eBPF Agents for Zero Trust Security in 5G Core Networks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security solutions for mobile networks, such as 4G/LTE and 5G, face challenges in deploying context-based security due to concerns over latency and service outages, and lack access to key metadata necessary for granular security policy enforcement, making zero trust security difficult to implement effectively.

Innovation Solution

The implementation of extended Berkeley Packet Filter (eBPF) agents in the 5G core mobile network elements to monitor and extract metadata associated with user sessions, sending this information to a security platform outside the network for granular security policy enforcement, allowing for zero trust security without requiring access to encrypted traffic or certificates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional security solutions are deployed in mobile networks, then security coverage is improved, but latency increases and service outages occur

Engineering Contradiction:

Improvesecurity coverageVSAvoidlatency

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The security function is segmented into two parts: metadata extraction is performed locally at the network element using eBPF, while actual security policy enforcement is handled by a separate security platform. This segmentation allows low-latency local metadata collection without requiring high-latency encrypted traffic decryption at the security platform.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

eBPF acts as an intermediary between the network element and the security platform. It extracts and shares only essential metadata (IMSI, IMEI, network slice IDs) with the security platform, eliminating the need for the security platform to directly access encrypted traffic, thereby reducing latency and avoiding service outages.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If traditional security solutions are deployed in mobile networks, then security coverage is improved, but service outages occur

Engineering Contradiction:

Improvesecurity coverageVSAvoidservice outage duration

Core Design Contradiction:

ReliabilityVSDuration of action of stationary object

Solution Approach 1:

The security function is segmented into metadata extraction at the network element and policy enforcement at the security platform. This segmentation ensures that security operations do not block network traffic paths, preventing service outages while maintaining comprehensive security coverage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The network element uses its own built-in eBPF capabilities to extract metadata independently, without requiring the security platform to interfere with network traffic. This self-service approach eliminates service outages caused by traditional security solutions that need to decrypt and inspect all traffic.

Inventive Principle:

Principle #25Self-service

3Reliability

If access to encrypted traffic is required for security inspection, then granular security policy enforcement is enabled, but zero trust security becomes difficult to implement

Engineering Contradiction:

Improvegranular security policy enforcementVSAvoidzero trust security implementation

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The solution extracts only the necessary metadata (IMSI, IMEI, network slice IDs) from network traffic at the network element level using eBPF, and shares this extracted information with the security platform. This extraction approach enables granular security policy enforcement without requiring access to the actual encrypted traffic content, making zero trust security implementation straightforward.

Inventive Principle:

Principle #2Taking out (Extraction)

4Adaptability or versatility

If loadable kernel modules are used for security functions, then flexibility is improved, but system stability deteriorates

Engineering Contradiction:

ImproveflexibilityVSAvoidsystem stability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent replaces traditional loadable kernel modules with eBPF (extended Berkeley Packet Filter), a modern alternative that provides similar flexibility in programming security functions but with improved system stability. eBPF programs are validated by the kernel before execution, preventing the stability issues associated with loading arbitrary kernel modules.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20240430680A1Mobile network information sharing via EBPF for zero trust security

Publication Date: 2024.12.26 PALO ALTO NETWORKS INC

AI summary

Techniques for mobile network information sharing via extended Berkeley Packet Filter (eBPF) for zero trust security are disclosed. In some embodiments, a system/process/computer program product for mobile network information sharing via eBPF for zero trust security includes monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications; extracting meta information associated with the session using the agent executed on a network element in the core mobile network; sending the extracted meta information to a security platform located outside of the core mobile network; and enforcing a security policy on the session at the security platform based on the extracted meta information to apply granular-based security in the core mobile network based on a security policy.