Application of subscriber ID-based security, device ID-based security, and / or network slice ID-based security with user ID and system log messages in mobile network

Abstract

Techniques are disclosed for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user ID and system log messages in a mobile network. In some embodiments, a system / process / computer program product applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user ID and system log messages in a mobile network includes monitoring network traffic on the mobile network at a security platform to identify a new session; extracting a plurality of parameters by parsing the system log message with a user ID agent at the secure platform; and enforcing, at the security platform, a security policy on the new session to apply context-based security in the mobile network based on one or more of a plurality of parameters including one or more of the subscriber ID, the device ID, and the network slice ID.

Description

Background Art

[0001] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is generally a device or a group of devices or software executed on a device (e.g., a computer) that provides firewall functionality for network access. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smart phone, or other type of device with network communication capabilities). A firewall can also be integrated into a computer server, a gateway, a network / routing device (e.g., a network router), or a data device (e.g., a security device or other type of dedicated device), or executed as software thereon.

[0002] Firewalls typically deny or allow network traffic based on a set of rules. These rule groups are often referred to as policies. For example, a firewall can filter inbound traffic by applying a set of rules or policies. A firewall can also filter outbound traffic by applying a set of rules or policies. Firewalls are also able to perform basic routing functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Various embodiments of the invention are disclosed in the following detailed description and accompanying drawings.

[0004] Figure 1A is a block diagram of an architecture of a 4G / LTE wireless network with a security platform for applying subscriber ID-based security in a mobile network using a user ID and a system log message network, according to some embodiments.

[0005] Figure 1B is another block diagram of an architecture of a 4G / LTE wireless network with a security platform for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network in accordance with some embodiments.

[0006] Figure 1C is a block diagram of an architecture of a 5G wireless network with a security platform for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network, according to some embodiments.

[0007] Figure 1D is another block diagram of an architecture of a 5G wireless network with a security platform for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network in accordance with some embodiments.

[0008] Figure 2A is an example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving system log messages from a PGW in a 4G / LTE network according to some embodiments.

[0009] Figure 2B is an example screen shot of an interface of a security platform at an N6 interface in L3 mode receiving system log messages from a UPF in a 5G network according to some embodiments.

[0010] Figure 2C is another example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving system log messages from a PGW in a 4G / LTE network in accordance with some embodiments.

[0011] Figure 2D is another example screen shot of an interface of a security platform at an N6 interface in L3 mode receiving system log messages from a UPF in a 5G network in accordance with some embodiments.

[0012] Figure 3 is a functional diagram of hardware components of a network device for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network utilizing user IDs and system log messages according to some embodiments.

[0013] Figure 4 is a functional diagram of logical components of a network device for applying subscriber ID-based security, device ID-based security and / or network slice ID-based security in a mobile network utilizing user IDs and system log messages according to some embodiments.

[0014] Figure 5 is a flowchart of a process for applying subscriber ID-based security, device ID-based security and / or network slice ID-based security in a mobile network utilizing user IDs and system log messages according to some embodiments.

[0015] Figure 6 is another flow chart of a process for applying subscriber ID-based security, device ID-based security and / or network slice ID-based security in a mobile network utilizing user IDs and system log messages in accordance with some embodiments. DETAILED DESCRIPTION

[0016] The present invention may be implemented in a variety of ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer-readable storage medium; and / or a processor, such as a processor configured to execute instructions stored on and / or provided by a memory, the memory being coupled to the processor. In this specification, these implementations or any other form that the present invention may take may be referred to as techniques. In general, the order of steps of the disclosed processes may be changed within the scope of the present invention. Unless otherwise stated, a component such as a processor or memory described as being configured to perform a task may be implemented as a general component temporarily configured to perform the task at a given time, or as a specific component manufactured to perform the task. As used herein, the term "processor" refers to one or more devices, circuits, and / or processing cores configured to process data such as computer program instructions.

[0017] A detailed description of one or more embodiments of the present invention is provided below together with the accompanying drawings that illustrate the principles of the present invention. The present invention is described in conjunction with these embodiments, but the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention includes many alternatives, modifications and equivalents. In order to provide a comprehensive understanding of the present invention, many specific details are set forth in the following description. These details are provided for illustrative purposes, and the present invention can be implemented according to the claims without some or all of these specific details. For the sake of clarity, technical materials known in the technical field related to the present invention are not described in detail to avoid unnecessarily obscuring the present invention.

[0018] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is generally a device, a group of devices, or software executed on a device that provides firewall functionality for network access. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smart phone, or other type of device with network communication capabilities). A firewall can also be integrated into various types of devices or security devices, or executed as a software application on various types of devices or security devices, such as computer servers, gateways, network / routing devices (e.g., network routers), or data devices (e.g., security devices or other types of dedicated devices).

[0019] Firewalls typically deny or allow network traffic based on a set of rules. These rule groups are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching the protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allowing, blocking, monitoring, notifying or logging, and / or other actions can be specified in a firewall / security rule or firewall / security policy, which can be triggered based on various criteria, as described herein). A firewall can also apply antivirus protection, malware detection / prevention, or intrusion protection by applying a set of rules or policies.

[0020] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may include various security functions (e.g., firewalls, anti-malware, intrusion prevention / detection, proxies, and / or other security functions), networking functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other networking functions), and / or other functions. For example, routing functions may be based on source information (e.g., source IP address and port), destination information (e.g., destination IP address and port), and protocol information.

[0021] Basic packet filtering firewalls filter network traffic by inspecting individual packets as they travel over the network (e.g., packet filtering firewalls or first generation firewalls, which are stateless packet filtering firewalls). Stateless packet filtering firewalls typically inspect each packet itself and apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port number).

[0022] Application firewalls can also perform application layer filtering (e.g., using application layer filtering firewalls or second generation firewalls, which work at the application level of the TCP / IP stack). Application layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using File Transfer Protocol (FTP), and various other types of applications and other protocols, such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate over standard ports (e.g., unauthorized / non-compliant protocols that attempt to sneak through using non-standard ports for the protocol can generally be identified using an application firewall).

[0023] A stateful firewall may also perform stateful packet inspection, where each packet is inspected in the context of a series of packets associated with a flow / packet stream of multiple packets transmitted over the network (e.g., a stateful firewall or third-generation firewall). This firewall technology is often referred to as stateful packet inspection because it maintains a record of all connections passing through the firewall and is able to determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the connection state itself can be one of the criteria for triggering a rule in a policy.

[0024] As described above, an advanced or next-generation firewall can perform stateless and stateful packet filtering as well as application layer filtering. A next-generation firewall can also perform additional firewall techniques. For example, some newer firewalls (sometimes referred to as advanced or next-generation firewalls) can also identify users and content. In particular, some next-generation firewalls are expanding the list of applications that these firewalls can automatically identify to thousands of applications. Examples of such next-generation firewalls are available from Palo Alto Networks, Inc. (e.g., Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls).

[0025] For example, Palo Alto Networks' next-generation firewall enables enterprises and service providers to identify and control applications, users, and content, not just ports, IP addresses, and packets, using a variety of identification technologies, such as App-ID for accurate application identification TM (e.g., application ID), User-ID for user identification (e.g., by user or user group) TM (e.g., user ID), and Content-ID for real-time content scanning (e.g., controlling web surfing and limiting data and file transfers) TM (e.g., Content ID). These identification technologies allow enterprises to securely enable application usage using business-relevant concepts rather than following the traditional approach provided by traditional port-blocking firewalls. In addition, dedicated hardware implemented as a next-generation firewall, such as a dedicated appliance, generally provides higher performance levels for application inspection than software executed on general-purpose hardware (e.g., security appliances such as those provided by PaloAlto Networks, Inc., which utilize dedicated, function-specific processing that is tightly integrated with a single-channel software engine to maximize network throughput while minimizing latency for PaloAlto Networks' PA Series Next-Generation Firewalls).

[0026] Technical Overview for Applying Subscriber ID-Based Security, Device ID-Based Security, and / or Network Slice ID-Based Security in Mobile Networks Utilizing User ID and System Log Messages

[0027] For devices in mobile networks (e.g., 4G / LTE and 5G mobile networks), service provider networks present technical and security challenges. For example, some private 4G / LTE and private 5G networks do not expose 3GPP interfaces between network functions, which prevents the deployment of security solutions (e.g., network gateway firewall (NFGW) or other security entities) on these interfaces to apply context-based security to network traffic. In addition, some mobile service providers are reluctant to deploy such security solutions on various interfaces (e.g., 3GPP interfaces) due to concerns about potential delays and service disruptions.

[0028] Therefore, there is a need for new and improved security techniques for devices communicating on such service provider network environments (e.g., mobile networks, including various 4G / LTE and 5G mobile networks). Specifically, there is a need for new and improved solutions for monitoring such network traffic and applying context-based security policies (e.g., security / firewall policies) for devices communicating on service provider networks, including for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in mobile networks utilizing user IDs and system log messages.

[0029] In some embodiments, a system / process / computer program product for applying subscriber ID-based security in a mobile network utilizing user ID and system log messages includes: monitoring network traffic on the mobile network at a security platform to identify new sessions; extracting multiple parameters by parsing system log messages utilizing a user ID agent at the security platform; and enforcing security policies on the new sessions at the security platform based on one or more of the multiple parameters including the subscriber ID to apply context-based security in the mobile network.

[0030] For example, the above techniques may be performed to apply subscriber ID-based security over the N6 interface in a private 5G network and / or over the SGi interface in a private 4G / LTE network.

[0031] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0032] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network and / or on an SGi interface in a 4G / LTE network.

[0033] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0034] In this way, service providers and / or enterprises can use the disclosed techniques and security platforms to apply subscriber ID-based security on the perimeter of external IP-based networks (eg, the Internet).

[0035] In some embodiments, a system / process / computer program product for applying device ID-based security in a mobile network utilizing user ID and system log messages includes: monitoring network traffic on the mobile network at a security platform to identify new sessions; extracting multiple parameters by parsing system log messages utilizing a user ID agent at the security platform; and implementing security policies on the new sessions at the security platform based on one or more of the multiple parameters including the device ID to apply context-based security in the mobile network.

[0036] For example, the above techniques may be performed to apply device ID-based security over the N6 interface in a private 5G network and / or over the SGi interface in a private 4G / LTE network.

[0037] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0038] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network and / or on an SGi interface in a 4G / LTE network.

[0039] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0040] In this way, service providers and / or enterprises can use the disclosed techniques and security platforms to apply device ID-based security on the perimeter of external IP-based networks (eg, the Internet).

[0041] In some embodiments, a system / process / computer program product for applying network slice ID-based security in a mobile network utilizing user ID and system log messages includes: monitoring network traffic on a mobile network at a security platform to identify new sessions; extracting multiple parameters by parsing system log messages utilizing a user ID agent at the security platform; and implementing security policies on the new sessions at the security platform based on one or more of the multiple parameters including the network slice ID to apply context-based security in the mobile network.

[0042] For example, the above techniques may be performed to apply network slice ID based security on the N6 interface in a private 5G network.

[0043] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network.

[0044] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network.

[0045] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network.

[0046] In this way, service providers and / or enterprises can use the disclosed techniques and security platform to apply network slice ID-based security on an IP-based external network (e.g., the Internet) perimeter. In addition, the disclosed techniques can be implemented to apply subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages for security policy enforcement in a mobile network using the security platform (e.g., including when the security platform is not online in a core mobile network (e.g., for a private 4G network, a private 5G network, etc.)).

[0047] In this way, a mobile network operator can use the disclosed technology to apply subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using such a security platform using user IDs and system log messages (for example, the security platform can also be configured into different deployment / operating environments for monitoring such network traffic and applying context-based security policies (for example, security / firewall policies) for devices communicating on the service provider network, including for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages, including office deployment / operating environments, enterprise deployment / operating environments, and factory deployment / operating environments), as will be further described below.

[0048] Thus, the disclosed technology facilitates enhanced context-based security in mobile networks. For example, security functions (e.g., security platforms) can be located closer to users / devices (e.g., UEs) for performing security policy analysis and enforcement. As another example, security functions can be implemented to facilitate security in selective industry verticals. As another example, security can be implemented in highly sensitive locations, such as government network environments, military network environments, and power plants or other critical infrastructure network environments.

[0049] Therefore, according to some embodiments, new and improved security solutions are disclosed that facilitate the use of a security platform to apply security (e.g., network-based security) that is used to execute the disclosed techniques for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user IDs and system log messages in mobile networks (e.g., a firewall (FW) / next-generation firewall (NGFW), a network sensor on behalf of a firewall, or another (virtual) device / component that can use the disclosed techniques to implement security policies, including, for example, Palo Alto Networks' PA series next-generation firewalls, PaloAlto Networks' VM series virtualized next-generation firewalls, and CN series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls that can be similarly implemented and configured to execute the disclosed techniques), in mobile networks (e.g., 4G / 5G / 6G / later versions of mobile networks) on various interfaces and protocols in a mobile network environment.

[0050] These and other embodiments and examples of applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in mobile networks utilizing user IDs and system log message networks will be further described below.

[0051] Example system architecture for applying subscriber ID-based security using user ID and system log messages in mobile networks

[0052] Thus, in some embodiments, the disclosed technology includes providing a security platform (e.g., the security function / platform may be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor working on behalf of a firewall, or another (virtual) device / component that may implement security policies using the disclosed technology, such as PANOS or another security platform / NFGW executed on a virtual / physical NGFW solution available from Palo Alto Networks, Inc., including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that may be similarly implemented and configured to perform the disclosed technology), which is configured to provide, for example, DPI capabilities (e.g., including stateful inspection) of GTP-U sessions (e.g., GTP-U traffic) through various interfaces (e.g., RESTful APIs; other interfaces in N3, N6, and / or 4G / 5G / 6G core networks) to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0053] Figure 1A is a block diagram of an architecture of a 4G / LTE wireless network with a security platform for applying subscriber ID-based security in a mobile network using a user ID and system log message network according to some embodiments. Specifically, Figure 1A An example 4G / LTE mobile network environment is provided that includes a security platform 102 (e.g., the security function / platform can be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor representing a firewall, or another (virtual) device / component that can implement security policies using the disclosed techniques, including, for example, PaloAlto Networks' PA Series Next-Generation Firewalls, PaloAlto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that can be similarly implemented and configured to perform the disclosed techniques) for applying subscriber ID-based security to a network in a mobile network using user IDs and system log messages, in a mobile network (e.g., a 4G / LTE or later mobile network) on various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interface and / or other interfaces in a 5G core network), as further described below.

[0054] As mentioned in this article, IMSI is a concept that the ITU-T calls "International Mobile Subscriber Identity." The IMSI is a 14 or 15 digit number.

[0055] As also mentioned in this article, SUPI is a globally unique 5G "Subscription Permanent Identifier" assigned to each subscriber in the 5G system. According to 3GPP T.S23.003v 16.9.0, the SUPI type can indicate IMSI, Network Access Identifier (NAI), Global Line Identifier (GLI) or Global Cable Identifier (GCI).

[0056] As also described herein, the International Mobile Equipment Identifier (IMEI) is defined in 3GPP TS 23.003, which can be used in https: / / portal.3gpp.org / desktopmodules / Specifications / SpecificationDetails.aspx? specificationId=729.

[0057] like Figure 1A As shown, the 4G / LTE mobile network environment may also include a 4G radio access network (RAN) access as shown at 106 and / or other networks including, for example, Wi-Fi access and fixed access (not shown) to facilitate data communications for subscribers (e.g., using user equipment (UE), such as a smartphone, laptop, computer (which may be in a fixed location) and / or other computing devices / apparatuses with cellular capabilities, such as IoT devices as shown at 104A, and / or UE, such as a customer device as shown at 104B, or other devices with network communication capabilities), including access to various applications, web services, content hosts, etc. and / or other networks through a packet data network (PDN) (e.g., the Internet) 120. Each of the above 4G / LTE network access mechanisms communicates with a 4G core network 110 including a packet data network gateway (PGW) 112. The PGW 112 communicates with the PDN 120 via an SGi interface, with the security platform 102 being located in the line between the PGW 112 and the PDN 120. The security platform 102 communicates with the PGW 112 (eg, via the SGi interface, as shown) to access real-time system log data with UE IP address and IMEI / IMSI information, as will be further described below.

[0058] refer to Figure 1A, using the security platform 102 to monitor network traffic communications. As shown, the security platform 102 (e.g., each including a firewall (FW), a network sensor working on behalf of a firewall, or a (virtual) device / apparatus of another device / component that can implement security policies using the disclosed techniques) is used in a 4G / LTE network to monitor / filter network traffic communications, and the security platform 102 is configured to perform the disclosed techniques for applying context-based security on various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interfaces and / or other interfaces in a 5G core network) in a mobile network, as similarly described above and further described below.

[0059] In this example implementation, the disclosed technology for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network can be performed using a security platform deployed in a mobile network based on 4G / LTE technology, such as Figure 1A As shown. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse creation events to map user equipment (UE) IP addresses to subscriber IDs, and also parse deletion events to delete obsolete mappings. Deleting obsolete mappings is often useful in mobile networks, where, for example, IP address allocations may change when the UE is restarted or during various other scenarios. Thus, in some embodiments, a system log parsing profile is used to parse system log messages to integrate with network functions from different device vendors, which can send system log messages in different formats (for example, a user can create a custom profile for each format).

[0060] In some embodiments, the security platform is further configured to provide the following DPI capabilities: DPI of IP traffic on the SGi interface. In an example implementation, the security platform is configured to provide DPI capabilities (e.g., including identifying application IDs, user IDs, content IDs, performing URL filtering) of IP sessions on the SGi interface between, for example, PGW 112 and PDN 120 to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0061] Additionally, the security platform 102 can also be integrated with a cloud security service 122 (e.g., a commercially available cloud-based security service such as WildFire TMA cloud-based malware analysis environment, which is a commercially available cloud security service provided by PaloAlto Networks, Inc., that includes automated security analysis of malware samples as well as security expert analysis, or may utilize a similar solution provided by another vendor) communicates with a network, such as via the Internet. For example, the cloud security service 122 may be used to provide dynamic prevention signatures for malware, DNS, URL, CNC malware, and / or other malware to the security platform, and receive malware samples for further security analysis.

[0062] Figure 2A is an example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving system log messages from a PGW in a 4G / LTE network according to some embodiments. In this example, the PGW sends an event system log (e.g., a system log message) to the security platform (e.g., NGFW 102) whenever a new default bearer is created or deleted. Each system log includes different fields, with the key fields highlighted: event type, IMSI, IMEI, APN, and Ue_IP.

[0063] The following is an example of a syslog message generated by the PGW.

[0064] Jan 908:12:14{"pgw","type":"create_session","evt":{"imsi":"002002999971493", "imei":"3526201120836534","apn":"apn2a6","user_addr":["172.16.15.159"]}}

[0065] The security platform (e.g., NGFW 102) receives the event system log and creates a user ID / IP mapping. The user ID can be configured as the UE IMSI, such as "002002999971493". The system log with the event "create session" can be configured as a user ID login action, while "delete session" can be used as a logout action.

[0066] refer to Figure 2A , an example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving system log messages from a PGW in a 4G / LTE network provides an example of a security policy configured with a user ID as UE IMSI=002002999971493".

[0067] Figure 1Bis another block diagram of an architecture of a 4G / LTE wireless network with a security platform for applying subscriber ID-based security in a mobile network using a user ID and system log message network in accordance with some embodiments. Specifically, Figure 1B is an example 4G / LTE mobile network environment, which includes a security platform 102 deployment in a 4G / LTE mobile edge computing (MEC) 114 environment, which includes such Figure 1B Multiple MEC applications (APPs) shown (e.g., security functions / platforms can be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor representing a firewall, or another (virtual) device / component that can implement security policies using the disclosed technology, for example, Palo Alto Networks' PA series next-generation firewalls, Palo Alto Networks' VM series virtualized next-generation firewalls, and CN series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls can be similarly implemented and configured to perform the disclosed technology) are used to apply subscriber ID-based security in a mobile network using a user ID and system log message network, in a mobile network (e.g., a 4G / LTE or later mobile network) through various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interface and / or other interfaces in a 5G core network), as further described below.

[0068] like Figure 1B As shown, the 4G / LTE mobile network environment may also include a 4G radio access network (RAN) access as shown in 106 and / or other networks including, for example, Wi-Fi access and fixed access (not shown) to facilitate data communications for subscribers (e.g., using user equipment (UE), such as smart phones, laptops, computers (which may be in a fixed location) and / or other computing devices / apparatuses with cellular capabilities, such as a smart factory including UEs and IoT devices as shown in 104C, or other devices with network communication capabilities), including access to various applications, web services, content hosts, etc. and / or other networks via a packet data network (PDN) (e.g., the Internet) 120. Each of the above-mentioned 4G / LTE network access mechanisms is connected to a 4G core network 110 (e.g., at Figure 1B As also shown, 4G RAN 106 communicates with the following via an S1-U interface: Figure 1BThe security platform 102 communicates with the SGW-U and PGW-U 116 (e.g., via the SGi interface, as shown) to access real-time system log data with UE IP address and IMEI / IMSI information, as similarly described above and further described below. Figure 1B As shown, the SGW-U and PGW-U 116 also communicate with the 4G Core 110 via the Sxa / Sxb interface.

[0069] refer to Figure 1B , using the security platform 102 to monitor network traffic communications. As shown, the security platform 102 (e.g., each including a firewall (FW), a network sensor working on behalf of a firewall, or a (virtual) device / apparatus of another device / component that can implement security policies using the disclosed techniques) is used in the 4G / LTE network to monitor / filter network traffic communications, and the security platform 102 is configured to perform the disclosed techniques for applying context-based security through various interfaces (e.g., SGi and / or other interfaces in the 4G / LTE core network, and N6 interface and / or other interfaces in the 5G core network) in the mobile network, as described similarly above and further described below.

[0070] In this example implementation, the disclosed technology for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network can be performed using a security platform deployed in a mobile network based on 4G / LTE technology, such as Figure 1B As shown. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse creation events to map user equipment (UE) IP addresses to subscriber IDs, and also parse deletion events to delete obsolete mappings. Deleting obsolete mappings is often useful in mobile networks, where IP address allocations may change, for example, when the UE is restarted or during various other scenarios. Thus, in some embodiments, a system log parsing profile is used to parse system log messages to integrate with network functions from different device vendors, which can send system log messages in different formats (for example, a user can create a custom profile for each format).

[0071] In some embodiments, the security platform is further configured to provide the following DPI capabilities: DPI of IP traffic on the SGi interface. In an example implementation, the security platform is configured to provide DPI capabilities (e.g., including identifying application IDs, user IDs, content IDs, performing URL filtering) of IP sessions on the SGi interface between, for example, the SGW-U and PGW-U 116 and the PDN 120 to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0072] Additionally, the security platform 102 can also be integrated with a cloud security service 122 (e.g., a commercially available cloud-based security service such as WildFire TM A cloud-based malware analysis environment, which is a commercially available cloud security service provided by PaloAlto Networks, Inc., that includes automated security analysis of malware samples as well as security expert analysis, or may utilize a similar solution provided by another vendor) communicates with a network, such as via the Internet. For example, the cloud security service 122 may be used to provide dynamic prevention signatures for malware, DNS, URL, CNC malware, and / or other malware to the security platform, and receive malware samples for further security analysis.

[0073] Figure 1C is a block diagram of an architecture of a 5G wireless network with a security platform for applying subscriber ID-based security in a mobile network using a user ID and a system log message network, according to some embodiments. Specifically, Figure 1C An example 5G mobile network environment is provided that includes a security platform 102 (e.g., the security function / platform may be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor representing a firewall, or another (virtual) device / component that may implement security policies using the disclosed techniques, including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that may be similarly implemented and configured to perform the disclosed techniques) for applying subscriber ID-based security to a network in a mobile network using user IDs and system log messages, in a mobile network (e.g., a 5G or later mobile network) via various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interface and / or other interfaces in a 5G core network), as further described below.

[0074] like Figure 1C As shown, the 5G mobile network environment may also include a 5G New Radio (NR) Radio Access Network (RAN) access as shown at 108 and / or other networks including, for example, Wi-Fi access and fixed access (not shown) to facilitate data communications for subscribers (e.g., using user equipment (UE), such as a smartphone, laptop, computer (which may be in a fixed location), and / or other computing devices / apparatuses with cellular capabilities, such as IoT devices as shown at 104A, and / or UE, such as a customer device as shown at 104B, or other devices with network communication capabilities), including access to various applications, web services, content hosts, etc., through a packet data network (PDN) (e.g., the Internet) 120, and / or other networks. Each of the above 5G network access mechanisms communicates with a 5G core network 118 including a 5G mobile core user plane function (UPF) 124. The UPF 124 communicates with the PDN 120 via an N6 interface, with the security platform 102 being located in the line between the UPF 124 and the PDN 120. The security platform 102 communicates with the UPF 124 (eg, via the N6 interface, as shown) to access real-time system log data with UE IP address and IMEI / IMSI information, as will be further described below.

[0075] refer to Figure 1C , using the security platform 102 to monitor network traffic communications. As shown, using the security platform 102 (e.g., each including a firewall (FW), a network sensor working on behalf of a firewall, or a (virtual) device / apparatus of another device / component that can implement security policies using the disclosed techniques) to monitor / filter network traffic communications in a 5G network, the security platform 102 is configured to perform the disclosed techniques for applying context-based security through various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interfaces and / or other interfaces in a 5G core network) in a mobile network, as similarly described above and further described below.

[0076] In this example implementation, the disclosed technology for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network can be performed using a security platform deployed in a mobile network based on 4G / LTE technology, such as Figure 1CAs shown. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse creation events to map user equipment (UE) IP addresses to subscriber IDs, and also parse deletion events to delete obsolete mappings. Deleting obsolete mappings is often useful in mobile networks, where IP address allocations may change, for example, when the UE is restarted or during various other scenarios. Thus, in some embodiments, a system log parsing profile is used to parse system log messages to integrate with network functions from different device vendors, which can send system log messages in different formats (for example, a user can create a custom profile for each format).

[0077] In some embodiments, the security platform is further configured to provide the following DPI capabilities: DPI of IP traffic on the N6 interface. In an example implementation, the security platform is configured to provide DPI capabilities (e.g., including identifying application IDs, user IDs, content IDs, performing URL filtering) of IP sessions on the N6 interface between, for example, UPF 124 and PDN 120 to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0078] Additionally, the security platform 102 can also be integrated with a cloud security service 122 (e.g., a commercially available cloud-based security service such as WildFire TM A cloud-based malware analysis environment, which is a commercially available cloud security service provided by PaloAlto Networks, Inc., that includes automated security analysis of malware samples as well as security expert analysis, or may utilize a similar solution provided by another vendor) communicates with a network, such as via the Internet. For example, the cloud security service 122 may be used to provide dynamic prevention signatures for malware, DNS, URL, CNC malware, and / or other malware to the security platform, and receive malware samples for further security analysis.

[0079] Figure 2Bis an example screen shot of an interface of a security platform at an N6 interface in L3 mode receiving a system log message from a UPF in a 5G network in accordance with some embodiments. In this example, the UPF sends an event system log (e.g., a system log message) to the security platform (e.g., NGFW 102) whenever a new PDU session is created or deleted. Each system log includes different fields, with the key fields highlighted: event type, IMSI, IMEI, DNN, S-NSSAI, and Ue_IP.

[0080] The following is an example of a syslog message generated by UPF.

[0081] Jan 1310:16:15{"upf","type":"create_pdu_session","evt":{"imsi":"312333000222123","imei": "4441221130832222","dnn":"dnn1bc4","s-nssai":"1:1000","user_addr":["172.16.15.171"]}}

[0082] The security platform (e.g., NGFW 102) receives the event system log and creates a user ID / IP mapping. The user ID can be configured as the UE IMSI, such as "312333000222123". The system log with the event "create session" can be configured as a user ID login action, while "delete session" can be used as a logout action.

[0083] refer to Figure 2B , an example screenshot of an interface of a security platform at an N6 interface in L3 mode receiving a system log message from a UPF in a 5G network provides an example of a security policy configured with a user ID as UE IMSI="312333000222123".

[0084] Figure 1D is another block diagram of an architecture of a 5G wireless network with a security platform for applying subscriber ID-based security in a mobile network using a user ID and a system log message network in accordance with some embodiments. Specifically, Figure 1D is an example 5G mobile network environment, which includes a security platform 102 deployment in a 5G mobile edge computing (MEC) 114 environment, which includes Figure 1DMultiple MEC applications (APPs) shown (e.g., security functions / platforms can be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor working on behalf of a firewall, or another (virtual) device / component that can implement security policies using the disclosed technology, including, for example, Palo Alto Networks' PA series next-generation firewalls, Palo Alto Networks' VM series virtualized next-generation firewalls, and CN series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls that can be similarly implemented and configured to perform the disclosed technology) are used to utilize user ID and system log message network application subscriber ID-based security in mobile networks, in mobile networks (e.g., 5G or later mobile networks) through various interfaces (e.g., SGi and / or other interfaces in 4G / LTE core networks, and N6 interfaces and / or other interfaces in 5G core networks), as further described below.

[0085] like Figure 1D As shown, the 5G mobile network environment may also include 5G New Radio (NR) Radio Access Network (RAN) access, respectively, as shown at 108, and / or other networks including, for example, Wi-Fi access and fixed access (not shown), to facilitate data communications for subscribers (e.g., using user equipment (UE), such as smart phones, laptops, computers (which may be in a fixed location), and / or other computing devices / apparatuses with cellular capabilities, such as smart factories including UEs and IoT devices as shown at 104C, or other devices with network communication capabilities), including access to various applications, web services, content hosts, etc., and / or other networks via a packet data network (PDN) (e.g., the Internet) 120. Each of the above-mentioned 5G network access mechanisms is connected to a 5G core network 118 (e.g., at Figure 1D As also shown, 5G NRRAN 108 communicates with the following via the N3 interface: Figure 1D The UPF 124 communicates with the PDN / Internet 120 via an N6 interface, with the security platform 102 being in the line between the UPF 124 and the PDN / Internet 120. The security platform 102 communicates with the UPF (e.g., via the N6 interface, as shown) to access real-time system log data with UE IP address and IMEI / IMSI information, as similarly described above and further described below. Figure 1D As shown, UPF 124 also communicates with 5G Core 118 via the N4 interface.

[0086] refer to Figure 1D, using the security platform 102 to monitor network traffic communications. As shown, using the security platform 102 (e.g., each including a firewall (FW), a network sensor working on behalf of a firewall, or a (virtual) device / apparatus of another device / component that can implement security policies using the disclosed technology) to monitor / filter network traffic communications in a 5G network, the security platform 102 is configured to perform the disclosed technology for applying context-based security through various interfaces (e.g., SGi and / or other interfaces in a 4G / LTE core network, and N6 interface and / or other interfaces in a 5G core network) in a mobile network, as similarly described above and further described below.

[0087] In this example implementation, the disclosed technology for applying subscriber ID-based security in a mobile network utilizing a user ID and a system log message network can be performed using a security platform deployed in a mobile network based on 5G technology, such as Figure 1D As shown. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse creation events to map user equipment (UE) IP addresses to subscriber IDs, and also parse deletion events to delete obsolete mappings. Deleting obsolete mappings is often useful in mobile networks, where IP address allocations may change, for example, when the UE is restarted or during various other scenarios. Thus, in some embodiments, a system log parsing profile is used to parse system log messages to integrate with network functions from different device vendors, which can send system log messages in different formats (for example, a user can create a custom profile for each format).

[0088] In some embodiments, the security platform is further configured to provide the following DPI capabilities: DPI of IP traffic on the N6 interface. In an example implementation, the security platform is configured to provide DPI capabilities (e.g., including identifying application IDs, user IDs, content IDs, performing URL filtering) of IP sessions on the N6 interface between, for example, UPF 124 and PDN 120 to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0089] Additionally, the security platform 102 can also be integrated with a cloud security service 122 (e.g., a commercially available cloud-based security service such as WildFire TMA cloud-based malware analysis environment, which is a commercially available cloud security service provided by PaloAlto Networks, Inc., that includes automated security analysis of malware samples as well as security expert analysis, or may utilize a similar solution provided by another vendor) communicates with a network, such as via the Internet. For example, the cloud security service 122 may be used to provide dynamic prevention signatures for malware, DNS, URL, CNC malware, and / or other malware to the security platform, and receive malware samples for further security analysis.

[0090] For example, the above techniques may be performed to apply subscriber ID-based security over the N6 interface in a private 5G network and / or over the SGi interface in a private 4G / LTE network.

[0091] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0092] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network and / or on an SGi interface in a 4G / LTE network.

[0093] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0094] In this way, service providers and / or enterprises can use the disclosed techniques and security platforms to apply subscriber ID-based security on the perimeter of external IP-based networks (eg, the Internet).

[0095] Example system architecture for applying device ID-based security using user ID and system log messages in mobile networks

[0096] Thus, in some embodiments, the disclosed technology includes providing a security platform (e.g., the security function / platform may be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor working on behalf of a firewall, or another (virtual) device / component that may implement security policies using the disclosed technology, such as PANOS or another security platform / NFGW executed on a virtual / physical NGFW solution commercially available from Palo Alto Networks, Inc., including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that may be similarly implemented and configured to perform the disclosed technology), which is configured to provide DPI capabilities (e.g., including stateful inspection) through various interfaces (e.g., RESTful APIs; other interfaces in N3, N6, and / or 4G / 5G / 6G core networks) to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0097] As referred to herein, the International Mobile Equipment Identifier (IMEI) is defined in 3GPP TS 23.003 and can be used in https: / / portal.3gpp.org / desktopmodules / Specifications / SpecificationDetails.aspx?specificationId=729. A mobile station device is uniquely defined by an IMEI or an IMEISV. The IMEI is a 15-digit number, and the IMEISV is a 16-digit number (eg, these values ​​consist of decimal numbers only).

[0098] As also mentioned in this article, in a 5G network environment, a permanent equipment identifier (PEI) identifies the UE. According to 3GPP T.S23.003 v 16.9.0, PEI type: can indicate IMEI or IMEISV, MAC address or IEEE Extended Unique Identifier (EUI-64).

[0099] In some embodiments, applying device ID-based security (e.g., including IMEI and / or PEI) in a mobile network using user ID and system log messages is similarly performed using a security platform deployed on the SGi interface in a 4G / LTE network, such as described above with respect to Figure 1A and 1B Similarly described, and / or performed using a security platform deployed on the N6 interface in the 5G network, such as the above Figure 1C and1D Similar to what is described.

[0100] In an example implementation, the disclosed technology for applying device ID-based security in a mobile network using user ID and system log message network can be performed using a security platform deployed in a mobile network based on 4G / LTE technology, such as similar to Figure 1A and 1B As shown, except that in this example, the security platform (e.g., NGFW 102) uses the SGi interface to obtain the real-time system log with UE IP and IMEI information from PGW 112 and from SGW-U and PGW-U 116, respectively, and is executed using a security platform deployed in a mobile network based on 5G technology, such as similar to Figure 1C and 1D As shown, except in this example, the security platform (e.g., NGFW 102) uses the N6 interface to obtain real-time system logs with UE IP and IMEI information from UPF 124. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse the creation event to map the user equipment (UE) IP address to the device ID, and also parse the deletion event to delete the obsolete mapping. Deleting obsolete mappings is often useful in mobile networks, where, for example, when the UE restarts or during various other scenarios, the IP address allocation may change. In this way, in some embodiments, the system log parsing profile is used to parse the system log message to integrate with network functions from different device vendors, which can send system log messages in different formats (e.g., users can create custom profiles for each format).

[0101] Figure 2C 1 is another example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving system log messages from a PGW in a 4G / LTE network in accordance with some embodiments. In this example, the PGW sends an event system log (e.g., a system log message) to the security platform (e.g., NGFW 102) whenever a new default bearer is created or deleted. Each system log includes different fields, with the key fields highlighted: event type, IMSI, IMEI, APN, and Ue_IP.

[0102] The following is an example of a syslog message generated by the PGW.

[0103] Jan 909:13:10{"pgw","type":"create_session","evt":{"imsi":"002002999971493", "imei":"3526201120836534","apn":"apn2a6","user_addr":["172.16.15.101"]}}

[0104] The security platform (e.g., NGFW 102) receives the event system log and creates a user ID / IP mapping. The user ID can be configured as the UE IMEI, such as "3526201120836534". The system log with the event "create session" can be configured as a user ID login action, while "delete session" can be used as a logout action.

[0105] refer to Figure 2C , an example screen shot of an interface of a security platform at an SGi interface in L3 mode receiving a system log message from a PGW in a 4G / LTE network provides an example of a security policy configured with a user ID as UE IMEI="3526201120836534".

[0106] For example, the above techniques may be performed to apply device ID-based security over the N6 interface in a private 5G network and / or over the SGi interface in a private 4G / LTE network.

[0107] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0108] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network and / or on an SGi interface in a 4G / LTE network.

[0109] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network and / or on the SGi interface in a 4G / LTE network.

[0110] In this way, service providers and / or enterprises can use the disclosed techniques and security platforms to apply device ID-based security on the perimeter of external IP-based networks (eg, the Internet).

[0111] Example system architecture for applying network slice ID based security using user ID and system log messages in mobile networks

[0112] Thus, in some embodiments, the disclosed technology includes providing a security platform (e.g., the security function / platform may be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor working on behalf of a firewall, or another (virtual) device / component that may implement security policies using the disclosed technology, such as PANOS or another security platform / NFGW executed on a virtual / physical NGFW solution available from Palo Alto Networks, Inc., including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that may be similarly implemented and configured to perform the disclosed technology), which is configured to provide, for example, DPI capabilities (e.g., including stateful inspection) of GTP-U sessions (e.g., GTP-U traffic) through various interfaces (e.g., RESTful APIs; other interfaces in N3, N6, and / or 4G / 5G / 6G core networks) to apply security to user plane traffic based on policies (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0113] As will now be described, in some embodiments, a security platform (e.g., NGFW 102) deployed on the N6 interface in the 5G network is utilized to perform Network Slice-ID / S-NSSAI (SST+SD) based security.

[0114] To identify network slices end-to-end, the 5G standard uses information called single network slice selection assistance information (S-NSSAI). S-NSSAI can include both SST and SD fields (for example, in this case, the S-NSSAI length is 32 bits in total), or S-NSSAI can include only the SST field (for example, in this case, the S-NSSAI length is only 8 bits).

[0115] The Slice / Service Type (SST) field can have standardized and non-standardized values. Values ​​0 to 127 belong to the standardized SST range, and they are defined in 3GPP TS23.501. According to the 5G standard, all log types and security policies in the network slice column must support the following SST. SST values ​​128 to 255 belong to the operator-specific range. Slice Differentiator (SD) refers to optional information that supplements the slice / service type to distinguish between multiple network slices.

[0116] In some embodiments, applying network slice ID-based security (e.g., including S-NSSAI) in a mobile network using user IDs and system log messages is similarly performed using a security platform deployed on the N6 interface in a 5G network, such as similar to the above with respect to Figure 1C and 1D as described.

[0117] In an example implementation, the disclosed techniques for applying network slice ID-based security in a mobile network utilizing user IDs and system log message networks can be performed using a security platform deployed in a mobile network based on 5G technology, such as similar to Figure 1C and 1D As shown, except that in this example, the security platform (e.g., NGFW 102) uses the N6 interface to obtain real-time system logs with UE IP and S-NSSAI information from UPF 124. Specifically, the mobile network has network functions that can generate system log messages for certain events (such as bearer creation and bearer deletion). These network functions can be configured to send system log messages including information about bearer creation and deletion events. The user ID agent in the security platform can be configured to parse these messages. For example, the user ID agent can be configured to parse the creation event to map the IP address (e.g., user equipment (UE) IP address) to the network slice ID, and also parse the deletion event to delete the obsolete mapping. Deleting obsolete mappings is often useful in mobile networks, where IP address allocations may change, such as when the UE restarts or during various other scenarios. In this way, in some embodiments, the system log parsing profile is used to parse the system log messages to integrate with network functions from different device vendors, which can send system log messages in different formats (e.g., users can create custom profiles for each format).

[0118] Figure 2D 1 is another example screen shot of an interface of a security platform at an N6 interface in L3 mode receiving system log messages from a UPF in a 5G network in accordance with some embodiments. In this example, the UPF sends an event system log (e.g., a system log message) to the security platform (e.g., NGFW 102) whenever a new PDU session is created or deleted. Each system log includes different fields, with the key fields highlighted: event type, IMSI, IMEI, DNN, S-NSSAI, and Ue_IP.

[0119] The following is an example of a syslog message generated by UPF.

[0120] Jan 1411:23:04{"upf","type":"create_pdu_session","evt":{"imsi":"312444555717000","imei": "4442332341119898","dnn":"dnn1bc4","s-nssai":"1:1000","user_addr":["172.16.15.112"]}}

[0121] The security platform (e.g., NGFW 102) receives the event system log and creates a user ID / IP mapping. The user ID can be configured as an S-NSSAI, such as "1:1000". The system log with the event "create session" can be configured as a user ID login action, while "delete session" can be used as a logout action.

[0122] refer to Figure 2D , an example screenshot of an interface of a security platform at an N6 interface in L3 mode receiving a system log message from a UPF in a 5G network provides an example of a security policy configured with a user ID as UE IMEI="1:1000".

[0123] For example, the above techniques may be performed to apply network slice ID based security on the N6 interface in a private 5G network.

[0124] As another example, the above techniques may be performed to apply known and unknown threat identification and prevention on the N6 interface in a 5G network.

[0125] As yet another example, the above techniques may be performed to apply an application identifier on an N6 interface in a 5G network.

[0126] As yet another example, the above techniques may be performed to apply URL filtering on the N6 interface in a 5G network.

[0127] In this way, service providers and / or enterprises can use the disclosed techniques and security platform to apply network slice ID-based security at the perimeter of an IP-based external network (e.g., the Internet).

[0128] Example use cases for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user ID and system log messages in mobile networks

[0129] The disclosed techniques for providing enhanced security for mobile / service provider networks using a security platform for security policy enforcement (including for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in mobile networks utilizing user IDs and system log messages) can be applied in a variety of additional example use case scenarios for facilitating enhanced security for mobile networks (e.g., 4G / 5G / 6G and later mobile networks), as will now be described with reference to various example use cases.

[0130] As an example use case of subscriber ID-based security in mobile networks utilizing user IDs and system log messages, the above-described techniques (which use a security platform for security policy enforcement to apply subscriber ID-based security in mobile networks utilizing user IDs and system log messages) can detect and / or prevent the following example vulnerabilities for a group of enterprise 5G users: (1) CVE-2021-30860: Apple Multi-Product Integer Overflow Vulnerability; (2) CVE-2022-22620L Apple Safari Use-after-Free Vulnerability; (3) CVE-2022-22784: Zoom XMPP Stanza Smuggling Vulnerability; and (4) CVE-2022-25235: Spring SecurityRegexRequestMatcher Authorization Bypass Vulnerability.

[0131] As an example use case of device ID-based security in mobile networks utilizing user IDs and system log messages, the above-described techniques (which use a security platform for security policy enforcement to apply device ID-based security in mobile networks utilizing user IDs and system log messages) can be used to perform the following enhanced security actions: (1) detect infected devices in 5G networks to block or limit their network access; and (2) apply application controls for enterprise 5G devices (e.g., allowing only trusted applications to communicate with smart sensors connected to a 5G network in a smart factory). Specifically, the above-mentioned techniques (which use a security platform for security policy enforcement to apply device ID-based security in mobile networks using user IDs and system log messages) can be used to detect and / or prevent the following example vulnerabilities for a group of enterprise 5G users: (1) CVE-2022-25845: FastJson Deserialization Vulnerability; (2) CVE-2019-7671: Prima Systems FlexAir Cross-site Scripting Vulnerability; (3) CVE-2019-7667: Prima Systems FlexAir Brute Force Information Disclosure Vulnerability; and (4) CVE-2021-23282: Eaton Intelligent Power Management Storage Cross-site Scripting Vulnerability.

[0132] As an example use case of network slice ID-based security in a mobile network using user IDs and system log messages, the above-described techniques (which use a security platform for security policy enforcement to apply network slice ID-based security in a mobile network using user IDs and system log messages) can be used to perform the following enhanced security actions: (1) investigating security incidents related to enterprise 5G customers related to a utility vertical, such as security services; and (2) a mobile network service provider providing bundled security with its 5G services to different enterprise customers. Specifically, the above-described techniques (which use a security platform for security policy enforcement to apply device ID-based security in a mobile network using user IDs and system log messages) can be used to detect and / or prevent the following examples of spyware for a group of enterprise 5G users: (1) Pingpull command and control traffic; (2) APT34 malicious Excel downloader traffic; (3) XANFPEZES command and control traffic; and (4) industrial command and control traffic.

[0133] It will be apparent to one of ordinary skill in the art that the disclosed techniques for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in mobile networks utilizing user IDs and system log messages using a security platform for security policy enforcement can be applied in a variety of additional example use case scenarios to detect / prevent these and other types of attacks, thereby facilitating enhanced security in various deployments and environments in mobile networks.

[0134] Example hardware components of a network device for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user IDs and system log messages in a mobile network

[0135] Figure 3300 (e.g., a device, gateway, or server that can implement the security platform disclosed herein). Specifically, the network device 300 includes a high-performance multi-core CPU 302 and RAM 304. The network device 300 also includes a storage device 310 (e.g., one or more hard disks or solid-state storage units), which can be used to store policies and other configuration information and signatures. In one embodiment, the storage device 310 stores certain information (e.g., subscriber ID, device ID, and / or network slice ID and user ID and system log message related / extracted parameters) extracted from monitored traffic through various interfaces (e.g., SGi, N6, and / or other interfaces) that is monitored to implement the disclosed security policy enforcement techniques for applying context-based security on various interfaces, including the disclosed techniques for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user ID and system log messages in a mobile device using a security platform, as described with respect to Figures 1A-1D 2A-2D. The network device 300 may also include one or more optional hardware accelerators. For example, the network device 300 may include a cryptographic engine 306 configured to perform encryption and decryption operations, and one or more FPGAs 308 configured to perform signature matching, act as a network processor, and / or perform other tasks.

[0136] Example logical components of a network device for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user ID and system log messages in a mobile network

[0137] Figure 4400 is a functional diagram of logical components of a network device for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages in accordance with some embodiments. The example shown is a representation of logical components that may be included in a network device 400 (e.g., a data device that may implement the disclosed security functions / platforms and perform the disclosed techniques for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages. As shown, the network device 400 includes a management plane 402 and a data plane 404. In one embodiment, the management plane is responsible for managing user interactions, such as by providing a user interface for configuring policies and viewing log data. The data plane is responsible for managing data, such as by performing packet processing and session processing.

[0138] Assume that a mobile device attempts to access a resource (e.g., a remote website / server, an MEC service, an IoT device, or another resource) using an encrypted session protocol such as SSL. The network processor 406 is configured to monitor packets from the mobile device and provide the packets to the data plane 404 for processing. The flow 408 identifies the packet as part of a new session and creates a new session flow. Based on the flow lookup, subsequent packets will be identified as belonging to the session. If applicable, the SSL decryption engine 410 applies SSL decryption using the various techniques described herein. Otherwise, processing by the SSL decryption engine 410 is omitted. The application identification (application ID) module 412 is configured to determine what type of traffic the session involves (e.g., as described above with reference to Figures 1A-1D 412 may identify a user associated with the traffic flow (e.g., identifying a user ID and an application ID (APP-ID) as described herein). For example, application ID 412 may identify a GET request in the received data and infer that the session requires HTTP decoder 414. As another example, application ID 412 may identify a GTP-U session message carrying encapsulated IP traffic from the UE (e.g., via various interfaces, such as described above with respect to Figures 1A-1D similarly described), and infers that the session requires a GTP-U decoder (e.g., to extract information exchanged over various interfaces in a GTP-U traffic session, including various parameters, such as those described above). Figures 1A-1D and Figures 2A-2DSimilarly described). For each type of protocol, there is a corresponding decoder 414. In one embodiment, application identification is performed by an application identification module (e.g., an application ID component / engine), while user identification is performed by another component / engine. Based on the determination made by the application ID 412, the data packet is sent to the appropriate decoder 414. The decoder 414 is configured to assemble the data packets (e.g., which may be received out of order) into the correct order, perform tokenization, and extract information (e.g., so as to extract various information exchanged in GTP-U traffic through various interfaces, as similarly described above and further described below). The decoder 414 also performs signature matching to determine what should be done to the data packet. The SSL encryption engine 416 uses the various techniques described herein to perform SSL encryption, and then forwards the data packet using the forwarding component 418 shown. As also shown, the policy 420 is received and stored in the management plane 402. In one embodiment, policy enforcement is applied as described herein with reference to various embodiments based on monitored, decrypted, identified, and decoded session traffic flows (e.g., a policy may include one or more rules, which may be specified using domains and / or host / server names, and the rules may apply one or more signatures or other matching criteria or heuristics, such as security policy enforcement for subscriber / IP flows on a service provider network, such as SGi / N6 / other interfaces, based on various parameters / information extracted from monitored GTP-U / IP traffic and / or monitored DPI of GTP-U / IP and / or other protocol traffic, as described above with reference to various embodiments). Figures 1A-1D similar to the description).

[0139] Likewise Figure 4 As shown, an interface (I / F) communicator 422 is also provided for security platform manager communications. In some cases, the network device 400 is used to monitor network communications of other network elements on the service provider network, and the data plane 404 supports decoding of such communications (e.g., the network device 400 including the I / F communicator 422 and the decoder 414 can be configured to monitor and / or communicate on reference point interfaces such as SGi, N6, and / or other interfaces where wired and wireless network traffic flows exist). In this way, the network device 400 including the I / F communicator 422 can be used to implement the disclosed technology for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user IDs and system log messages in a mobile network, as described above and further described below.

[0140] Additional example procedures for the disclosed techniques for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network utilizing user IDs and system log messages will now be described.

[0141] Example procedures for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security using user IDs and system log messages in a mobile network

[0142] Figure 5 is a flow chart of a process for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages according to some embodiments. Figure 5 The illustrated process 500 is performed by a security platform and techniques similar to those described above, including the above referenced Figure 1A-4 In one embodiment, process 500 is performed by referring to Figure 3 The data device 300, the above reference Figure 4 The network device 400, virtual appliances (e.g., PaloAlto Networks' VM series virtualized next-generation firewalls, CN series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls can be similarly implemented and configured to perform the disclosed technology), SDN security solutions, cloud security services, and / or combinations or hybrid implementations of the above as described herein.

[0143] At 502, monitoring of network traffic on a mobile network to identify new sessions is performed at a security platform. For example, in some cases, a security platform (e.g., a firewall, a network sensor working on behalf of a firewall, or another device / component that can implement security policies) can monitor various protocols (e.g., GTP-U) on the mobile network (e.g., via SGi, N6, and / or other interfaces) and / or other protocols, and more specifically, by performing the disclosed techniques, various interfaces, such as SGi and N6 interfaces, can be monitored, as described above with reference to Figures 1A-1D Similar to what is described.

[0144] At 504, the execution is performed by parsing the system log message using the user ID agent at the security platform to extract multiple parameters. For example, the above reference Figures 1A-1D Parameters similar to those described in 2A-2D.

[0145] At 506, security policy enforcement on the new session at the security platform based on one or more of a plurality of parameters including one or more of a subscriber ID, a device ID, and a network slice ID is performed to apply context-based security in the mobile network. For example, security policy enforcement may include allowing or blocking the session.

[0146] Figure 6is another flow chart of a process for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security in a mobile network using user IDs and system log messages in accordance with some embodiments. Figure 6 The illustrated process 600 is performed by a security platform and techniques similar to those described above, including the security platforms and techniques described above with reference to Figure 1A-4 In one embodiment, process 600 is performed by referring to Figure 3 The data device 300, the above reference Figure 4 The network device 400, virtual appliances (e.g., PaloAlto Networks' VM series virtualized next-generation firewalls, CN series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls can be similarly implemented and configured to perform the disclosed technology), SDN security solutions, cloud security services, and / or combinations or hybrid implementations of the above as described herein.

[0147] At 602, monitoring of network traffic on a mobile network at a security platform to identify new sessions is performed. For example, in some cases, a security platform (e.g., a firewall, a network sensor working on behalf of a firewall, or another device / component that can implement security policies) can monitor various protocols (e.g., GTP-U) on the mobile network (e.g., via SGi, N6, and / or other interfaces) and / or other protocols, and more specifically, by performing the disclosed techniques, various interfaces, such as SGi and N6 interfaces, can be monitored, as described above with reference to Figures 1A-1D Similar to what is described.

[0148] At 604, the execution is performed by parsing the system log message using the user ID agent at the security platform to extract multiple parameters. For example, the above reference Figures 1A-1D Parameters similar to those described in 2A-2D.

[0149] At 606, a security policy is selected for applying subscriber ID-based security, device ID-based security, and / or network slice ID-based security at the security platform using the user ID and system log message. Figures 1A-1D Parameters similar to those described in 2A-2D.

[0150] At 608, security policy enforcement on the new session at the security platform based on one or more of a plurality of parameters including one or more of a subscriber ID, a device ID, and a network slice ID is performed to apply context-based security in the mobile network. For example, security policy enforcement may include allowing or blocking the session.

[0151] Although the foregoing embodiments have been described in detail for the purpose of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative rather than restrictive.

Claims

1. A system comprising: The processor is configured to: monitoring, at the security platform, network traffic on the mobile network to identify new sessions; extracting a plurality of parameters by parsing a system log message using a user ID agent at a security platform; and implementing, at the security platform, a security policy on the new session based on one or more of a plurality of parameters including one or more of a subscriber ID, a device ID, and a network slice ID to apply context-based security in the mobile network; and A memory is coupled to the processor and configured to provide instructions to the processor.

2. The system according to claim 1, wherein: Context-based security includes subscriber ID-based security.

3. The system according to claim 1, wherein: Context-based security includes device ID-based security.

4. The system according to claim 1, wherein: Context-based security includes network slice-based security.

5. The system according to claim 1, wherein: The security platform is configured with multiple security policies to apply subscriber ID-based security, device ID-based security and / or network slice ID-based security in the mobile network.

6. The system according to claim 1, wherein: The processor is further configured to: The system log message is received at the security platform from a 4G network entity and / or a 5G network entity.

7. The system according to claim 1, wherein: The processor is further configured to: The system log message is received at the secure platform from a 4G network entity, wherein the mobile network is a dedicated 4G network.

8. The system according to claim 1, wherein: The processor is further configured to: The system log message is received at the security platform from a 5G network entity, wherein the mobile network is a private 5G network.

9. The system according to claim 1, wherein: The processor is further configured to: The system log message is received at the security platform from the 4G network entity and / or the 5G network entity, and one or more parameters are extracted for performing subscriber ID-based security, device ID-based security and / or network slice ID security.

10. The system according to claim 1, wherein: The processor is further configured to: Level threat identification and prevention is performed in the mobile network.

11. The system according to claim 1, wherein: The processor is further configured to: Application identification and control is performed in the mobile network.

12. The system of claim 1, wherein: The processor is further configured to: URL filtering is performed in the mobile network.

13. The system of claim 1, wherein: The processor is further configured to: Based on the security policy, the new session is blocked from accessing resources.

14. The system of claim 1, wherein: The processor is further configured to: Based on the security policy, the new session is allowed to access resources.

15. A method comprising: monitoring, at the security platform, network traffic on the mobile network to identify new sessions; extracting a plurality of parameters by parsing a system log message using a user ID agent at a security platform; and Based on one or more of multiple parameters including one or more of subscriber ID, device ID, and network slice ID, security policies are enforced on the new session at the security platform to apply context-based security in the mobile network.

16. The method according to claim 15, wherein: Context-based security includes subscriber ID-based security.

17. The method according to claim 15, wherein: Context-based security includes device ID-based security.

18. The method according to claim 15, wherein: Context-based security includes network slice ID-based security.

19. The method according to claim 15, further comprising: Based on the security policy, the new session is blocked from accessing resources.

20. A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for: monitoring, at the security platform, network traffic on the mobile network to identify new sessions; extracting a plurality of parameters by parsing a system log message using a user ID agent at a security platform; and Based on one or more of multiple parameters including one or more of subscriber ID, device ID, and network slice ID, security policies are enforced on the new session at the security platform to apply context-based security in the mobile network.

Images