Selective Mobile Traffic Offloading for L7 Security Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile network security solutions struggle to efficiently and cost-effectively apply Layer 7 (L7) inspection to selected users while allowing the rest of the traffic to pass through without additional security measures, especially in high-traffic environments like 4G/LTE and 5G networks, necessitating improved security techniques for mobile network environments.
Innovation Solution
Implementing a security platform with selective intelligent enforcement and offloading capabilities, utilizing Smart NICs and DPUs to monitor network traffic, extract meta-information, and apply policies to determine whether to inspect or offload sessions based on subscriber identity, equipment identity, network slice information, or other criteria, thereby optimizing security analysis performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If L7 security inspection is applied to all network traffic, then security coverage is improved, but system performance and cost-effectiveness deteriorate due to high processing load
Solution Approach 1:
The patent segments network traffic into two categories: selected traffic requiring L7 inspection and non-selected traffic passing through without inspection. This segmentation is achieved through policy-based routing that directs different traffic flows to different processing paths, allowing security resources to be focused on high-priority traffic while maintaining overall system performance
Solution Approach 2:
The patent applies different security inspection qualities to different traffic streams. High-priority or suspicious traffic receives full L7 inspection with deep packet analysis, while normal traffic receives minimal or no inspection. This local quality differentiation ensures comprehensive security where needed while preserving system performance for overall traffic handling
2Productivity
If L7 security inspection is applied to selected users only, then cost-effectiveness is improved, but security coverage deteriorates for non-inspected traffic
Solution Approach 1:
The patent performs preliminary classification of traffic before the inspection decision is made. By analyzing traffic characteristics, subscriber profiles, and threat indicators in advance, the system pre-identifies which traffic streams require inspection. This preliminary action ensures that no potentially malicious traffic is missed while avoiding unnecessary inspection of benign traffic
Solution Approach 2:
The patent implements feedback mechanisms where inspection results and threat intelligence are continuously fed back into the traffic classification system. This feedback loop allows the system to dynamically adjust which traffic receives inspection, ensuring that emerging threats are promptly detected and that security coverage adapts to changing conditions while maintaining cost-effectiveness
3Productivity
If traffic is offloaded to Smart NICs, then firewall load is reduced, but inspection capability deteriorates for offloaded traffic
Solution Approach 1:
The patent extracts only the essential security functions needed for offloaded traffic, such as basic packet filtering and protocol validation, while leaving complex L7 inspection for traffic that requires it. This extraction approach allows the firewall to offload appropriate traffic to Smart NICs without compromising the inspection capability for traffic that truly needs deep analysis
Solution Approach 2:
The patent introduces Smart NICs as intermediary devices between the firewall and the network. These intermediaries perform initial traffic processing, filtering, and basic security functions, allowing the firewall to focus its L7 inspection capabilities on traffic that requires advanced analysis. The Smart NICs act as a buffer that preserves firewall capacity while maintaining adequate inspection capability through distributed functionality
Data Source
AI summary
Techniques for selective intelligent offloading for mobile networks using a security platform are disclosed. In some embodiments, a system/process/computer program product for selective intelligent offloading for mobile networks using a security platform monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications; extracting meta information associated with the new session using the security platform executed on the network element in the core mobile network; applying selective intelligent offloading using the security platform if the extracted meta information associated with the new session matches a selective intelligent offload policy; and performing traffic inspection by the security platform if the extracted meta information associated with the new session does not match a selective intelligent offload policy.