Secure access service edge for mobile networks
Techniques for providing security for providing Secure Access Service Edge (SASE) for mobile networks (e.g., service provider networks for mobile subscribers) are disclosed. In some embodiments, a system/process/computer program product for providing SASE for mobile networks in accordance with some embodiments includes receiving traffic associated with a User Equipment (UE) from a mobile core network at a SASE cloud network; enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic; and forwarding the secured data plane traffic from the SASE cloud network to the mobile core network, wherein the secured data plane traffic egresses the mobile core network for its original destination.
1 . A system, comprising:
a processor configured to:
receive traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network;
extract contextual information from the traffic, wherein:
the contextual information includes the following: subscriber-ID, Network Slice ID, equipment-ID, and other information;
the subscriber-ID includes one or more of the following: International Mobile Subscriber Identity (IMSI) and/or Subscription Permanent Identifier (SUPI);
the equipment-ID includes one or more of the following: International Mobile Equipment Identity (IMEI) and/or Permanent Equipment Identifier (PEI);
the Network Slice ID includes the following: Single Network Slice Selection Assistance Information (S-NSSAI); and
the other information includes one or more of the following: User Equipment (UE) IP, Access Point Name (APN), Data Network Name (DNN), and/or Radio Access Technology (RAT) Type information;
enforce a security policy on data plane traffic associated with the UE based on the contextual information associated with the UE to provide secured data plane traffic;
forward the secured data plane traffic from the SASE cloud network to the mobile core network, wherein the secured data plane traffic egresses the mobile core network for its original destination; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on a subscriber identity and an application identifier.
3 . The system recited in claim 1 , wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on a subscriber identity, a unique device identifier, and an application identifier.
4 . The system recited in claim 1 , wherein the mobile core network includes a 4G mobile core network, a 5G mobile core network, and/or 6G mobile core network.
5 . The system recited in claim 1 , wherein the data plane traffic is secured from and to 4G, 5G, and/or 6G UE devices.
6 . The system recited in claim 1 , wherein Internet access is secured from and to 4G, 5G, and/or 6G UE devices.
7 . The system recited in claim 1 , wherein enterprise data center access is secured from and to 4G, 5G, and/or 6G UE devices.
8 . The system recited in claim 1 , wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform Uniform Resource Link (URL) filtering for the data plane traffic.
9 . The system recited in claim 1 , wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) detection for the data plane traffic.
10 . The system recited in claim 1 , wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) prevention for the data plane traffic.
11 . The system recited in claim 1 , wherein each of a plurality of security policies is distinctly selected and enforced for each mobile service provider (MSP) enterprise tenant at the SASE cloud network, wherein per tenant security policy configuration and enforcement are provided by the SASE cloud network.
12 . The system recited in claim 1 , wherein the data plane traffic is encapsulated with meta information.
13 . The system recited in claim 1 , wherein the processor is further configured to:
receive a control message over a network protocol from the mobile core network at the SASE cloud network, wherein contextual information associated with the control message is communicated using a DIAMETER protocol, a Radius protocol, and/or via an Application Programming Interface (API).
14 . The system recited in claim 1 , wherein the processor is further configured to:
receive an accounting message from the mobile core network at the SASE cloud network, wherein contextual information associated with the accounting message is communicated using a DIAMETER protocol, a Radius protocol, and/or via an Application Programming Interface (API).
15 . A method, comprising:
receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network;
extracting contextual information from the traffic, wherein:
the contextual information includes the following: subscriber-ID, Network Slice ID, equipment-ID, and other information;
the subscriber-ID includes one or more of the following: International Mobile Subscriber Identity (IMSI) and/or Subscription Permanent Identifier (SUPI);
the equipment-ID includes one or more of the following: International Mobile Equipment Identity (IMEI) and/or Permanent Equipment Identifier (PEI);
the Network Slice ID includes the following: Single Network Slice Selection Assistance Information (S-NSSAI); and
the other information includes one or more of the following: User Equipment (UE) IP, Access Point Name (APN), Data Network Name (DNN), and/or Radio Access Technology (RAT) Type information;
enforcing a security policy on data plane traffic associated with the UE based on the contextual information associated with the UE to provide secured data plane traffic; and
forwarding the secured data plane traffic from the SASE cloud network to the mobile core network, wherein the secured data plane traffic egresses the mobile core network for its original destination.
16 . The method of claim 15 , wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on a subscriber identity and an application identifier.
17 . The method of claim 15 , wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on a subscriber identity, a unique device identifier, and an application identifier.
18 . A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network;
extracting contextual information from the traffic, wherein:
the contextual information includes the following: subscriber-ID, Network Slice ID, equipment-ID, and other information;
the subscriber-ID includes one or more of the following: International Mobile Subscriber Identity (IMSI) and/or Subscription Permanent Identifier (SUPI);
the equipment-ID includes one or more of the following: International Mobile Equipment Identity (IMEI) and/or Permanent Equipment Identifier (PEI);
the Network Slice ID includes the following: Single Network Slice Selection Assistance Information (S-NSSAI); and
the other information includes one or more of the following: User Equipment (UE) IP, Access Point Name (APN), Data Network Name (DNN), and/or Radio Access Technology (RAT) Type information;
enforcing a security policy on data plane traffic associated with the UE based on the contextual information associated with the UE to provide secured data plane traffic; and
forwarding the secured data plane traffic from the SASE cloud network to the mobile core network, wherein the secured data plane traffic egresses the mobile core network for its original destination.