Diameter/RADIUS Metadata for Selective Layer 7 Inspection in Mobile Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile network security solutions struggle to efficiently and cost-effectively apply Layer 7 inspection to selected users while allowing the rest of the traffic to pass through without additional security measures, particularly in high-throughput environments like 4G/LTE and 5G networks, necessitating improved techniques for selective intelligent enforcement and offloading.
Innovation Solution
Implementing a security platform that monitors network traffic, extracts meta-information from sessions, and applies selective intelligent enforcement or offloading based on policies, utilizing Smart NICs and DPUs to offload sessions that do not require inspection, thereby reducing the load on firewalls and enhancing performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Layer 7 inspection is applied to all network traffic, then security coverage is improved, but network throughput and performance deteriorate due to processing overhead
Solution Approach 1:
The patent segments network traffic into two categories: selected user traffic that requires Layer 7 inspection and regular traffic that bypasses inspection. This segmentation is achieved through protocol analysis (Diameter/RADIUS) to identify and separate traffic flows, allowing security resources to be focused only on high-risk traffic while maintaining high throughput for legitimate traffic.
Solution Approach 2:
The patent applies different quality levels of security inspection to different traffic segments. High-value traffic from selected users receives full Layer 7 inspection with deep packet analysis, while regular traffic receives minimal or no inspection. This local quality differentiation optimizes the balance between security coverage and network performance.
2Reliability
If Layer 7 inspection is applied to selected users, then security analysis performance is improved, but resource consumption and cost increase
Solution Approach 1:
The patent implements partial action by applying Layer 7 inspection only to a selected subset of users rather than all users. The system identifies high-value users through protocol analysis and applies intensive security inspection only to their traffic, while allowing other traffic to pass through with minimal resource consumption.
Solution Approach 2:
The patent introduces protocol analysis (Diameter/RADIUS) as an intermediary mechanism to identify selected users before applying Layer 7 inspection. This intermediary layer enables the system to selectively route traffic based on user identity and risk profile, optimizing resource allocation for security analysis.
3Reliability
If all traffic is inspected by the firewall, then security enforcement is improved, but device complexity and processing load increase
Solution Approach 1:
The patent performs preliminary action by conducting protocol analysis (Diameter/RADIUS) before traffic reaches the firewall for Layer 7 inspection. This preliminary identification of selected users and their traffic patterns allows the firewall to be configured in advance, reducing its processing load during actual inspection by pre-filtering and pre-configuring security rules.
Data Source
AI summary
Techniques for selective intelligent enforcement for mobile networks using a security platform are disclosed. In some embodiments, a system/process/computer program product for selective intelligent enforcement for mobile networks using a security platform includes monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications; extracting meta information associated with the new session over a Diameter protocol and/or a Radius protocol using the security platform executed on the network element in the core mobile network; applying selective intelligent enforcement using the security platform if the extracted meta information associated with the new session matches a selective intelligent enforcement policy; and offloading the session to bypass inspection by the security platform if the extracted meta information associated with the new session does not match the selective intelligent enforcement policy.