Mobile Network Segmentation Using SR Paths and Security Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile networks, particularly 5G networks implementing segment routing (SR) or SR for IPv6 (SRv6), lack effective methods for transport and data center segmentation.
Innovation Solution
Implement segment routing (SR) to steer traffic based on security group identification, using segment identifiers (SIDs) and virtual extensible LAN (VXLAN) network identifiers (VNIs) to provide transport and data center segmentation, with intelligence for slicing and node selection choices influenced by segmentation policies, and append identifiers to traffic for virtual networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network segmentation is implemented to provide dedicated transport for critical data, then data security and reliability are improved, but network complexity and overhead increase
Solution Approach 1:
The patent applies network segmentation by dividing the mobile network into separate logical channels - a dedicated secure transport channel for critical data and a general data channel for other traffic. This segmentation isolates critical data traffic, ensuring it receives prioritized handling and enhanced security without compromising overall network functionality.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a gateway or boundary element that manages traffic between the segmented channels. This intermediary controls the flow of data between the secure transport channel and general data channel, enabling selective routing while maintaining network security and managing complexity through centralized control.
2Reliability
If dedicated transport channels are created for critical data, then data transmission reliability improves, but available network resources and throughput decrease
Solution Approach 1:
The network is segmented into prioritized and non-prioritized traffic channels. Critical data traffic is routed through the dedicated secure transport channel with guaranteed resources, while non-critical traffic uses the general data channel. This segmentation ensures reliable transmission for critical data without requiring all network resources to be dedicated to it.
Solution Approach 2:
Instead of dedicating all network resources to critical data transmission, the patent applies partial action by allocating only the necessary portion of network resources to the secure transport channel. This partial dedication ensures reliable transmission for critical data while leaving sufficient resources available for other network functions.
3Reliability
If network segmentation is implemented, then data security improves, but processing time and latency increase
Solution Approach 1:
By segmenting the network into dedicated secure transport channels, critical data traffic is isolated and can be processed through optimized paths with reduced interference. This segmentation enables faster processing for critical data while maintaining security, as the dedicated channels eliminate the need for continuous security checks across all traffic.
Solution Approach 2:
The patent implements preliminary action by pre-establishing dedicated secure transport channels and configuring traffic routing rules before data transmission occurs. This preliminary setup eliminates the need for real-time security processing and routing decisions, reducing latency for critical data transmission while maintaining security through pre-configured secure paths.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
In a mobile network, an identity of a security group associated with user equipments (UEs) may be obtained. A segment route (SR) path for session communications in the mobile network for the UEs may be selected based on the identity of the security group. The SR path may be one of a plurality of SR paths in a transport network used by the mobile network and defined at least in part by one or more segment IDs (SIDs). An identity of a virtual network associated with the security group may also be obtained. The selected SR path and the identity of the virtual network may be provisioned in one or more routers of the transport network, such that IP messages communicated for the UEs in the mobile network are forwarded via the selected SR path and (at least ultimately) via the tunnel associated with the security group.