Mobile Network Security Using Syslog IDs for Context-Based Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile network environments, particularly 4G/LTE and 5G networks, face challenges in deploying context-based security solutions due to concerns over latency and service outages, as they do not expose 3GPP interfaces, preventing effective application of security policies like subscriber-ID, equipment-ID, and network slice-ID based security.
Innovation Solution
A system and process for applying subscriber-ID, equipment-ID, and network slice-ID based security in mobile networks using a security platform that monitors network traffic, extracts parameters from syslog messages, and enforces context-based security policies, utilizing technologies like Palo Alto Networks' next generation firewalls to facilitate enhanced security over interfaces such as N6 and SGi.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security platforms are deployed in mobile networks with exposed 3GPP interfaces, then context-based security enforcement is improved, but network complexity and deployment difficulty increase
Solution Approach 1:
The patent introduces a Security Platform as an intermediary component that mediates between network traffic and security policies. This platform receives traffic from mobile networks, applies context-based security rules (subscriber-ID, equipment-ID, network slice-ID), and forwards traffic accordingly, thereby enabling security enforcement without directly modifying core network infrastructure and reducing deployment complexity
Solution Approach 2:
The security platform segments security enforcement into distinct functional modules: traffic reception module, parameter extraction module, policy matching module, and traffic forwarding module. This segmentation allows each component to handle specific tasks independently, improving reliability while managing complexity through modular design
2Measurement precision
If security platforms process network traffic in real-time, then threat identification speed is improved, but processing latency increases
Solution Approach 1:
The security platform performs preliminary actions by pre-processing and caching subscriber-ID, equipment-ID, and network slice-ID parameters from syslog messages before actual security policy evaluation. This preliminary parameter extraction and caching reduces the processing time required during real-time threat identification, improving speed while minimizing latency
Solution Approach 2:
The patent replaces traditional mechanical packet inspection methods with optimized parameter extraction from syslog messages. By substituting deep packet inspection with syslog-based parameter retrieval and matching, the system achieves faster threat identification with reduced processing latency
Data Source
AI summary
Techniques for applying subscriber-ID based security, equipment-ID based security, and/or network slice-ID based security with user-ID and syslog messages in mobile networks are disclosed. In some embodiments, a system/process/computer program product for applying subscriber-ID based security, equipment-ID based security, and/or network slice-ID based security with user-ID and syslog messages in mobile networks includes monitoring network traffic on a mobile network at a security platform to identify a new session; extracting a plurality of parameters by parsing syslog messages with a user-ID agent at the security platform; and enforcing a security policy on the new session at the security platform based on one or more of the plurality of parameters including one or more of a subscriber-ID, equipment-ID, and network slice-ID to apply context-based security in the mobile network.