5G SASE Explicit Proxy for Context-Based Zero Trust Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SASE environments face challenges in effectively integrating with service provider networks, particularly in mobile/cellular networks, due to the need for efficient traffic processing and security integration, including support for both IPsec and non-IPsec traffic, and reliance on cloud computing providers that can be expensive and high in latency.
Innovation Solution
A SASE interconnect platform solution that supports both IPsec and non-IPsec traffic, integrates with service provider networks, and applies intelligent security using context-based policies, leveraging context-based information such as subscriber-ID, equipment-ID, and network slice information to enhance security for devices communicating over mobile networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SASE environments integrate with service provider networks using traditional cloud computing providers, then security processing capability is improved, but latency and cost increase
Solution Approach 1:
The patent introduces a service provider network as an intermediary between mobile devices and SASE environments. This intermediary provides optimized network paths and localized security processing capabilities, reducing the latency associated with traditional cloud computing providers while maintaining security processing capability.
Solution Approach 2:
The patent segments the security processing function from the cloud computing provider by implementing it within the service provider network infrastructure. This segmentation allows security processing to occur closer to the network edge, reducing latency while maintaining the reliability of security processing capability.
2Reliability
If SASE environments integrate with service provider networks using traditional cloud computing providers, then security processing capability is improved, but cost increases
Solution Approach 1:
The service provider network acts as an intermediary that leverages existing infrastructure to provide security processing, avoiding the need to pay premium prices to traditional cloud computing providers while maintaining security processing capability.
Solution Approach 2:
The service provider network provides security processing capabilities as part of its own infrastructure, eliminating the need to externally purchase these services from cloud computing providers, thereby reducing cost while maintaining capability.
3Measurement precision
If context-based security policies are applied using subscriber-ID and equipment-ID information, then security precision is improved, but device complexity increases
Solution Approach 1:
The patent leverages existing subscriber-ID and equipment-ID information that is already collected by the service provider network for other purposes. By reusing this existing data for security policy enforcement, the system improves security precision without adding significant device complexity, as the information gathering is already performed by the network infrastructure.
Data Source
AI summary
In some embodiments, a system, process, and/or computer program product includes processing a Radius start message and populating 5G synchronized (sync) data with a 5G user identity and IP mapping using a 5G Secure Access Service Edge (SASE) service, wherein a service provider (SP) configures IMSI, IMEI, and APN information to identify UEs from each SP 5G network, and configures a security policy per user group and/or individual users for a 5G SASE service; extracting contextual information associated with monitored 5G SP data plane traffic to determine a security policy to apply to the 5G SP data plane traffic; enforcing the security policy on the 5G SP data plane traffic associated with a UE based on contextual information associated with the UE to provide secured 5G SP data plane traffic; and egressing the secured 5G SP data plane traffic back to an SP backbone or to an external network.