters, such as location information associated with a subscriber / mobile device, device ID / IMEI, subscriber information / IMSI and / or RAT, such as described further below). In one embodiment, the disclosed technology performs inspection of signaling / control traffic (such as GTP-C traffic) in a service provider network to extract information exchanged in the GTP-C traffic (e.g., parameters, such as described above and further described below), and monitors tunneled user traffic in a service provider network (e.g., using DPI, such as described above and further described below).

[0076] In an example implementation, the security platform is configured to monitor the respective interfaces of the MME, SGW, and PGW to monitor control / signaling traffic (e.g., GTP-C messages) and tunneled user traffic (GTP-U) to implement a security platform with GTP monitoring capabilities that implements a security policy that can use, for example, parameters such as location information, device ID / IMEI, subscriber information / IMSI, and / or RAT and / or any other parameters / information associated with a subscriber / mobile device that can be extracted from control / signaling traffic (e.g., GTP-C messages), and perform DPI on IP packets within the tunnel, as further described below. As described above, the location information / parameters, hardware identification (e.g., IMEI), subscriber identification (e.g., IMSI), and / or radio access technology (RAT) can be extracted by the security platform from the create session request message, which can be stored (e.g., cached as associated with the IP flow) for use in applying a security policy based on the extracted information and / or in conjunction with DPI, such as further described below.

[0077] The disclosed technology is illustrated and generally described herein with respect to performing network traffic inspection for GTPv1-C and GTP-U traffic in a 3G mobile packet core (MPC) and in a 4G evolved packet core (EPC) using GTPv2-C and GTP-U protocols, and / or may be similarly implemented in other mobile core networks / using other mobile network protocols (e.g., such as for a 5G core network or other mobile networks / protocols), wherein the mobile network protocols include location, device, subscriber and / or RAT parameters / information (e.g., location information, hardware identification, subscriber identifier information, RAT type information and / or other user / device / network specific parameters in the corresponding protocols) and / or tunneled user traffic on a service provider network for mobile device communications.

[0078] Figure 3A is another example of a GTPv1-C message flow between an SGSN and a GGSN in a 3G network according to some embodiments. Specifically, Figure 3A GTPv1-C messages exchanged between SGSN 302 and GGSN 304 in a 3G network for a GTPv1-C Create PDP message flow are shown.

[0079] refer to Figure 3A A Create PDP Request message is sent from SGSN 302 to GGSN 304 using the Gn / Gp interface, as shown at 310. A Create PDP Response message is sent from GGSN 304 to SGSN 302 using the Gn / Gp interface, as shown at 312.

[0080] Figure 3B is another example of a GTPv2-C message flow between an MME, SGW, and PGW in a 4G / LTE network according to some embodiments. Specifically, Figure 3B 322, SGW 324, and PDN-GW (PGW) 326 in a 4G / LTE network (e.g., Figure 1B FIG. 4 shows GTPv2-C messages exchanged between GGSN / PGW for a GTPv2-C create session message flow.

[0081] refer to Figure 3B , a create session request message is sent from the MME 322 to the SGW 324 using the S11 interface, as shown at 330, and then a create session request message is sent from the SGW 324 to the PGW 326 using the S5 / S8 interface, as shown at 332. A create session response message is sent from the PGW 326 to the SGW 324 using the S5 / S8 interface, as shown at 334, and then a create session response message is sent from the SGW 324 to the MME 322 using the S11 interface, as shown at 336.

[0082] As will now be further described below, various information / parameters, such as location, hardware identity (e.g., IMEI), subscriber identity (e.g., IMSI), and / or radio access technology (RAT), may be extracted from control / signaling traffic monitored by the security platform (e.g., GTPv1-C Create PDP Request message, GTPv2-C Create Session Request message, and / or other control / signaling protocols / messages in the mobile core network), which may be stored (e.g., cached as associated with an IP flow) for use in applying security policies based on this extracted information and / or in conjunction with DPI performed by the security platform on tunneled user data traffic (e.g., GTP-U traffic and / or other tunneled user data protocols in the mobile core network).

[0083] Technology for location-based security in service provider's mobile networks

[0084] In one embodiment, the disclosed technology for enhanced security in a service provider's mobile network includes providing location-based security in the service provider's mobile network. For example, a mobile service provider (e.g., a service provider of a mobile network, a service provider of a mobile device or IoT, a security service provider, or other entity that provides devices / services associated with using a mobile network) can apply the disclosed technology to provide location-based security to user devices (e.g., subscribers' mobile devices) and / or IoT devices connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs).

[0085] In one embodiment, a mobile service provider may apply the disclosed technology to provide new and enhanced location-based security services. For example, a mobile service provider may apply the disclosed technology to provide a location-based firewall service. As another example, a mobile service provider may apply the disclosed technology to provide a location-based threat detection service (e.g., a location-based basic threat detection service for known threats, a location-based advanced threat detection service for unknown threats, and / or other threat detection services that can utilize location-based information to apply security policies). As yet another example, a mobile service provider may apply the disclosed technology to provide a location-based threat prevention service for known threats (e.g., a location-based basic threat prevention service for known threats, a location-based advanced threat prevention service for unknown threats, and / or other threat prevention services that can utilize location-based information to apply security policies). As an additional example, a mobile service provider may apply the disclosed technology to provide a location-based URL filtering service.

[0086] In one embodiment, the disclosed technology for enhanced security in a mobile network of a service provider includes performing location-based security in a mobile network using a security platform that can implement security policies based on location information. For example, the security platform can monitor GTP-C traffic in the mobile network and process (e.g., parse) GTP-C messages to extract location information (e.g., the location information can be extracted from a Create PDP Request message that is sent from an SGSN to a GGSN in a mobile core network).

[0087] As similarly described above, the GPRS Tunneling Protocol (GTP) is a set of IP-based communication protocols used on various interfaces within the Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), and Long Term Evolution (LTE) networks. GTPv1-C and GTPv2-C are used in today's mobile networks (e.g., GTPv1-C and GTPv2-C are typically used in today's 3G and 4G / LTE mobile networks, respectively).

[0088] In one embodiment, the security platform is configured to extract user location information from a GTPv1-C Create PDP Request (e.g., in a 3G mobile network). In one embodiment, the security platform is configured to extract user location information from a GTPv2-C Create Session (e.g., in a 4G mobile network).

[0089] For example, such a request message may typically be sent by various network elements in a mobile network (e.g., a serving gateway (SGW), a mobility management entity (MME), and / or other network elements in the mobile network). In addition, such a request message may typically be sent over various interfaces (e.g., S11, S5 / S8, S4, and / or other interfaces in the mobile network as part of a number of processes such as E-UTRAN initial attach, UE requested PDN connection, PDP context activation, handover from trusted or untrusted non-3gpp IP access to E-UTRAN, and / or other processes). A user location information element (IE) is typically present in a GTPv2-C Create Session Request message as specified in 3GPP TS 29.274.

[0090] In one embodiment, the security platform may extract a location identifier (e.g., Location IE) (e.g., supported by GTPv1-C, GTPv2-C, or other network protocols) that may be used to apply security in a service provider's mobile network. Example location identifiers supported by GTPv2-C that may be used to apply security in a service provider's mobile network include the following: CGI (Cell Global Identifier), SAI (Service Area Identifier), RAI (Routing Area Identifier), TAI (Tracking Area Identifier), ECGI (E-UTRAN Cell Global Identifier), LAC (Location Area Identifier), and / or other location identifiers or combinations thereof. Specifically, the CGI (Cell Global Identifier) ​​typically provides location information including the following parameters: MCC (Mobile Country Code), MNC (Mobile Network Code), LAC (Location Area Code), and CI (Cell Identity) (e.g., CI is typically an area of ​​several hundred meters within a base station). The SAI (Service Area Identifier) ​​typically provides location information including the following parameters: MCC, MNC, LAC, and SAC (Service Area Code). RAI (Routing Area Identifier) ​​generally provides location information including the following parameters: MCC, MNC, LAC, and RAC (Routing Area Code). TAI (Tracking Area Identifier) ​​generally provides location information including the following parameters: MCC, MNC, and TAC (Tracking Area Code). ECGI (E-UTRAN Cell Global Identifier) ​​generally provides location information corresponding to MCC, MNC, and ECI (E-UTRAN Cell Identifier). LAC (Location Area Identifier) ​​generally provides location information including the following parameters: MCC, MNC, and LAC.

[0091] For example, the security platform may monitor the GTPv2-C Create Session Request message to extract such location parameters. Specifically, CGI, SAI, RAI, TAI ECGI, and LAC are included as parameters that may be extracted from the GTPv2-C Create Session Request message. In some cases, the GTPv2-C Create Session Request message may include two or more such location parameters (e.g., CGI and SAI). Example use case scenarios for enhanced security that may be performed on a service provider's mobile network using such location information are further described below (e.g., a fire emergency use case scenario using location information to restrict flying drones from being used in specific areas next to / near a fire emergency, as further described below).

[0092] As another example, the security platform can extract the user location information from the GTPv1-C Create PDP Request message, which is typically sent from the SGSN node to the GGSN node as part of the GPRS PDP context activation procedure, as described herein with respect to Figure 2ASimilar as described. The User Location Information Element (IE) is typically present in the GTPv1-C Create PDP Context Request message as specified in 3GPP TS 29.060. Example location identifiers supported by GTPv1-C that can be used to apply security in a service provider's mobile network include the following: CGI (Cell Global Identifier), SAI (Service Area Identifier) ​​and RAI (Routing Area Identifier) ​​and / or other location identifiers or combinations thereof. Specifically, the CGI (Cell Global Identifier) ​​typically provides location information including the following parameters: MCC (Mobile Country Code), MNC (Mobile Network Code), LAC (Location Area Code) and CI (Cell Identity) (for example, the CI is typically an area of ​​several hundred meters within a base station). The SAI (Service Area Identifier) ​​typically provides location information including the following parameters: MCC, MNC, LAC and SAC (Service Area Code). The RAI (Routing Area Identifier) ​​typically provides location information including the following parameters: MCC, MNC, LAC and RAC (Routing Area Code).

[0093] Thus, the disclosed technology for enhanced security in a service provider's mobile network includes performing location-based security in a mobile network using a security platform that can implement security policies based on location information.

[0094] In one embodiment, the security platform can extract location information to perform security based on security policies that can be applied based on location information (e.g., each CGI, SAI, RAI, TAI, ECGI, and / or LAC in a mobile network). In one embodiment, the security platform can extract location information to perform threat detection based on security policies that can be applied based on location information (e.g., each CGI, SAI, RAI, TAI, ECGI, and / or LAC in a mobile network).

[0095] In one embodiment, the security platform may extract location information to perform threat prevention based on security policies, which may be applied based on location information (e.g., each CGI, SAI, RAI, TAI, ECGI, and / or LAC in a mobile network).

[0096] In one embodiment, the security platform can extract location information to perform URL filtering based on security policies, which can be applied based on location information (e.g., each CGI, SAI, RAI, TAI, ECGI and / or LAC in the mobile network).

[0097] In one embodiment, the security platform can extract location information to perform threat detection, threat prevention, URL filtering, and / or other security techniques (e.g., including using DPI-based security techniques from monitored tunneled user traffic) based on security policies that can be applied based on location information (e.g., each CGI, SAI, RAI, TAI, ECGI, and / or LAC in a mobile network).

[0098] As will now be apparent to one of ordinary skill in the art, a mobile service provider (e.g., a service provider of a mobile network, a service provider of a mobile device or IoT, a security service provider, or other entity that provides devices / services associated with using a mobile network) can use the disclosed techniques to provide each or a combination of these location-based firewall services and various other location-based services. In addition, a mobile service provider can apply the disclosed techniques to provide such a location-based firewall service in conjunction with various other enhanced security services, such as based on subscriber / user identification, based on hardware identification, based on RAT, and / or a combination thereof, as further described below.

[0099] These and other techniques for providing enhanced security in a service provider's mobile network based on location information (e.g., and / or in conjunction with other DPI and / or NGFW techniques, such as application ID, user ID, content ID, URL filtering, etc.) are further described below.

[0100] Technology for mobile device identity and / or IoT device identity based security enforcement in a service provider's mobile network

[0101] As discussed above, the International Mobile Equipment Identity (IMEI) is a unique identifier (e.g., a 16 or 15 digit code) that is typically used to identify a mobile device (e.g., a hardware device) to a mobile network (e.g., a GSM or UMTS network). For example, the IMEI can provide a unique hardware identifier (ID) for a mobile device / station, including a mobile / smartphone, a laptop, a tablet, or other computing device, or an IoT device or any other device that has a Subscriber Identity Module (SIM) card or an embedded SIM / embedded Universal Integrated Circuit Card (eUICC) and communicates on a mobile network or any other device (e.g., a GSM or UMTS network). In an example implementation, a mobile equipment identity / IMEI and / or IoT device identity (e.g., IMEI or IMEISV) as defined in 3GPP TS 23.003 and application ID-based security are further described herein, which can be implemented using an NGFW by parsing GTP-C messages to obtain IMEI / IMEISV information and inspecting tunnel traffic (e.g., DPI of GTP-U traffic).

[0102] In one embodiment, the disclosed technology for enhanced security in a service provider's mobile network includes providing security based on mobile device identifiers in the service provider's mobile network. For example, a mobile service provider can apply the disclosed technology to provide security based on mobile device identifiers (e.g., using NGFW in conjunction with application IDs) to user devices (e.g., subscribers' mobile devices) and / or IoT devices connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs).

[0103] In one embodiment, the disclosed technology for enhanced security in a service provider's mobile network includes providing enhanced security in the service provider's mobile network using a mobile device identifier and an application ID. For example, a mobile service provider can apply the disclosed technology to provide enhanced security to user devices (e.g., subscribers' mobile devices) and / or IoT devices connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs) based on a mobile device identifier and an application ID (e.g., the application ID can be determined by a security platform monitoring tunneled user traffic, which is inspected using a DPI technology implemented by an NGFW, as further described below).

[0104] In one embodiment, a mobile service provider may apply the disclosed technology to use a mobile device identifier and / or use a mobile device identifier and an application ID to provide new and enhanced security services. For example, a mobile service provider may apply the disclosed technology to use a mobile device identifier and an application ID to provide a firewall service. As another example, a mobile service provider may apply the disclosed technology to use a mobile device identifier and an application ID to provide a threat detection service (e.g., a basic threat detection service for known threats based on a mobile device identifier, an advanced threat detection service for unknown threats based on a mobile device identifier, and / or other threat detection services that can utilize information based on a mobile device identifier to apply security policies). As another example, a mobile service provider may apply the disclosed technology to use a mobile device identifier and an application ID to provide a threat prevention service for known threats (e.g., a basic threat prevention service for known threats based on a mobile device identifier, an advanced threat prevention service for unknown threats based on a mobile device identifier, and / or other threat prevention services that can utilize information based on a mobile device identifier to apply security policies). As an additional example, a mobile service provider may apply the disclosed technology to use a mobile device identifier and an application ID to provide a URL filtering service. As a further example, a mobile service provider can apply the disclosed technology to provide an application denial of service (DoS) detection service for DoS attacks using a mobile device identifier and an application ID. As another example, a mobile service provider can apply the disclosed technology to provide an application denial of service (DoS) prevention service for DoS attacks using a mobile device identifier and an application ID.

[0105] In one embodiment, the disclosed technology for enhanced security in a mobile network of a service provider includes performing mobile device identifier-based security in a mobile network using a security platform that can implement security policies based on mobile device identifier information. For example, the security platform can monitor GTP-C traffic in the mobile network and process (e.g., parse) GTP-C messages to extract mobile device identifier information (e.g., mobile device identifier information, such as IMEI, can be extracted from a Create PDP Request message in a 3G mobile network or a Create Session Request message in a 4G mobile network).

[0106] As similarly described above, the GPRS Tunneling Protocol (GTP) is a set of IP-based communication protocols used on various interfaces within the Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), and Long Term Evolution (LTE) networks. GTPv1-C and GTPv2-C are used in today's mobile networks (e.g., GTPv1-C and GTPv2-C are typically used in today's 3G and 4G / LTE mobile networks, respectively).

[0107] In one embodiment, the security platform is configured to extract the mobile device identifier information (e.g., IMEI or IMEISV) from a GTPv1-C Create PDP Request (e.g., in a 3G mobile network). In one embodiment, the security platform is configured to extract the mobile device identifier information (e.g., IMEI or IMEISV) from a GTPv2-C Create Session (e.g., in a 4G mobile network).

[0108] For example, a GTPv2-C create session request message may generally be sent by various network elements in a mobile network (e.g., a serving gateway (SGW), a mobility management entity (MME), and / or other network elements in a mobile network), as described herein with respect to Figure 2B Similar as described. In addition, such a Create Session Request message may generally be sent over various interfaces (e.g., S11, S5 / S8, S4, and / or other interfaces in the mobile network as part of a number of processes such as E-UTRAN initial attach, UE requested PDN connection, PDP context activation, handover from trusted or untrusted non-3GPP IP access to E-UTRAN, and / or other processes). The IMEI information element (IE) is generally present in the GTPv2-C Create Session Request message as specified in 3GPP TS 29.274.

[0109] As another example, the security platform may extract the mobile device identifier information (e.g., IMEI or IMEISV) from the GTPv1-C Create PDP Request message, which is typically sent from the SGSN node to the GGSN node as part of the GPRS PDP context activation procedure, as described herein with respect to Figure 2A Similar to what described.

[0110] Thus, the disclosed technology for enhanced security in a service provider's mobile network includes enforcing security in the mobile network using a security platform that can implement security policies (e.g., for users / subscribers of the mobile network) based on IMEI and application ID. In addition, the disclosed technology for enhanced security in a service provider's mobile network includes enforcing security in the mobile network using a security platform that can implement security policies (e.g., for mobile devices and / or IoT devices) based on IMEI and application ID.

[0111] In one embodiment, the security platform can extract the mobile device identifier information (e.g., IMEI or IMEISV) to perform security based on a security policy that can be applied based on the mobile device identifier information. In one embodiment, the security platform can extract the mobile device identifier information (e.g., IMEI or IMEISV) and perform DPI to identify the application ID to perform security based on a security policy that can be applied based on the mobile device identifier information and the application ID.

[0112] In one embodiment, the security platform can extract mobile device identifier information (e.g., IMEI or IMEISV) and perform DPI to identify the application ID to perform security based on a security policy that can be applied based on the mobile device identifier information and the application ID. For example, the security platform can perform threat detection by applying security policies based on IMEI and application ID in mobile and converged networks using the disclosed techniques. As another example, the security platform can perform threat prevention by applying security policies based on IMEI and application ID in mobile and converged networks using the disclosed techniques. As yet another example, the security platform can perform URL filtering by applying security policies based on IMEI and application ID in mobile and converged networks using the disclosed techniques. An example use case scenario for enhanced security that can be performed on a service provider's mobile network using such mobile device identifier information (e.g., IMEI or IMEISV) and application ID is further described below (e.g., a service provider can restrict remote access to a network-enabled thermostat that is determined to be compromised, as further described below).

[0113] As will now be apparent to one of ordinary skill in the art, a mobile service provider (e.g., a service provider of a mobile network, a service provider of a mobile device or IoT, a security service provider, or other entity that provides devices / services associated with the use of a mobile network) can use the disclosed techniques to provide each or a combination of these mobile device identifier-based firewall services and various other mobile device identifier-based services. In addition, a mobile service provider can apply the disclosed techniques to provide such a firewall service using a mobile device identifier in conjunction with various other enhanced security services, such as location-based, subscriber / user identity-based, RAT-based, and / or a combination thereof, as further described below.

[0114] These and other techniques for providing enhanced security in a service provider's mobile network based on mobile device identifier information and application ID (e.g., and / or other DPI and / or NGFW techniques such as user ID, content ID, URL filtering, etc.) are further described below.

[0115] Technology for secure implementation of mobile user identity and / or SIM-based IoT identity and application identity in a service provider's mobile network In one embodiment, the disclosed technology for enhanced security in a service provider's mobile network includes providing security based on mobile user identity and / or SIM-based IoT identity in the service provider's mobile network. For example, a mobile service provider can apply the disclosed technology to provide security based on mobile user identity and / or SIM-based IoT identity (e.g., using NGFW in conjunction with application ID) to user devices (e.g., mobile devices of subscribers including subscriber identity module (SIM) cards or embedded SIM / embedded universal integrated circuit cards (eUICC)) connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs).

[0116] In one embodiment, the disclosed technology for enhanced security in a service provider's mobile network includes providing enhanced security in the service provider's mobile network using a mobile user identity and an application ID. For example, a mobile service provider can apply the disclosed technology to provide enhanced security to user devices (e.g., mobile devices of subscribers) and / or IoT devices connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs) based on a mobile user identity and / or a SIM-based IoT identity (e.g., an International Mobile Subscriber Identity (IMSI) or other mobile user identifier) ​​and an application ID (e.g., the application ID can be determined by a security platform monitoring tunneled user traffic, which is inspected using a DPI technology implemented by an NGFW, as further described below).

[0117] In one embodiment, a mobile service provider may apply the disclosed technology to use a mobile user identity and / or use a mobile user identity and an application ID to provide new and enhanced security services. For example, a mobile service provider may apply the disclosed technology to use a mobile user identity (e.g., an IMSI or other mobile user identity) and an application ID to provide a firewall service. As another example, a mobile service provider may apply the disclosed technology to use a mobile user identity and an application ID to provide a threat detection service (e.g., a basic threat detection service for known threats based on a mobile user identity, an advanced threat detection service for unknown threats based on a mobile user identity, and / or other threat detection services that can utilize information based on a mobile user identity to apply security policies). As another example, a mobile service provider may apply the disclosed technology to use a mobile user identity and an application ID to provide a threat prevention service for known threats (e.g., a basic threat prevention service for known threats based on a mobile user identity, an advanced threat prevention service for unknown threats based on a mobile user identity, and / or other threat prevention services that can utilize information based on a mobile user identity to apply security policies). As an additional example, a mobile service provider may apply the disclosed technology to use a mobile user identity and an application ID to provide a URL filtering service. As a further example, a mobile service provider can apply the disclosed technology to provide an application denial of service (DoS) detection service for DoS attacks using mobile user identification and application ID. As another example, a mobile service provider can apply the disclosed technology to provide an application denial of service (DoS) prevention service for DoS attacks using mobile user identification and application ID.

[0118] As similarly described above, the GPRS Tunneling Protocol (GTP) is a set of IP-based communication protocols used on various interfaces within the Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), and Long Term Evolution (LTE) networks. GTPv1-C and GTPv2-C are used in today's mobile networks (e.g., GTPv1-C and GTPv2-C are typically used in today's 3G and 4G / LTE mobile networks, respectively).

[0119] In one embodiment, the disclosed technology for enhanced security in a mobile network of a service provider includes performing mobile user identity and / or SIM-based IoT identity-based security in a mobile network using a security platform that can implement security policies based on mobile user identity and / or SIM-based IoT identity information and application IDs. For example, the security platform can monitor GTP-C traffic in the mobile network and process (e.g., parse) GTP-C messages to extract mobile user identity and / or SIM-based IoT identity (e.g., mobile user identifier information, such as IMSI, can be extracted from a Create PDP Request message in a 3G mobile network or a Create Session Request message in a 4G mobile network).

[0120] In one embodiment, the security platform is configured to extract the mobile user identification information (e.g., IMSI) from a GTPv1-C Create PDP Request (e.g., in a 3G mobile network). In one embodiment, the security platform is configured to extract the mobile user identification information (e.g., IMSI) from a GTPv2-C Create Session (e.g., in a 4G mobile network).

[0121] For example, a GTPv2-C create session request message may generally be sent by various network elements in a mobile network (e.g., a serving gateway (SGW), a mobility management entity (MME), and / or other network elements in a mobile network), as described herein with respect to Figure 2B Similar as described. In addition, such request messages may typically be sent over various interfaces (e.g., S11, S5 / S8, S4, and / or other interfaces in the mobile network as part of a number of processes such as E-UTRAN initial attach, UE requested PDN connection, PDP context activation, handover from trusted or untrusted non-3GPP IP access to E-UTRAN, and / or other processes). The IMSI information element (IE) is typically present in the GTPv2-C Create Session Request message as specified in 3GPP TS 29.274.

[0122] As another example, the security platform may extract mobile user identity information (e.g., IMSI) from a GTPv1-C Create PDP Request message, which is typically sent from an SGSN node to a GGSN node as part of a GPRS PDP context activation procedure, as described herein with respect to Figure 2A Similar to what described.

[0123] Thus, the disclosed technology for enhanced security in a service provider's mobile network includes performing security in the mobile network using a security platform that can implement security policies (e.g., for users / subscribers of the mobile network) based on IMSI and application ID. In addition, the disclosed technology for enhanced security in a service provider's mobile network includes performing security in the mobile network using a security platform that can implement security policies (e.g., for mobile devices and / or IoT devices including a SIM or an embedded SIM) based on IMSI and application ID.

[0124] In one embodiment, the security platform may extract mobile user identification information (e.g., IMSI) to perform security based on security policies that may be applied based on the mobile user identification information. In one embodiment, the security platform may extract mobile user identification information (e.g., IMSI) and perform DPI to identify the application ID to perform security based on security policies that may be applied based on the mobile user identification information and the application ID.

[0125] In one embodiment, the security platform may extract mobile user identification information (e.g., IMSI) and perform DPI to identify the application ID to perform security based on a security policy, which may be applied based on the mobile user identification information and the application ID. For example, the security platform may perform threat detection by applying security policies based on IMSI and application ID in mobile and converged networks using the disclosed techniques. As another example, the security platform may perform threat prevention by applying security policies based on IMSI and application ID in mobile and converged networks using the disclosed techniques. As yet another example, the security platform may perform URL filtering by applying security policies based on IMSI and application ID in mobile and converged networks using the disclosed techniques. An example use case scenario for enhanced security that may be performed on a service provider's mobile network using such mobile user identification information (e.g., IMSI) and application ID is further described below (e.g., a service provider may block access to resources (such as devices or applications of devices) based on mobile user identification information, as further described below).

[0126] As will now be apparent to one of ordinary skill in the art, a mobile service provider (e.g., a service provider of a mobile network, a service provider of a mobile device or IoT, a security service provider, or other entity that provides devices / services associated with the use of a mobile network) can use the disclosed techniques to provide each or a combination of these mobile user identity-based firewall services and various other mobile user identity-based services. In addition, a mobile service provider can apply the disclosed techniques to provide such a firewall service using a mobile user identity in combination with various other enhanced security services, such as location-based, mobile device identifier-based, RAT-based, and / or a combination thereof, as further described below.

[0127] These and other techniques for providing enhanced security in a service provider's mobile network based on mobile user identification information and application ID (e.g., and / or other DPI and / or NGFW techniques, such as user ID, content ID, URL filtering, etc.) are further described below.

[0128] Techniques for Radio Access Technology-Based Security Enforcement in a Service Provider's Mobile Network In one embodiment, the disclosed techniques for enhanced security in a service provider's mobile network include providing radio access technology (RAT)-based security in the service provider's mobile network. For example, a mobile service provider can apply the disclosed techniques to provide RAT-based security (e.g., using NGFW in conjunction with application ID) to user devices connected to their mobile networks using 3G, 4G, or 5G radio access technologies (RATs).

[0129] In one embodiment, the disclosed techniques for enhanced security in a service provider's mobile network include providing RAT-based security in the service provider's mobile network. For example, a mobile service provider may apply the disclosed techniques to provide RAT-based security to user devices (e.g., subscribers' mobile devices) and / or IoT devices connected to their mobile networks using 3GPP RAT or non-3GPP RAT.

[0130] In one embodiment, a mobile service provider may apply the disclosed technology to provide new and enhanced security services based on RAT. For example, a mobile service provider may apply the disclosed technology to provide a firewall service based on RAT. As another example, a mobile service provider may apply the disclosed technology to use RAT information to provide threat detection services (e.g., basic threat detection services for known threats based on RAT, advanced threat detection services for unknown threats based on RAT, and / or other threat detection services that can utilize RAT-based information to apply security policies). As another example, a mobile service provider may apply the disclosed technology to use RAT information to provide threat prevention services for known threats (e.g., basic threat prevention services for known threats based on RAT, advanced threat prevention services for unknown threats based on RAT, and / or other threat prevention services that can utilize RAT-based information to apply security policies). As an additional example, a mobile service provider may apply the disclosed technology to use RAT information to provide URL filtering services.

[0131] As similarly described above, the GPRS Tunneling Protocol (GTP) is a set of IP-based communication protocols used on various interfaces within the Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), and Long Term Evolution (LTE) networks. GTPv1-C and GTPv2-C are used in today's mobile networks (e.g., GTPv1-C and GTPv2-C are typically used in today's 3G and 4G / LTE mobile networks, respectively).

[0132] In one embodiment, the disclosed technology for enhanced security in a mobile network of a service provider includes performing RAT-based security in the mobile network using a security platform that can implement security policies based on RAT information. For example, the security platform can monitor GTP-C traffic in the mobile network and process (e.g., parse) GTP-C messages to extract RAT information.

[0133] In one embodiment, the security platform is configured to extract RAT information from a GTPv2-C create session (e.g., in a 4G mobile network). For example, a GTPv2-C create session request message may be generally sent by various network elements in a mobile network (e.g., a serving gateway (SGW), a mobility management entity (MME), and / or other network elements in a mobile network), as described herein with respect to Figure 2BSimilar as described. In addition, such a Create Session Request message may generally be sent over various interfaces (e.g., S11, S5 / S8, S4, and / or other interfaces in the mobile network as part of a number of processes such as E-UTRAN initial attach, UE requested PDN connection, PDP context activation, handover from trusted or untrusted non-3GPP IP access to E-UTRAN, and / or other processes). A RAT information element (IE) is generally present in a GTPv2-C Create Session Request message as specified in 3GPP TS 29.274. For example, the RAT IE may be set to the 3GPP access or non-3GPP access that the user equipment (UE) is using to attach to the mobile network.

[0134] In one embodiment, the disclosed technology for enhanced security in a mobile network of a service provider includes performing RAT-based security in a mobile network using a security platform that can implement security policies based on RAT information (e.g., RAT types supported by GTPv2-C). Example RAT types supported by GTPv2-C include the following: UTRAN (e.g., RAT type value = 1), GERAN (e.g., RAT type value = 2), WLAN (e.g., RAT type value = 3), GAN (e.g., RAT type value = 4), HSPA evolution (e.g., RAT type value = 5), EUTRAN (WB-E-UTRAN) (e.g., RAT type value = 6), virtual (e.g., RAT type value = 7), and EUTRAN-NB-IoT (e.g., RAT type value = 8).

[0135] In one embodiment, the security platform is configured to extract the RAT information from a GTPv1-C Create PDP Request message (e.g., in a 3G mobile network). For example, the security platform can extract the RAT information from a GTPv1-C Create PDP Request message, which is typically sent from an SGSN node to a GGSN node as part of a GPRS PDP context activation procedure, as described herein with respect to Figure 2A Similar to what described.

[0136] Thus, the disclosed techniques for enhanced security in a service provider's mobile network include performing security in a mobile network using a security platform that can implement security policies based on RAT information. In one embodiment, the security platform can extract the RAT information to perform security based on a security policy that can be applied based on the RAT information. For example, the security platform can perform threat detection by applying security policies based on RAT type in mobile and converged networks using the disclosed techniques. As another example, the security platform can perform threat prevention by applying security policies based on RAT type in mobile and converged networks using the disclosed techniques. As yet another example, the security platform can perform URL filtering by applying security policies based on RAT type in mobile and converged networks using the disclosed techniques. Example use case scenarios for enhanced security that may be performed on a service provider's mobile network using RAT information are further described below (e.g., a Tier 1 cellular / mobile service provider that leases 3G (but not 4G) cellular / mobile network access to a Tier 2 service provider may configure the disclosed security platform to utilize RAT information to allow access to their 3G network for users / subscribers of the Tier 2 cellular / mobile service provider, but restrict / disallow access to their 4G network for such users / subscribers, such as described further below).

[0137] As will now be apparent to one of ordinary skill in the art, a mobile service provider (e.g., a service provider of a mobile network, a service provider of a mobile device or IoT, a security service provider, or other entity that provides devices / services associated with using a mobile network) can use the disclosed techniques to provide each or a combination of these RAT-based firewall services and various other RAT-based services. In addition, a mobile service provider can apply the disclosed techniques to provide such a firewall service using a RAT in combination with various other enhanced security services, such as location-based, mobile device identifier-based, mobile user identifier-based, and / or a combination thereof, as further described below.

[0138] These and other techniques for providing enhanced security in a service provider's mobile network based on RAT information (e.g., and / or in combination with various DPI and / or NGFW techniques, such as application ID, user ID, content ID, URL filtering, etc.) are further described below.

[0139] Example use case for enhanced security of mobile / service provider networks using a security platform for security policy enforcement Figure 4A is an example use case for providing enhanced security for roaming access in a 3G network according to some embodiments. Specifically, Figure 4AA network layout of a security platform, shown as a roaming firewall 402, is shown between a GGSN 404 and a SGSN 406 in a 3G network.

[0140] refer to Figure 4A , a roaming firewall 402 may be used to monitor Create PDP Request messages (e.g., and / or other control / signaling messages) for a roaming subscriber (shown as roaming subscriber 408) sent from SGSN 406 to GGSN 404 using a Gp interface and a GTPv1-C protocol (e.g., and / or tunneled user data communications using a GTP-U protocol), as shown. For example, various security policies may be implemented by roaming firewall 402 using the disclosed techniques based on parameters / information extracted from such GTPv1-C messages and / or user data communications in GTP-U traffic (e.g., a roaming subscriber may generally have different security policies implemented than those implemented for a non-roaming subscriber, a roaming subscriber may have access restricted based on RAT type, a roaming subscriber may have access restricted based on RAT type and application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies may be implemented).

[0141] Figure 4B is an example use case for providing enhanced security for roaming access in 4G / LTE networks according to some embodiments. Specifically, Figure 4B A network layout of a security platform between PGW 412 and SGW 414 and MME 416 in a 4G / LTE network is shown, the security platform being shown as a roaming firewall 410 .

[0142] refer to Figure 4B , a roaming firewall 410 may be used to monitor create session request messages (e.g., and / or other control / signaling messages) for a roaming subscriber (shown as roaming subscriber 418) sent from an MME 416 to an SGW 414 using an S11 interface and then to a PGW 412 using an S8 interface and a GTPv2-C protocol (e.g., and / or tunneled user data communications using a GTP-U protocol), as shown. For example, various security policies may be implemented by the roaming firewall 410 using the disclosed techniques based on parameters / information extracted from such GTPv2-C messages and / or user data communications in GTP-U traffic (e.g., a roaming subscriber may generally have different security policies implemented than those implemented for a non-roaming subscriber, a roaming subscriber may have access restricted based on RAT type, a roaming subscriber may have access restricted based on RAT type and application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies may be implemented).

[0143] Figure 4C is an example use case for providing enhanced security for roaming access in a mixed 3G and 4G / LTE network according to some embodiments. Specifically, Figure 4C A network layout of a security platform, shown as a roaming firewall 420, is shown between a GGSN 422 and a SGSN 424 in a 3G network. Figure 4C Also shown is the network layout of a roaming firewall 420 between a PGW 426 and an SGW 428 in a 4G / LTE network.

[0144] refer to Figure 4C , a roaming firewall 420 may be used to monitor create session / PDP request messages (e.g., and / or other control / signaling messages) for a roaming subscriber (shown as roaming subscriber 430) sent using the Gp / S8 interface and the GTPv1-C / GTPv2-C protocol (e.g., and / or tunneled user data communications using the GTP-U protocol), as shown and as similarly described above. For example, various security policies may be implemented by the roaming firewall 420 using the disclosed techniques based on parameters / information extracted from such GTPv1-C / GTPv2-C messages and / or user data communications in the GTP-U traffic (e.g., a roaming subscriber may generally have different security policies implemented than those implemented for a non-roaming subscriber, a roaming subscriber may have access restricted based on RAT type (such as a roaming subscriber may be restricted to access only 3G networks in an H-PLMN (home network), such as Figure 4C ), roaming subscribers may have restricted access based on RAT type and application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies may be implemented).

[0145] Figure 4D is an example use case for providing enhanced security for mobile access in 4G / LTE networks according to some embodiments. Specifically, Figure 4D A network layout of a security platform between an SGW 434 and an MME 436 in a 4G / LTE network is shown, the security platform being shown as a RAN firewall 432 .

[0146] refer to Figure 4D, a RAN firewall 432 may be used to monitor a create session request message (e.g., and / or other control / signaling messages) for a mobile subscriber in a home network (shown as mobile subscriber 440) sent from an MME 436 to an SGW 434 using an S11 interface (e.g., and / or tunneled user data communications using a GTP-U protocol), as shown. For example, various security policies may be implemented by the RAN firewall 432 using the disclosed techniques based on parameters / information extracted from such GTPv2-C messages and / or user data communications in GTP-U traffic (e.g., a mobile subscriber may typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber, a mobile subscriber may also typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber in combination with an application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies may be implemented).

[0147] Figure 4E is an example use case for providing enhanced security for non-3GPP access in 4G / LTE networks according to some embodiments. Specifically, Figure 4E A network layout of a security platform between a PGW 444 and an evolved packet data gateway (ePDG) 446 and a trusted Wi-Fi access gateway (TWAG) 448 in a 4G / LTE network is shown, the security platform being shown as a non-3GPP access firewall 442 .

[0148] refer to Figure 4E , a non-3GPP access firewall 442 can be used to monitor create session request messages (e.g., and / or other control / signaling messages) for mobile subscribers in an untrusted non-3GPP access network or from mobile subscribers in a trusted 3GPP access network (e.g., and / or tunneled user data communications using the GTP-U protocol), as shown. For example, various security policies can be implemented by the non-3GPP access firewall 442 using the disclosed techniques based on parameters / information extracted from such GTPv2-C messages and / or user data communications in GTP-U traffic (e.g., a mobile subscriber can typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber, a mobile subscriber can also typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber in combination with an application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies can be implemented).

[0149] Figure 4Fis an example use case of using a core firewall in a 4G / LTE network to provide enhanced security for mobile access according to some embodiments. Specifically, Figure 4F A network layout of a security platform between an SGW 454 and a PGW 456 in a 4G / LTE network is shown, the security platform being shown as a core firewall 452 .

[0150] refer to Figure 4F , a core firewall 452 can be used to monitor create session request messages (e.g., and / or other control / signaling messages) for mobile subscribers (e.g., and / or tunneled user data communications using the GTP-U protocol), as shown. For example, various security policies can be implemented by the core firewall 452 using the disclosed techniques based on parameters / information extracted from such GTPv2-C messages and / or user data communications in GTP-U traffic (e.g., a mobile subscriber can typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber, a mobile subscriber can also typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber in combination with an application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies can be implemented).

[0151] Figure 4G is an example use case of using a core firewall in a 3G network to provide enhanced security for mobile access according to some embodiments. Specifically, Figure 4G A network layout of a security platform between an SGSN 464 and a GGSN 466 in a 3G network is shown, the security platform being shown as a core firewall 462 .

[0152] refer to Figure 4G , a core firewall 462 can be used to monitor create session request messages (e.g., and / or other control / signaling messages) for mobile subscribers (e.g., and / or tunneled user data communications using the GTP-U protocol), as shown. For example, various security policies can be implemented by the core firewall 462 using the disclosed techniques based on parameters / information extracted from such GTPv2-C messages and / or user data communications in GTP-U traffic (e.g., a mobile subscriber can typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber, a mobile subscriber can also typically have different security policies implemented based on location, device identifier, subscriber identity, and / or RAT associated with the mobile subscriber in combination with an application ID (and / or other DPI-determined information, such as content ID, user ID, URL, etc.), and / or various other security policies can be implemented).

[0153] Additional Example Use Case Scenarios for Enhanced Security of Mobile / Service Provider Networks Using a Security Platform for Security Policy Enforcement The disclosed techniques for providing enhanced security for mobile / service provider networks using a security platform for security policy enforcement can be applied in a variety of additional example use case scenarios for facilitating enhanced and more flexible and dynamic security in mobile / service provider network environments. The additional example use case scenarios are further described below.

[0154] As a first example use case scenario, assume that subscriber Alice connects to a mobile network through her mobile network service provider (e.g., AT&T). 、T- , or another service provider) signs up for enhanced security, and the security platform dynamically applies new security policies based on Alice's subscriber identity (IMSI) and / or Alice's device identifier (e.g., IMEI associated with Alice's mobile phone or her (one or more) other devices). In addition, such security policy enforcement implemented for sessions associated with Alice and / or her devices on mobile networks controlled / managed by Alice's service provider may include security policy enforcement based on other information / parameters, such as location and / or RAT, threat detection / prevention, URL filtering, application ID, content ID, and / or other DPI-based security policy checks / enforcement, as similarly described above.

[0155] As a second example use case scenario, assume that the control of one or more applications within a car (e.g., radio application, acceleration control, steering wheel control, brake control) is hijacked by an unauthorized user / entity. In this scenario, the disclosed technology can be applied by implementing security policies per car (e.g., based on the IMEI associated with the compromised / infected car), per user (e.g., based on IMSI), per location, and / or per application (e.g., based on application ID). Specifically, a service provider can use a security platform implementing the disclosed technology to block attacks / control of specific applications for each user (e.g., IMSI) and / or each car identifier (e.g., IMEI). For example, the security platform can detect that the car is infected, such as based on detecting command and control (C&C) traffic (e.g., using DPI-based firewall technology (such as by monitoring DNS requests from the car), and / or using other DPI-based firewall technology). As another example, the security platform can detect malware traffic directed toward the car (e.g., using DPI-based firewall techniques (such as by performing URL filtering, identifying content IDs, and / or using other DPI-based firewall techniques). The firewall can be configured to generate alerts, block / drop packets, or perform other actions including blocking specific applications (e.g., based on the car's application ID and IMEI, including acceleration, steering, and braking applications, but radio applications can be allowed to have Internet access, which can be configured to block applications / whitelist applications and / or modify access permissions when suspicious / malware behavior is detected). As yet another example, if a hacker hardware identification (IMEI) is determined to be attacking / targeting the car, then all GTP-C create PDP / session messages can be blocked / dropped to not allow any communication from such an unauthorized entity (e.g., a hacker / hacked device).

[0156] As a third example use case scenario, assume that a network-accessible thermostat (e.g., an IoT thermostat) is hijacked by an unauthorized user / entity. In this scenario, the disclosed technology can be applied by implementing security policies per thermostat (e.g., based on the IMEI associated with the compromised / infected thermostat), per user (e.g., based on the IMSI), per location, and / or per application (e.g., based on the application ID). Specifically, a service provider can use a security platform implementing the disclosed technology to block attacks / control of specific applications for each user (e.g., IMSI) and / or each thermostat identifier (e.g., IMEI). For example, the security platform can detect that the thermostat is infected, such as based on detecting command and control (C&C) traffic (e.g., using DPI-based firewall technology (such as by monitoring DNS requests from cars), and / or using other DPI-based firewall technology). As another example, the security platform can detect malware traffic directed toward the thermostat (e.g., using DPI-based firewall technology (such as by performing URL filtering, identifying content IDs), and / or using other DPI-based firewall technology). The firewall may be configured to generate alerts, block / drop packets, or perform other actions including blocking specific applications (e.g., based on the thermostat's application ID and IMEI, including remote control such as temperature accessed via the Internet so that the user can only change manually on the thermostat device dial itself and not via the Internet, which can be configured to block applications and / or modify access permissions when suspicious / malware behavior is detected). As yet another example, if a hacker hardware identification (IMEI) is determined to be attacking / targeting the thermostat, then all GTP-C Create PDP / Session messages may be blocked / dropped to not allow any communications from such unauthorized entities (e.g., hackers / hacked devices).

[0157] As a fourth example use case scenario, assuming that a given location suffers an emergency forest fire event, a security platform implementing the disclosed technology can be configured to block all GTP-C create PD / session messages based on (one or more) location information / parameters in the geographic area. For example, blocking such new GTP sessions in the geographic area of ​​the emergency forest fire event can be used to prevent unauthorized / non-emergency personnel from flying drones that could interfere with firefighting efforts in the geographic area of ​​the emergency forest fire event (e.g., which could interfere with the use of helicopters or aircraft to fight the fire, or otherwise put emergency personnel / others at further risk).

[0158] In an example implementation, a mobile network service provider and / or other service provider may use table(s) (e.g., stored in the data plane of a security platform device, such as described further below) to implement such security policies in various use case scenarios, which may include correlations between IMEI, IMSI, and IP address. For example, for a home or office with multiple IoT devices associated with a given IP address of a user's home or office network, a user may enter a corresponding IMSI for each of their IoT devices. In this example, security policies may be implemented based on IMSI (e.g., in addition to based on IP address, which would affect each of the user's home or office IoT devices because they are each associated with the same home IP address of the user using NAT). In this way, the mobile network or other service provider may use the table to enforce security policies using the techniques described above.

[0159] As a fifth example use case scenario, assuming that a network service provider (e.g., a small cell company, which is a Tier 2 or Tier 3 mobile operator company) leases network access from another network service provider (e.g., a large cell company, such as AT&T or Verizon, which is a Tier 1 mobile operator company), then the large cell company can utilize a security platform that implements the disclosed technology to allow RATs and / or block RATs based on security policies corresponding to the lease agreement between the large cell company and the small cell company (e.g., the large cell company may have only leased a 3G network but not a 4G network to the small cell company). As another example, the large cell company may have only leased RAT access to IoT to the small cell company (e.g., a security policy may be specified for IoT access, wherein the security policy specifies applications and protocols that can be used on IoT (whitelisted) so that other protocols / applications can be blocked / filtered as not allowed (blacklisted)).

[0160] In view of the disclosed embodiments, as will now be apparent, network service providers / mobile operators (e.g., cellular service provider entities), device manufacturers (e.g., automotive entities, IoT device entities, and / or other device manufacturers), and / or system integrators can specify such security policies, which can be implemented by a security platform using the disclosed techniques to address these and other technical cybersecurity challenges.

[0161] Example hardware components of a network device for performing security policy enforcement on a mobile / service provider network environment

[0162] Figure 55 is a functional diagram of hardware components of a network device for performing security policy enforcement on a mobile / service provider network environment according to some embodiments. The example shown is a representation of physical / hardware components that may be included in a network device 500 (e.g., equipment, gateways, or servers that may implement the security platform disclosed herein). Specifically, the network device 500 includes a high-performance multi-core CPU 502 and a RAM 504. The network device 500 also includes a storage device 510 (e.g., one or more hard disks or solid-state storage units), which may be used to store policies and other configuration information and signatures. In one embodiment, the storage device 510 stores location information, hardware identifier information, subscriber identification information, and / or RAT information, as well as associated IP addresses and possibly other information (e.g., application ID, content ID, user ID, URL, and / or other information), which is monitored for use in implementing the disclosed security policy enforcement techniques using a security platform / firewall device. The network device 500 may also include one or more optional hardware accelerators. For example, network device 500 may include a cryptographic engine 506 configured to perform encryption and decryption operations, and one or more FPGAs 508 configured to perform signature matching, act as a network processor, and / or perform other tasks.

[0163] Example logical components of a network device for performing security policy enforcement on a mobile / service provider network environment

[0164] Figure 6 6 is a functional diagram of logical components of a network device for performing security policy enforcement on a mobile / service provider network environment in accordance with some embodiments. The example shown is a representation of logical components that may be included in a network device 600 (e.g., data equipment that may implement the disclosed security platform and perform the disclosed techniques). As shown, the network device 600 includes a management plane 602 and a data plane 604. In one embodiment, the management plane is responsible for managing user interactions, such as by providing a user interface for configuring policies and viewing log data. The data plane is responsible for managing data, such as by performing packet processing and session handling.

[0165] Assume that a mobile device attempts to access a resource (e.g., a remote website / server, IoT device, or other resource) using an encrypted session protocol (such as SSL). The network processor 606 is configured to monitor packets from the mobile device and provide the packets to the data plane 604 for processing. The flow 608 identifies the packet as part of a new session and creates a new session flow. Subsequent packets will be identified as belonging to the session based on the flow lookup. If applicable, SSL decryption is applied by the SSL decryption engine 610 using various techniques as described herein. Otherwise, the processing of the SSL decryption engine 610 is omitted. The application identification (APP ID) module 612 is configured to determine what type of traffic the session involves and identify the user associated with the traffic flow (e.g., identify the application ID as described herein). For example, the APP ID 612 can identify a GET request in the received data and conclude that the session requires an HTTP decoder. As another example, the APP ID 612 can identify a create session request or a create PDP request in the received data and conclude that the session requires a GTP decoder. For each type of protocol, there is a corresponding decoder 614. In one embodiment, application identification is performed by an application identification module (e.g., an APP-ID component / engine), and user identification is performed by another component / engine. Based on the determination made by APP ID 612, the packet is sent to an appropriate decoder 614. Decoder 614 is configured to assemble packets (e.g., which may be received out of order) into the correct order, perform tokenization, and extract information. Decoder 614 also performs signature matching to determine what should happen to the packet. SSL encryption engine 616 performs SSL encryption using various techniques as described herein, and then forwards packets using forwarding component 618, as shown. Also as shown, policy 620 is received and stored in management plane 602. In one embodiment, policy enforcement is applied as described herein with respect to various embodiments based on monitored, decrypted, identified, and decoded session traffic flows (e.g., a policy may include one or more rules that may be specified using domains and / or host / server names, and the rules may apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement for subscriber / IP flows on a service provider network based on various extracted parameters / information from DPI of monitored GTP-C messages and / or monitored GTP-U traffic as disclosed herein).

[0166] Also like Figure 6As shown in , an interface (I / F) communicator 622 is also provided for security platform manager communication (e.g., via (REST) ​​API, message or network protocol communication or other communication mechanism). In some cases, the network device 600 is used to monitor network communications of other network elements on the service provider network, and the data plane 604 supports decoding of such communications (e.g., the network device 600, including the I / F communicator 622 and the decoder 614, can be configured to monitor, for example, Gn, Gp, SGi, Gi, S1, S5, S8, S11 and / or other interfaces where wired and wireless network traffic flows exist, and / or communicate on, for example, Gn, Gp, SGi, Gi, S1, S5, S8, S11 and / or other interfaces where wired and wireless network traffic flows exist, as similarly described herein). In this way, the network device 600 including the I / F communicator 622 can be used to implement the disclosed technology for security policy enforcement on a mobile / service provider network environment, as described above and as will be further described below.

[0167] Additional example procedures for the disclosed techniques for performing security policy enforcement on a mobile / service provider network environment will now be described.

[0168] Example Procedure for Location-Based Security in a Service Provider's Mobile Network

[0169] Figure 7 is a flow chart of a process for performing location-based security in a mobile network of a service provider according to some embodiments. Figure 7 The process 700 shown in FIG. 1 is performed by a security platform and techniques similar to those described above (including the above description of Figure 1A-6 In one embodiment, process 700 is performed by Figure 5 The data equipment 500 described above Figure 6 The described network device 600, virtual equipment, SDN security solution, cloud security service and / or a combination or hybrid implementation of the above as described herein are performed.

[0170] The process starts at 702. At 702, monitoring of network traffic on a service provider network at a security platform to identify the location of a new session is performed. For example, the security platform (e.g., a firewall, a network sensor acting on behalf of a firewall, or another device / component that can implement security policies) can extract location information / parameters from GTP-C traffic on a mobile core network, as similarly described above.

[0171] Associating the location with the new session at the security platform is performed at 704. For example, the security platform may identify a new IP session (e.g., a data call or other session) and associate the location and assigned IP address with the new flow (e.g., cached / stored in a table in the data plane of the security platform), as similarly described above.

[0172] At 706, location-based determination of a security policy to be applied at the security platform to the new session is performed. For example, the security policy may be determined and / or implemented based on various combinations of location, hardware identifier, subscriber identification, and RAT information and / or based on information detected / determined using DPI-based firewall techniques, such as by performing URL filtering, identifying application IDs, identifying content IDs, and / or using other DPI-based firewall techniques, as similarly described above.

[0173] At 708, enforcement of the security policy on the new session using the security platform is performed. For example, the security platform can be used to perform various enforcement actions (e.g., allow / pass, block / drop, alert, tag, monitor, log, throttle, limit access, and / or other enforcement actions), as similarly described above.

[0174] Example process for mobile device identity and / or IoT device identity and application identity based security enforcement in a mobile network of a service provider

[0175] Figure 8 1 is a flowchart of a process for performing security enforcement based on mobile device identification and / or IoT device identification and application identification for a service provider in a mobile network according to some embodiments. Figure 8 The process 800 shown in FIG. 1 is performed by a secure platform and techniques similar to those described above (including the above Figure 1A-6 In one embodiment, process 800 is performed as described above with respect to Figure 5 The data equipment 500 described above Figure 6 The described network device 600, virtual equipment, SDN security solution, cloud security service and / or a combination or hybrid implementation of the above as described herein are performed.

[0176] The process starts at 802. At 802, monitoring network traffic on a service provider network at a security platform to identify a mobile device identity and / or IoT device identity for a new session is performed. For example, the security platform (e.g., a firewall, a network sensor acting on behalf of a firewall, or another device / component that can implement security policies) can extract the mobile device identity and / or IoT device identity information / parameters (e.g., IMEI) from GTP-C traffic on the mobile core network, as similarly described above.

[0177] At 804, determining an application identification (e.g., an application identifier) ​​of user traffic associated with the new session at the security platform is performed. For example, the application identifier (e.g., application ID) can be identified by monitoring GTP-U traffic using a DPI-based firewall technique, as similarly described above.

[0178] At 806, determining a security policy to be applied to the new session at the security platform based on the mobile device identification and / or IoT device identification and application identification is performed. For example, the security policy can be determined and / or implemented based on various combinations of location, hardware identifier, subscriber identification, and RAT information and / or based on information detected / determined using DPI-based firewall techniques, such as by performing URL filtering, identifying application IDs, identifying content IDs, and / or using other DPI-based firewall techniques, as similarly described above.

[0179] At 808, enforcement of the security policy on the new session using the security platform is performed. For example, the security platform can be used to perform various enforcement actions (e.g., allow / pass, block / drop, alert, tag, monitor, log, moderate, restrict access, and / or other enforcement actions), as similarly described above.

[0180] Example process for secure implementation of mobile subscriber identity based and / or SIM based IoT identity and application identity in a mobile network of a service provider

[0181] Fig. 9 is a flow chart of a process for performing security enforcement based on mobile user identity and / or SIM-based IoT identity and application identity for a service provider in a mobile network according to some embodiments. Fig. 9 The process 900 shown in FIG. 1 is performed by a secure platform and techniques similar to those described above (including the above Figure 1A-6 In one embodiment, process 900 is performed as described above with respect to Figure 5 The data equipment 500 described above Figure 6The described network device 600, virtual equipment, SDN security solution, cloud security service and / or a combination or hybrid implementation of the above as described herein are performed.

[0182] The process starts at 902. At 902, monitoring network traffic on a service provider network at a security platform to identify a subscriber identity and / or a SIM-based IoT identity for a new session is performed. For example, the security platform (e.g., a firewall, a network sensor acting on behalf of a firewall, or another device / component that can implement security policies) can extract mobile subscriber identity and / or SIM-based IoT identity information / parameters (e.g., IMSI) from GTP-C traffic on a mobile core network, as similarly described above.

[0183] At 904, determining at the security platform an application identification (e.g., an application identifier) ​​of user traffic associated with the new session is performed. For example, the application identifier (e.g., application ID) can be identified by monitoring GTP-U traffic using a DPI-based firewall technique, as similarly described above.

[0184] At 906, determining a security policy to be applied at the security platform to the new session based on the subscriber identification and the application identifier is performed. For example, the security policy can be determined and / or implemented based on various combinations of location, hardware identifier, subscriber identification, and RAT information and / or based on information detected / determined using DPI-based firewall techniques, such as by performing URL filtering, identifying application IDs, identifying content IDs, and / or using other DPI-based firewall techniques, as similarly described above.

[0185] At 908, enforcement of the security policy on the new session using the security platform is performed. For example, the security platform can be used to perform various enforcement actions (e.g., allow / pass, block / drop, alert, tag, monitor, log, moderate, restrict access, and / or other enforcement actions), as similarly described above.

[0186] Example procedures for radio access technology based security implementation in a service provider's mobile network

[0187] Fig.10 is a flow chart of a process for performing radio access technology (RAT) based security in a mobile network of a service provider according to some embodiments. Fig.10 The process 1000 shown in FIG. 1000 is performed by a secure platform and techniques similar to those described above (including the above Figure 1A-6 In one embodiment, process 1000 is performed as described above with respect to Figure 5 The data equipment 500 described above Figure 6The described network device 600, virtual equipment, SDN security solution, cloud security service and / or a combination or hybrid implementation of the above as described herein are performed.

[0188] The process starts at 1002. At 1002, monitoring network traffic on a service provider network at a security platform to identify a RAT for a new session is performed. For example, a security platform (e.g., a firewall, a network sensor acting on behalf of a firewall, or another device / component that can implement security policies) can extract RAT information / parameters from GTP-C traffic on a mobile core network, as similarly described above.

[0189] Associating the RAT with the new session at the security platform is performed at 1004. For example, the security platform may identify the new session (e.g., a data call or other session) and associate the RAT and assigned IP address with the new flow (e.g., cache / store in a table in the data plane of the security platform), as similarly described above.

[0190] At 1006, a RAT-based determination of a security policy to be applied at the security platform to the new session is performed. For example, the security policy may be determined and / or implemented based on various combinations of location, hardware identifier, subscriber identification, and RAT information and / or based on information detected / determined using DPI-based firewall techniques, such as by performing URL filtering, identifying application IDs, identifying content IDs, and / or using other DPI-based firewall techniques, as similarly described above.

[0191] At 1008, enforcement of the security policy on the new session using the security platform is performed. For example, the security platform can be used to perform various enforcement actions (e.g., allow / pass, block / drop, alert, tag, monitor, log, moderate, restrict access, and / or other enforcement actions) as similarly described above.

[0192] Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative rather than restrictive.

Claims

1. A system for location-based security in a service provider network, comprising: A hardware processor configured to: Monitor network traffic on the service provider network at the security platform to identify device identifiers for new sessions, including: identifying a create packet data protocol (PDP) request message or a create session request message in network traffic to create a new session; and Extracting a device identifier from a create PDP request message or from a create session request message, wherein the device identifier is a mobile device identifier, and wherein the mobile device identifier includes an IoT device identifier, and the IoT device identifier includes the extracted International Mobile Equipment Identifier (IMEI) software version (IMEISV) information; Determining, at the security platform, an application identifier of user traffic associated with the new session, including: monitoring tunnel user traffic via deep packet inspection to obtain the application identifier after the new session has been created, wherein the tunnel user traffic comprises General Packet Radio Service (GPRS) Tunneling Protocol User Plane (GTP-U) traffic; extracting the location from the Create PDP Request message or the Create Session Request message, wherein the location is a location identifier, and wherein the location identifier comprises a cell global identifier CGI, a service area identifier SAI, a routing area identifier RAI, a tracking area identifier TAI, an E-UTRAN cell global identifier ECGI, a location area identifier LAC, or a combination thereof; associating, at the secure platform, the location with the new session; determining a security policy to be applied to the new session at a security platform based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session, wherein the security platform is configured with a plurality of security policies based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session; and Performing security policy enforcement based on the security policy to provide enhanced IoT device security, wherein the security policy includes two or more security rules for threat detection, threat prevention, uniform resource location (URL) filtering, denial of service (DoS) detection, and / or denial of service (DoS) prevention; and A memory is coupled to the hardware processor and configured to provide instructions to the hardware processor. 2 . The system of claim 1 , wherein the security platform is configured with a plurality of security policies based on the device identifier and the application identifier.

3. The system of claim 1 , wherein the hardware processor is further configured to: Threat detection is performed based on the device identifier and the application identifier.

4. The system of claim 1, wherein the hardware processor is further configured to: Threat prevention is performed based on the device identifier and the application identifier.

5. The system of claim 1, wherein the hardware processor is further configured to: Uniform resource link (URL) filtering is performed based on the device identifier and the application identifier.

6. The system of claim 1, wherein the hardware processor is further configured to: A plurality of security policies are implemented based on the device identifier and the application identifier, wherein the device identifier comprises an International Mobile Equipment Identifier (IMEI).

7. The system of claim 1, wherein the hardware processor is further configured to: The wireless interfaces are monitored, the wireless interfaces comprising a plurality of interfaces for control protocols and user data traffic in a mobile core network of a 3G and / or 4G network.

8. The system of claim 1, wherein the hardware processor is further configured to: A radio interface is monitored, the radio interface comprising a plurality of interfaces for a GPRS Tunneling Protocol GTP in a mobile core network of a 3G and / or 4G network.

9. The system of claim 1, wherein the hardware processor is further configured to: Prevent new sessions from accessing resources based on security policy.

10. A method for location-based security in a service provider network, comprising: Monitor network traffic on the service provider network at the security platform to identify device identifiers for new sessions, including: identifying a create packet data protocol (PDP) request message or a create session request message in network traffic to create a new session; and Extracting a device identifier from a create PDP request message or from a create session request message, wherein the device identifier is a mobile device identifier, and wherein the mobile device identifier includes an IoT device identifier, and the IoT device identifier includes the extracted International Mobile Equipment Identifier (IMEI) software version (IMEISV) information; Determining, at the security platform, an application identifier of user traffic associated with the new session, including: monitoring tunnel user traffic via deep packet inspection to obtain the application identifier after the new session has been created, wherein the tunnel user traffic comprises General Packet Radio Service (GPRS) Tunneling Protocol User Plane (GTP-U) traffic; extracting the location from the Create PDP Request message or the Create Session Request message, wherein the location is a location identifier, and wherein the location identifier comprises a cell global identifier CGI, a service area identifier SAI, a routing area identifier RAI, a tracking area identifier TAI, an E-UTRAN cell global identifier ECGI, a location area identifier LAC, or a combination thereof; associating, at the secure platform, the location with the new session; determining a security policy to be applied to the new session at a security platform based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session, wherein the security platform is configured with a plurality of security policies based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session; and Security policy enforcement is performed based on the security policy to provide enhanced IoT device security, wherein the security policy includes two or more security rules for threat detection, threat prevention, uniform resource location (URL) filtering, denial of service (DoS) detection, and / or denial of service (DoS) prevention.

11. The method according to claim 10, further comprising: A plurality of security policies are implemented based on the device identifier and the application identifier.

12. The method according to claim 10, further comprising: Threat detection and / or threat prevention is performed based on the device identifier and the application identifier.

13. The method according to claim 10, further comprising: Uniform resource link (URL) filtering is performed based on the device identifier and the application identifier.

14. A computer program product embodied in a tangible, non-transitory computer-readable storage medium and comprising computer instructions for: Monitor network traffic on the service provider network at the security platform to identify device identifiers for new sessions, including: Identify a create packet data protocol (PDP) request message or a create session request message in network traffic to create a new session; as well as Extracting a device identifier from a create PDP request message or from a create session request message, wherein the device identifier is a mobile device identifier, and wherein the mobile device identifier includes an IoT device identifier, and the IoT device identifier includes the extracted International Mobile Equipment Identifier (IMEI) software version (IMEISV) information; Determining, at the security platform, an application identifier of user traffic associated with the new session, including: monitoring tunnel user traffic via deep packet inspection to obtain the application identifier after the new session has been created, wherein the tunnel user traffic comprises General Packet Radio Service (GPRS) Tunneling Protocol User Plane (GTP-U) traffic; extracting the location from the Create PDP Request message or the Create Session Request message, wherein the location is a location identifier, and wherein the location identifier comprises a cell global identifier CGI, a service area identifier SAI, a routing area identifier RAI, a tracking area identifier TAI, an E-UTRAN cell global identifier ECGI, a location area identifier LAC, or a combination thereof; associating, at the secure platform, the location with the new session; determining a security policy to be applied to the new session at a security platform based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session, wherein the security platform is configured with a plurality of security policies based on at least one combination including a device identifier and the application identifier associated with the new session and / or location information associated with the new session; and Security policy enforcement is performed based on the security policy to provide enhanced IoT device security, wherein the security policy includes two or more security rules for threat detection, threat prevention, uniform resource location (URL) filtering, denial of service (DoS) detection, and / or denial of service (DoS) prevention.

15. The computer program product of claim 14, further comprising computer instructions for: A plurality of security policies are implemented based on the device identifier and the application identifier.

16. The computer program product of claim 14, further comprising computer instructions for: Threat detection and / or threat prevention is performed based on the device identifier and the application identifier.

17. The computer program product of claim 14, further comprising computer instructions for: Uniform resource link (URL) filtering is performed based on the device identifier and the application identifier.

Images