Selective Session Offloading in Diameter and RADIUS Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile network security solutions struggle to efficiently and cost-effectively apply Layer 7 inspection to selected users while allowing the rest of the traffic to pass without additional security measures, particularly in high-throughput environments like 5G networks, due to increasing network traffic and regulatory requirements for per-subscriber or per-equipment security.
Innovation Solution
Implementing a security platform with selective intelligent enforcement and offloading techniques using a Smart Network Interface Card (NIC) or Data Processing Unit (DPU) to monitor network traffic, extract meta-information, and apply policies to selectively enforce security on certain sessions while offloading others, thereby reducing the load on firewalls and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Layer 7 security inspection is applied to all network traffic, then security coverage is improved, but processing load on firewalls increases and performance deteriorates
Solution Approach 1:
The patent segments network traffic into two categories: selected traffic that requires Layer 7 security inspection and non-selected traffic that bypasses inspection. This segmentation is achieved through traffic classification mechanisms that identify and separate traffic flows based on policy criteria, allowing the firewall to focus resources only on traffic that requires deep inspection, thereby maintaining security coverage for critical traffic while preserving overall processing performance
Solution Approach 2:
Instead of applying Layer 7 inspection to all traffic (excessive action), the patent applies inspection only to selected traffic flows that match specific criteria (partial action). This selective approach uses traffic classification to identify subsets of traffic requiring enhanced security analysis, applying full inspection depth only where necessary while allowing other traffic to pass through with minimal processing, thus resolving the contradiction between comprehensive security and processing performance
2Productivity
If Layer 7 security inspection is applied to selected users only, then processing load is reduced, but security coverage becomes uneven across different users
Solution Approach 1:
The patent implements local quality by applying different security inspection levels to different traffic flows based on their characteristics and policy requirements. Rather than uniform security application, the system assigns appropriate inspection depth and resource allocation to each traffic flow locally, allowing high-priority or suspicious traffic to receive full Layer 7 inspection while standard traffic receives streamlined processing, thus achieving both processing efficiency and context-appropriate security coverage
Solution Approach 2:
The system incorporates feedback mechanisms that continuously monitor traffic patterns, security events, and policy compliance to dynamically adjust which traffic flows receive Layer 7 inspection. This feedback loop ensures that security coverage remains appropriate and uniform in terms of risk management, while processing load is optimized by adjusting inspection intensity based on real-time conditions rather than applying static uniform inspection to all users
3Productivity
If traffic offloading is implemented, then firewall load is reduced, but complexity of traffic management increases
Solution Approach 1:
The patent introduces traffic classification mechanisms as intermediary components that sit between the firewall and network traffic flows. These intermediaries perform the complex task of traffic analysis, policy matching, and flow identification, freeing the firewall from complex traffic management decisions. The classification intermediaries handle the complexity of determining which traffic to offload and which to inspect, while the firewall focuses on its core security enforcement function, thus reducing firewall load without concentrating all complexity in one device
Data Source
AI summary
Techniques for selective intelligent offloading for mobile networks using a security platform are disclosed. In some embodiments, a system/process/computer program product for selective intelligent offloading for mobile networks using a security platform includes monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications; extracting meta information associated with the new session over a Diameter protocol and/or a Radius protocol using the security platform executed on the network element in the core mobile network; applying apply selective intelligent offloading using the security platform if the extracted meta information associated with the new session matches a selective intelligent offload policy; and performing traffic inspection by the security platform if the extracted meta information associated with the new session does not match a selective intelligent offload policy.