Diameter and RADIUS Session Offloading for Selective Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile network security solutions struggle to efficiently and cost-effectively apply Layer 7 inspection to selected users while allowing the rest of the traffic to pass without additional security measures, particularly in high-throughput environments like 5G networks, due to increasing network traffic and regulatory requirements for per-subscriber or per-equipment security.
Innovation Solution
Implementing a security platform with selective intelligent enforcement techniques that utilize a Smart NIC or DPU to monitor network traffic, extract meta-information, and apply policies to selectively enforce security on relevant traffic while offloading non-relevant traffic, thereby reducing the load on the firewall and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Layer 7 inspection is applied to all network traffic, then security analysis performance is improved, but device complexity and processing load increase significantly
Solution Approach 1:
The patent segments network traffic into two categories: traffic requiring security inspection and traffic that can bypass inspection. A Smart NIC is introduced to perform initial traffic classification based on flow state information, separating packets that need Layer 7 inspection from those that don't, thereby reducing the processing load on firewalls while maintaining security analysis performance for relevant traffic
Solution Approach 2:
The Smart NIC acts as an intermediary device between the network interface and the firewall. It performs flow state tracking and packet classification, determining which packets should be forwarded to the firewall for inspection and which can be handled directly by the network stack, thus reducing firewall complexity and processing requirements
2Productivity
If Layer 7 inspection is applied to selected users, then security resource usage is optimized, but measurement precision in identifying relevant traffic increases
Solution Approach 1:
The system performs preliminary flow state tracking and classification before packets reach the firewall. The Smart NIC maintains flow state information and pre-determines which traffic flows require security inspection, allowing the firewall to focus resources only on pre-identified relevant traffic rather than making classification decisions in real-time for each packet
Solution Approach 2:
The patent replaces complex firewall-based traffic classification mechanisms with a dedicated Smart NIC that handles flow state tracking and packet classification. This substitution moves the classification function from a software-based system to a hardware-based system, improving measurement precision and classification accuracy while optimizing security resource usage
Data Source
AI summary
Techniques for selective intelligent enforcement for mobile networks using a security platform are disclosed. In some embodiments, a system/process/computer program product for selective intelligent enforcement for mobile networks using a security platform includes receiving extracted meta information associated with the new session over a Diameter protocol and/or a Radius protocol, wherein the meta information associated with the new session is extracted by performing inspection of Diameter messages and/or Radius messages from monitored network traffic in a core mobile network using a security platform executed on a network element in the core mobile network; applying selective intelligent enforcement using the security platform if the extracted meta information associated with the new session matches a selective intelligent enforcement policy; and offloading the new session to bypass inspection by the security platform if the extracted meta information associated with the new session does not match the selective intelligent enforcement policy.