IP Library › Granted Patent US 12684355

Granted Patent B2

US 12684355 · App. 18/813,004 · Granted Jul 14, 2026

Isolated telco functions for enhanced security monitoring and analysis

Inventors: Geoffrey Todd Gibson (Ben Wheeler, TX); Jeffrey Scott Simon (Issaquah, WA); Gaurav Madan (Snoqualmie, WA)

Assignee: T-Mobile USA, Inc.

H04W12/128 H04W88/06

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12684355
App. No.: 18/813,004
Granted: Jul 14, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Solutions are disclosed that provide isolated telecommunication (telco) functions for enhanced security monitoring and analysis. Examples monitor a plurality of network functions (NFs) of a wireless network for indications of malicious activity, such as mobility management entities (MMEs), user plane functions (UPFs), authentication server functions (AUSFs), and others. When suspected malicious activity is detected from a user equipment (UE), an isolated telco stack (i.e., an isolated network slice) is stood up in real-time to isolate the traffic to/from the UE. This facilitates capturing and analyzing the traffic, so that a responsive action may be selected. The configuration of the isolated telco stack (i.e., the NFs included in the isolated network slice) may be customized based on the nature of the suspected malicious activity. For example, suspected data exfiltration will trigger a first configuration, whereas suspected denial service will trigger a different configuration.

Claims (70)

1 . A method comprising:

monitoring, by a security orchestrator, network functions (NFs) of a wireless network for indications of malicious activity in a first portion of the wireless network;

detecting, by the security orchestrator while monitoring the NFs, a specific type of malicious activity from a list of malicious activity types that includes a data exfiltration malicious activity type, an unauthorized use malicious activity type, a denial of service malicious activity type, an API exploitation malicious activity type, a reconnaissance malicious activity type, a replay attack malicious activity type, and a packet tampering malicious activity type;

selecting a specific subset of the NFs to form an isolated network slice based on the specific type of malicious activity detected by the security orchestrator, wherein different subsets of the NFs are selected to form the isolated network slice for different detected malicious activity types in the list of malicious activity types;

identifying a user equipment (UE) associated with the specific type of malicious activity;

moving the UE to the isolated network slice;

analyzing traffic of the UE captured from the isolated network slice;

based on at least analyzing the traffic of the UE captured from the isolated network slice, selecting a responsive action to apply to the UE; and

applying the responsive action to the UE.

2 . The method of claim 1 , wherein the NFs includes at least three NFs selected from a list consisting of:

a base station, a mobility node, a session management node, a packet routing node, a proxy node, a subscriber node, an authentication node, and a policy node.

3 . The method of claim 2 ,

wherein the base station comprises a gNodeB (gNB) or an eNodeB (eNB);

wherein the mobility node comprises an access mobility function (AMF) or a mobility management entity (MME);

wherein the session management node comprises a session management function (SMF) or a system architecture evolution gateway (SAEGW) control plane (SAEGW-C);

wherein the packet routing node comprises a user plane function (UPF) or an SAEGW-user plane (SAEGW-U);

wherein the proxy node comprises a proxy call session control function (P-CSCF);

wherein the authentication node comprises an authentication server function (AUSF);

wherein the subscriber node comprises a unified data management (UDM) or a home subscriber server (HSS); and

wherein the policy node comprises a policy control function (PCF) or a policy and charging rules function (PCRF).

4 . The method of claim 1 , wherein the responsive action includes returning the UE to the first portion of the wireless network.

5 . The method of claim 1 , wherein the responsive action includes removing the UE from the wireless network.

6 . The method of claim 1 , wherein the responsive action includes blocking the UE from the wireless network based on a UE identifier of the UE.

7 . The method of claim 1 , wherein the responsive action includes blocking the UE from the wireless network based on a subscriber identity module (SIM) of the UE.

8 . The method of claim 1 , wherein the responsive action includes altering traffic to or from the UE and storing the traffic to or from the UE in an archive.

9 . The method of claim 1 , wherein a mobility node, an authentication node, a subscriber node, and a packet routing node are selected for the isolated network slice when the specific type of malicious activity is the data exfiltration malicious activity type.

10 . The method of claim 1 , wherein a mobility node, a session management node, and a packet routing node are selected for the isolated network slice when the specific type of malicious activity is the unauthorized use malicious activity type.

11 . The method of claim 1 , wherein a mobility node is selected for the isolated network slice when the specific type of malicious activity is the denial of service malicious activity type.

12 . A system comprising:

a processor; and

a computer-readable medium storing programming instructions for execution by the processor, the programming instructions, upon execution by the processor, causing the system to perform the following operations: